Appendixes

Remote Management from NoMachines.Com

Adding printers without user intervention

+ +Chapter 22. Advanced Network Management

Chapter 22. Advanced Network Management
Prev	Part III. Advanced Configuration	Next

`Chapter 22. Advanced Network Management`

`John H. Terpstra`

Samba Team <jht@samba.org>

April 3 2003

Table of Contents

Remote Management from NoMachines.Com

Adding printers without user intervention

There are a number of possible remote desktop management solutions that range from free through costly. Do not let that put you off. Sometimes the most costly solutions is the most cost effective. In any case, you will need to draw your own conclusions as to which is the best tool in your network environment. -

`Remote Management from NoMachines.Com`

+

`Remote Management from NoMachines.Com`

The following information was posted to the Samba mailing list at Apr 3 23:33:50 GMT 2003. It is presented in slightly edited form (with author details omitted for privacy reasons). The entire answer is reproduced below with some comments removed. -

-

+	

+ > I have a wonderful linux/samba server running as PDC for a network.
 > Now I would like to add remote desktop capabilities so that
 > users outside could login to the system and get their desktop up from
@@ -48,8 +49,8 @@ is the best tool in your network environment.
 > even if the computer is in a domain?
 >
 > Any ideas/experience would be appreciated :)
-

-

+

+ Answer provided: Check out the new offer from NoMachine, "NX" software: http://www.nomachine.com/. @@ -119,7 +120,7 @@ is the best tool in your network environment. NoMachine are encouraging and offering help to OSS/Free Software implementations for such a frontend too, even if it means competition to them (they have written to this effect even to the LTSP, KDE and GNOME developer mailing lists) -

`Network Logon Script Magic`

+

`Network Logon Script Magic`

This section needs work. Volunteer contributions most welcome. Please send your patches or updates to John Terpstra.

@@ -131,10 +132,10 @@ See examples directory genlogonntlogon subdirectories.

The following listings are from the genlogon directory. -

+

This is the genlogon.pl file: - + #!/usr/bin/perl # # genlogon.pl @@ -206,18 +207,18 @@ This is the genlogon.pl file: # All done! Close the output file. close LOGON; - - + + Those wishing to use more elaborate or capable logon processing system should check out the following sites: - http://www.craigelachie.org/rhacer/ntlogon http://www.kixtart.org http://support.microsoft.com/default.asp?scid=kb;en-us;189105 Adding printers without user intervention + http://www.craigelachie.org/rhacer/ntlogon http://www.kixtart.org http://support.microsoft.com/default.asp?scid=kb;en-us;189105 Adding printers without user intervention Printers may be added automatically during logon script processing through the use of: - + rundll32 printui.dll,PrintUIEntry /? - + See the documentation in the Microsoft knowledgebase article no: 189105. - Common Errors +

`Common Errors`

The information provided in this chapter has been reproduced from postings on the samba@samba.org mailing list. No implied endorsement or recommendation is offered. Administrators should conduct their own evaluation of alternatives and are encouraged to draw their own conclusions. diff --git a/docs/htmldocs/Appendixes.html b/docs/htmldocs/Appendixes.html index 854437acde..ab96964c13 100644 --- a/docs/htmldocs/Appendixes.html +++ b/docs/htmldocs/Appendixes.html @@ -1,4 +1,5 @@ -Part VI. Appendixes

Part VI. Appendixes
Prev		Next

`Appendixes`

Table of Contents

36. How to compile SAMBA

Accessing the samba sources via rsync and ftp

Introduction
CVS Access to samba.org

Compiling samba with Active Directory support

Starting from inetd.conf
Alternative: starting it as a daemon

37. Portability

HPUX

DNIX

AIX

Sequential Read Ahead

Locking improvements
Winbind on Solaris 9

38. Samba and other CIFS clients

How can I configure OS/2 Warp Connect or - OS/2 Warp 4 as a client for Samba?
How can I configure OS/2 Warp 3 (not Connect), - OS/2 1.2, 1.3 or 2.x for Samba?
How do I get printer driver download working - for OS/2 clients?

Use latest TCP/IP stack from Microsoft
Delete .pwl files after password change
Configure WfW password handling
Case handling of passwords
Use TCP/IP as default protocol
Speed improvement

Speed improvement

39. Samba Performance Tuning

Comparisons
Socket options
Read size
Max xmit
Log level
Read raw
Write raw
Slow Logins
Client tuning
Samba performance problem due changing kernel
Corrupt tdb Files

40. DNS and DHCP Configuration Guide

Note

41. Further Resources

Websites
Related updates from Microsoft
Books

Prev	Up	Next
Chapter 35. Reporting Bugs	Home	Chapter 36. How to compile SAMBA

+ +Part VI. AppendixesPart VI. Appendixes Prev Next Appendixes Table of Contents 36. How to compile SAMBA Access Samba source code via CVS Introduction CVS Access to samba.org Accessing the samba sources via rsync and ftp Verifying Samba's PGP signature Building the Binaries Compiling samba with Active Directory support Starting the smbd and nmbd Starting from inetd.conf Alternative: starting it as a daemon Common Errors 37. Portability HPUX SCO Unix DNIX RedHat Linux Rembrandt-II AIX Sequential Read Ahead Solaris Locking improvements Winbind on Solaris 9 38. Samba and other CIFS clients Macintosh clients? OS2 Client How can I configure OS/2 Warp Connect or + OS/2 Warp 4 as a client for Samba? How can I configure OS/2 Warp 3 (not Connect), + OS/2 1.2, 1.3 or 2.x for Samba? How do I get printer driver download working + for OS/2 clients? Windows for Workgroups Use latest TCP/IP stack from Microsoft Delete .pwl files after password change Configure WfW password handling Case handling of passwords Use TCP/IP as default protocol Speed improvement Windows '95/'98 Speed improvement Windows 2000 Service Pack 2 Windows NT 3.1 39. Samba Performance Tuning Comparisons Socket options Read size Max xmit Log level Read raw Write raw Slow Logins Client tuning Samba performance problem due changing kernel Corrupt tdb Files 40. DNS and DHCP Configuration Guide Note 41. Further Resources Websites Related updates from Microsoft Books Prev Up Next Chapter 35. Reporting Bugs Home Chapter 36. How to compile SAMBA diff --git a/docs/htmldocs/Backup.html b/docs/htmldocs/Backup.html index 9fac452023..392e14c645 100644 --- a/docs/htmldocs/Backup.html +++ b/docs/htmldocs/Backup.html @@ -1,9 +1,10 @@ -Chapter 28. Samba Backup TechniquesChapter 28. Samba Backup Techniques Prev Part III. Advanced Configuration Next Chapter 28. Samba Backup Techniques John H. Terpstra Samba Team <jht@samba.org> Table of Contents Note Features and Benefits Note + +Chapter 28. Samba Backup Techniques Chapter 28. Samba Backup Techniques Prev Part III. Advanced Configuration Next Chapter 28. Samba Backup Techniques John H. Terpstra Samba Team <jht@samba.org> Table of Contents Note Features and Benefits Note This chapter did not make it into this release. It is planned for the published release of this document. If you have something to contribute for this section please email it to jht@samba.org/ - Features and Benefits + Features and Benefits We need feedback from people who are backing up samba servers. We would like to know what software tools you are using to backup your samba server/s. diff --git a/docs/htmldocs/CUPS-printing.html b/docs/htmldocs/CUPS-printing.html index 46ca8e15f7..dff70b1726 100644 --- a/docs/htmldocs/CUPS-printing.html +++ b/docs/htmldocs/CUPS-printing.html @@ -1,21 +1,22 @@ -Chapter 19. CUPS Printing Support in Samba 3.0 Chapter 19. CUPS Printing Support in Samba 3.0 Prev Part III. Advanced Configuration Next Chapter 19. CUPS Printing Support in Samba 3.0 Kurt Pfeifle Danka Deutschland GmbH <kpfeifle@danka.de> Ciprian Vizitiu drawings<CVizitiu@gbif.org> (3 June 2003) Table of Contents Introduction Features and Benefits Overview Basic Configuration of CUPS support Linking of smbd with libcups.so Simple smb.conf Settings for CUPS More complex smb.conf Settings for -CUPS Advanced Configuration Central spooling vs. "Peer-to-Peer" printing CUPS/Samba as a "spooling-only" Print Server; "raw" printing -with Vendor Drivers on Windows Clients Driver Installation Methods on Windows Clients Explicitly enable "raw" printing for -application/octet-stream! Three familiar Methods for driver upload plus a new one Using CUPS/Samba in an advanced Way -- intelligent printing -with PostScript Driver Download GDI on Windows -- PostScript on Unix Windows Drivers, GDI and EMF Unix Printfile Conversion and GUI Basics PostScript and Ghostscript Ghostscript -- the Software RIP for non-PostScript Printers PostScript Printer Description (PPD) Specification CUPS can use all Windows-formatted Vendor PPDs CUPS also uses PPDs for non-PostScript Printers The CUPS Filtering Architecture MIME types and CUPS Filters MIME type Conversion Rules Filter Requirements Prefilters pstops pstoraster imagetops and imagetoraster rasterto [printers specific] CUPS Backends cupsomatic/Foomatic -- how do they fit into the Picture? The Complete Picture mime.convs "Raw" printing "application/octet-stream" printing PostScript Printer Descriptions (PPDs) for non-PS Printers Difference between cupsomatic/foomatic-rip and -native CUPS printing Examples for filtering Chains Sources of CUPS drivers / PPDs Printing with Interface Scripts Network printing (purely Windows) From Windows Clients to an NT Print Server Driver Execution on the Client Driver Execution on the Server Network Printing (Windows clients -- UNIX/Samba Print -Servers) From Windows Clients to a CUPS/Samba Print Server Samba receiving Jobfiles and passing them to CUPS Network PostScript RIP: CUPS Filters on Server -- clients use -PostScript Driver with CUPS-PPDs PPDs for non-PS Printers on UNIX PPDs for non-PS Printers on Windows Windows Terminal Servers (WTS) as CUPS Clients Printer Drivers running in "Kernel Mode" cause many -Problems Workarounds impose Heavy Limitations CUPS: a "Magical Stone"? PostScript Drivers with no major problems -- even in Kernel -Mode Setting up CUPS for driver Download cupsaddsmb: the unknown Utility Prepare your smb.conf for -cupsaddsmb CUPS Package of "PostScript Driver for WinNT/2k/XP" Recognize the different Driver Files Acquiring the Adobe Driver Files ESP Print Pro Package of "PostScript Driver for -WinNT/2k/XP" Caveats to be considered What are the Benefits of using the "CUPS PostScript Driver for -Windows NT/2k/XP" as compared to the Adobe Driver? Run "cupsaddsmb" (quiet Mode) Run "cupsaddsmb" with verbose Output Understanding cupsaddsmb How to recognize if cupsaddsm completed successfully cupsaddsmb with a Samba PDC cupsaddsmb Flowchart Installing the PostScript Driver on a Client Avoiding critical PostScript Driver Settings on the -Client Installing PostScript Driver Files manually (using -rpcclient) A Check of the rpcclient man Page Understanding the rpcclient man Page Producing an Example by querying a Windows Box What is required for adddriver and setdriver to succeed Manual Commandline Driver Installation in 15 little Steps Troubleshooting revisited The printing *.tdb Files Trivial DataBase Files Binary Format Losing *.tdb Files Using tdbbackup CUPS Print Drivers from Linuxprinting.org foomatic-rip and Foomatic explained foomatic-rip and Foomatic-PPD Download and Installation Page Accounting with CUPS Setting up Quotas Correct and incorrect Accounting Adobe and CUPS PostScript Drivers for Windows Clients The page_log File Syntax Possible Shortcomings Future Developments Other Accounting Tools Additional Material Auto-Deletion or Preservation of CUPS Spool Files CUPS Configuration Settings explained Pre-conditions Manual Configuration When not to use Samba to print to -CUPS In Case of Trouble..... Where to find Documentation How to ask for Help Where to find Help Appendix Printing from CUPS to Windows attached -Printers More CUPS filtering Chains Trouble Shooting Guidelines to fix typical Samba printing -Problems An Overview of the CUPS Printing Processes Introduction Features and Benefits + +Chapter 19. CUPS Printing Support in Samba 3.0 Chapter 19. CUPS Printing Support in Samba 3.0 Prev Part III. Advanced Configuration Next Chapter 19. CUPS Printing Support in Samba 3.0 Kurt Pfeifle Danka Deutschland GmbH <kpfeifle@danka.de> Ciprian Vizitiu drawings<CVizitiu@gbif.org> (3 June 2003) Table of Contents Introduction Features and Benefits Overview Basic Configuration of CUPS support Linking of smbd with libcups.so Simple smb.conf Settings for CUPS More complex smb.conf Settings for +CUPS Advanced Configuration Central spooling vs. "Peer-to-Peer" printing CUPS/Samba as a "spooling-only" Print Server; "raw" printing +with Vendor Drivers on Windows Clients Driver Installation Methods on Windows Clients Explicitly enable "raw" printing for +application/octet-stream! Three familiar Methods for driver upload plus a new one Using CUPS/Samba in an advanced Way -- intelligent printing +with PostScript Driver Download GDI on Windows -- PostScript on Unix Windows Drivers, GDI and EMF Unix Printfile Conversion and GUI Basics PostScript and Ghostscript Ghostscript -- the Software RIP for non-PostScript Printers PostScript Printer Description (PPD) Specification CUPS can use all Windows-formatted Vendor PPDs CUPS also uses PPDs for non-PostScript Printers The CUPS Filtering Architecture MIME types and CUPS Filters MIME type Conversion Rules Filter Requirements Prefilters pstops pstoraster imagetops and imagetoraster rasterto [printers specific] CUPS Backends cupsomatic/Foomatic -- how do they fit into the Picture? The Complete Picture mime.convs "Raw" printing "application/octet-stream" printing PostScript Printer Descriptions (PPDs) for non-PS Printers Difference between cupsomatic/foomatic-rip and +native CUPS printing Examples for filtering Chains Sources of CUPS drivers / PPDs Printing with Interface Scripts Network printing (purely Windows) From Windows Clients to an NT Print Server Driver Execution on the Client Driver Execution on the Server Network Printing (Windows clients -- UNIX/Samba Print +Servers) From Windows Clients to a CUPS/Samba Print Server Samba receiving Jobfiles and passing them to CUPS Network PostScript RIP: CUPS Filters on Server -- clients use +PostScript Driver with CUPS-PPDs PPDs for non-PS Printers on UNIX PPDs for non-PS Printers on Windows Windows Terminal Servers (WTS) as CUPS Clients Printer Drivers running in "Kernel Mode" cause many +Problems Workarounds impose Heavy Limitations CUPS: a "Magical Stone"? PostScript Drivers with no major problems -- even in Kernel +Mode Setting up CUPS for driver Download cupsaddsmb: the unknown Utility Prepare your smb.conf for +cupsaddsmb CUPS Package of "PostScript Driver for WinNT/2k/XP" Recognize the different Driver Files Acquiring the Adobe Driver Files ESP Print Pro Package of "PostScript Driver for +WinNT/2k/XP" Caveats to be considered What are the Benefits of using the "CUPS PostScript Driver for +Windows NT/2k/XP" as compared to the Adobe Driver? Run "cupsaddsmb" (quiet Mode) Run "cupsaddsmb" with verbose Output Understanding cupsaddsmb How to recognize if cupsaddsm completed successfully cupsaddsmb with a Samba PDC cupsaddsmb Flowchart Installing the PostScript Driver on a Client Avoiding critical PostScript Driver Settings on the +Client Installing PostScript Driver Files manually (using +rpcclient) A Check of the rpcclient man Page Understanding the rpcclient man Page Producing an Example by querying a Windows Box What is required for adddriver and setdriver to succeed Manual Commandline Driver Installation in 15 little Steps Troubleshooting revisited The printing *.tdb Files Trivial DataBase Files Binary Format Losing *.tdb Files Using tdbbackup CUPS Print Drivers from Linuxprinting.org foomatic-rip and Foomatic explained foomatic-rip and Foomatic-PPD Download and Installation Page Accounting with CUPS Setting up Quotas Correct and incorrect Accounting Adobe and CUPS PostScript Drivers for Windows Clients The page_log File Syntax Possible Shortcomings Future Developments Other Accounting Tools Additional Material Auto-Deletion or Preservation of CUPS Spool Files CUPS Configuration Settings explained Pre-conditions Manual Configuration When not to use Samba to print to +CUPS In Case of Trouble..... Where to find Documentation How to ask for Help Where to find Help Appendix Printing from CUPS to Windows attached +Printers More CUPS filtering Chains Trouble Shooting Guidelines to fix typical Samba printing +Problems An Overview of the CUPS Printing Processes Introduction Features and Benefits The Common Unix Print System (CUPS) has become very popular. All big Linux distributions now ship it as their default printing system. But to many it is still a very mystical tool. Normally it @@ -40,7 +41,7 @@ Problems An Overview of the C contained. But lets start with the most basic things first. Maybe this is all you need for now. Then you can skip most of the other paragraphs. - Overview + Overview CUPS is more than just a print spooling system. It is a complete printer management system that complies with the new IPP (Internet Printing Protocol). IPP is an industry @@ -60,7 +61,7 @@ Problems An Overview of the C argue that CUPS is better! In any case, let us now move on to explore how one may configure CUPS for interfacing with MS Windows print clients via Samba. - Basic Configuration of CUPS support + Basic Configuration of CUPS support Printing with CUPS in the most basic smb.conf setup in Samba 3.0 (as was true for 2.2.x) only needs two settings: printing = cups and printcap @@ -76,7 +77,7 @@ Problems An Overview of the C details see man cupsd.conf and other CUPS-related documentation, like the wealth of documents on your CUPS server itself: http://localhost:631/documentation.html. - Linking of smbd with libcups.so + Linking of smbd with libcups.so Samba has a very special relationship to CUPS. The reason is: Samba can be compiled with CUPS library support. Most recent installations have this support enabled, and per default CUPS linking is compiled @@ -113,7 +114,7 @@ Problems An Overview of the C print command; other commands are lppause command, lpresume command, lpq command, lprm command, queuepause command and queue resume - command). Simple smb.conf Settings for CUPS + command). Simple smb.conf Settings for CUPS To summarize, here is the simplest printing-related setup for smb.conf to enable basic CUPS support: @@ -148,7 +149,7 @@ ProblemsAn Overview of the C printer is not a PostScript device, the print data stream is "binary", sensible only for the target printer. Read on to learn which problem this may cause and how to avoid it. - More complex smb.conf Settings for + More complex smb.conf Settings for CUPS Here is a slightly more complex printing-related setup for smb.conf. It enables general CUPS printing @@ -199,13 +200,13 @@ allowing access from three hosts. To prevent CUPS kicking in and taking over the print jobs for that share, we need to set printing = sysv and printcap = lpstat. - Advanced Configuration + Advanced Configuration Before we dive into all the configuration options, let's clarify a few points. Network printing needs to be organized and setup correctly. Often this is not done correctly. Legacy systems or small LANs in business environments often lack a clear design and good housekeeping. - Central spooling vs. "Peer-to-Peer" printing + Central spooling vs. "Peer-to-Peer" printing Many small office or home networks, as well as badly organized larger environments, allow each client a direct access to available network printers. Generally, this is a bad idea. It often blocks one client's @@ -217,7 +218,7 @@ is the usage of a "print server": it routes all jobs through one central system, which responds immediately, takes jobs from multiple concurrent clients at the same time and in turn transfers them to the printer(s) in the correct order. - CUPS/Samba as a "spooling-only" Print Server; "raw" printing + CUPS/Samba as a "spooling-only" Print Server; "raw" printing with Vendor Drivers on Windows Clients Most traditionally configured Unix print servers acting on behalf of Samba's Windows clients represented a really simple setup. Their only @@ -236,7 +237,7 @@ sent in a format that is suitable for direct delivery to the printer. Clients need to run the vendor-provided drivers to do this. In this case CUPS will NOT do any print file format conversion work. - Driver Installation Methods on Windows Clients + Driver Installation Methods on Windows Clients The printer drivers on the Windows clients may be installed in two functionally different ways: manually install the drivers locally on each client, @@ -249,7 +250,7 @@ first time they access the printer; with this method NT/2K/XP clients use the SPOOLSS/MS-RPC type printing calls. The second method is recommended for use over the first. - Explicitly enable "raw" printing for + Explicitly enable "raw" printing for application/octet-stream! If you use the first option (drivers are installed on the client side), there is one setting to take care of: CUPS needs to be told @@ -298,7 +299,7 @@ This is all you need to know to get the CUPS/Samba combo printing locally installed. If you are not interested in background information about more advanced CUPS/Samba printing, simply skip the remaining sections of this chapter. - Three familiar Methods for driver upload plus a new one + Three familiar Methods for driver upload plus a new one If you want to use the MS-RPC type printing, you must upload the drivers onto the Samba server first ([print$] share). For a discussion on how to deposit printer drivers on the @@ -320,7 +321,7 @@ utility. cupsaddsmb is discussed in much detail further below. But we will first explore the CUPS filtering system and compare the Windows and UNIX printing architectures. - Using CUPS/Samba in an advanced Way -- intelligent printing + Using CUPS/Samba in an advanced Way -- intelligent printing with PostScript Driver Download Still reading on? Good. Let's go into more detail then. We now know how to set up a "dump" printserver, that is, a server which is spooling @@ -345,7 +346,7 @@ how CUPS works and how you can enable its features. What follows is the comparison of some fundamental concepts for Windows and Unix printing; then is the time for a description of the CUPS filtering system, how it works and how you can tweak it. - GDI on Windows -- PostScript on Unix + GDI on Windows -- PostScript on Unix Network printing is one of the most complicated and error-prone day-to-day tasks any user or an administrator may encounter. This is true for all OS platforms. And there are reasons for this. @@ -361,7 +362,7 @@ into semi-official "standards", by being the most widely used PDLs many manufacturers who "roll their own" (their reasons may be unacceptable license fees for using printer-embedded PostScript interpreters, etc.). - Windows Drivers, GDI and EMF + Windows Drivers, GDI and EMF In Windows OS, the format conversion job is done by the printer drivers. On MS Windows OS platforms all application programmers have at their disposal a built-in API, the GDI (Graphical Device @@ -383,10 +384,10 @@ put paper and screen output on a common foundation for their (BSD-Unix-based, did you know??) Mac OS X and Darwin Operating Systems.Their Core Graphic Engine uses a PDF derivate for all display work. - + - Figure 19.1. Windows Printing to a local Printer - Unix Printfile Conversion and GUI Basics + Figure 19.1. Windows Printing to a local Printer + Unix Printfile Conversion and GUI Basics In Unix and Linux, there is no comparable layer built into the OS kernel(s) or the X (screen display) server. Every application is responsible for itself to create its print output. Fortunately, most @@ -422,7 +423,7 @@ form and you will be reading its PostScript code, the language instructions which need to be interpreted by a rasterizer. Rasterizers produce pixel images, which may be displayed on screen by a viewer program or on paper by a printer. - PostScript and Ghostscript + PostScript and Ghostscript So, Unix is lacking a common ground for printing on paper and displaying on screen. Despite this unfavorable legacy for Unix, basic printing is fairly easy: if you have PostScript printers at your @@ -441,9 +442,9 @@ options a printer supports: duplexing, stapling, punching... Therefore Unix users for a long time couldn't choose many of the supported device and job options, unlike Windows or Apple users. But now there is CUPS.... ;-) - - Figure 19.2. Printing to a Postscript Printer - + +Figure 19.2. Printing to a Postscript Printer + However, there are other types of printers out there. These don't know how to print PostScript. They use their own Page Description Language (PDL, often proprietary). To print to them is much @@ -451,7 +452,7 @@ more demanding. Since your Unix applications mostly produce PostScript, and since these devices don't understand PostScript, you need to convert the printfiles to a format suitable for your printer on the host, before you can send it away. - Ghostscript -- the Software RIP for non-PostScript Printers + Ghostscript -- the Software RIP for non-PostScript Printers Here is where Ghostscript kicks in. Ghostscript is the traditional (and quite powerful) PostScript interpreter used on Unix platforms. It is a RIP in software, capable to do a @@ -459,9 +460,9 @@ Unix platforms. It is a RIP in software, capable to do a spectrum of hardware devices as well as software file formats. Ghostscript technology and drivers is what enables PostScript printing to non-PostScript hardware. - - Figure 19.3. Ghostscript as a RIP for non-postscript printers - Tip + +Figure 19.3. Ghostscript as a RIP for non-postscript printers +Tip Use the "gs -h" command to check for all built-in "devices" of your Ghostscript version. If you specify e.g. a parameter of -sDEVICE=png256 on your Ghostscript command @@ -478,7 +479,7 @@ enhancement over GNU Ghostscript, with lots of bug-fixes, additional devices and improvements. It is jointly maintained by developers from CUPS, Gimp-Print, MandrakeSoft, SuSE, RedHat and Debian. It includes the "cups" device (essential to print to non-PS printers from CUPS). - PostScript Printer Description (PPD) Specification + PostScript Printer Description (PPD) Specification While PostScript in essence is a Page Description Language (PDL) to represent the page layout in a device independent way, real world print jobs are @@ -509,7 +510,7 @@ for achieving a certain print job output (e.g. duplexed, stapled and punched) on a specific target machine, may not print as expected, or may not be printable at all on other models; it also may not be fit for further processing by software (e.g. by a PDF distilling program). - CUPS can use all Windows-formatted Vendor PPDs + CUPS can use all Windows-formatted Vendor PPDs CUPS can handle all spec-compliant PPDs as supplied by the manufacturers for their PostScript models. Even if a Unix/Linux-illiterate vendor might not have mentioned our favorite @@ -536,7 +537,7 @@ your LAN has the PostScript driver installed, just use access the Windows directory where all printer driver files are stored. First look in the W32X86/2 subdir for the PPD you are seeking. - CUPS also uses PPDs for non-PostScript Printers + CUPS also uses PPDs for non-PostScript Printers CUPS also uses specially crafted PPDs to handle non-PostScript printers. These PPDs are usually not available from the vendors (and no, you can't just take the PPD of a Postscript printer with the same @@ -544,7 +545,7 @@ model name and hope it works for the non-PostScript version too). To understand how these PPDs work for non-PS printers we first need to dive deeply into the CUPS filtering and file format conversion architecture. Stay tuned. - The CUPS Filtering Architecture + The CUPS Filtering Architecture The core of the CUPS filtering system is based on Ghostscript. In addition to Ghostscript, CUPS uses some other filters of its own. You (or your OS vendor) may have @@ -586,7 +587,7 @@ others. However, even for Foomatic/cupsomatic usage, best results and broadest printer model support is provided by ESP Ghostscript (more about cupsomatic/Foomatic, particularly the new version called now foomatic-rip, follows below). - MIME types and CUPS Filters + MIME types and CUPS Filters CUPS reads the file /etc/cups/mime.types (and all other files carrying a *.types suffix in the same directory) upon startup. These files contain the MIME @@ -639,7 +640,7 @@ CUPS can handle ASCII text, HP-GL, PDF, PostScript, DVI and a lot of image formats (GIF. PNG, TIFF, JPEG, Photo-CD, SUN-Raster, PNM, PBM, SGI-RGB and some more) and their associated MIME types with its filters. - MIME type Conversion Rules + MIME type Conversion Rules CUPS reads the file /etc/cups/mime.convs (and all other files named with a *.convs suffix in the same directory) upon startup. These files contain @@ -680,7 +681,7 @@ The last two examples name the texttops f to work on "text/plain" as well as on "application/x-shell". (Hint: this differentiation is needed for the syntax highlighting feature of "texttops"). - Filter Requirements + Filter Requirements There are many more combinations named in mime.convs. However, you are not limited to use the ones pre-defined there. You can plug in any filter you like into the CUPS framework. It must meet, or must be made @@ -701,7 +702,7 @@ attribute Printer The string fr attribute Printer The job options Printer (Optionally) The print request file (if missing, filters expected data fed through stdin). In most cases it is very easy to write a simple wrapper script around existing -filters to make them work with CUPS. Prefilters +filters to make them work with CUPS. Prefilters As was said, PostScript is the central file format to any Unix based printing system. From PostScript, CUPS generates raster data to feed non-PostScript printers. @@ -718,18 +719,18 @@ the imagetops filter. Its outcome is alwa MIME type application/vnd.cups-postscript (not application/postscript), meaning it has the print options already embedded into the file. - - Figure 19.4. Prefiltering in CUPS to form Postscript - pstops + +Figure 19.4. Prefiltering in CUPS to form Postscript + pstops pstopsis the filter to convert application/postscript to application/vnd.cups-postscript. It was said above that this filter inserts all device-specific print options (commands to the printer to ask for the duplexing of output, or stapling an punching it, etc.) into the PostScript file. - - Figure 19.5. Adding Device-specific Print Options - + +Figure 19.5. Adding Device-specific Print Options + This is not all: other tasks performed by it are: selecting the range of pages to be printed (if you choose to @@ -740,7 +741,7 @@ putting 2 or more logical pages on one sheet of paper (the so-called "number-up" function) counting the pages of the job to insert the accounting information into the /var/log/cups/page_log - pstoraster + pstoraster pstoraster is at the core of the CUPS filtering system. It is responsible for the first stage of the rasterization process. Its input is of MIME type application/vnd.cups-postscript; @@ -748,9 +749,9 @@ its output is application/vnd.cups-raster. This output format is not yet meant to be printable. Its aim is to serve as a general purpose input format for more specialized raster drivers, that are able to generate device-specific printer data. - - Figure 19.6. Postscript to intermediate Raster format - + +Figure 19.6. Postscript to intermediate Raster format + CUPS raster is a generic raster format with powerful features. It is able to include per-page information, color profiles and more to be used by the following downstream raster drivers. Its MIME type is @@ -761,9 +762,9 @@ printer models, should they choose to do so. CUPS always takes care for the first stage of rasterization so these vendors don't need to care about Ghostscript complications (in fact, there is currently more than one vendor financing the development of CUPS raster drivers). - - Figure 19.7. CUPS-raster production using Ghostscript - + +Figure 19.7. CUPS-raster production using Ghostscript + CUPS versions before version 1.1.15 were shipping a binary (or source code) standalone filter, named "pstoraster". pstoraster was derived from GNU Ghostscript 5.50, and could be installed besides and in @@ -776,16 +777,16 @@ integrated back into Ghostscript (now based on GNU Ghostscript version parameter. If your Ghostscript doesn't show a success on asking for gs -h |grep cups, you might not be able to print. Update your Ghostscript then! - imagetops and imagetoraster + imagetops and imagetoraster Above in the section about prefilters, we mentioned the prefilter that generates PostScript from image formats. The imagetoraster filter is used to convert directly from image to raster, without the intermediate PostScript stage. It is used more often than the above mentioned prefilters. Here is a summarizing flowchart of image file filtering: - - Figure 19.8. Image format to CUPS-raster format conversion - rasterto [printers specific] + +Figure 19.8. Image format to CUPS-raster format conversion + rasterto [printers specific] CUPS ships with quite some different raster drivers processing CUPS raster. On my system I find in /usr/lib/cups/filter/ these: rastertoalps, rastertobj, rastertoepson, rastertoescp, @@ -797,9 +798,9 @@ than this; some of these are installed by commercial add-ons to CUPS rastertoprinter) by 3rd party driver development projects (such as Gimp-Print) wanting to cooperate as closely as possible with CUPS. - - Figure 19.9. Raster to Printer Specific formats - CUPS Backends + +Figure 19.9. Raster to Printer Specific formats + CUPS Backends The last part of any CUPS filtering chain is a "backend". Backends are special programs that send the print-ready file to the final device. There is a separate backend program for any transfer @@ -886,7 +887,7 @@ all available backends: lpinfo -v - cupsomatic/Foomatic -- how do they fit into the Picture? + cupsomatic/Foomatic -- how do they fit into the Picture? "cupsomatic" filters may be the most widely used on CUPS installations. You must be clear about the fact that these were not developed by the CUPS people. They are a "Third Party" add-on to @@ -936,11 +937,11 @@ print-options from page to page, in the middle of a job. And the best thing is: the new foomatic-rip now works seamlessly with all legacy spoolers too (like LPRng, BSD-LPD, PDQ, PPR etc.), providing for them access to use PPDs for their printing! - The Complete Picture + The Complete Picture If you want to see an overview over all the filters and how they relate to each other, the complete picture of the puzzle is at the end of this document. - mime.convs + mime.convs CUPS auto-constructs all possible filtering chain paths for any given MIME type, and every printer installed. But how does it decide in favor or against a specific alternative? (There may often be cases, @@ -957,7 +958,7 @@ cost. This is a very efficient way to limit the load of any CUPS server by setting an appropriate "FilterLimit" value. A FilterLimit of 200 allows roughly 1 job at a time, while a FilterLimit of 1000 allows approximately 5 jobs maximum at a time. - "Raw" printing + "Raw" printing You can tell CUPS to print (nearly) any file "raw". "Raw" means it will not be filtered. CUPS will send the file to the printer "as is" without bothering if the printer is able to digest it. Users need to @@ -980,7 +981,7 @@ CUPS will automatically treat each job sent to a queue as a "raw" one, if it can't find a PPD associated with the queue. However, CUPS will only send known MIME types (as defined in its own mime.types file) and refuse others. - "application/octet-stream" printing + "application/octet-stream" printing Any MIME type with no rule in the /etc/cups/mime.types file is regarded as unknown or application/octet-stream and will not be @@ -1038,7 +1039,7 @@ be one that is known to CUPS and an allowed one. The file recognizes MIME types. The file /etc/cups/mime.convs decides which file conversion filter(s) may be applied to which MIME types. - PostScript Printer Descriptions (PPDs) for non-PS Printers + PostScript Printer Descriptions (PPDs) for non-PS Printers Originally PPDs were meant to be used for PostScript printers only. Here, they help to send device-specific commands and settings to the RIP which processes the jobfile. CUPS has extended this @@ -1083,7 +1084,7 @@ specific model supports): stphoto2.ppd newer Epson Stylus Photo printers laserjet.ppd all PCL printers. Further below is a discussion of several other driver/PPD-packages suitable fur use with CUPS. - Difference between cupsomatic/foomatic-rip and + Difference between cupsomatic/foomatic-rip and native CUPS printing Native CUPS rasterization works in two steps. @@ -1096,9 +1097,9 @@ quality filters for this step, some are Free Software, some are Shareware/Non-Free, some are proprietary. Often this produces better quality (and has several more advantages) than other methods. - - Figure 19.10. cupsomatic/foomatic processing versus Native CUPS - + +Figure 19.10. cupsomatic/foomatic processing versus Native CUPS + One other method is the cupsomatic/foomatic-rip way. Note that cupsomatic is not made by the CUPS developers. It is an independent contribution to printing development, @@ -1132,7 +1133,7 @@ installation: Therefore the printfile bypasses the "pstoraster" filter cupsomatic hands the rendered file directly to the CUPS backend. The flowchart above illustrates the difference between native CUPS rendering and the Foomatic/cupsomatic method. - Examples for filtering Chains + Examples for filtering Chains Here are a few examples of commonly occurring filtering chains to illustrate the workings of CUPS. @@ -1182,7 +1183,7 @@ which transfers the job to the printers. The resulting filter chain therefore is: pdftops --> pstops --> pstoraster --> rastertoepson --> usb - Sources of CUPS drivers / PPDs + Sources of CUPS drivers / PPDs On the internet you can find now many thousand CUPS-PPD files (with their companion filters), in many national languages, supporting more than 1000 non-PostScript models. @@ -1217,7 +1218,7 @@ HPIJS). Printing with Interface Scripts + Printing with Interface Scripts CUPS also supports the usage of "interface scripts" as known from System V AT&T printing systems. These are often used for PCL printers, from applications that generate PCL print jobs. Interface @@ -1239,12 +1240,12 @@ with CUPS they provide the most easy way to plug in your own custom-written filtering script or program into one specific print queue (some information about the traditional usage of interface scripts is to be found at http://playground.sun.com/printing/documentation/interface.html). -

`Network printing (purely Windows)`

+

`Network printing (purely Windows)`

Network printing covers a lot of ground. To understand what exactly goes on with Samba when it is printing on behalf of its Windows clients, let's first look at a "purely Windows" setup: Windows clients with a Windows NT print server. -

`From Windows Clients to an NT Print Server`

+

`From Windows Clients to an NT Print Server`

Windows clients printing to an NT-based print server have two options. They may

execute the driver locally and render the GDI output @@ -1253,7 +1254,7 @@ or
send the GDI output (EMF) to the server, where the driver is executed to render the printer specific output.

Both print paths are shown in the flowcharts below. -

`Driver Execution on the Client`

+

`Driver Execution on the Client`

In the first case the print server must spool the file as "raw", meaning it shouldn't touch the jobfile and try to convert it in any way. This is what traditional Unix-based print server can do too; and @@ -1263,9 +1264,9 @@ advantage of this setup is that this "spooling-only" print server may be used even if no driver(s) for Unix are available it is sufficient to have the Windows client drivers available and installed on the clients. -

-

Figure 19.11. Print Driver execution on the Client

-

`Driver Execution on the Server`

+

+Figure 19.11. Print Driver execution on the Client +

`Driver Execution on the Server`

The other path executes the printer driver on the server. The clients transfers print files in EMF format to the server. The server uses the PostScript, PCL, ESC/P or other driver to convert the EMF file into @@ -1273,18 +1274,18 @@ the printer-specific language. It is not possible for Unix to do the same. Currently there is no program or method to convert a Windows client's GDI output on a Unix server into something a printer could understand. -

-

Figure 19.12. Print Driver execution on the Server

-

+

+Figure 19.12. Print Driver execution on the Server + However, there is something similar possible with CUPS. Read on... -

`Network Printing (Windows clients -- UNIX/Samba Print +`

`Network Printing (Windows clients -- UNIX/Samba Print Servers)`

Since UNIX print servers cannot execute the Win32 program code on their platform, the picture is somewhat different. However, this doesn't limit your options all that much. In the contrary, you may have a way here to implement printing features which are not possible otherwise. -

`From Windows Clients to a CUPS/Samba Print Server`

+

`From Windows Clients to a CUPS/Samba Print Server`

Here is a simple recipe showing how you can take advantage of CUPS powerful features for the benefit of your Windows network printing clients: @@ -1311,9 +1312,9 @@ other print commands are set up, then printing will use the option automatically passing through (if you want your own defined print commands to work with a Samba that has CUPS support compiled in, simply use printing = sysv). -

-

Figure 19.13. Printing via CUPS/samba server

-

`Samba receiving Jobfiles and passing them to CUPS`

+

+Figure 19.13. Printing via CUPS/samba server +

`Samba receiving Jobfiles and passing them to CUPS`

Samba must use its own spool directory (it is set by a line similar to path = /var/spool/samba, in the [printers] or @@ -1331,7 +1332,7 @@ A Windows user authenticates only to Samba (by whatever means is configured). If Samba runs on the same host as CUPS, you only need to allow "localhost" to print. If they run on different machines, you need to make sure the Samba host gets access to printing on CUPS. -

`Network PostScript RIP: CUPS Filters on Server -- clients use +`

`Ninth Step: Tell Samba which Printer should use these Driver +`

`Ninth Step: Tell Samba which Printer should use these Driver Files (setdriver)`

 
 #  rpcclient -Uroot%xxxx -c 'setdriver mysmbtstprn mydrivername' localhost
@@ -2315,7 +2316,7 @@ driver. You don't need to repeat all the previous steps for the
 setdriver command to succeed. The only pre-conditions are:
 enumdrivers must find the driver and
 enumprinters must find the printer.
-

`Tenth Step (optional): Verify if Samba has this Association +`

`Tenth Step (optional): Verify if Samba has this Association recognized`

 
 #  rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost | grep driver
@@ -2357,7 +2358,7 @@ Compare these results with the ones from steps 2 and 3. Note that
 every single of these commands show the driver is installed.  Even
 the enumprinters command now lists the driver
 on the "description" line.
-

`Eleventh Step (optional): Tickle the Driver into a correct +`

`Eleventh Step (optional): Tickle the Driver into a correct Device Mode`

You certainly know how to install the driver on the client. In case you are not particularly familiar with Windows, here is a short @@ -2382,7 +2383,7 @@ into the "DOS box" (type root's smbpassword when prompted): Change any printer setting once (like "portrait" --> "landscape"), click "Apply"; change the setting back. -

`Twelfth Step: Install the Printer on a Client +`

`Twelfth Step: Install the Printer on a Client ("Point'n'Print")`

 
  C:\> rundll32 printui.dll,PrintUIEntry /in /n "\\sambacupsserver\mysmbtstprn"
@@ -2390,24 +2391,24 @@ back.

If it doesn't work it could be a permission problem with the [print$] share. -

`Thirteenth Step (optional): Print a Test Page`

 
  C:\> rundll32 printui.dll,PrintUIEntry /p /n "\\sambacupsserver\mysmbtstprn"

Then hit [TAB] 5 times, [ENTER] twice, [TAB] once and [ENTER] again and march to the printer. -

`Fourteenth Step (recommended): Study the Test Page`

+

`Fourteenth Step (recommended): Study the Test Page`

Hmmm.... just kidding! By now you know everything about printer installations and you don't need to read a word. Just put it in a frame and bolt it to the wall with the heading "MY FIRST RPCCLIENT-INSTALLED PRINTER" - why not just throw it away! -

`Fifteenth Step (obligatory): Enjoy. Jump. Celebrate your +`

`Fifteenth Step (obligatory): Enjoy. Jump. Celebrate your Success`

 
 # echo "Cheeeeerioooooo! Success..." >> /var/log/samba/log.smbd     
 
-

`CUPS Print Drivers from Linuxprinting.org`

CUPS ships with good support for HP LaserJet type printers. You can install the generic driver as follows:

@@ -2565,7 +2566,7 @@ not work with PPDs generated for the old cupsomatic. The new-style
 PPDs are 100% compliant to the Adobe PPD specification. They are
 intended to be used by Samba and the cupsaddsmb utility also, to
 provide the driver files for the Windows clients also!
-

This all has changed in Foomatic versions 2.9 (Beta) and released as "stable" 3.0. This has now achieved the convergence of all *omatic @@ -2700,7 +2701,7 @@ sizes for many printers; and it will support printing on media drawn from different paper trays within the same job (in both cases: even where there is no support for this from Windows-based vendor printer drivers). -

`Driver Development outside`

+

`Driver Development outside`

Most driver development itself does not happen within Linuxprinting.org. Drivers are written by independent maintainers. Linuxprinting.org just pools all the information, and stores it in its @@ -2723,7 +2724,7 @@ effort, started by Michael Sweet (also lead developer for CUPS), now directed by Robert Krawitz, which has achieved an amazing level of photo print quality (many Epson users swear that its quality is better than the vendor drivers provided by Epson for the Microsoft -platforms). This currently supports 522 models.

`Forums, Downloads, Tutorials, Howtos -- also for Mac OS X and +platforms). This currently supports 522 models.`

`Forums, Downloads, Tutorials, Howtos -- also for Mac OS X and commercial Unix`

You can read more about the setup of this combination in the manpage for "cupsaddsmb" (which is only present with CUPS installed, and only current from CUPS 1.1.16). -

`The page_log File Syntax`

+

`The page_log File Syntax`

These are the items CUPS logs in the "page_log" for every single page of a job:

Printer name
User name
Job ID
Time of printing
the page number
the number of copies
a billing information string @@ -2949,7 +2950,7 @@ This was job ID "401", printed on "infotec_IS2027" by user & from IP address 10.160.50.13. The next job had ID "402", was sent by user "boss" from IP address 10.160.51.33,printed from one page 440 copies and is set to be billed to "finance-dep". -

`Possible Shortcomings`

+

`Possible Shortcomings`

What flaws or shortcomings are there with this quota system?

the ones named above (wrongly logged job in case of printer hardware failure, etc.)
in reality, CUPS counts the job pages that are being @@ -2963,7 +2964,7 @@ groups
no means to read out the current balance or the "used-up" number of current quota
a user having used up 99 sheets of 100 quota will still be able to send and print a 1,000 sheet job
a user being denied a job because of a filled-up quota doesn't get a meaningful error message from CUPS other than -"client-error-not-possible".

`Future Developments`

+"client-error-not-possible".

`Future Developments`

This is the best system currently available, and there are huge improvements under development for CUPS 1.2:

page counting will go into the "backends" (these talk @@ -2971,9 +2972,9 @@ directly to the printer and will increase the count in sync with the actual printing process: thus a jam at the 5th sheet will lead to a stop in the counting)
quotas will be handled more flexibly
probably there will be support for users to inquire their "accounts" in advance
probably there will be support for some other tools -around this topic

`In Case of Trouble.....`

If you have more problems, post the output of these commands to the CUPS or Samba mailing lists (choose the one which seems more relevant to your problem): @@ -3119,13 +3120,13 @@ compact way. Don't forget to name the CUPS and Samba versions you are using! This saves bandwidth and makes for easier readability for experts (and you are expecting experts to read them, right? ;-) -

`Where to find Documentation`

+

`Where to find Documentation`

[TO BE DONE] -

`How to ask for Help`

+

`How to ask for Help`

[TO BE DONE] -

`Where to find Help`

+

`Where to find Help`

[TO BE DONE] -

`Appendix`

`Printing from CUPS to Windows attached +`

`Appendix`

`Printing from CUPS to Windows attached Printers`

From time to time the question arises, how you can print to a Windows attached printer @@ -3213,7 +3214,7 @@ doesn't require a password! Printing will only work if you have a working netbios name resolution up and running. Note that this is a feature of CUPS and you don't necessarily need to have smbd running (but who wants that? :-). -

`More CUPS filtering Chains`

+

`More CUPS filtering Chains`

The following diagrams reveal how CUPS handles print jobs.

 #########################################################################
@@ -3504,7 +3505,7 @@ The following diagrams reveal how CUPS handles print jobs.
 #       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
 #
 ##########################################################################
-

`Trouble Shooting Guidelines to fix typical Samba printing +`

`Trouble Shooting Guidelines to fix typical Samba printing Problems`

This is a short description of how to debug printing problems with Samba. This describes how to debug problems with printing from @@ -3617,35 +3618,35 @@ three dialogs look the same. Only one of does what you intend. You need to be Administrator or Print Administrator to do this for all users. Here is how I do in on XP: -

The first "wrong" way: +
1. The first "wrong" way: - Open the Printers + Open the Printers folder. Right-click on the printer (remoteprinter on cupshost) and select in context menu Printing Preferences... Look at this dialog closely and remember what it looks -like. - The second "wrong" way: +like. +
2. The second "wrong" way: - Open the Printers + Open the Printers folder. Right-click on the printer (remoteprinter on cupshost) and select in the context menu Properties Click on the General tab Click on the button Printing Preferences... A new dialog opens. Keep this dialog open and go back -to the parent dialog. - The third, the "correct" way: (should you do +to the parent dialog. +
3. The third, the "correct" way: (should you do this from the beginning, just carry out steps 1. and 2. from second "way" above) - Click on the Advanced + Click on the Advanced tab. (Hmmm... if everything is "Grayed Out", then you are not logged in as a user with enough privileges). Click on the Printing Defaults... button. On any of the two new tabs, click on the Advanced... button. A new dialog opens. Compare this one to the other, -identical looking one from "B.5" or A.3". - +identical looking one from "B.5" or A.3".
+

Do you see any difference? I don't either... However, only the last one, which you arrived at with steps "C.1.-6." will save any settings permanently and be the defaults for new users. If you want all clients @@ -3728,6 +3729,6 @@ Windows box with a shared PostScript printer: smbclient W32X86/2 subdir to mget ADOBE* and other files or to WIN40/0 to do the same. -- Another option is to download the *.exe packaged -files from the Adobe website.

`An Overview of the CUPS Printing Processes`

-

Figure 19.15. CUPS Printing Overview

-

Prev	Up	Next
Chapter 18. Classical Printing Support	Home	Chapter 20. Stackable VFS modules

+files from the Adobe website.

`An Overview of the CUPS Printing Processes`

+Figure 19.15. CUPS Printing Overview +

Prev	Up	Next
Chapter 18. Classical Printing Support	Home	Chapter 20. Stackable VFS modules

Of course, you also need to ensure that the directory named by the path parameter exists on the Unix file system. -

`Parameters in the [print$] Section`

+

`Parameters in the [print$] Section`

[print$] is a special section in . It contains settings relevant to potential printer driver download and local installation by clients. @@ -6812,7 +6815,7 @@ sure these accounts can copy files to the share. If this is a non-root account, then the account should also be mentioned in the global printer admin parameter. See the man page for more information on -configuring file shares.

`Subdirectory Structure in [print$]`

+configuring file shares.

`Subdirectory Structure in [print$]`

In order for a Windows NT print server to support the downloading of driver files by multiple client architectures, you must create several subdirectories within the [print$] service @@ -6851,7 +6854,7 @@ client workstation. Open Network Neighbourhood or Once you have located the server, navigate to its Printers and Faxes folder. You should see an initial listing of printers that matches the printer shares defined on your Samba host. -

`Installing Drivers into [print$]`

+

`Installing Drivers into [print$]`

You have successfully created the [print$] share in ? And Samba has re-read its configuration? Good. But you are not yet ready to take off. The @@ -6869,7 +6872,7 @@ Properties and Add Printer Wizard

The latter option is probably the easier one (even if the only entrance to this realm seems a little bit weird at first). -

`Setting Drivers for existing Printers with a Client GUI`

+

`Setting Drivers for existing Printers with a Client GUI`

The initial listing of printers in the Samba host's Printers folder accessed from a client's Explorer will have no real printer driver assigned to them. By default, in @@ -6915,7 +6918,7 @@ Assuming you have connected with an administrative (or root) account you will also be able to modify other printer properties such as ACLs and default device settings using this dialog. For the default device settings, please consider the advice given further below. -

`Setting Drivers for existing Printers with +`

`Setting Drivers for existing Printers with rpcclient`

The second way to install printer drivers into [print$] and set them up in a valid way can be @@ -6930,7 +6933,7 @@ time with the setdriver subcommand.

We will provide detailed hints for each of these steps in the next few paragraphs. -

`Identifying the Driver Files`

+

`Identifying the Driver Files`

To find out about the driver files, you have two options: you could investigate the driver CD which comes with your printer. Study the *.inf file on the CD, if it is contained. This @@ -7033,7 +7036,7 @@ Windows 2000 changed this. While it still can use the Kernel Mode drivers (if this is enabled by the Admin), its native mode for printer drivers is User Mode execution. This requires drivers designed for this. These type of drivers install into the "3" subdirectory. -

`Collecting the Driver Files from a Windows Host's +`

`Collecting the Driver Files from a Windows Host's [print$] Share`

Now we need to collect all the driver files we identified. in our previous step. Where do we get them from? Well, why not retrieve them @@ -7069,7 +7072,7 @@ files for these architectures are in the WIN40/0/ subdir. Once we are complete, we can run smbclient ... put to store the collected files on the Samba server's [print$] share. -

`Depositing the Driver Files into [print$]`

+

`Depositing the Driver Files into [print$]`

So, now we are going to put the driver files into the [print$] share. Remember, the UNIX path to this share has been defined previously in your @@ -7130,7 +7133,7 @@ re-location will automatically be done by the don't forget to also put the files for the Win95/98/ME architecture into the WIN40/ subdirectory should you need them). -

`Check if the Driver Files are there (with smbclient)`

+

`Check if the Driver Files are there (with smbclient)`

For now we verify that our files are there. This can be done with smbclient too (but of course you can log in via SSH also and do this through a standard UNIX shell access too): @@ -7183,7 +7186,7 @@ Point'n'Print. The reason is: Samba doesn't know yet that these files are something special, namely printer driver files and it doesn't know yet to which print queue(s) these driver files belong. -

`Running rpcclient with +`

`Running rpcclient with adddriver`

So, next you must tell Samba about the special category of the files you just uploaded into the [print$] share. This @@ -7218,7 +7221,7 @@ files successfully, but render the driver unworkable. So take care! Hints about the syntax of the adddriver command are in the man page. The CUPS printing chapter of this HOWTO collection provides a more detailed description, if you should need it. -

`Check how Driver Files have been moved after +`

`Check how Driver Files have been moved after adddriver finished`

One indication for Samba's recognition of the files as driver files is the successfully installed message. @@ -7266,7 +7269,7 @@ subdirectory. You can check this again with

Another verification is that the timestamp of the printing TDB files is now updated (and possibly their filesize has increased). -

`Check if the Driver is recognized by Samba`

+

`Check if the Driver is recognized by Samba`

Now the driver should be registered with Samba. We can easily verify this, and will do so in a moment. However, this driver is not yet associated with a particular @@ -7310,7 +7313,7 @@ time. Our new driver only shows up for Windows NT 4.0 or 2000. To have it present for Windows 95, 98 and ME you'll have to repeat the whole procedure with the WIN40 architecture and subdirectory. -

`A side note: you are not bound to specific driver names`

+

`A side note: you are not bound to specific driver names`

You can name the driver as you like. If you repeat the adddriver step, with the same files as before, but with a different driver name, it will work the same: @@ -7344,7 +7347,7 @@ repeatedly. Each run "consumes" the files you had put into the respective subdirectories. So you must precede an smbclient ... put command before each rpcclient ... adddriver" command. -

`La Grande Finale: Running rpcclient with +`

`La Grande Finale: Running rpcclient with setdriver`

Samba still needs to know which printer's driver this is. It needs to create a mapping of the driver to a printer, and @@ -7374,13 +7377,13 @@ known to Samba already. A bug in 2.2.x prevented Samba from recognizing freshly installed printers. You had to restart Samba, or at least send a HUP signal to all running smbd processes to work around this: -kill -HUP `pidof smbd`.

"The Proof of the Pudding lies in the Eating" (Client Driver Install +kill -HUP `pidof smbd`.

`"The Proof of the Pudding lies in the Eating" (Client Driver Install Procedure)`

“I can't set and save default print options +

“I can't set and save default print options for all users on Win2K/XP! Why not?” How are you doing it? I bet the wrong way.... (it is not very easy to find out, though). There are 3 different ways to bring you to @@ -7578,34 +7581,34 @@ dialogs look the same. Only one of them Administrator to do this for all users. Here is how I reproduce it in on XP Professional: - The first "wrong" way: + The first "wrong" way: - Open the Printers + Open the Printers folder. Right-click on the printer (remoteprinter on cupshost) and select in context menu Printing Preferences... Look at this dialog closely and remember what it looks -like. - The second "wrong" way: +like. + The second "wrong" way: - Open the Printers + Open the Printers folder. Right-click on the printer (remoteprinter on cupshost) and select in the context menu Properties Click on the General tab Click on the button Printing Preferences... A new dialog opens. Keep this dialog open and go back -to the parent dialog. - The third, the "correct" way: (should you do +to the parent dialog. + The third, the "correct" way: (should you do this from the beginning, just carry out steps 1. and 2. from second "way" above) - Click on the Advanced + Click on the Advanced tab. (Hmmm... if everything is "Grayed Out", then you are not logged in as a user with enough privileges). Click on the Printing Defaults... button. On any of the two new tabs, click on the Advanced... button. A new dialog opens. Compare this one to the other, -identical looking one from "B.5" or A.3". - +identical looking one from "B.5" or A.3". + Do you see any difference in the two settings dialogs? I don't either. However, only the last one, which you arrived at with steps @@ -7632,7 +7635,7 @@ try the same way with Win2k or WinXP. You wouldn't dream that there is now a different "clicking path" to arrive at an identically looking, but functionally different dialog to set defaults for all users! - Tip Try (on Win2000 and WinXP) to run this command (as a user + Tip Try (on Win2000 and WinXP) to run this command (as a user with the right privileges): rundll32 printui.dll,PrintUIEntry /p /t3 /n\\SAMBA-SERVER\printersharename @@ -7646,7 +7649,7 @@ to see the tab with the Printing Preferences... button (the one which doesn't set system-wide defaults). You can start the commands from inside a DOS box" or from the Start -- Run... menu. - Supporting large Numbers of Printers +

`Supporting large Numbers of Printers`

One issue that has arisen during the recent development phase of Samba is the need to support driver downloads for 100's of printers. Using Windows NT APW here is somewhat awkward (to say the least). If you @@ -7683,9 +7686,9 @@ following is an example of how this could be accomplished: Driver Name: [myphantasydrivername] [....] -

+ -

+ root# rpcclient SAMBA-CUPS -U root%secret -c 'enumprinters'
  cmd = enumprinters
    flags:[0x800000]
@@ -7693,15 +7696,15 @@ following is an example of how this could be accomplished:
    description:[\\SAMBA-CUPS\dm9110,,110ppm HiVolume DANKA Stuttgart]
    comment:[110 ppm HiVolume DANKA Stuttgart]
  [....]
-

+

- + root# rpcclient SAMBA-CUPS -U root%secret -c 'setdriver dm9110 "Heidelberg Digimaster 9110 (PS)"' cmd = setdriver dm9110 Heidelberg Digimaster 9110 (PPD) Successfully set dm9110 to driver Heidelberg Digimaster 9110 (PS). - + - + root# rpcclient SAMBA-CUPS -U root%secret -c 'enumprinters' cmd = enumprinters flags:[0x800000] @@ -7709,15 +7712,15 @@ following is an example of how this could be accomplished: description:[\\SAMBA-CUPS\dm9110,Heidelberg Digimaster 9110 (PS),110ppm HiVolume DANKA Stuttgart] comment:[110ppm HiVolume DANKA Stuttgart] [....] - + - + root# rpcclient SAMBA-CUPS -U root%secret -c 'setdriver dm9110 myphantasydrivername' cmd = setdriver dm9110 myphantasydrivername Successfully set dm9110 to myphantasydrivername. - + - + root# rpcclient SAMBA-CUPS -U root%secret -c 'enumprinters' cmd = enumprinters flags:[0x800000] @@ -7733,7 +7736,7 @@ commas in the "description" field). After the setdriver command succeeded, all is well. (The CUPS Printing chapter has more info about the installation of printer drivers with the help of rpcclient). -

`Adding new Printers with the Windows NT APW`

+

`Adding new Printers with the Windows NT APW`

By default, Samba exhibits all printer shares defined in smb.conf in the Printers... folder. Also located in this folder @@ -7779,7 +7782,7 @@ user, not necessarily a root account. A map to guest = user may have connected you unwittingly under the wrong privilege; you should check it by using the smbstatus command. -

The Imprints tool set provides a UNIX equivalent of the Windows NT Add Printer Wizard. For complete information, please refer to the Imprints web site @@ -7995,20 +7998,20 @@ coordinate your efforts on the samba-technical mailing list. The toolset is still in usable form; but only for a series of older printer models, where there are prepared packages to use. Packages for more up to date print devices are needed if Imprints should have a -future.

`What is Imprints?`

+future.

`What is Imprints?`

Imprints is a collection of tools for supporting these goals:

Providing a central repository information regarding Windows NT and 95/98 printer driver packages
Providing the tools necessary for creating the Imprints printer driver packages.
Providing an installation client which will obtain printer drivers from a central internet (or intranet) Imprints Server repository and install them on remote Samba and Windows NT4 print -servers.

`Creating Printer Driver Packages`

+servers.

`Creating Printer Driver Packages`

The process of creating printer driver packages is beyond the scope of this document (refer to Imprints.txt also included with the Samba distribution for more information). In short, an Imprints driver package is a gzipped tarball containing the driver files, related INF files, and a control file needed by the installation client. -

`The Imprints Server`

+

`The Imprints Server`

The Imprints server is really a database server that may be queried via standard HTTP mechanisms. Each printer entry in the database has an associated URL for the actual downloading of the package. Each @@ -8016,7 +8019,7 @@ package is digitally signed via GnuPG which can be used to verify that package downloaded is actually the one referred in the Imprints database. It is strongly recommended that this security check not be disabled. -

`The Installation Client`

+

`The Installation Client`

More information regarding the Imprints installation client is available in the Imprints-Client-HOWTO.ps file included with the imprints source package. @@ -8031,10 +8034,10 @@ remote Samba and Windows NT print servers.

The basic installation process is in four steps and perl code is wrapped around smbclient and rpcclient -

+
- foreach (supported architecture for a given driver) - rpcclient: Get the appropriate upload directory on the remote server smbclient: Upload the driver files rpcclient: Issues an AddPrinterDriver() MS-RPC -
- rpcclient: Issue an AddPrinterEx() MS-RPC to actually create the printer
+
1. rpcclient: Get the appropriate upload directory on the remote server
2. smbclient: Upload the driver files
3. rpcclient: Issues an AddPrinterDriver() MS-RPC
+
rpcclient: Issue an AddPrinterEx() MS-RPC to actually create the printer

`Chapter 19. CUPS Printing Support in Samba 3.0`

`Kurt Pfeifle`

Danka Deutschland GmbH <kpfeifle@danka.de>

`Ciprian Vizitiu`

drawings<CVizitiu@gbif.org>

(3 June 2003)

Table of Contents

Basic Configuration of CUPS support

Features and Benefits
Overview

Linking of smbd with libcups.so
Simple smb.conf Settings for CUPS
More complex smb.conf Settings for -CUPS

Advanced Configuration

Central spooling vs. "Peer-to-Peer" printing
CUPS/Samba as a "spooling-only" Print Server; "raw" printing -with Vendor Drivers on Windows Clients
Driver Installation Methods on Windows Clients
Explicitly enable "raw" printing for -application/octet-stream!
Three familiar Methods for driver upload plus a new one

Using CUPS/Samba in an advanced Way -- intelligent printing -with PostScript Driver Download

GDI on Windows -- PostScript on Unix
Windows Drivers, GDI and EMF
Unix Printfile Conversion and GUI Basics
PostScript and Ghostscript
Ghostscript -- the Software RIP for non-PostScript Printers
PostScript Printer Description (PPD) Specification
CUPS can use all Windows-formatted Vendor PPDs
CUPS also uses PPDs for non-PostScript Printers

The CUPS Filtering Architecture

MIME types and CUPS Filters
MIME type Conversion Rules
Filter Requirements
Prefilters
pstops
pstoraster
imagetops and imagetoraster
rasterto [printers specific]
CUPS Backends
cupsomatic/Foomatic -- how do they fit into the Picture?
The Complete Picture
mime.convs
"Raw" printing
"application/octet-stream" printing
PostScript Printer Descriptions (PPDs) for non-PS Printers
Difference between cupsomatic/foomatic-rip and -native CUPS printing
Examples for filtering Chains
Sources of CUPS drivers / PPDs
Printing with Interface Scripts

Network printing (purely Windows)

From Windows Clients to an NT Print Server
Driver Execution on the Client
Driver Execution on the Server

Network Printing (Windows clients -- UNIX/Samba Print -Servers)

From Windows Clients to a CUPS/Samba Print Server
Samba receiving Jobfiles and passing them to CUPS

Network PostScript RIP: CUPS Filters on Server -- clients use -PostScript Driver with CUPS-PPDs

PPDs for non-PS Printers on UNIX
PPDs for non-PS Printers on Windows

Windows Terminal Servers (WTS) as CUPS Clients

Printer Drivers running in "Kernel Mode" cause many -Problems
Workarounds impose Heavy Limitations
CUPS: a "Magical Stone"?
PostScript Drivers with no major problems -- even in Kernel -Mode

Setting up CUPS for driver Download

cupsaddsmb: the unknown Utility
Prepare your smb.conf for -cupsaddsmb
CUPS Package of "PostScript Driver for WinNT/2k/XP"
Recognize the different Driver Files
Acquiring the Adobe Driver Files
ESP Print Pro Package of "PostScript Driver for -WinNT/2k/XP"
Caveats to be considered
What are the Benefits of using the "CUPS PostScript Driver for -Windows NT/2k/XP" as compared to the Adobe Driver?
Run "cupsaddsmb" (quiet Mode)
Run "cupsaddsmb" with verbose Output
Understanding cupsaddsmb
How to recognize if cupsaddsm completed successfully
cupsaddsmb with a Samba PDC
cupsaddsmb Flowchart
Installing the PostScript Driver on a Client
Avoiding critical PostScript Driver Settings on the -Client

Installing PostScript Driver Files manually (using -rpcclient)

A Check of the rpcclient man Page
Understanding the rpcclient man Page
Producing an Example by querying a Windows Box
What is required for adddriver and setdriver to succeed
Manual Commandline Driver Installation in 15 little Steps
Troubleshooting revisited

The printing *.tdb Files

Trivial DataBase Files
Binary Format
Losing *.tdb Files
Using tdbbackup

CUPS Print Drivers from Linuxprinting.org

foomatic-rip and Foomatic explained
foomatic-rip and Foomatic-PPD Download and Installation

Page Accounting with CUPS

Setting up Quotas
Correct and incorrect Accounting
Adobe and CUPS PostScript Drivers for Windows Clients
The page_log File Syntax
Possible Shortcomings
Future Developments
Other Accounting Tools

Additional Material

Auto-Deletion or Preservation of CUPS Spool Files

CUPS Configuration Settings explained
Pre-conditions
Manual Configuration

When not to use Samba to print to -CUPS

In Case of Trouble.....

Where to find Documentation
How to ask for Help
Where to find Help

Appendix

Printing from CUPS to Windows attached -Printers
More CUPS filtering Chains
Trouble Shooting Guidelines to fix typical Samba printing -Problems
An Overview of the CUPS Printing Processes

`Introduction`

`Features and Benefits`

+

`Chapter 19. CUPS Printing Support in Samba 3.0`

`Kurt Pfeifle`

Danka Deutschland GmbH <kpfeifle@danka.de>

`Ciprian Vizitiu`

drawings<CVizitiu@gbif.org>

(3 June 2003)

Table of Contents

Basic Configuration of CUPS support

Features and Benefits
Overview

Linking of smbd with libcups.so
Simple smb.conf Settings for CUPS
More complex smb.conf Settings for +CUPS

Advanced Configuration

Central spooling vs. "Peer-to-Peer" printing
CUPS/Samba as a "spooling-only" Print Server; "raw" printing +with Vendor Drivers on Windows Clients
Driver Installation Methods on Windows Clients
Explicitly enable "raw" printing for +application/octet-stream!
Three familiar Methods for driver upload plus a new one

Using CUPS/Samba in an advanced Way -- intelligent printing +with PostScript Driver Download

GDI on Windows -- PostScript on Unix
Windows Drivers, GDI and EMF
Unix Printfile Conversion and GUI Basics
PostScript and Ghostscript
Ghostscript -- the Software RIP for non-PostScript Printers
PostScript Printer Description (PPD) Specification
CUPS can use all Windows-formatted Vendor PPDs
CUPS also uses PPDs for non-PostScript Printers

The CUPS Filtering Architecture

MIME types and CUPS Filters
MIME type Conversion Rules
Filter Requirements
Prefilters
pstops
pstoraster
imagetops and imagetoraster
rasterto [printers specific]
CUPS Backends
cupsomatic/Foomatic -- how do they fit into the Picture?
The Complete Picture
mime.convs
"Raw" printing
"application/octet-stream" printing
PostScript Printer Descriptions (PPDs) for non-PS Printers
Difference between cupsomatic/foomatic-rip and +native CUPS printing
Examples for filtering Chains
Sources of CUPS drivers / PPDs
Printing with Interface Scripts

Network printing (purely Windows)

From Windows Clients to an NT Print Server
Driver Execution on the Client
Driver Execution on the Server

Network Printing (Windows clients -- UNIX/Samba Print +Servers)

From Windows Clients to a CUPS/Samba Print Server
Samba receiving Jobfiles and passing them to CUPS

Network PostScript RIP: CUPS Filters on Server -- clients use +PostScript Driver with CUPS-PPDs

PPDs for non-PS Printers on UNIX
PPDs for non-PS Printers on Windows

Windows Terminal Servers (WTS) as CUPS Clients

Printer Drivers running in "Kernel Mode" cause many +Problems
Workarounds impose Heavy Limitations
CUPS: a "Magical Stone"?
PostScript Drivers with no major problems -- even in Kernel +Mode

Setting up CUPS for driver Download

cupsaddsmb: the unknown Utility
Prepare your smb.conf for +cupsaddsmb
CUPS Package of "PostScript Driver for WinNT/2k/XP"
Recognize the different Driver Files
Acquiring the Adobe Driver Files
ESP Print Pro Package of "PostScript Driver for +WinNT/2k/XP"
Caveats to be considered
What are the Benefits of using the "CUPS PostScript Driver for +Windows NT/2k/XP" as compared to the Adobe Driver?
Run "cupsaddsmb" (quiet Mode)
Run "cupsaddsmb" with verbose Output
Understanding cupsaddsmb
How to recognize if cupsaddsm completed successfully
cupsaddsmb with a Samba PDC
cupsaddsmb Flowchart
Installing the PostScript Driver on a Client
Avoiding critical PostScript Driver Settings on the +Client

Installing PostScript Driver Files manually (using +rpcclient)

A Check of the rpcclient man Page
Understanding the rpcclient man Page
Producing an Example by querying a Windows Box
What is required for adddriver and setdriver to succeed
Manual Commandline Driver Installation in 15 little Steps
Troubleshooting revisited

The printing *.tdb Files

Trivial DataBase Files
Binary Format
Losing *.tdb Files
Using tdbbackup

CUPS Print Drivers from Linuxprinting.org

foomatic-rip and Foomatic explained
foomatic-rip and Foomatic-PPD Download and Installation

Page Accounting with CUPS

Setting up Quotas
Correct and incorrect Accounting
Adobe and CUPS PostScript Drivers for Windows Clients
The page_log File Syntax
Possible Shortcomings
Future Developments
Other Accounting Tools

Additional Material

Auto-Deletion or Preservation of CUPS Spool Files

CUPS Configuration Settings explained
Pre-conditions
Manual Configuration

When not to use Samba to print to +CUPS

In Case of Trouble.....

Where to find Documentation
How to ask for Help
Where to find Help

Appendix

Printing from CUPS to Windows attached +Printers
More CUPS filtering Chains
Trouble Shooting Guidelines to fix typical Samba printing +Problems
An Overview of the CUPS Printing Processes

`Introduction`

`Features and Benefits`

The Common Unix Print System (CUPS) has become very popular. All big Linux distributions now ship it as their default printing system. But to many it is still a very mystical tool. Normally it @@ -8240,7 +8243,7 @@ Problems

An Overview of the CUPS Printing Proce contained. But lets start with the most basic things first. Maybe this is all you need for now. Then you can skip most of the other paragraphs. -

`Overview`

+

`Overview`

CUPS is more than just a print spooling system. It is a complete printer management system that complies with the new IPP (Internet Printing Protocol). IPP is an industry @@ -8260,7 +8263,7 @@ Problems

An Overview of the CUPS Printing Proce argue that CUPS is better! In any case, let us now move on to explore how one may configure CUPS for interfacing with MS Windows print clients via Samba. -

`Basic Configuration of CUPS support`

+

`Basic Configuration of CUPS support`

Printing with CUPS in the most basic smb.conf setup in Samba 3.0 (as was true for 2.2.x) only needs two settings: printing = cups and printcap @@ -8276,7 +8279,7 @@ Problems

An Overview of the CUPS Printing Proce details see man cupsd.conf and other CUPS-related documentation, like the wealth of documents on your CUPS server itself: http://localhost:631/documentation.html. - Linking of smbd with libcups.so + Linking of smbd with libcups.so Samba has a very special relationship to CUPS. The reason is: Samba can be compiled with CUPS library support. Most recent installations have this support enabled, and per default CUPS linking is compiled @@ -8313,7 +8316,7 @@ Problems

An Overview of the CUPS Printing Proce print command; other commands are lppause command, lpresume command, lpq command, lprm command, queuepause command and queue resume - command).

`Simple smb.conf Settings for CUPS`

+ command).

`Simple smb.conf Settings for CUPS`

To summarize, here is the simplest printing-related setup for smb.conf to enable basic CUPS support:

@@ -8348,7 +8351,7 @@ ProblemsAn Overview of the CUPS Printing Proce
 			printer is not a PostScript device, the print data stream is "binary",
 			sensible only for the target printer. Read on to learn which problem
 			this may cause and how to avoid it.
-

`More complex smb.conf Settings for +`

`More complex smb.conf Settings for CUPS`

Here is a slightly more complex printing-related setup for smb.conf. It enables general CUPS printing @@ -8399,13 +8402,13 @@ allowing access from three hosts. To prevent CUPS kicking in and taking over the print jobs for that share, we need to set printing = sysv and printcap = lpstat. -

`Advanced Configuration`

+

`Advanced Configuration`

Before we dive into all the configuration options, let's clarify a few points. Network printing needs to be organized and setup correctly. Often this is not done correctly. Legacy systems or small LANs in business environments often lack a clear design and good housekeeping. -

`Central spooling vs. "Peer-to-Peer" printing`

+

`Central spooling vs. "Peer-to-Peer" printing`

Many small office or home networks, as well as badly organized larger environments, allow each client a direct access to available network printers. Generally, this is a bad idea. It often blocks one client's @@ -8417,7 +8420,7 @@ is the usage of a "print server": it routes all jobs through one central system, which responds immediately, takes jobs from multiple concurrent clients at the same time and in turn transfers them to the printer(s) in the correct order. -

`CUPS/Samba as a "spooling-only" Print Server; "raw" printing +`

`CUPS/Samba as a "spooling-only" Print Server; "raw" printing with Vendor Drivers on Windows Clients`

Most traditionally configured Unix print servers acting on behalf of Samba's Windows clients represented a really simple setup. Their only @@ -8436,7 +8439,7 @@ sent in a format that is suitable for direct delivery to the printer. Clients need to run the vendor-provided drivers to do this. In this case CUPS will NOT do any print file format conversion work. -

`Driver Installation Methods on Windows Clients`

+

`Driver Installation Methods on Windows Clients`

The printer drivers on the Windows clients may be installed in two functionally different ways:

manually install the drivers locally on each client, @@ -8449,7 +8452,7 @@ first time they access the printer; with this method NT/2K/XP clients use the SPOOLSS/MS-RPC type printing calls.

The second method is recommended for use over the first. -

`Explicitly enable "raw" printing for +`

`Explicitly enable "raw" printing for application/octet-stream!`

If you use the first option (drivers are installed on the client side), there is one setting to take care of: CUPS needs to be told @@ -8498,7 +8501,7 @@ This is all you need to know to get the CUPS/Samba combo printing locally installed. If you are not interested in background information about more advanced CUPS/Samba printing, simply skip the remaining sections of this chapter. -

`Three familiar Methods for driver upload plus a new one`

+

`Three familiar Methods for driver upload plus a new one`

If you want to use the MS-RPC type printing, you must upload the drivers onto the Samba server first ([print$] share). For a discussion on how to deposit printer drivers on the @@ -8520,7 +8523,7 @@ utility.

cupsaddsmb is discussed in much detail further below. But we will first explore the CUPS filtering system and compare the Windows and UNIX printing architectures. -

`Using CUPS/Samba in an advanced Way -- intelligent printing +`

-

There are many more combinations named in mime.convs. However, you are not limited to use the ones pre-defined there. You can plug in any filter you like into the CUPS framework. It must meet, or must be made @@ -8901,7 +8904,7 @@ attribute

Printer

The string fr attribute

Printer

The job options

+

`pstoraster`

pstoraster is at the core of the CUPS filtering system. It is responsible for the first stage of the rasterization process. Its input is of MIME type application/vnd.cups-postscript; @@ -8948,9 +8951,9 @@ its output is application/vnd.cups-raster. This output format is not yet meant to be printable. Its aim is to serve as a general purpose input format for more specialized raster drivers, that are able to generate device-specific printer data. -

-

Figure 19.6. Postscript to intermediate Raster format

-

Originally PPDs were meant to be used for PostScript printers only. Here, they help to send device-specific commands and settings to the RIP which processes the jobfile. CUPS has extended this @@ -9283,7 +9286,7 @@ specific model supports):

stphoto2.ppd

newer Epson Stylus Photo printers

laserjet.ppd

all PCL printers. Further below is a discussion of several other driver/PPD-packages suitable fur use with CUPS. -

`Difference between cupsomatic/foomatic-rip and +`

`Difference between cupsomatic/foomatic-rip and native CUPS printing`

Native CUPS rasterization works in two steps.

@@ -9296,9 +9299,9 @@ quality filters for this step, some are Free Software, some are Shareware/Non-Free, some are proprietary.

Often this produces better quality (and has several more advantages) than other methods. -

-

Figure 19.10. cupsomatic/foomatic processing versus Native CUPS

-

+

+Figure 19.10. cupsomatic/foomatic processing versus Native CUPS + One other method is the cupsomatic/foomatic-rip way. Note that cupsomatic is not made by the CUPS developers. It is an independent contribution to printing development, @@ -9332,7 +9335,7 @@ installation: Therefore the printfile bypasses the "pstoraster" filter cupsomatic hands the rendered file directly to the CUPS backend. The flowchart above illustrates the difference between native CUPS rendering and the Foomatic/cupsomatic method. -

`Examples for filtering Chains`

+

`Examples for filtering Chains`

Here are a few examples of commonly occurring filtering chains to illustrate the workings of CUPS.

@@ -9382,7 +9385,7 @@ which transfers the job to the printers.

The resulting filter chain therefore is:

 pdftops --> pstops --> pstoraster --> rastertoepson --> usb
-

+

`From Windows Clients to an NT Print Server`

Windows clients printing to an NT-based print server have two options. They may

execute the driver locally and render the GDI output @@ -9453,7 +9456,7 @@ or
send the GDI output (EMF) to the server, where the driver is executed to render the printer specific output.

-

+

+Figure 19.12. Print Driver execution on the Server + However, there is something similar possible with CUPS. Read on... -

`Network Printing (Windows clients -- UNIX/Samba Print +`

`Network Printing (Windows clients -- UNIX/Samba Print Servers)`

`From Windows Clients to a CUPS/Samba Print Server`

+

`From Windows Clients to a CUPS/Samba Print Server`

Here is a simple recipe showing how you can take advantage of CUPS powerful features for the benefit of your Windows network printing clients: @@ -9511,9 +9514,9 @@ other print commands are set up, then printing will use the option automatically passing through (if you want your own defined print commands to work with a Samba that has CUPS support compiled in, simply use printing = sysv). -

-

Figure 19.13. Printing via CUPS/samba server

-

`Samba receiving Jobfiles and passing them to CUPS`

+

+Figure 19.13. Printing via CUPS/samba server +

`Samba receiving Jobfiles and passing them to CUPS`

Samba must use its own spool directory (it is set by a line similar to path = /var/spool/samba, in the [printers] or @@ -9531,7 +9534,7 @@ A Windows user authenticates only to Samba (by whatever means is configured). If Samba runs on the same host as CUPS, you only need to allow "localhost" to print. If they run on different machines, you need to make sure the Samba host gets access to printing on CUPS. -

`Network PostScript RIP: CUPS Filters on Server -- clients use +`

`Network PostScript RIP: CUPS Filters on Server -- clients use PostScript Driver with CUPS-PPDs`

PPDs can control all print device options. They are usually provided by the manufacturer; if you own a PostScript printer, that is. PPD @@ -9551,7 +9554,7 @@ or see if you have lphelp on your system). There are also some different GUI frontends on Linux/UNIX, which can present PPD options to users. PPD options are normally meant to be evaluated by the PostScript RIP on the real PostScript printer. -

`PPDs for non-PS Printers on UNIX`

+

`PPDs for non-PS Printers on UNIX`

CUPS doesn't limit itself to "real" PostScript printers in its usage of PPDs. The CUPS developers have extended the scope of the PPD concept, to also describe available device and driver options for @@ -9568,7 +9571,7 @@ the supplied PostScript. Thus CUPS lets all its printers appear as PostScript devices to its clients, because it can act as a PostScript RIP for those printers, processing the received PostScript code into a proper raster print format. -

`PPDs for non-PS Printers on Windows`

+

`PPDs for non-PS Printers on Windows`

CUPS-PPDs can also be used on Windows-Clients, on top of a "core" PostScript driver (now recommended is the "CUPS PostScript Driver for WindowsNT/2K/XP"; you can also use the Adobe one, with @@ -9584,13 +9587,13 @@ which always remain unfiltered per definition;

enable clients to driver, even for many different target printers.

Using CUPS PPDs on Windows clients enables these to control all print job settings just as a UNIX client can do too. -

`Windows Terminal Servers (WTS) as CUPS Clients`

+

`Windows Terminal Servers (WTS) as CUPS Clients`

Printer Drivers running in "Kernel Mode" cause many + Printer Drivers running in "Kernel Mode" cause many Problems The reason is that in Win NT printer drivers run in "Kernel Mode", this introduces a high risk for the stability of the system @@ -9607,7 +9610,7 @@ might be because there have so far only been 2 different PostScript drivers the ones from Adobe and the one from Microsoft. Both are very well tested and are as stable as you ever can imagine on Windows. The CUPS driver is derived from the Microsoft one. - Workarounds impose Heavy Limitations + Workarounds impose Heavy Limitations In many cases, in an attempt to work around this problem, site administrators have resorted to restrict the allowed drivers installed on their WTS to one generic PCL- and one PostScript driver. This @@ -9615,7 +9618,7 @@ however restricts the clients in the amount of printer options available for them; often they can't get out more than simplex prints from one standard paper tray, while their devices could do much better, if driven by a different driver! ) - CUPS: a "Magical Stone"? + CUPS: a "Magical Stone"? Using a PostScript driver, enabled with a CUPS-PPD, seems to be a very elegant way to overcome all these shortcomings. There are, depending on the version of Windows OS you use, up to 3 different PostScript @@ -9627,7 +9630,7 @@ is a certain price for this too: a CUPS server acting as a PostScript RIP for its clients requires more CPU and RAM than when just acting as a "raw spooling" device. Plus, this setup is not yet widely tested, although the first feedbacks look very promising. - PostScript Drivers with no major problems -- even in Kernel + PostScript Drivers with no major problems -- even in Kernel Mode More recent printer drivers on W2K and XP don't run in Kernel mode (unlike Win NT) any more. However, both operating systems can still @@ -9644,14 +9647,14 @@ development efforts. This is what the CUPS people have done. The license doesn't allow them to publish the whole of the source code. However, they have released the "diff" under the GPL, and if you are owner of an "MS DDK for Win NT", you can check the driver yourself. - Setting up CUPS for driver Download + Setting up CUPS for driver Download As we have said before: all previously known methods to prepare client printer drivers on the Samba server for download and "Point'n'Print" convenience of Windows workstations are working with CUPS too. These methods were described in the previous chapter. In reality, this is a pure Samba business, and only relates to the Samba/Win client relationship. - cupsaddsmb: the unknown Utility + cupsaddsmb: the unknown Utility The cupsaddsmb utility (shipped with all current CUPS versions) is an alternative method to transfer printer drivers into the Samba [print$] share. Remember, this share is where @@ -9676,7 +9679,7 @@ job-billing) However, currently only Windows NT, 2000, and XP are supported by the CUPS drivers. You will need to get the respective part of Adobe driver too if you need to support Windows 95, 98, and ME clients. - Prepare your smb.conf for + Prepare your smb.conf for cupsaddsmb Prior to running cupsaddsmb, you need the following settings in smb.conf: @@ -9705,7 +9708,7 @@ Prior to running cupsaddsmb, you need the following settings in read only = yes write list = root - CUPS Package of "PostScript Driver for WinNT/2k/XP" + CUPS Package of "PostScript Driver for WinNT/2k/XP" CUPS users may get the exactly same packages fromhttp://www.cups.org/software.html. It is a separate package from the CUPS base software files, tagged as CUPS 1.1.x Windows NT/2k/XP Printer Driver for SAMBA @@ -9776,7 +9779,7 @@ Studio 6. Driver developers are not allowed to distribute the whole of the source code as Free Software. However, CUPS developers released the "diff" in source code under the GPL, so anybody with a license of Visual Studio and a DDK will be able to compile for him/herself. - Recognize the different Driver Files + Recognize the different Driver Files The CUPS drivers don't support the "older" Windows 95/98/ME, but only the Windows NT/2000/XP client: @@ -9811,7 +9814,7 @@ support of WinNT/2k/XP are present in , the Adobe ones will be ignored and the CUPS ones will be used. If you prefer -- for whatever reason -- to use Adobe-only drivers, move away the 3 CUPS driver files. The Win95/98/ME clients use the Adobe drivers in any case. - Acquiring the Adobe Driver Files + Acquiring the Adobe Driver Files Acquiring the Adobe driver files seems to be unexpectedly difficult for many users. They are not available on the Adobe website as single files and the self-extracting and/or self-installing Windows-exe is @@ -9824,7 +9827,7 @@ Generic PostScript printer. After this, the client's where you can get them with smbclient from the CUPS host. A more detailed description about this is in the next (the CUPS printing) chapter. - ESP Print Pro Package of "PostScript Driver for + ESP Print Pro Package of "PostScript Driver for WinNT/2k/XP" Users of the ESP Print Pro software are able to install their "Samba Drivers" package for this purpose with no problem. Retrieve the driver @@ -9840,7 +9843,7 @@ driver files; i.e. mainly setup the [print$] share, etc. The ESP Print Pro package includes the CUPS driver files as well as a (licensed) set of Adobe drivers for the Windows 95/98/ME client family. - Caveats to be considered + Caveats to be considered Once you have run the install script (and possibly manually moved the cups.hlp file to /usr/share/cups/drivers/), the driver is @@ -9860,8 +9863,8 @@ working in an environment where everything is configured for Once the driver files are in the [print$] share and are initialized, they are ready to be downloaded and installed by the Win NT/2k/XP clients. - Note - + Note + Win 9x/ME clients won't work with the CUPS PostScript driver. For these you'd still need to use the ADOBE*.* drivers as previously. @@ -9896,8 +9899,8 @@ as described elsewhere in the "Samba HOWTO Collection": either change a driver for an existing printer by running the "Printer Properties" dialog, or use rpcclient with the setdriver sub-command. - - What are the Benefits of using the "CUPS PostScript Driver for + + What are the Benefits of using the "CUPS PostScript Driver for Windows NT/2k/XP" as compared to the Adobe Driver? You are interested in a comparison between the CUPS and the Adobe PostScript drivers? For our purposes these are the most important @@ -9943,7 +9946,7 @@ not disturb any other applications as they will regard it as a comment and simply ignore it). the CUPS PostScript driver will be the heart of the fully fledged CUPS IPP client for Windows NT/2K/XP to be released soon (probably alongside the first Beta release for CUPS -1.2). Run "cupsaddsmb" (quiet Mode) +1.2). Run "cupsaddsmb" (quiet Mode) The cupsaddsmb command copies the needed files into your [print$] share. Additionally, the PPD associated with this printer is copied from @@ -9973,7 +9976,7 @@ To share all printers and drivers, use th -a parameter instead of a printer name. Since cupsaddsmb "exports" the printer drivers to Samba, it should be obvious that it only works for queues with a CUPS driver associated. - Run "cupsaddsmb" with verbose Output + Run "cupsaddsmb" with verbose Output Probably you want to see what's going on. Use the -v parameter to get a more verbose output. The output below was edited for better readability: all "\" at the end of @@ -10058,7 +10061,7 @@ you'll discover error messages like NT_STATUS_OBJECT_NAME_COLLISION in between. They occur, because the directories WIN40 and W32X86 already existed in the [print$] driver download share (from a previous driver installation). They are harmless here. - Understanding cupsaddsmb + Understanding cupsaddsmb What has happened? What did cupsaddsmb do? There are five stages of the procedure call the CUPS server via IPP and request the @@ -10081,7 +10084,7 @@ same host): # cupsaddsmb -H sambaserver -h cupsserver -v printername - How to recognize if cupsaddsm completed successfully + How to recognize if cupsaddsm completed successfully You must always check if the utility completed successfully in all fields. You need as a minimum these 3 messages amongst the output: @@ -10102,7 +10105,7 @@ It is impossible to see any diagnostic output if you don't run cupsaddsmb in verbose mode. Therefore we strongly recommend to not use the default quiet mode. It will hide any problems from you which might occur. - cupsaddsmb with a Samba PDC + cupsaddsmb with a Samba PDC You can't get the standard cupsaddsmb command to run on a Samba PDC? You are asked for the password credential all over again and again and the command just will not take off at all? Try one of these @@ -10116,13 +10119,13 @@ variations: (Note the two backslashes: the first one is required to "escape" the second one). - cupsaddsmb Flowchart + cupsaddsmb Flowchart Here is a chart about the procedures, commandflows and dataflows of the "cupaddsmb" command. Note again: cupsaddsmb is not intended to, and does not work with, "raw" queues! - - Figure 19.14. cupsaddsmb flowchart - Installing the PostScript Driver on a Client + +Figure 19.14. cupsaddsmb flowchart + Installing the PostScript Driver on a Client After cupsaddsmb completed, your driver is prepared for the clients to use. Here are the steps you must perform to download and install it via "Point'n'Print". From a Windows client, browse to the CUPS/Samba @@ -10158,7 +10161,7 @@ functions. (Note that user "ntadmin" needs to be a valid Samba user with the required privileges to access the printershare) This would set up the printer connection in the traditional LanMan way (not using MS-RPC). - Avoiding critical PostScript Driver Settings on the + Avoiding critical PostScript Driver Settings on the Client Soooo: printing works, but there are still problems. Most jobs print well, some don't print at all. Some jobs have problems with fonts, @@ -10184,7 +10187,7 @@ get a printout at all) (Adobe) Sometimes you can choose : in case of problems try 2 instead of 3 (the latest ESP Ghostscript package handles Level 3 PostScript very well) (Adobe). Say Yes to PostScript -Error Handler (Adobe) Installing PostScript Driver Files manually (using +Error Handler (Adobe) Installing PostScript Driver Files manually (using rpcclient) Of course you can run all the commands which are embedded into the cupsaddsmb convenience utility yourself, one by one, and hereby upload @@ -10205,7 +10208,7 @@ the MS-RPC protocol. You can use it to query (and command) a Win NT (or 2K/XP) PC too. MS-RPC is used by Windows clients, amongst other things, to benefit from the "Point'n'Print" features. Samba can now mimic this too. - A Check of the rpcclient man Page + A Check of the rpcclient man Page First let's have a little check of the rpcclient man page. Here are two relevant passages: @@ -10238,7 +10241,7 @@ printer driver associated with an installed printer. The printer driver must already be correctly installed on the print server. See also the enumprinters and enumdrivers commands for obtaining a list of installed printers and drivers. - Understanding the rpcclient man Page + Understanding the rpcclient man Page The exact format isn't made too clear by the man page, since you have to deal with some parameters containing spaces. Here is a better description for it. We have line-broken the @@ -10274,7 +10277,7 @@ box now, and access it from a UNIX workstation. We will query it with rpcclient to see what it tells us and try to understand the man page more clearly which we've read just now. - Producing an Example by querying a Windows Box + Producing an Example by querying a Windows Box We could run rpcclient with a getdriver or a getprinter subcommand (in level 3 verbosity) against it. Just sit down at UNIX or @@ -10319,7 +10322,7 @@ Some printer drivers list additional files under the label ListOfFiles,Comma-separated. For the CUPS PostScript drivers we don't need any (nor would we for the Adobe PostScript driver): therefore the field will get a "NULL" entry. - What is required for adddriver and setdriver to succeed + What is required for adddriver and setdriver to succeed From the manpage (and from the quoted output of cupsaddsmb, above) it becomes clear that you need to have certain conditions in order to make the manual uploading @@ -10350,12 +10353,12 @@ rpcclient. A long-standing bug prevented a proper update of the printer list until every smbd process had received a SIGHUP or was restarted. Remember this in case you've created the CUPS printer just shortly ago and encounter problems: try restarting -Samba. Manual Commandline Driver Installation in 15 little Steps +Samba. Manual Commandline Driver Installation in 15 little Steps We are going to install a printer driver now by manually executing all required commands. As this may seem a rather complicated process at first, we go through the procedure step by step, explaining every single action item as it comes up. - First Step: Install the Printer on CUPS + First Step: Install the Printer on CUPS # lpadmin -p mysmbtstprn -v socket://10.160.51.131:9100 -E -P /home/kurt/canonIR85.ppd @@ -10364,7 +10367,7 @@ This installs printer with the name mysmbtstprn< to the CUPS system. The printer is accessed via a socket (a.k.a. JetDirect or Direct TCP/IP) connection. You need to be root for this step - Second Step (optional): Check if the Printer is recognized by + Second Step (optional): Check if the Printer is recognized by Samba # rpcclient -Uroot%xxxx -c 'enumprinters' localhost | grep -C2 mysmbtstprn @@ -10385,7 +10388,7 @@ already. You need to know root's Samba password (as set by the following steps. Alternatively you can authenticate as one of the users from the "write list" as defined in smb.conf for [print$]. - Third Step (optional): Check if Samba knows a Driver for the + Third Step (optional): Check if Samba knows a Driver for the Printer # rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost | grep driver @@ -10411,7 +10414,7 @@ This step was done for the purpose of demonstrating this condition. An attempt to connect to the printer at this stage will prompt the message along the lines: "The server has not the required printer driver installed". - Fourth Step: Put all required Driver Files into Samba's + Fourth Step: Put all required Driver Files into Samba's [print$] # smbclient //localhost/print\$ -U 'root%xxxx' \ @@ -10430,7 +10433,7 @@ present in the [print$] share. However, client would still not be able to install them, because Samba does not yet treat them as driver files. A client asking for the driver would still be presented with a "not installed here" message. - Fifth Step: Verify where the Driver Files are now + Fifth Step: Verify where the Driver Files are now # ls -l /etc/samba/drivers/W32X86/ total 669 @@ -10444,7 +10447,7 @@ be presented with a "not installed here" message. The driver files now are in the W32X86 architecture "root" of [print$]. - Sixth Step: Tell Samba that these are + Sixth Step: Tell Samba that these are Driver Files (adddriver) @@ -10465,7 +10468,7 @@ driver. It is normally a good idea to use the same name as is used for the printername; however, in big installations you may use this driver for a number of printers which have obviously different names. So the name of the driver is not fixed. - Seventh Step: Verify where the Driver Files are now + Seventh Step: Verify where the Driver Files are now # ls -l /etc/samba/drivers/W32X86/ total 1 @@ -10484,7 +10487,7 @@ name of the driver is not fixed. Notice how step 6 did also move the driver files to the appropriate subdirectory. Compare with the situation after step 5. - Eighth Step (optional): Verify if Samba now recognizes the + Eighth Step (optional): Verify if Samba now recognizes the Driver # rpcclient -Uroot%xxxx -c 'enumdrivers 3' localhost | grep -B2 -A5 mydrivername @@ -10501,7 +10504,7 @@ Driver

Remember, this command greps for the name you did choose for the driver in step Six. This command must succeed before you can proceed. -

`Ninth Step: Tell Samba which Printer should use these Driver +`

`Ninth Step: Tell Samba which Printer should use these Driver Files (setdriver)`

 
 #  rpcclient -Uroot%xxxx -c 'setdriver mysmbtstprn mydrivername' localhost
@@ -10515,7 +10518,7 @@ driver. You don't need to repeat all the previous steps for the
 setdriver command to succeed. The only pre-conditions are:
 enumdrivers must find the driver and
 enumprinters must find the printer.
-

`Tenth Step (optional): Verify if Samba has this Association +`

`Tenth Step (optional): Verify if Samba has this Association recognized`

 
 #  rpcclient -Uroot%xxxx -c 'getprinter mysmbtstprn 2' localhost | grep driver
@@ -10557,7 +10560,7 @@ Compare these results with the ones from steps 2 and 3. Note that
 every single of these commands show the driver is installed.  Even
 the enumprinters command now lists the driver
 on the "description" line.
-

`Eleventh Step (optional): Tickle the Driver into a correct +`

`Eleventh Step (optional): Tickle the Driver into a correct Device Mode`

You certainly know how to install the driver on the client. In case you are not particularly familiar with Windows, here is a short @@ -10582,7 +10585,7 @@ into the "DOS box" (type root's smbpassword when prompted): Change any printer setting once (like "portrait" --> "landscape"), click "Apply"; change the setting back. -

`Twelfth Step: Install the Printer on a Client +`

`Twelfth Step: Install the Printer on a Client ("Point'n'Print")`

 
  C:\> rundll32 printui.dll,PrintUIEntry /in /n "\\sambacupsserver\mysmbtstprn"
@@ -10590,24 +10593,24 @@ back.

If it doesn't work it could be a permission problem with the [print$] share. -

`Thirteenth Step (optional): Print a Test Page`

 
  C:\> rundll32 printui.dll,PrintUIEntry /p /n "\\sambacupsserver\mysmbtstprn"

Then hit [TAB] 5 times, [ENTER] twice, [TAB] once and [ENTER] again and march to the printer. -

`Fourteenth Step (recommended): Study the Test Page`

+

`Fourteenth Step (recommended): Study the Test Page`

`Fifteenth Step (obligatory): Enjoy. Jump. Celebrate your +`

`Fifteenth Step (obligatory): Enjoy. Jump. Celebrate your Success`

 
 # echo "Cheeeeerioooooo! Success..." >> /var/log/samba/log.smbd     
 
-

`CUPS Print Drivers from Linuxprinting.org`

CUPS ships with good support for HP LaserJet type printers. You can install the generic driver as follows:

@@ -10765,7 +10768,7 @@ not work with PPDs generated for the old cupsomatic. The new-style
 PPDs are 100% compliant to the Adobe PPD specification. They are
 intended to be used by Samba and the cupsaddsmb utility also, to
 provide the driver files for the Windows clients also!
-

This all has changed in Foomatic versions 2.9 (Beta) and released as "stable" 3.0. This has now achieved the convergence of all *omatic @@ -10900,7 +10903,7 @@ sizes for many printers; and it will support printing on media drawn from different paper trays within the same job (in both cases: even where there is no support for this from Windows-based vendor printer drivers). -

`Driver Development outside`

+

`Driver Development outside`

Most driver development itself does not happen within Linuxprinting.org. Drivers are written by independent maintainers. Linuxprinting.org just pools all the information, and stores it in its @@ -10923,7 +10926,7 @@ effort, started by Michael Sweet (also lead developer for CUPS), now directed by Robert Krawitz, which has achieved an amazing level of photo print quality (many Epson users swear that its quality is better than the vendor drivers provided by Epson for the Microsoft -platforms). This currently supports 522 models.

`Forums, Downloads, Tutorials, Howtos -- also for Mac OS X and +platforms). This currently supports 522 models.`

`Forums, Downloads, Tutorials, Howtos -- also for Mac OS X and commercial Unix`

Printer name
User name
Job ID
Time of printing
the page number
the number of copies
a billing information string @@ -11149,7 +11152,7 @@ This was job ID "401", printed on "infotec_IS2027" by user & from IP address 10.160.50.13. The next job had ID "402", was sent by user "boss" from IP address 10.160.51.33,printed from one page 440 copies and is set to be billed to "finance-dep". -

`Possible Shortcomings`

+

`Possible Shortcomings`

What flaws or shortcomings are there with this quota system?

the ones named above (wrongly logged job in case of printer hardware failure, etc.)
in reality, CUPS counts the job pages that are being @@ -11163,7 +11166,7 @@ groups
no means to read out the current balance or the "used-up" number of current quota
a user having used up 99 sheets of 100 quota will still be able to send and print a 1,000 sheet job
a user being denied a job because of a filled-up quota doesn't get a meaningful error message from CUPS other than -"client-error-not-possible".

`Future Developments`

+"client-error-not-possible".

`Future Developments`

This is the best system currently available, and there are huge improvements under development for CUPS 1.2:

page counting will go into the "backends" (these talk @@ -11171,9 +11174,9 @@ directly to the printer and will increase the count in sync with the actual printing process: thus a jam at the 5th sheet will lead to a stop in the counting)
quotas will be handled more flexibly
probably there will be support for users to inquire their "accounts" in advance
probably there will be support for some other tools -around this topic

`Pre-conditions`

+

`Pre-conditions`

For everything to work as announced, you need to have three things:

a Samba-smbd which is compiled against "libcups" (Check @@ -11295,15 +11298,15 @@ In this case all other manually set printing-related commands (like "print command", "lpq command", "lprm command", "lppause command" or "lpresume command") are ignored and they should normally have no influence what-so-ever on your printing. -

`Where to find Help`

+

`Where to find Help`

[TO BE DONE] -

`Appendix`

`Printing from CUPS to Windows attached +`

`Appendix`

`Printing from CUPS to Windows attached Printers`

From time to time the question arises, how you can print to a Windows attached printer @@ -11413,7 +11416,7 @@ doesn't require a password! Printing will only work if you have a working netbios name resolution up and running. Note that this is a feature of CUPS and you don't necessarily need to have smbd running (but who wants that? :-). -

`More CUPS filtering Chains`

+

`More CUPS filtering Chains`

The following diagrams reveal how CUPS handles print jobs.

 #########################################################################
@@ -11704,7 +11707,7 @@ The following diagrams reveal how CUPS handles print jobs.
 #       CUPS and ESP PrintPro plug-in where rastertosomething is noted.
 #
 ##########################################################################
-

`Trouble Shooting Guidelines to fix typical Samba printing +`

`Trouble Shooting Guidelines to fix typical Samba printing Problems`

This is a short description of how to debug printing problems with Samba. This describes how to debug problems with printing from @@ -11817,35 +11820,35 @@ three dialogs look the same. Only one of does what you intend. You need to be Administrator or Print Administrator to do this for all users. Here is how I do in on XP: -

The first "wrong" way: +
1. The first "wrong" way: - Open the Printers + Open the Printers folder. Right-click on the printer (remoteprinter on cupshost) and select in context menu Printing Preferences... Look at this dialog closely and remember what it looks -like. - The second "wrong" way: +like. +
2. The second "wrong" way: - Open the Printers + Open the Printers folder. Right-click on the printer (remoteprinter on cupshost) and select in the context menu Properties Click on the General tab Click on the button Printing Preferences... A new dialog opens. Keep this dialog open and go back -to the parent dialog. - The third, the "correct" way: (should you do +to the parent dialog. +
3. The third, the "correct" way: (should you do this from the beginning, just carry out steps 1. and 2. from second "way" above) - Click on the Advanced + Click on the Advanced tab. (Hmmm... if everything is "Grayed Out", then you are not logged in as a user with enough privileges). Click on the Printing Defaults... button. On any of the two new tabs, click on the Advanced... button. A new dialog opens. Compare this one to the other, -identical looking one from "B.5" or A.3". - +identical looking one from "B.5" or A.3".
+

Do you see any difference? I don't either... However, only the last one, which you arrived at with steps "C.1.-6." will save any settings permanently and be the defaults for new users. If you want all clients @@ -11928,43 +11931,43 @@ Windows box with a shared PostScript printer: smbclient W32X86/2 subdir to mget ADOBE* and other files or to WIN40/0 to do the same. -- Another option is to download the *.exe packaged -files from the Adobe website.

`An Overview of the CUPS Printing Processes`

-

Figure 19.15. CUPS Printing Overview

-

`Chapter 20. Stackable VFS modules`

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

`John H. Terpstra`

Samba Team <jht@samba.org>

`Tim Potter`

`Simo Sorce`

original vfs_skel README

`Alexander Bokovoy`

original vfs_netatalk docs

`Stefan Metzmacher`

Update for multiple modules

Table of Contents

VFS modules available elsewhere

Discussion

Included modules

audit
extd_audit
fake_perms
recycle
netatalk

DatabaseFS
vscan

`Features and Benefits`

+files from the Adobe website.

`An Overview of the CUPS Printing Processes`

+Figure 19.15. CUPS Printing Overview +

`Chapter 20. Stackable VFS modules`

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

`John H. Terpstra`

Samba Team <jht@samba.org>

`Tim Potter`

`Simo Sorce`

original vfs_skel README

`Alexander Bokovoy`

original vfs_netatalk docs

`Stefan Metzmacher`

Update for multiple modules

Table of Contents

VFS modules available elsewhere

Discussion

Included modules

audit
extd_audit
fake_perms
recycle
netatalk

DatabaseFS
vscan

`Features and Benefits`

Since Samba-3, there is support for stackable VFS(Virtual File System) modules. Samba passes each request to access the unix file system thru the loaded VFS modules. This chapter covers all the modules that come with the samba source and references to some external modules. -

`Discussion`

+

`Discussion`

If not supplied with your platform distribution binary Samba package you may have problems to compile these modules, as shared libraries are compiled and linked in different ways on different systems. They currently have been tested against GNU/Linux and IRIX. -

+

To use the VFS modules, create a share similar to the one below. The important parameter is the vfs objects parameter where you can list one or more VFS modules by name. For example, to log all access to files and put deleted files in a recycle bin: - + [audit] comment = Audited /data directory path = /data vfs objects = audit recycle writeable = yes browseable = yes - - + + The modules are used in the order in which they are specified. Samba will attempt to load modules from the lib directory in the root directory of the samba installation (usually /usr/lib/samba/vfs or /usr/local/samba/lib/vfs ). - + Some modules can be used twice for the same share. This can be done using a configuration similar to the one below. - + [test] comment = VFS TEST path = /data @@ -11974,12 +11977,12 @@ This can be done using a configuration similar to the one below. example1: parameter = 1 example: parameter = 5 test: parameter = 7 - -

`Included modules`

`audit`

+ +

`Included modules`

`audit`

A simple module to audit file access to the syslog facility. The following operations are logged: - share connect/disconnect directory opens/create/remove file open/close/rename/unlink/chmod -

`extd_audit`

+ share connect/disconnect directory opens/create/remove file open/close/rename/unlink/chmod +

`extd_audit`

This module is identical with the audit module above except that it sends audit logs to both syslog as well as the smbd log file/s. The loglevel for this module is set in the smb.conf file. @@ -11987,23 +11990,23 @@ This can be done using a configuration similar to the one below. The logging information that will be written to the smbd log file is controlled by the log level parameter in smb.conf. The following information will be recorded: -

Table 20.1. Extended Auditing Log Information Log Level Log Details - File and Directory Operations 0 Creation / Deletion 1 Create / Delete / Rename / Permission Changes 2 Create / Delete / Rename / Perm Change / Open / Close

`fake_perms`

+

`fake_perms`

This module was created to allow Roaming Profile files and directories to be set (on the Samba server under Unix) as read only. This module will if installed on the Profiles share will report to the client that the Profile files and directories are writable. This satisfies the client even though the files will never be overwritten as the client logs out or shuts down. -

`recycle`

+

`recycle`

A recycle-bin like module. When used any unlink call will be intercepted and files moved to the recycle directory instead of being deleted. -

Supported options: -

recycle:repository: FIXME
recycle:keeptree: FIXME
recycle:versions: FIXME
recycle:touch: FIXME
recycle:maxsize: FIXME
recycle:exclude: FIXME
recycle:exclude_dir: FIXME
recycle:noversions: FIXME

`DatabaseFS`

URL: http://www.css.tayloru.edu/~elorimer/databasefs/index.php

By Eric Lorimer.

I have created a VFS module which implements a fairly complete read-only @@ -12026,15 +12029,15 @@ should be implied due to its presence here. Any feedback would be appreciated: comments, suggestions, patches, etc... If nothing else, hopefully it might prove useful for someone else who wishes to create a virtual filesystem. -

`vscan`

URL: http://www.openantivirus.org/

+

`vscan`

URL: http://www.openantivirus.org/

samba-vscan is a proof-of-concept module for Samba, which uses the VFS (virtual file system) features of Samba 2.2.x/3.0 alphaX. Of course, Samba has to be compiled with VFS support. samba-vscan supports various virus scanners and is maintained by Rainer Link. -

`Common Errors`

+

`Common Errors`

There must be some gotchas we should record here! Jelmer??? -

`Chapter 21. Integrated Logon Support using Winbind`

`Tim Potter`

Samba Team <tpot@linuxcare.com.au>

`Andrew Tridgell`

Samba Team <tridge@samba.org>

`Naag Mummaneni`

<getnag@rediffmail.com>

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

`John H. Terpstra`

Samba Team <jht@samba.org>

27 June 2002

Table of Contents

What Winbind Provides

Target Uses

How Winbind Works

Microsoft Remote Procedure Calls
Microsoft Active Directory Services
Name Service Switch
Pluggable Authentication Modules
User and Group ID Allocation
Result Caching

Installation and Configuration

Introduction
Requirements
Testing Things Out

Conclusion

`Features and Benefits`

Integration of UNIX and Microsoft Windows NT through +

`Chapter 21. Integrated Logon Support using Winbind`

`Tim Potter`

Samba Team <tpot@samba.org>

`Andrew Tridgell`

Samba Team <tridge@samba.org>

`Naag Mummaneni`

<getnag@rediffmail.com>

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

`John H. Terpstra`

Samba Team <jht@samba.org>

27 June 2002

Table of Contents

What Winbind Provides

Target Uses

How Winbind Works

Microsoft Remote Procedure Calls
Microsoft Active Directory Services
Name Service Switch
Pluggable Authentication Modules
User and Group ID Allocation
Result Caching

Installation and Configuration

Introduction
Requirements
Testing Things Out

Conclusion

`Features and Benefits`

Integration of UNIX and Microsoft Windows NT through a unified logon has been considered a "holy grail" in heterogeneous computing environments for a long time. We present winbind, a component of the Samba suite @@ -12044,7 +12047,7 @@ There must be some gotchas we should record here! Jelmer??? Service Switch to allow Windows NT domain users to appear and operate as UNIX users on a UNIX machine. This paper describes the winbind system, explaining the functionality it provides, how it is configured, - and how it works internally.

`Introduction`

It is well known that UNIX and Microsoft Windows NT have + and how it works internally.

`Introduction`

It is well known that UNIX and Microsoft Windows NT have different models for representing user and group information and use different technologies for implementing them. This fact has made it difficult to integrate the two systems in a satisfactory @@ -12065,7 +12068,7 @@ There must be some gotchas we should record here! Jelmer??? tasks for the system administrator when maintaining users and groups on either system. The winbind system provides a simple and elegant solution to all three components of the unified logon - problem.

`What Winbind Provides`

Winbind unifies UNIX and Windows NT account management by + problem.

`What Winbind Provides`

Winbind unifies UNIX and Windows NT account management by allowing a UNIX box to become a full member of a NT domain. Once this is done the UNIX box will see NT users and groups as if they were native UNIX users and groups, allowing the NT domain @@ -12089,7 +12092,7 @@ There must be some gotchas we should record here! Jelmer??? to provide authentication via a NT domain to any PAM enabled applications. This capability solves the problem of synchronizing passwords between systems since all passwords are stored in a single - location (on the domain controller).

`Target Uses`

Winbind is targeted at organizations that have an + location (on the domain controller).

`Target Uses`

Winbind is targeted at organizations that have an existing NT based domain infrastructure into which they wish to put UNIX workstations or servers. Winbind will allow these organizations to deploy UNIX workstations without having to @@ -12099,12 +12102,12 @@ There must be some gotchas we should record here! Jelmer??? be used is as a central part of UNIX based appliances. Appliances that provide file and print services to Microsoft based networks will be able to use Winbind to provide seamless integration of - the appliance into the domain.

`How Winbind Works`

The winbind system is designed around a client/server + the appliance into the domain.

`How Winbind Works`

The winbind system is designed around a client/server architecture. A long running winbindd daemon listens on a UNIX domain socket waiting for requests to arrive. These requests are generated by the NSS and PAM clients and processed sequentially.

The technologies used to implement winbind are described - in detail below.

`Microsoft Remote Procedure Calls`

Over the last few years, efforts have been underway + in detail below.

`Microsoft Remote Procedure Calls`

Over the last few years, efforts have been underway by various Samba Team members to decode various aspects of the Microsoft Remote Procedure Call (MSRPC) system. This system is used for most network related operations between @@ -12117,7 +12120,7 @@ There must be some gotchas we should record here! Jelmer??? users or groups. Other MSRPC calls can be used to authenticate NT domain users and to change user passwords. By directly querying a Windows PDC for user and group information, winbind maps the - NT account information onto UNIX user and group names.

`Microsoft Active Directory Services`

+ NT account information onto UNIX user and group names.

`Microsoft Active Directory Services`

Since late 2001, Samba has gained the ability to interact with Microsoft Windows 2000 using its 'Native Mode' protocols, rather than the NT4 RPC services. @@ -12126,7 +12129,7 @@ There must be some gotchas we should record here! Jelmer??? same way as a Win2k client would, and in so doing provide a much more efficient and effective winbind implementation. -

`Name Service Switch`

The Name Service Switch, or NSS, is a feature that is +

`Name Service Switch`

The Name Service Switch, or NSS, is a feature that is present in many UNIX operating systems. It allows system information such as hostnames, mail aliases and user information to be resolved from different sources. For example, a standalone @@ -12163,7 +12166,7 @@ passwd: files example is to put libnss_winbind.so in /lib/ then add "winbind" into /etc/nsswitch.conf at the appropriate place. The C library will then call Winbind to - resolve user and group names.

`Pluggable Authentication Modules`

Pluggable Authentication Modules, also known as PAM, + resolve user and group names.

`Pluggable Authentication Modules`

Pluggable Authentication Modules, also known as PAM, is a system for abstracting authentication and authorization technologies. With a PAM module it is possible to specify different authentication methods for different system applications without @@ -12188,7 +12191,7 @@ passwd: files example is copied to /lib/security/ and the PAM control files for relevant services are updated to allow authentication via winbind. See the PAM documentation - for more details.

`User and Group ID Allocation`

When a user or group is created under Windows NT + for more details.

`User and Group ID Allocation`

When a user or group is created under Windows NT is it allocated a numerical relative identifier (RID). This is slightly different to UNIX which has a range of numbers that are used to identify users, and the same range in which to identify @@ -12201,7 +12204,7 @@ passwd: files example time, winbind will have mapped all Windows NT users and groups to UNIX user ids and group ids.

The results of this mapping are stored persistently in an ID mapping database held in a tdb database). This ensures that - RIDs are mapped to UNIX IDs in a consistent way.

`Result Caching`

An active system can generate a lot of user and group + RIDs are mapped to UNIX IDs in a consistent way.

`Result Caching`

An active system can generate a lot of user and group name lookups. To reduce the network cost of these lookups winbind uses a caching scheme based on the SAM sequence number supplied by NT domain controllers. User or group information returned @@ -12212,14 +12215,14 @@ passwd: files example the PDC and compared against the sequence number of the cached entry. If the sequence numbers do not match, then the cached information is discarded and up to date information is requested directly - from the PDC.

`Installation and Configuration`

+ from the PDC.

`Installation and Configuration`

Many thanks to John Trostel jtrostel@snapserver.com for providing the HOWTO for this section.

The configuration and compilation of SAMBA is pretty straightforward. The first three steps may not be necessary depending upon whether or not you have previously built the Samba binaries. @@ -12297,15 +12300,15 @@ whether or not you have previously built the Samba binaries. This will, by default, install SAMBA in /usr/local/samba. See the main SAMBA documentation if you want to install SAMBA somewhere else. It will also build the winbindd executable and libraries. -

`Configure nsswitch.conf and the +`

`Configure nsswitch.conf and the winbind libraries on Linux and Solaris`

The libraries needed to run the winbindd daemon through nsswitch need to be copied to their proper locations, so -

-

+

+ root# cp ../samba/source/nsswitch/libnss_winbind.so /lib
-

-

+

+ I also found it necessary to make the following symbolic link: root# ln -s /lib/libnss_winbind.so /lib/libnss_winbind.so.2 @@ -12332,7 +12335,7 @@ is faster (and you don't need to reboot) if you do it manually: This makes libnss_winbind available to winbindd and echos back a check to you. -

`NSS Winbind on AIX`

(This section is only for those running AIX)

+

`NSS Winbind on AIX`

(This section is only for those running AIX)

Eventually, you will want to modify your smb startup script to automatically invoke the winbindd daemon when the other parts of SAMBA start, but it is possible to test out just the winbind @@ -12457,7 +12460,7 @@ directories and default shells. The same thing can be done for groups with the command

root# getent group -

`Fix the init.d startup scripts`

`Linux`

+

`Fix the init.d startup scripts`

`Linux`

The winbindd daemon needs to start up after the smbd and nmbd daemons are running. To accomplish this task, you need to modify the startup scripts of your system. @@ -12488,18 +12491,18 @@ start() { touch /var/lock/subsys/smb || RETVAL=1 return $RETVAL } -

If you would like to run winbindd in dual daemon mode, replace +If you would like to run winbindd in dual daemon mode, replace the line -

+         daemon /usr/local/samba/bin/winbindd
-

+

in the example above with: - + daemon /usr/local/samba/bin/winbindd -B - . - + . + The 'stop' function has a corresponding entry to shut down the services and looks like this: @@ -12523,7 +12526,7 @@ stop() { echo "" return $RETVAL } -

`Solaris`

Winbind doesn't work on Solaris 9, see the Portability chapter for details.

On Solaris, you need to modify the +

`Solaris`

Winbind doesn't work on Solaris 9, see the Portability chapter for details.

On Solaris, you need to modify the /etc/init.d/samba.server startup script. It usually only starts smbd and nmbd but should now start winbindd too. If you have samba installed in /usr/local/samba/bin, @@ -12575,22 +12578,22 @@ the file could contains something like this: echo "Usage: /etc/init.d/samba.server { start | stop }" ;; esac -

+ Again, if you would like to run samba in dual daemon mode, replace -

+ 	/usr/local/samba/bin/winbindd
-

+

in the script above with: - + /usr/local/samba/bin/winbindd -B - -

`Restarting`

+ +

`Restarting`

If you restart the smbd, nmbd, and winbindd daemons at this point, you should be able to connect to the samba server as a domain member just as if you were a local user. -

`Configure Winbind and PAM`

+

`Configure Winbind and PAM`

If you have made it this far, you know that winbindd and samba are working together. If you want to use winbind to provide authentication for other services, keep reading. The pam configuration files need to be altered in @@ -12610,7 +12613,7 @@ your other pam security modules. On my RedHat system, this was the modules reside in /usr/lib/security.

root# cp ../samba/source/nsswitch/pam_winbind.so /lib/security -

`Linux/FreeBSD-specific PAM configuration`

+

`Linux/FreeBSD-specific PAM configuration`

The /etc/pam.d/samba file does not need to be changed. I just left this file as it was:

@@ -12666,14 +12669,14 @@ same way.  It now looks like this:
 	password   required     /lib/security/pam_stack.so service=system-auth
 	session    required     /lib/security/pam_stack.so service=system-auth
 	session    optional     /lib/security/pam_console.so
-

-In this case, I added the

auth sufficient /lib/security/pam_winbind.so

-lines as before, but also added the

required pam_securetty.so

+ +In this case, I added the

auth sufficient /lib/security/pam_winbind.so

+lines as before, but also added the required pam_securetty.so above it, to disallow root logins over the network. I also added a sufficient /lib/security/pam_unix.so use_first_pass line after the winbind.so line to get rid of annoying double prompts for passwords. -

`Solaris-specific configuration`

+

`Solaris-specific configuration`

The /etc/pam.conf needs to be changed. I changed this file so that my Domain users can logon both locally as well as telnet.The following are the changes that I made.You can customize the pam.conf file as per your requirements,but @@ -12745,12 +12748,12 @@ annoying double prompts for passwords.

Now restart your Samba and try connecting through your application that you configured in the pam.conf. -

`Conclusion`

The winbind system, through the use of the Name Service +

`Conclusion`

The winbind system, through the use of the Name Service Switch, Pluggable Authentication Modules, and appropriate Microsoft RPC calls have allowed us to provide seamless integration of Microsoft Windows NT domain users on a UNIX system. The result is a great reduction in the administrative - cost of running a mixed UNIX and NT network.

`Common Errors`

Winbind has a number of limitations in its current + cost of running a mixed UNIX and NT network.

`Common Errors`

Winbind has a number of limitations in its current released version that we hope to overcome in future releases:

Winbind is currently only available for the Linux, Solaris and IRIX operating systems, although ports to other operating @@ -12765,11 +12768,11 @@ configured in the pam.conf. containing this information is corrupted or destroyed.
Currently the winbind PAM module does not take into account possible workstation and logon time restrictions that may be been set for Windows NT users, this is - instead up to the PDC to enforce.

`Chapter 22. Advanced Network Management`

`John H. Terpstra`

Samba Team <jht@samba.org>

April 3 2003

Table of Contents

Remote Management from NoMachines.Com

Adding printers without user intervention

+ instead up to the PDC to enforce.

`Chapter 22. Advanced Network Management`

`John H. Terpstra`

Samba Team <jht@samba.org>

April 3 2003

Table of Contents

Remote Management from NoMachines.Com

Adding printers without user intervention

`Features and Benefits`

+

+ Answer provided: Check out the new offer from NoMachine, "NX" software: http://www.nomachine.com/. @@ -12886,7 +12889,7 @@ is the best tool in your network environment. NoMachine are encouraging and offering help to OSS/Free Software implementations for such a frontend too, even if it means competition to them (they have written to this effect even to the LTSP, KDE and GNOME developer mailing lists) -

`Network Logon Script Magic`

+

`Network Logon Script Magic`

This section needs work. Volunteer contributions most welcome. Please send your patches or updates to John Terpstra.

@@ -12898,10 +12901,10 @@ See examples directory genlogonntlogon subdirectories.

The following listings are from the genlogon directory. -

+

This is the genlogon.pl file: - + #!/usr/bin/perl # # genlogon.pl @@ -12973,28 +12976,28 @@ This is the genlogon.pl file: # All done! Close the output file. close LOGON; - - + + Those wishing to use more elaborate or capable logon processing system should check out the following sites: - http://www.craigelachie.org/rhacer/ntlogon http://www.kixtart.org http://support.microsoft.com/default.asp?scid=kb;en-us;189105 Adding printers without user intervention + http://www.craigelachie.org/rhacer/ntlogon http://www.kixtart.org http://support.microsoft.com/default.asp?scid=kb;en-us;189105 Adding printers without user intervention Printers may be added automatically during logon script processing through the use of: - + rundll32 printui.dll,PrintUIEntry /? - + See the documentation in the Microsoft knowledgebase article no: 189105. - Common Errors +

`Common Errors`

The information provided in this chapter has been reproduced from postings on the samba@samba.org mailing list. No implied endorsement or recommendation is offered. Administrators should conduct their own evaluation of alternatives and are encouraged to draw their own conclusions. -

`Chapter 23. System and Account Policies`

`John H. Terpstra`

Samba Team <jht@samba.org>

April 3 2003

Table of Contents

Creating and Managing System Policies

Windows 9x/Me Policies
Windows NT4 Style Policy Files
MS Windows 200x / XP Professional Policies

Managing Account/User Policies

Samba Editreg Toolset
Windows NT4/200x
Samba PDC

System Startup and Logon Processing Overview

Policy Does Not Work

+

`Chapter 23. System and Account Policies`

`John H. Terpstra`

Samba Team <jht@samba.org>

April 3 2003

Table of Contents

Creating and Managing System Policies

Windows 9x/Me Policies
Windows NT4 Style Policy Files
MS Windows 200x / XP Professional Policies

Managing Account/User Policies

Samba Editreg Toolset
Windows NT4/200x
Samba PDC

System Startup and Logon Processing Overview

Policy Does Not Work

This chapter summarises the current state of knowledge derived from personal practice and knowledge from samba mailing list subscribers. Before reproduction of posted information effort has been made to validate the information provided. Where additional information was uncovered through this validation it is provided also. -

`Features and Benefits`

+

`Features and Benefits`

When MS Windows NT3.5 was introduced the hot new topic was the ability to implement Group Policies for users and group. Then along came MS Windows NT4 and a few sites started to adopt this capability. How do we know that? By way of the number of "booboos" @@ -13015,7 +13018,7 @@ network client workstations.

A tool new to Samba-3 may become an important part of the future Samba Administrators' arsenal. The editreg tool is described in this document. -

`Creating and Managing System Policies`

+

`Creating and Managing System Policies`

Under MS Windows platforms, particularly those following the release of MS Windows NT4 and MS Windows 95) it is possible to create a type of file that would be placed in the NETLOGON share of a domain controller. As the client logs onto the network @@ -13050,7 +13053,7 @@ be read and understood. Try searching on the Microsoft web site for "Group

Instead of using the tool called The System Policy Editor, commonly called Poledit (from the executable name poledit.exe), GPOs are created and managed using a Microsoft Management Console (MMC) snap-in as follows:

@@ -13167,7 +13170,7 @@ here is incomplete - you are warned. The MS Windows 2000 Resource Kit contains a tool called gpolmig.exe. This tool can be used to migrate an NT4 NTConfig.POL file into a Windows 200x style GPO. Be VERY careful how you use this powerful tool. Please refer to the resource kit manuals for specific usage information. -

`Managing Account/User Policies`

+

`Managing Account/User Policies`

Policies can define a specific user's settings or the settings for a group of users. The resulting policy file contains the registry settings for all users, groups, and computers that will be using the policy file. Separate policy files for each user, group, or computer are not not necessary. @@ -13192,42 +13195,42 @@ In addition to user access controls that may be imposed or applied via system an in a manner that works in conjunction with user profiles, the user management environment under MS Windows NT4/200x/XP allows per domain as well as per user account restrictions to be applied. Common restrictions that are frequently used includes: -

-

Logon Hours

Password Aging

Permitted Logon from certain machines only

Account type (Local or Global)

User Rights

-

`Samba Editreg Toolset`

+

+Logon Hours Password Aging Permitted Logon from certain machines only Account type (Local or Global) User Rights +Samba Editreg Toolset Describe in detail the benefits of editreg and how to use it. - Windows NT4/200x + Windows NT4/200x The tools that may be used to configure these types of controls from the MS Windows environment are: The NT4 User Manager for domains, the NT4 System and Group Policy Editor, the registry editor (regedt32.exe). Under MS Windows 200x/XP this is done using the Microsoft Management Console (MMC) with appropriate "snap-ins", the registry editor, and potentially also the NT4 System and Group Policy Editor. - Samba PDC + Samba PDC With a Samba Domain Controller, the new tools for managing of user account and policy information includes: smbpasswd, pdbedit, net, rpcclient. The administrator should read the man pages for these tools and become familiar with their use. -

`System Startup and Logon Processing Overview`

+

`System Startup and Logon Processing Overview`

The following attempts to document the order of processing of system and user policies following a system reboot and as part of the user logon:

Network starts, then Remote Procedure Call System Service (RPCSS) and Multiple Universal Naming Convention Provider (MUP) start -
+
Where Active Directory is involved, an ordered list of Group Policy Objects (GPOs) is downloaded and applied. The list may include GPOs that: - Apply to the location of machines in a Directory Apply only when settings have changed Depend on configuration of scope of applicability: local, site, domain, organizational unit, etc. +Apply to the location of machines in a Directory Apply only when settings have changed Depend on configuration of scope of applicability: local, site, domain, organizational unit, etc. No desktop user interface is presented until the above have been processed. -
+
Execution of start-up scripts (hidden and synchronous by default).
A keyboard action to affect start of logon (Ctrl-Alt-Del).
User credentials are validated, User profile is loaded (depends on policy settings). -
+

An ordered list of User GPOs is obtained. The list contents depends on what is configured in respect of: - Is user a domain member, thus subject to particular policies Loopback enablement, and the state of the loopback policy (Merge or Replace) Location of the Active Directory itself Has the list of GPOs changed. No processing is needed if not changed. -

+Is user a domain member, thus subject to particular policies Loopback enablement, and the state of the loopback policy (Merge or Replace) Location of the Active Directory itself Has the list of GPOs changed. No processing is needed if not changed. +

User Policies are applied from Active Directory. Note: There are several types.
Logon scripts are run. New to Win2K and Active Directory, logon scripts may be obtained based on Group @@ -13236,10 +13239,10 @@ reboot and as part of the user logon:
The User Interface as determined from the GPOs is presented. Note: In a Samba domain (like and NT4 Domain) machine (system) policies are applied at start-up, User policies are applied at logon. -

`Common Errors`

+

`Common Errors`

Policy related problems can be very difficult to diagnose and even more difficult to rectify. The following collection demonstrates only basic issues. -

`Policy Does Not Work`

+

`Policy Does Not Work`

Question: We have created the config.pol file and put it in the NETLOGON share. It has made no difference to our Win XP Pro machines, they just don't see it. IT worked fine with Win 98 but does not work any longer since we upgraded to Win XP Pro. Any hints? @@ -13247,7 +13250,7 @@ work any longer since we upgraded to Win XP Pro. Any hints? ANSWER: Policy files are NOT portable between Windows 9x / Me and MS Windows NT4 / 200x / XP based platforms. You need to use the NT4 Group Policy Editor to create a file called NTConfig.POL so that it is in the correct format for your MS Windows XP Pro clients. -

`Chapter 24. Desktop Profile Management`

`John H. Terpstra`

Samba Team <jht@samba.org>

April 3 2003

Table of Contents

Creating/Managing Group Profiles

Roaming Profiles

Samba Configuration for Profile Handling
Windows Client Profile Configuration Information
Sharing Profiles between W9x/Me and NT4/200x/XP workstations
Profile Migration from Windows NT4/200x Server to Samba

Mandatory profiles

Default Profile for Windows Users

MS Windows 9x/Me
MS Windows NT4 Workstation
MS Windows 200x/XP

How does one set up roaming profiles for just one (or a few) user/s or group/s?
Can NOT use Roaming Profiles
Changing the default profile

`Features and Benefits`

+

`Chapter 24. Desktop Profile Management`

`John H. Terpstra`

Samba Team <jht@samba.org>

April 3 2003

Table of Contents

Creating/Managing Group Profiles

Roaming Profiles

Samba Configuration for Profile Handling
Windows Client Profile Configuration Information
Sharing Profiles between W9x/Me and NT4/200x/XP workstations
Profile Migration from Windows NT4/200x Server to Samba

Mandatory profiles

Default Profile for Windows Users

MS Windows 9x/Me
MS Windows NT4 Workstation
MS Windows 200x/XP

How does one set up roaming profiles for just one (or a few) user/s or group/s?
Can NOT use Roaming Profiles
Changing the default profile

`Features and Benefits`

Roaming Profiles are feared by some, hated by a few, loved by many, and a Godsend for some administrators.

@@ -13260,7 +13263,7 @@ problem to others. In particular, users of mobile computing tools, where often t be a sustained network connection, are often better served by purely Local Profiles. This chapter provides information to help the Samba administrator to deal with those situations also. -

`Roaming Profiles`

`Warning`

+

`Roaming Profiles`

`Warning`

Roaming profiles support is different for Win9x / Me and Windows NT4/200x.

Before discussing how to configure roaming profiles, it is useful to see how @@ -13273,23 +13276,23 @@ profiles are restricted to being stored in the user's home directory.

Windows NT4/200x clients send a NetSAMLogon RPC request, which contains many fields, including a separate field for the location of the user's profiles. -

`Samba Configuration for Profile Handling`

+

`Samba Configuration for Profile Handling`

This section documents how to configure Samba for MS Windows client profile support. -

`NT4/200x User Profiles`

+

`NT4/200x User Profiles`

To support Windows NT4/200x clients, in the [global] section of smb.conf set the following (for example): -

-

+

+ 	logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath
-

+

This is typically implemented like: - + logon path = \\%L\Profiles\%u - + where %L translates to the name of the Samba server and %u translates to the user name - + The default for this option is \\%N\%U\profile, namely \\sambaserver\username\profile. The \\N%\%U service is created automatically by the [homes] service. If you are using @@ -13300,7 +13303,7 @@ semantics of %L and %N, as well as %U and %u. MS Windows NT/2K clients at times do not disconnect a connection to a server between logons. It is recommended to NOT use the homes meta-service name as part of the profile share path. -

`Windows 9x / Me User Profiles`

+

`Windows 9x / Me User Profiles`

To support Windows 9x / Me clients, you must use the logon home parameter. Samba has now been fixed so that net use /home now works as well, and it, too, relies on the logon home parameter. @@ -13318,28 +13321,28 @@ Not only that, but net use /home will also wor Windows 9x / Me. It removes any directory stuff off the end of the home directory area and only uses the server and share portion. That is, it looks like you specified \\%L\%U for logon home. -

`Mixed Windows 9x / Me and Windows NT4/200x User Profiles`

+

`Mixed Windows 9x / Me and Windows NT4/200x User Profiles`

You can support profiles for both Win9X and WinNT clients by setting both the logon home and logon path parameters. For example:

 	logon home = \\%L\%u\.profiles
 	logon path = \\%L\profiles\%u
-

`Disabling Roaming Profile Support`

+

`Disabling Roaming Profile Support`

A question often asked is “How may I enforce use of local profiles?” or “How do I disable Roaming Profiles?”

There are three ways of doing this: -

In smb.conf

+

In smb.conf

Affect the following settings and ALL clients will be forced to use a local profile: - + logon home = logon path = - -

MS Windows Registry:

+ +

MS Windows Registry:

By using the Microsoft Management Console gpedit.msc to instruct your MS Windows XP machine to use only a local profile. This of course modifies registry settings. The full path to the option is: - + Local Computer Policy\ Computer Configuration\ Administrative Templates\ @@ -13348,8 +13351,8 @@ There are three ways of doing this: Disable: Only Allow Local User Profiles Disable: Prevent Roaming Profile Change from Propagating to the Server - -

Change of Profile Type:

+ +

Change of Profile Type:

From the start menu right click on the My Computer icon, select Properties, click on the User Profiles tab, select the profile you wish to change from Roaming type to Local, click Change Type. @@ -13361,7 +13364,7 @@ profiles. The specifics of how to convert a local profile to a roaming profile, or a roaming profile to a local one vary according to the version of MS Windows you are running. Consult the Microsoft MS Windows Resource Kit for your version of Windows for specific information. -

`Windows Client Profile Configuration Information`

`Windows 9x / Me Profile Setup`

+

`Windows Client Profile Configuration Information`

`Windows 9x / Me Profile Setup`

When a user first logs in on Windows 9X, the file user.DAT is created, as are folders Start Menu, Desktop, Programs and Nethood. @@ -13467,7 +13470,7 @@ If you have access to an Windows NT4/200x server, then first set up roaming prof and / or netlogons on the Windows NT4/200x server. Make a packet trace, or examine the example packet traces provided with Windows NT4/200x server, and see what the differences are with the equivalent samba trace. -

`Windows NT4 Workstation`

+

`Windows NT4 Workstation`

When a user first logs in to a Windows NT Workstation, the profile NTuser.DAT is created. The profile location can be now specified through the logon path parameter. @@ -13496,7 +13499,7 @@ turns a profile into a mandatory one.

The case of the profile is significant. The file must be called NTuser.DAT or, for a mandatory profile, NTuser.MAN. -

`Windows 2000/XP Professional`

+

`Windows 2000/XP Professional`

You must first convert the profile from a local profile to a domain profile on the MS Windows workstation as follows:

@@ -13546,7 +13549,7 @@ On the XP workstation log in with an Administrator account.
Click: Start, Run
Type: mmc
Click: OK
A Microsoft Management Console should appear.
Click: File, Add/Remove Snap-in..., Add
Double-Click: Group Policy
Click: Finish, Close
Click: OK
In the "Console Root" window:
Expand: Local Computer Policy, Computer Configuration, Administrative Templates, System, User Profiles
Double-Click: Do not check for user ownership of Roaming Profile Folders
Select: Enabled
Click: OK
Close the whole console. You do not need to save the settings (this refers to the console settings rather than the policies you have - changed).
Reboot

`Sharing Profiles between W9x/Me and NT4/200x/XP workstations`

+ changed).

Reboot

`Sharing Profiles between W9x/Me and NT4/200x/XP workstations`

Sharing of desktop profiles between Windows versions is NOT recommended. Desktop profiles are an evolving phenomenon and profiles for later versions of MS Windows clients add features that may interfere with earlier versions @@ -13563,12 +13566,12 @@ that need to be common are logon path and

If you have this set up correctly, you will find separate user.DAT and NTuser.DAT files in the same profile directory. -

`Profile Migration from Windows NT4/200x Server to Samba`

Most organisations are arranged into departments. There is a nice benefit in this fact since usually most users in a department will require the same desktop applications and the same desktop layout. MS Windows NT4/200x/XP will allow the @@ -13639,14 +13642,14 @@ the now modified profile.

`Note`

Be careful with group profiles, if the user who is a member of a group also has a personal profile, then the result will be a fusion (merge) of the two. -

`Default Profile for Windows Users`

+

`Default Profile for Windows Users`

MS Windows 9x / Me and NT4/200x/XP will use a default profile for any user for whom a profile does not already exist. Armed with a knowledge of where the default profile is located on the Windows workstation, and knowing which registry keys affect the path from which the default profile is created, it is possible to modify the default profile to one that has been optimised for the site. This has significant administrative advantages. -

`MS Windows 9x/Me`

+

`MS Windows 9x/Me`

To enable default per use profiles in Windows 9x / Me you can either use the Windows 98 System Policy Editor or change the registry directly.

@@ -13658,7 +13661,7 @@ select User Profiles, click on the enable box. Do To modify the registry directly, launch the Registry Editor (regedit.exe), select the hive HKEY_LOCAL_MACHINE\Network\Logon. Now add a DWORD type key with the name "User Profiles", to enable user profiles set the value to 1, to disable user profiles set it to 0. -

`How User Profiles Are Handled in Windows 9x / Me?`

+

`How User Profiles Are Handled in Windows 9x / Me?`

When a user logs on to a Windows 9x / Me machine, the local profile path, HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProfileList, is checked for an existing entry for that user: @@ -13674,7 +13677,7 @@ If a User Profile is not found in either location, the Default User Profile from machine is used and is copied to a newly created folder for the logged on user. At log off, any changes that the user made are written to the user's local profile. If the user has a roaming profile, the changes are written to the user's profile on the server. -

`MS Windows NT4 Workstation`

+

`MS Windows NT4 Workstation`

On MS Windows NT4 the default user profile is obtained from the location %SystemRoot%\Profiles which in a default installation will translate to C:\WinNT\Profiles. Under this directory on a clean install there will be @@ -13715,15 +13718,15 @@ the following steps are followed in respect of profile handling: MS Windows NT4 profiles may be Local or Roaming. A Local profile will stored in the %SystemRoot%\Profiles\%USERNAME% location. A roaming profile will also remain stored in the same way, unless the following registry key is created: -

-

+

+ 	HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\winlogon\
 	"DeleteRoamingCache"=dword:00000001
-

+

In which case, the local copy (in %SystemRoot%\Profiles\%USERNAME%) will be deleted on logout. - + Under MS Windows NT4 default locations for common resources (like My Documents may be redirected to a network share by modifying the following registry keys. These changes may be affected via use of the System Policy Editor (to do so may require that you create your owns template extension @@ -13736,17 +13739,17 @@ are controlled by entries on Windows NT4 is: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\ The above hive key contains a list of automatically managed folders. The default entries are: - - Table 24.1. User Shell Folder registry keys default values Name Default Value AppData %USERPROFILE%\Application Data Desktop %USERPROFILE%\Desktop Favorites %USERPROFILE%\Favorites NetHood %USERPROFILE%\NetHood PrintHood %USERPROFILE%\PrintHood Programs %USERPROFILE%\Start Menu\Programs Recent %USERPROFILE%\Recent SendTo %USERPROFILE%\SendTo Start Menu %USERPROFILE%\Start Menu Startup %USERPROFILE%\Start Menu\Programs\Startup - + +Table 24.1. User Shell Folder registry keys default values Name Default Value AppData %USERPROFILE%\Application Data Desktop %USERPROFILE%\Desktop Favorites %USERPROFILE%\Favorites NetHood %USERPROFILE%\NetHood PrintHood %USERPROFILE%\PrintHood Programs %USERPROFILE%\Start Menu\Programs Recent %USERPROFILE%\Recent SendTo %USERPROFILE%\SendTo Start Menu %USERPROFILE%\Start Menu Startup %USERPROFILE%\Start Menu\Programs\Startup + The registry key that contains the location of the default profile settings is: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders - + The default entries are: - Table 24.2. Defaults of profile settings registry keys Common Desktop %SystemRoot%\Profiles\All Users\Desktop Common Programs %SystemRoot%\Profiles\All Users\Programs Common Start Menu %SystemRoot%\Profiles\All Users\Start Menu Common Startup %SystemRoot%\Profiles\All Users\Start Menu\Programs\Startup -

`MS Windows 200x/XP`

`Note`

+

Table 24.2. Defaults of profile settings registry keys Common Desktop %SystemRoot%\Profiles\All Users\Desktop Common Programs %SystemRoot%\Profiles\All Users\Programs Common Start Menu %SystemRoot%\Profiles\All Users\Start Menu Common Startup %SystemRoot%\Profiles\All Users\Start Menu\Programs\Startup

+

`MS Windows 200x/XP`

`Note`

MS Windows XP Home Edition does use default per user profiles, but can not participate in domain security, can not log onto an NT/ADS style domain, and thus can obtain the profile only from itself. While there are benefits in doing this the beauty of those MS Windows @@ -13794,9 +13797,9 @@ are controlled by entries on Windows 200x/XP is: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\

The above hive key contains a list of automatically managed folders. The default entries are: -

-

Table 24.3. Defaults of default user profile paths registry keys Name Default Value AppData %USERPROFILE%\Application Data Cache %USERPROFILE%\Local Settings\Temporary Internet Files Cookies %USERPROFILE%\Cookies Desktop %USERPROFILE%\Desktop Favorites %USERPROFILE%\Favorites History %USERPROFILE%\Local Settings\History Local AppData %USERPROFILE%\Local Settings\Application Data Local Settings %USERPROFILE%\Local Settings My Pictures %USERPROFILE%\My Documents\My Pictures NetHood %USERPROFILE%\NetHood Personal %USERPROFILE%\My Documents PrintHood %USERPROFILE%\PrintHood Programs %USERPROFILE%\Start Menu\Programs Recent %USERPROFILE%\Recent SendTo %USERPROFILE%\SendTo Start Menu %USERPROFILE%\Start Menu Startup %USERPROFILE%\Start Menu\Programs\Startup Templates %USERPROFILE%\Templates

-

+

+Table 24.3. Defaults of default user profile paths registry keys Name Default Value AppData %USERPROFILE%\Application Data Cache %USERPROFILE%\Local Settings\Temporary Internet Files Cookies %USERPROFILE%\Cookies Desktop %USERPROFILE%\Desktop Favorites %USERPROFILE%\Favorites History %USERPROFILE%\Local Settings\History Local AppData %USERPROFILE%\Local Settings\Application Data Local Settings %USERPROFILE%\Local Settings My Pictures %USERPROFILE%\My Documents\My Pictures NetHood %USERPROFILE%\NetHood Personal %USERPROFILE%\My Documents PrintHood %USERPROFILE%\PrintHood Programs %USERPROFILE%\Start Menu\Programs Recent %USERPROFILE%\Recent SendTo %USERPROFILE%\SendTo Start Menu %USERPROFILE%\Start Menu Startup %USERPROFILE%\Start Menu\Programs\Startup Templates %USERPROFILE%\Templates + There is also an entry called "Default" that has no value set. The default entry is of type REG_SZ, all the others are of type REG_EXPAND_SZ. @@ -13820,9 +13823,9 @@ MS Windows 200x/XP profiles may be Local A roaming profile will be cached locally unless the following registry key is created: HKEY_LOCAL_MACHINE\SYSTEM\Software\Microsoft\Windows NT\CurrentVersion\winlogon\"DeleteRoamingCache"=dword:00000001 In which case, the local cache copy will be deleted on logout. -

`Common Errors`

+

`Common Errors`

The following are some typical errors/problems/questions that have been asked. -

`How does one set up roaming profiles for just one (or a few) user/s or group/s?`

+

`How does one set up roaming profiles for just one (or a few) user/s or group/s?`

With samba-2.2.x the choice you have is to enable or disable roaming profiles support. It is a global only setting. The default is to have roaming profiles and the default path will locate them in the user's home @@ -13840,25 +13843,25 @@ using the Domain User Manager (as with MS Windows NT4/ Win 2Kx).

In any case, you can configure only one profile per user. That profile can be either: -

A profile unique to that user

A mandatory profile (one the user can not change)

A group profile (really should be mandatory ie:unchangable)

`Can NOT use Roaming Profiles`

+

A profile unique to that user

A mandatory profile (one the user can not change)

A group profile (really should be mandatory ie:unchangable)

`Can NOT use Roaming Profiles`

“ I dont want Roaming profile to be implemented, I just want to give users local profiles only. ... Please help me I am totally lost with this error from past two days I tried everything and googled around quite a bit but of no help. Please help me. -”

+”

Your choices are: - Local profiles + Local profiles I know of no registry keys that will allow auto-deletion of LOCAL profiles on log out - Roaming profiles - can use auto-delete on logout option requires a registry key change on workstation + Roaming profiles + can use auto-delete on logout option requires a registry key change on workstation Your choices are: - Personal Roaming profiles + Personal Roaming profiles - should be preserved on a central server - workstations 'cache' (store) a local copy - used in case the profile can not be downloaded @@ -13866,10 +13869,10 @@ Your choices are: Group profiles - loaded from a central place Mandatory profiles - can be personal or group - can NOT be changed (except by an administrator - - + + - + A WinNT4/2K/XP profile can vary in size from 130KB to off the scale. Outlook PST files are most often part of the profile and can be many GB in size. On average (in a well controlled environment) roaming profile size of @@ -13884,19 +13887,19 @@ a problem free site. Microsoft's answer to the PST problem is to store all email in an MS Exchange Server back-end. But this is another story ...! - + So, having LOCAL profiles means: - If lots of users user each machine - lot's of local disk storage needed for local profiles Every workstation the user logs into has it's own profile - can be very different from machine to machine +If lots of users user each machine - lot's of local disk storage needed for local profiles Every workstation the user logs into has it's own profile - can be very different from machine to machine On the other hand, having roaming profiles means: - The network administrator can control EVERY aspect of user profiles With the use of mandatory profiles - a drastic reduction in network management overheads User unhappiness about not being able to change their profiles soon fades as they get used to being able to work reliably +The network administrator can control EVERY aspect of user profiles With the use of mandatory profiles - a drastic reduction in network management overheads User unhappiness about not being able to change their profiles soon fades as they get used to being able to work reliably - + I have managed and installed MANY NT/2K networks and have NEVER found one where users who move from machine to machine are happy with local profiles. In the long run local profiles bite them. -

`Changing the default profile`

“ +

`Changing the default profile`

“ When the client tries to logon to the PDC it looks for a profile to download where do I put this default profile. ”

@@ -13926,7 +13929,7 @@ Secondly, for roaming profiles you need: logon drive = H: (Z: is the default) Plus you need a PROFILES share that is world writable. -

`Chapter 25. PAM based Distributed Authentication`

`John H. Terpstra`

Samba Team <jht@samba.org>

`Stephen Langasek`

<vorlon@netexpress.net>

May 31, 2003

Table of Contents

Technical Discussion

PAM Configuration Syntax
Example System Configurations
smb.conf PAM Configuration
Remote CIFS Authentication using winbindd.so
Password Synchronization using pam_smbpass.so

pam_winbind problem

+

`Chapter 25. PAM based Distributed Authentication`

`John H. Terpstra`

Samba Team <jht@samba.org>

`Stephen Langasek`

<vorlon@netexpress.net>

May 31, 2003

Table of Contents

Technical Discussion

PAM Configuration Syntax
Example System Configurations
smb.conf PAM Configuration
Remote CIFS Authentication using winbindd.so
Password Synchronization using pam_smbpass.so

pam_winbind problem

This chapter you should help you to deploy winbind based authentication on any PAM enabled Unix/Linux system. Winbind can be used to enable user level application access authentication from any MS Windows NT Domain, MS Windows 200x Active Directory based domain, or any Samba @@ -13937,7 +13940,7 @@ In addition to knowing how to configure winbind into PAM, you will learn generic possibilities and in particular how to deploy tools like pam_smbpass.so to your advantage.

`Note`

The use of Winbind require more than PAM configuration alone. Please refer to the Winbind chapter. -

`Features and Benefits`

+

`Features and Benefits`

A number of Unix systems (eg: Sun Solaris), as well as the xxxxBSD family and Linux, now utilize the Pluggable Authentication Modules (PAM) facility to provide all authentication, authorization and resource control services. Prior to the introduction of PAM, a decision @@ -13995,12 +13998,12 @@ of distributed samba domain controllers that can provide wide are network bandwi efficient authentication services for PAM capable systems. In effect, this allows the deployment of centrally managed and maintained distributed authentication from a single user account database. -

`Technical Discussion`

+

`Technical Discussion`

PAM is designed to provide the system administrator with a great deal of flexibility in configuration of the privilege granting applications of their system. The local configuration of system security controlled by PAM is contained in one of two places: either the single system file, /etc/pam.conf; or the /etc/pam.d/ directory. -

`PAM Configuration Syntax`

+

`PAM Configuration Syntax`

In this section we discuss the correct syntax of and generic options respected by entries to these files. PAM specific tokens in the configuration file are case insensitive. The module paths, however, are case sensitive since they indicate a file's name and reflect the case dependence of typical file-systems. @@ -14014,22 +14017,22 @@ If the PAM authentication module (loadable link library file) is located in the default location then it is not necessary to specify the path. In the case of Linux, the default location is /lib/security. If the module is located outside the default then the path must be specified as: -

-

+

+ auth  required  /other_path/pam_strange_module.so
-

-
Anatomy of /etc/pam.d Entries

+

+Anatomy of /etc/pam.d Entries The remaining information in this subsection was taken from the documentation of the Linux-PAM project. For more information on PAM, see http://ftp.kernel.org/pub/linux/libs/pam The Official Linux-PAM home page. A general configuration line of the /etc/pam.conf file has the following form: - - + + service-name module-type control-flag module-path args - - + + Below, we explain the meaning of each of these tokens. The second (and more recently adopted) way of configuring Linux-PAM is via the contents of the /etc/pam.d/ directory. Once we have explained the meaning of the above tokens, we will describe this method. @@ -14146,8 +14149,8 @@ Once we have explained the meaning of the above tokens, we will describe this me Each of the four keywords: required; requisite; sufficient; and optional, have an equivalent expression in terms of the [...] syntax. They are as follows: - - + + required is equivalent to [success=ok new_authtok_reqd=ok ignore=ignore default=bad] requisite is equivalent to [success=ok new_authtok_reqd=ok ignore=ignore default=die] @@ -14155,8 +14158,8 @@ Once we have explained the meaning of the above tokens, we will describe this me sufficient is equivalent to [success=done new_authtok_reqd=done default=ignore] optional is equivalent to [success=ok new_authtok_reqd=ok default=ignore] - - + + Just to get a feel for the power of this new syntax, here is a taste of what you can do with it. With Linux-PAM-0.63, the notion of client plug-in agents was introduced. This is something that makes it possible for PAM to support machine-machine authentication using the transport protocol inherent to the client/server application. With the @@ -14188,13 +14191,13 @@ squid auth required pam_mysql.so user=passwd_query passwd=mada \ Any line in (one of) the configuration file(s), that is not formatted correctly, will generally tend (erring on the side of caution) to make the authentication process fail. A corresponding error is written to the system log files with a call to syslog(3). -

`Example System Configurations`

+

`Example System Configurations`

The following is an example /etc/pam.d/login configuration file. This example had all options been uncommented is probably not usable as it stacks many conditions before allowing successful completion of the login process. Essentially all conditions can be disabled by commenting them out except the calls to pam_pwdb.so. -

`PAM: original login config`

+
PAM: original login config
 #%PAM-1.0
 # The PAM configuration file for the `login' service
 #
@@ -14209,10 +14212,10 @@ session      required    pam_pwdb.so
 # session    optional    pam_lastlog.so
 # password   required    pam_cracklib.so retry=3
 password     required    pam_pwdb.so shadow md5
-
PAM: login using pam_smbpass

+

`PAM: login using pam_smbpass`

PAM allows use of replaceable modules. Those available on a sample system include: -

$/bin/ls /lib/security -

+
$/bin/ls /lib/security
+ pam_access.so    pam_ftp.so          pam_limits.so     
 pam_ncp_auth.so  pam_rhosts_auth.so  pam_stress.so     
 pam_cracklib.so  pam_group.so        pam_listfile.so   
@@ -14288,7 +14291,7 @@ authentication to be configured in a single central file. The
 on the basis that it allows for easier administration. As with all issues in 
 life though, every decision makes trade-offs, so you may want examine the 
 PAM documentation for further helpful information.
-

`smb.conf PAM Configuration`

+

`smb.conf PAM Configuration`

There is an option in smb.conf called obey pam restrictions. The following is from the on-line help for this option in SWAT;

@@ -14303,7 +14306,7 @@ ignores PAM for authentication in the case of The reason is that PAM modules cannot support the challenge/response authentication mechanism needed in the presence of SMB password encryption. -

Default: obey pam restrictions = no

`Remote CIFS Authentication using winbindd.so`

+

I have the following PAM configuration: -

-

+	

+ auth required /lib/security/pam_securetty.so
 auth sufficient /lib/security/pam_winbind.so
 auth sufficient /lib/security/pam_unix.so use_first_pass nullok
@@ -14435,8 +14438,8 @@ auth required /lib/security/pam_nologin.so
 account required /lib/security/pam_stack.so service=system-auth
 account required /lib/security/pam_winbind.so
 password required /lib/security/pam_stack.so service=system-auth
-

-

+

+ When I open a new console with [ctrl][alt][F1], then I cant log in with my user "pitie". I've tried with user "scienceu+pitie" also. @@ -14447,7 +14450,7 @@ password required /lib/security/pam_stack.so service=system-auth /etc/pam.d/system-auth and copy only what you need from it into your /etc/pam.d/login file. Alternatively, if you want all services to use winbind, you can put the winbind-specific stuff in /etc/pam.d/system-auth. -

`Chapter 26. Integrating MS Windows networks with Samba`

`John H. Terpstra`

Samba Team <jht@samba.org>

(Jan 01 2001)

Table of Contents

Background Information

Name Resolution in a pure Unix/Linux world

/etc/hosts
/etc/resolv.conf
/etc/host.conf
/etc/nsswitch.conf

Name resolution as used within MS Windows networking

The NetBIOS Name Cache
The LMHOSTS file
HOSTS file
DNS Lookup
WINS Lookup

My Boomerang Won't Come Back
Very Slow Network Connections
Samba server name change problem

+

`Chapter 26. Integrating MS Windows networks with Samba`

`John H. Terpstra`

Samba Team <jht@samba.org>

(Jan 01 2001)

Table of Contents

Background Information

Name Resolution in a pure Unix/Linux world

/etc/hosts
/etc/resolv.conf
/etc/host.conf
/etc/nsswitch.conf

Name resolution as used within MS Windows networking

The NetBIOS Name Cache
The LMHOSTS file
HOSTS file
DNS Lookup
WINS Lookup

Planning and Getting Started

My Boomerang Won't Come Back
Very Slow Network Connections
Samba server name change problem

This section deals with NetBIOS over TCP/IP name to IP address resolution. If your MS Windows clients are NOT configured to use NetBIOS over TCP/IP then this section does not apply to your installation. If your installation involves use of @@ -14458,7 +14461,7 @@ NetBIOS over TCP/IP then this section may help you to resolve networking problem to NOT run NetBEUI at all. Note also that there is NO such thing as NetBEUI over TCP/IP - the existence of such a protocol is a complete and utter mis-apprehension. -

`Features and Benefits`

+

`Features and Benefits`

Many MS Windows network administrators have never been exposed to basic TCP/IP networking as it is implemented in a Unix/Linux operating system. Likewise, many Unix and Linux administrators have not been exposed to the intricacies of MS Windows TCP/IP based @@ -14466,7 +14469,7 @@ networking (and may have no desire to be either).

This chapter gives a short introduction to the basics of how a name can be resolved to it's IP address for each operating system environment. -

`Background Information`

+

`Background Information`

Since the introduction of MS Windows 2000 it is possible to run MS Windows networking without the use of NetBIOS over TCP/IP. NetBIOS over TCP/IP uses UDP port 137 for NetBIOS name resolution and uses TCP port 139 for NetBIOS session services. When NetBIOS over @@ -14482,10 +14485,10 @@ disable NetBIOS over TCP/IP today use MS Active Directory Service (ADS). ADS req Dynamic DNS with Service Resource Records (SRV RR) and with Incremental Zone Transfers (IXFR). Use of DHCP with ADS is recommended as a further means of maintaining central control over client workstation network configuration. -

`Name Resolution in a pure Unix/Linux world`

+

`Name Resolution in a pure Unix/Linux world`

The key configuration files covered in this section are: -

/etc/hosts
/etc/resolv.conf
/etc/host.conf
/etc/nsswitch.conf

`/etc/hosts`

-Contains a static list of IP Addresses and names. +

/etc/hosts
/etc/resolv.conf
/etc/host.conf
/etc/nsswitch.conf

`/etc/hosts`

+Contains a static list of IP addresses and names. eg:

 	127.0.0.1	localhost localhost.localdomain
@@ -14497,7 +14500,7 @@ IP addresses.
 

 Network packets that are sent over the physical network transport 
 layer communicate not via IP addresses but rather using the Media 
-Access Control address, or MAC address. IP Addresses are currently 
+Access Control address, or MAC address. IP addresses are currently 
 32 bits in length and are typically presented as four (4) decimal 
 numbers that are separated by a dot (or period). eg: 168.192.1.1.
 

@@ -14541,7 +14544,7 @@ primary names by which they are known within the local machine.
 This file helps to prime the pump so that a basic level of name 
 resolution can exist before any other method of name resolution 
 becomes available.
-

`/etc/resolv.conf`

+

`/etc/resolv.conf`

This file tells the name resolution libraries:

The name of the domain to which the machine belongs @@ -14551,7 +14554,7 @@ This file tells the name resolution libraries:
The name or IP address of available Domain Name Servers that may be asked to perform name to address translation lookups -

A WINS (Windows Internet Name Server) service is the equivalent of the rfc1001/1002 specified NBNS (NetBIOS Name Server). A WINS server stores the names and IP addresses that are registered by a Windows client @@ -14817,11 +14820,11 @@ needed in the smb.conf file:

where xxx.xxx.xxx.xxx is the IP address of the WINS server. -

`Common Errors`

+

`Common Errors`

TCP/IP network configuration problems find every network administrator sooner or later. The cause can be anything from keyboard mishaps, forgetfulness, simple mistakes, and carelessness. Of course, no one is every deliberately careless! -

`My Boomerang Won't Come Back`

+

`My Boomerang Won't Come Back`

Well, the real complaint said, "I can ping my samba server from Windows, but I can not ping my Windows machine from the samba server."

@@ -14831,9 +14834,9 @@ carelessness. Of course, no one is every deliberately careless!

Due to inconsistent netmasks, the Windows machine was on network 192.168.1.0/24, while the Samba server was on network 192.168.1.128/25 - logically a different network. -

`Very Slow Network Connections`

+

`Very Slow Network Connections`

A common causes of slow network response includes: -

Client is configured to use DNS and DNS server is down
Client is configured to use remote DNS server, but remote connection is down
Client is configured to use a WINS server, but there is no WINS server
Client is NOT configured to use a WINS server, but there is a WINS server
Firewall is filtering our DNS or WINS traffic

`Samba server name change problem`

+

Client is configured to use DNS and DNS server is down
Client is configured to use remote DNS server, but remote connection is down
Client is configured to use a WINS server, but there is no WINS server
Client is NOT configured to use a WINS server, but there is a WINS server
Firewall is filtering our DNS or WINS traffic

`Samba server name change problem`

The name of the samba server was changed, samba was restarted, samba server can not be pinged by new name from MS Windows NT4 Workstation, but it does still respond to ping using the old name. Why? @@ -14842,8 +14845,8 @@ carelessness. Of course, no one is every deliberately careless!

WINS is NOT in use, only broadcast based name resolution is used
The samba server was renamed and restarted within the last 10-15 minutes
The old samba server name is still in the NetBIOS name cache on the MS Windows NT4 Workstation

To find what names are present in the NetBIOS name cache on the MS Windows NT4 machine, open a cmd shell, then: -

-

+	

+	 	C:\temp\>nbtstat -n
 
 	              NetBIOS Local Name Table
@@ -14867,13 +14870,13 @@ carelessness. Of course, no one is every deliberately careless!
 	FRODO            <20>  UNIQUE      192.168.1.1          240
 
 	C:\Temp\>
-	

-	

+

+ In the above example, FRODO is the Samba server and SLACK is the MS Windows NT4 Workstation. - The first listing shows the contents of the Local Name Table (ie: Identity information on + The first listing shows the contents of the Local Name Table (i.e.: Identity information on the MS Windows workstation), the second shows the NetBIOS name in the NetBIOS name cache. The name cache contains the remote machines known to this workstation. -

`Chapter 27. Unicode/Charsets`

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

`TAKAHASHI Motonobu`

<monyo@home.monyo.com>

25 March 2003

Table of Contents

Features and Benefits
What are charsets and unicode?
Samba and charsets
Conversion from old names
Japanese charsets

`Features and Benefits`

+

`Chapter 27. Unicode/Charsets`

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

`TAKAHASHI Motonobu`

<monyo@home.monyo.com>

25 March 2003

Table of Contents

Features and Benefits
What are charsets and unicode?
Samba and charsets
Conversion from old names
Japanese charsets

`Features and Benefits`

Every industry eventually matures. One of the great areas of maturation is in the focus that has been given over the past decade to make it possible for anyone anywhere to use a computer. It has not always been that way, in fact, not so long @@ -14888,7 +14891,7 @@ special mention. For more information about Openi18n please refer to: Samba-2.x supported a single locale through a mechanism called codepages. Samba-3 is destined to become a truly trans-global file and printer sharing platform. -

`What are charsets and unicode?`

+

`What are charsets and unicode?`

Computers communicate in numbers. In texts, each number will be translated to a corresponding letter. The meaning that will be assigned to a certain number depends on the character set(charset) @@ -14915,7 +14918,7 @@ communicating. negotiating the charset to be used in the smb protocol. Thus, you have to make sure you are using the same charset when talking to an old client. Newer clients (Windows NT, 2K, XP) talk unicode over the wire. -

`Samba and charsets`

+

`Samba and charsets`

As of samba 3.0, samba can (and will) talk unicode over the wire. Internally, samba knows of three kinds of character sets:

unix charset: @@ -14929,14 +14932,14 @@ samba knows of three kinds of character sets: The default depends on the charsets you have installed on your system. Run testparm -v | grep "dos charset" to see what the default is on your system. -

`Conversion from old names`

Because previous samba versions did not do any charset conversion, +

`Conversion from old names`

Because previous samba versions did not do any charset conversion, characters in filenames are usually not correct in the unix charset but only for the local charset used by the DOS/Windows clients.

The following script from Steve Langasek converts all filenames from CP850 to the iso8859-15 charset.

#find /path/to/share -type f -exec bash -c 'CP="{}"; ISO=`echo -n "$CP" | iconv -f cp850 \ -t iso8859-15`; if [ "$CP" != "$ISO" ]; then mv "$CP" "$ISO"; fi' \; -

`Japanese charsets`

Samba doesn't work correctly with Japanese charsets yet. Here are +

`Japanese charsets`

Samba doesn't work correctly with Japanese charsets yet. Here are points of attention when setting it up:

You should set mangling method = hash
There are various iconv() implementations around and not all of them work equally well. glibc2's iconv() has a critical problem @@ -14946,28 +14949,28 @@ Shift_JIS, SJIS...
Currently only unix c will work (but still has some problems...) because of iconv() issues. unix charset = EUC-JP doesn't work well because of iconv() issues.
Currently Samba 3.0 does not support unix charset -= UTF8-MAC/CAP/HEX/JIS*

More information (in Japanese) is available at: http://www.atmarkit.co.jp/flinux/special/samba3/samba3a.html.

`Chapter 28. Samba Backup Techniques`

`John H. Terpstra`

Samba Team <jht@samba.org>

Table of Contents

Note
Features and Benefits

`Note`

+= UTF8-MAC/CAP/HEX/JIS*

More information (in Japanese) is available at: http://www.atmarkit.co.jp/flinux/special/samba3/samba3a.html.

`Chapter 28. Samba Backup Techniques`

`John H. Terpstra`

Samba Team <jht@samba.org>

Table of Contents

Note
Features and Benefits

`Note`

This chapter did not make it into this release. It is planned for the published release of this document. If you have something to contribute for this section please email it to jht@samba.org/ -

`Features and Benefits`

+

`Features and Benefits`

We need feedback from people who are backing up samba servers. We would like to know what software tools you are using to backup your samba server/s.

In particular, if you have any success and / or failure stories you could share with other users this would be appreciated. -

`Chapter 29. High Availability Options`

`John H. Terpstra`

Samba Team <jht@samba.org>

Table of Contents

Note

`Note`

+

`Chapter 29. High Availability Options`

`John H. Terpstra`

Samba Team <jht@samba.org>

Table of Contents

Note

`Note`

This chapter did not make it into this release. It is planned for the published release of this document. -

`Migration and Updating`

`Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0`

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

25 October 2002

Table of Contents

Charsets
Obsolete configuration options
Password Backend

`Charsets`

You might experience problems with special characters +

`Migration and Updating`

`Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0`

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

25 October 2002

Table of Contents

Charsets
Obsolete configuration options
Password Backend

`Charsets`

You might experience problems with special characters when communicating with old DOS clients. Codepage support has changed in samba 3.0. Read the chapter Unicode support for details. -

`Obsolete configuration options`

+

`Obsolete configuration options`

In 3.0, the following configuration options have been removed. -

printer driver (replaced by new driver procedures)

printer driver file (replaced by new driver procedures)

printer driver location (replaced by new driver procedures)

use rhosts

postscript

client code page (replaced by dos charset)

vfs path

vfs options

`Password Backend`

+

printer driver (replaced by new driver procedures)

printer driver file (replaced by new driver procedures)

printer driver location (replaced by new driver procedures)

use rhosts

postscript

client code page (replaced by dos charset)

vfs path

vfs options

`Password Backend`

Effective with the release of samba-3 it is now imperative that the password backend be correctly defined in smb.conf.

@@ -14979,10 +14982,10 @@ Those migrating from samba-2.x with encrypted password support should add to smb

LDAP using Samba-2.x systems can continue to operate with the following entry passdb backend = ldapsam_compat, guest. -

`Chapter 31. Migration from NT4 PDC to Samba-3 PDC`

`John H. Terpstra`

Samba Team <jht@samba.org>

April 3, 2003

Table of Contents

Objectives
Steps In Migration Process

Migration Options

Planning for Success
Samba Implementation Choices

+

`Chapter 31. Migration from NT4 PDC to Samba-3 PDC`

`John H. Terpstra`

Samba Team <jht@samba.org>

April 3, 2003

Table of Contents

Planning and Getting Started

Objectives
Steps In Migration Process

Migration Options

Planning for Success
Samba Implementation Choices

User and Group Profiles may be migrated using the tools described in the section titled Desktop Profile Management.

Profiles may also be managed using the Samba-3 tool profiles. This tool allows the MS Windows NT style security identifiers (SIDs) that are stored inside the profile NTuser.DAT file to be changed to the SID of the Samba-3 domain. -

`User and Group Accounts`

+

`User and Group Accounts`

It is possible to migrate all account settings from an MS Windows NT4 domain to Samba-3. Before attempting to migrate user and group accounts it is STRONGLY advised to create in Samba-3 the groups that are present on the MS Windows NT4 domain AND to connect these to suitable Unix/Linux groups. Following this simple advice will mean that all user and group attributes should migrate painlessly. -

`Steps In Migration Process`

+

`Steps In Migration Process`

The approximate migration process is described below.

You will have an NT4 PDC that has the users, groups, policies and profiles to be migrated @@ -15099,11 +15102,11 @@ Samba-3 set up as a DC with netlogon share, profile share, etc.

Procedure 31.1. The Account Migration Process

Create a BDC account for the samba server using NT Server Manager
1. Samba must NOT be running
rpcclient NT4PDC -U Administrator%passwd
1. lsaquery
2. Note the SID returned
net getsid -S NT4PDC -w DOMNAME -U Administrator%passwd
1. Note the SID
net getlocalsid
1. Note the SID, now check that all three SIDS reported are the same!
net rpc join -S NT4PDC -w DOMNAME -U Administrator%passwd
net rpc vampire -S NT4PDC -U administrator%passwd
pdbedit -L
1. Note - did the users migrate?
initGrps.sh DOMNAME
net groupmap list
1. Now check that all groups are recognised
net rpc vampire -S NT4PDC -U administrator%passwd
pdbedit -Lv
1. Note - check that all group membership has been migrated

Now it is time to migrate all the profiles, then migrate all policy files. More later. -

`Migration Options`

+

`Migration Options`

Based on feedback from many sites as well as from actual installation and maintenance experience sites that wish to migrate from MS Windows NT4 Domain Control to a Samba based solution fit into three basic categories. -

Table 31.1. The 3 Major Site Types Number of Users Description < 50 Want simple conversion with NO pain 50 - 250 Want new features, can manage some in-house complexity > 250 Solution/Implementation MUST scale well, complex needs. Cross departmental decision process. Local expertise in most areas

`Planning for Success`

+

`Planning for Success`

There are three basic choices for sites that intend to migrate from MS Windows NT4 to Samba-3.

@@ -15122,7 +15125,7 @@ No matter what choice you make, the following rules will minimise down-stream pr Test ALL assumptions
Test full roll-out program, including workstation deployment -

Table 31.2. Nature of the Conversion Choices Simple Upgraded Redesign Make use of minimal OS specific features Translate NT4 features to new host OS features Decide: Suck all accounts from NT4 into Samba-3 Copy and improve: Authentication Regime (database location and access) Make least number of operational changes Make progressive improvements Desktop Management Methods Take least amount of time to migrate Minimise user impact Better Control of Desktops / Users Live versus Isolated Conversion Maximise functionality Identify Needs for: Manageability, Scalability, Security, Availability Integrate Samba-3 then migrate while users are active, then Change of control (ie: swap out) Take advantage of lower maintenance opportunity

`Samba Implementation Choices`

 Authentication database back end
 	Winbind (external Samba or NT4/200x server)
 	Can use pam_mkhomedir.so to auto-create home dirs
@@ -15179,8 +15182,8 @@ Migration Tools
 
 Authentication
 	New SAM back end (smbpasswd, tdbsam, ldapsam, mysqlsam)
-

-

`Chapter 32. SWAT - The Samba Web Administration Tool`

`John H. Terpstra`

Samba Team <jht@samba.org>

April 21, 2003

Table of Contents

Enabling SWAT for use
Securing SWAT through SSL
The SWAT Home Page
Global Settings
Share Settings
Printers Settings
The SWAT Wizard
The Status Page
The View Page
The Password Change Page

+ +

`Chapter 32. SWAT - The Samba Web Administration Tool`

`John H. Terpstra`

Samba Team <jht@samba.org>

April 21, 2003

Table of Contents

Enabling SWAT for use
Securing SWAT through SSL
The SWAT Home Page
Global Settings
Share Settings
Printers Settings
The SWAT Wizard
The Status Page
The View Page
The Password Change Page

There are many and varied opinions regarding the usefulness or otherwise of SWAT. No matter how hard one tries to produce the perfect configuration tool it remains an object of personal taste. SWAT is a tool that will allow web based configuration @@ -15188,7 +15191,7 @@ of samba. It has a wizard that may help to get samba configured quickly, it has sensitive help on each smb.conf parameter, it provides for monitoring of current state of connection information, and it allows network wide MS Windows network password management. -

`Features and Benefits`

+

`Features and Benefits`

There are network administrators who believe that it is a good idea to write systems documentation inside configuration files, for them SWAT will aways be a nasty tool. SWAT does not store the configuration file in any intermediate form, rather, it stores only the @@ -15200,7 +15203,7 @@ internal ordering. So before using SWAT please be warned - SWAT will completely replace your smb.conf with a fully optimised file that has been stripped of all comments you might have placed there and only non-default settings will be written to the file. -

`Enabling SWAT for use`

+

`Enabling SWAT for use`

SWAT should be installed to run via the network super daemon. Depending on which system your Unix/Linux system has you will have either an inetd or xinetd based system. @@ -15216,8 +15219,8 @@ The control entry for the older style file might be: swat stream tcp nowait.400 root /usr/sbin/swat swat

A control file for the newer style xinetd could be: -

-

+

+ 	# default: off
 	# description: SWAT is the Samba Web Admin Tool. Use swat \
 	#              to configure your Samba server. To use SWAT, \
@@ -15233,9 +15236,9 @@ A control file for the newer style xinetd could be:
 		log_on_failure  += USERID
 		disable = yes
 	}
-

+

- + Both the above examples assume that the swat binary has been located in the /usr/sbin directory. In addition to the above SWAT will use a directory access point from which it will load it's help files @@ -15254,32 +15257,32 @@ So long as you log onto SWAT as the user rootHOME, GLOBALS, SHARES, PRINTERS, WIZARD, STATUS, VIEW, PASSWORD. -

`Securing SWAT through SSL`

+

`Securing SWAT through SSL`

Lots of people have asked about how to setup SWAT with SSL to allow for secure remote administration of Samba. Here is a method that works, courtesy of Markus Krieger

Modifications to the swat setup are as following:

install OpenSSL -
+

generate certificate and private key - + root# /usr/bin/openssl req -new -x509 -days 365 -nodes -config \ /usr/share/doc/packages/stunnel/stunnel.cnf \ -out /etc/stunnel/stunnel.pem -keyout /etc/stunnel/stunnel.pem

remove swat-entry from [x]inetd -
+

start stunnel - + root# stunnel -p /etc/stunnel/stunnel.pem -d 901 \ -l /usr/local/samba/bin/swat swat

afterwords simply contact to swat by using the URL https://myhost:901, accept the certificate and the SSL connection is up. -

`The SWAT Home Page`

+

`The SWAT Home Page`

The SWAT title page provides access to the latest Samba documentation. The manual page for each samba component is accessible from this page as are the Samba-HOWTO-Collection (this document) as well as the O'Reilly book "Using Samba". @@ -15295,7 +15298,7 @@ as it runs SWAT without authentication and with full administrative ability. ie: changes to smb.conf as well as general operation with root privileges. The option that creates this ability is the -a flag to swat. Do not use this in any production environment. -

`Global Settings`

+

`Global Settings`

The Globals button will expose a page that allows configuration of the global parameters in smb.conf. There are three levels of exposure of the parameters:

@@ -15317,7 +15320,7 @@ your changes will be immediately lost.
Note
SWAT has context sensitive help. To find out what each parameter is for simply click the Help link to the left of the configuration parameter. -

@@ -15353,7 +15356,7 @@ Finally, there are a limited set of options that will determine what type of ser will be configured for, whether it will be a WINS server, participate as a WINS client, or operate with no WINS support. By clicking on one button you can elect to expose (or not) user home directories. -

`The Status Page`

+

`The Status Page`

The status page serves a limited purpose. Firstly, it allows control of the samba daemons. The key daemons that create the samba server environment are: smbd, nmbd, winbindd.

@@ -15364,11 +15367,11 @@ conditions with minimal effort.

Lastly, the Status page may be used to terminate specific smbd client connections in order to free files that may be locked. -

`The View Page`

+

`The View Page`

This page allows the administrator to view the optimised smb.conf file and, if you are particularly masochistic, will permit you also to see all possible global configuration parameters and their settings. -

`The Password Change Page`

+

`The Password Change Page`

The Password Change page is a popular tool. This tool allows the creation, deletion, deactivation and reactivation of MS Windows networking users on the local machine. Alternatively, you can use this tool to change a local password for a user account. @@ -15379,7 +15382,7 @@ required.

One popular use for this tool is to change user passwords across a range of remote MS Windows servers. -

`Troubleshooting`

Table of Contents

33. The Samba checklist

Introduction
Assumptions
The tests
Still having troubles?

34. Analysing and solving samba problems

Diagnostics tools
Installing 'Network Monitor' on an NT Workstation or a Windows 9x box
Useful URLs
Getting help from the mailing lists
How to get off the mailing lists

35. Reporting Bugs

Introduction
General info
Debug levels
Internal errors
Attaching to a running process
Patches

`Chapter 33. The Samba checklist`

`Andrew Tridgell`

Samba Team <tridge@samba.org>

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

Wed Jan 15

Table of Contents

Introduction
Assumptions
The tests
Still having troubles?

`Introduction`

+

`Troubleshooting`

Table of Contents

33. The Samba checklist

Introduction
Assumptions
The tests
Still having troubles?

34. Analysing and solving samba problems

Diagnostics tools
Installing 'Network Monitor' on an NT Workstation or a Windows 9x box
Useful URLs
Getting help from the mailing lists
How to get off the mailing lists

35. Reporting Bugs

Introduction
General info
Debug levels
Internal errors
Attaching to a running process
Patches

`Chapter 33. The Samba checklist`

`Andrew Tridgell`

Samba Team <tridge@samba.org>

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

Wed Jan 15

Table of Contents

Introduction
Assumptions
The tests
Still having troubles?

`Introduction`

This file contains a list of tests you can perform to validate your Samba server. It also tells you what the likely cause of the problem is if it fails any one of these steps. If it passes all these tests @@ -15394,7 +15397,7 @@ to solve a problem. If you send one of the samba mailing lists an email saying "it doesn't work" and you have not followed this test procedure then you should not be surprised if your email is ignored. -

`Assumptions`

+

`Assumptions`

In all of the tests it is assumed you have a Samba server called BIGSERVER and a PC called ACLIENT both in workgroup TESTGROUP.

@@ -15411,8 +15414,8 @@ following to smb.conf: path = /tmp read only = yes -

-

`Note`

+ +

`Note`

These tests assume version 3.0 or later of the samba suite. Some commands shown did not exist in earlier versions.

@@ -15435,7 +15438,7 @@ depending on how or if you specified logging in your smb.co

If you make changes to your smb.conf file while going through these test, don't forget to restart smbd and nmbd. -

`The tests`

Procedure 33.1. Diagnosing your samba server

`The tests`

Procedure 33.1. Diagnosing your samba server

In the directory in which you store your smb.conf file, run the command testparm smb.conf. If it reports any errors then your smb.conf configuration file is faulty. @@ -15678,13 +15681,13 @@ capability and is in user level security mode. In this case either set password server = Windows_NT_Machine in your smb.conf file, or make sure encrypted passwords is set to "yes". -

`Still having troubles?`

Read the chapter on +

`Still having troubles?`

Read the chapter on Analysing and Solving Problems. -

`Chapter 34. Analysing and solving samba problems`

`Gerald (Jerry) Carter`

Samba Team <jerry@samba.org>

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

`David Bannon`

Samba Team <dbannon@samba.org>

8 Apr 2003

Table of Contents

Diagnostics tools
Installing 'Network Monitor' on an NT Workstation or a Windows 9x box
Useful URLs
Getting help from the mailing lists
How to get off the mailing lists

+

`Chapter 34. Analysing and solving samba problems`

`Gerald (Jerry) Carter`

Samba Team <jerry@samba.org>

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

`David Bannon`

Samba Team <dbannon@samba.org>

8 Apr 2003

Table of Contents

Diagnostics tools
Installing 'Network Monitor' on an NT Workstation or a Windows 9x box
Useful URLs
Getting help from the mailing lists
How to get off the mailing lists

There are many sources of information available in the form of mailing lists, RFC's and documentation. The docs that come with the samba distribution contain very good explanations of -general SMB topics such as browsing.

`Diagnostics tools`

+general SMB topics such as browsing.

`Diagnostics tools`

One of the best diagnostic tools for debugging problems is Samba itself. You can use the -d option for both smbd and nmbd to specify what debug level at which to run. See the man pages on smbd, nmbd and @@ -15723,7 +15726,7 @@ The version on the NT Server install CD will only allow monitoring of network traffic directed to the local NT box and broadcasts on the local subnet. Be aware that Ethereal can read and write netmon formatted files. -

`Installing 'Network Monitor' on an NT Workstation or a Windows 9x box`

+

`Installing 'Network Monitor' on an NT Workstation or a Windows 9x box`

Installing netmon on an NT workstation requires a couple of steps. The following are for installing Netmon V4.00.349, which comes with Microsoft Windows NT Server 4.0, on Microsoft Windows NT @@ -15762,11 +15765,11 @@ from the Windows 9x CD (\admin\nettools\netmon). Ther file located with the netmon driver files on the CD if you need information on how to do this. Copy the files from a working Netmon installation. -

`Useful URLs`

See how Scott Merrill simulates a BDC behavior at +

`Useful URLs`

See how Scott Merrill simulates a BDC behavior at http://www.skippy.net/linux/smb-howto.html.
FTP site for older SMB specs: - ftp://ftp.microsoft.com/developr/drg/CIFS/

`Getting help from the mailing lists`

+ ftp://ftp.microsoft.com/developr/drg/CIFS/

`Getting help from the mailing lists`

There are a number of Samba related mailing lists. Go to http://samba.org, click on your nearest mirror and then click on Support and then click on Samba related mailing lists. @@ -15800,7 +15803,7 @@ error messages.

(Possibly) If you have a complete netmon trace ( the pipe to the error ) you can send the *.CAP file as well.

Please think carefully before attaching a document to an email. Consider pasting the relevant parts into the body of the message. The samba mailing lists go to a huge number of people, do they all need a copy of your -smb.conf in their attach directory?

`How to get off the mailing lists`

To have your name removed from a samba mailing list, go to the +smb.conf in their attach directory?

`How to get off the mailing lists`

To have your name removed from a samba mailing list, go to the same place you went to to get on it. Go to http://lists.samba.org, click on your nearest mirror and then click on Support and then click on Samba related mailing lists. Or perhaps see @@ -15808,7 +15811,7 @@ then click on Samba related mailing lists. Or perhaps se

Please don't post messages to the list asking to be removed, you will just be referred to the above address (unless that process failed in some way...) -

`Chapter 35. Reporting Bugs`

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

`Someone; Tridge or Karl Auer perhaps?`

27 June 1997

Table of Contents

Introduction
General info
Debug levels
Internal errors
Attaching to a running process
Patches

`Introduction`

Please report bugs using +

`Chapter 35. Reporting Bugs`

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

`Someone; Tridge or Karl Auer perhaps?`

27 June 1997

Table of Contents

Introduction
General info
Debug levels
Internal errors
Attaching to a running process
Patches

`Introduction`

36. How to compile SAMBA

Accessing the samba sources via rsync and ftp

Introduction
CVS Access to samba.org

Compiling samba with Active Directory support

Starting from inetd.conf
Alternative: starting it as a daemon

37. Portability

HPUX

DNIX

AIX

Sequential Read Ahead

Locking improvements
Winbind on Solaris 9

38. Samba and other CIFS clients

How can I configure OS/2 Warp Connect or - OS/2 Warp 4 as a client for Samba?
How can I configure OS/2 Warp 3 (not Connect), - OS/2 1.2, 1.3 or 2.x for Samba?
How do I get printer driver download working - for OS/2 clients?

Use latest TCP/IP stack from Microsoft
Delete .pwl files after password change
Configure WfW password handling
Case handling of passwords
Use TCP/IP as default protocol
Speed improvement

Speed improvement

39. Samba Performance Tuning

Comparisons
Socket options
Read size
Max xmit
Log level
Read raw
Write raw
Slow Logins
Client tuning
Samba performance problem due changing kernel
Corrupt tdb Files

40. DNS and DHCP Configuration Guide

Note

41. Further Resources

Websites
Related updates from Microsoft
Books

`Chapter 36. How to compile SAMBA`

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

`Someone; Jerry perhaps?`

22 May 2001

18 March 2003

Table of Contents

Accessing the samba sources via rsync and ftp

Introduction
CVS Access to samba.org

Compiling samba with Active Directory support

Starting from inetd.conf
Alternative: starting it as a daemon

+

`Appendixes`

Table of Contents

36. How to compile SAMBA

Accessing the samba sources via rsync and ftp

Introduction
CVS Access to samba.org

Compiling samba with Active Directory support

Starting from inetd.conf
Alternative: starting it as a daemon

37. Portability

HPUX

DNIX

AIX

Sequential Read Ahead

Locking improvements
Winbind on Solaris 9

38. Samba and other CIFS clients

How can I configure OS/2 Warp Connect or + OS/2 Warp 4 as a client for Samba?
How can I configure OS/2 Warp 3 (not Connect), + OS/2 1.2, 1.3 or 2.x for Samba?
How do I get printer driver download working + for OS/2 clients?

Use latest TCP/IP stack from Microsoft
Delete .pwl files after password change
Configure WfW password handling
Case handling of passwords
Use TCP/IP as default protocol
Speed improvement

Speed improvement

39. Samba Performance Tuning

Comparisons
Socket options
Read size
Max xmit
Log level
Read raw
Write raw
Slow Logins
Client tuning
Samba performance problem due changing kernel
Corrupt tdb Files

40. DNS and DHCP Configuration Guide

Note

41. Further Resources

Websites
Related updates from Microsoft
Books

`Chapter 36. How to compile SAMBA`

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

`Someone; Jerry perhaps?`

22 May 2001

18 March 2003

Table of Contents

Accessing the samba sources via rsync and ftp

Introduction
CVS Access to samba.org

Compiling samba with Active Directory support

Starting from inetd.conf
Alternative: starting it as a daemon

You can obtain the samba source from the samba website. To obtain a development version, you can download samba from CVS or using rsync. -

`Access Samba source code via CVS`

`Introduction`

+

`Access Samba source code via CVS`

`Introduction`

Samba is developed in an open environment. Developers use CVS (Concurrent Versioning System) to "checkin" (also known as "commit") new source code. Samba's various CVS branches can @@ -15942,12 +15945,12 @@ detailed in this chapter.

This chapter is a modified version of the instructions found at http://samba.org/samba/cvs.html -

`CVS Access to samba.org`

+

pserver.samba.org also exports unpacked copies of most parts of the CVS tree at ftp://pserver.samba.org/pub/unpacked and also via anonymous rsync at rsync://pserver.samba.org/ftp/unpacked/. I recommend using rsync rather than ftp. @@ -16014,7 +16017,7 @@ on this system just substitute the correct package name The disadvantage of the unpacked trees is that they do not support automatic merging of local changes like CVS does. rsync access is most convenient for an initial install. -

`Verifying Samba's PGP signature`

+

`Verifying Samba's PGP signature`

In these days of insecurity, it's strongly recommended that you verify the PGP signature for any source file before installing it. Even if you're not downloading from a mirror site, verifying PGP signatures should be a @@ -16041,7 +16044,7 @@ then all is well. The warnings about trust relationships can be ignored. An example of what you would not want to see would be:

gpg: BAD signature from "Samba Distribution Verification Key" -

`Building the Binaries`

To do this, first run the program ./configure +

`Building the Binaries`

To do this, first run the program ./configure in the source directory. This should automatically configure Samba for your operating system. If you have unusual needs then you may wish to run

root# ./configure --help @@ -16054,7 +16057,7 @@ example of what you would not want to see would be: of Samba you might like to know that the old versions of the binaries will be renamed with a ".old" extension. You can go back to the previous version with

root# make revert -

if you find this version a disaster!

`Compiling samba with Active Directory support`

In order to compile samba with ADS support, you need to have installed +

if you find this version a disaster!

`Compiling samba with Active Directory support`

In order to compile samba with ADS support, you need to have installed on your system:

the MIT kerberos development libraries (either install from the sources or use a package). The Heimdal libraries will not work.
the OpenLDAP development libraries.

If your kerberos libraries are in a non-standard location then @@ -16066,12 +16069,12 @@ example of what you would not want to see would be: #define HAVE_LDAP 1

If it doesn't then configure did not find your krb5 libraries or your ldap libraries. Look in config.log to figure - out why and fix it.

`Installing the required packages for Debian`

On Debian you need to install the following packages:

-

libkrb5-dev

krb5-user

-

`Installing the required packages for RedHat`

On RedHat this means you should have at least:

-

krb5-workstation (for kinit)

krb5-libs (for linking with)

krb5-devel (because you are compiling from source)

-

in addition to the standard development environment.

Note that these are not standard on a RedHat install, and you may need - to get them off CD2.

`Starting the smbd and nmbd`

You must choose to start smbd and nmbd either + out why and fix it.

`Installing the required packages for Debian`

On Debian you need to install the following packages:

+ libkrb5-dev krb5-user +

`Installing the required packages for RedHat`

On RedHat this means you should have at least:

+ krb5-workstation (for kinit) krb5-libs (for linking with) krb5-devel (because you are compiling from source) + in addition to the standard development environment. Note that these are not standard on a RedHat install, and you may need + to get them off CD2.

`Starting the smbd and nmbd`

You must choose to start smbd and nmbd either as daemons or from inetd. Don't try to do both! Either you can put them in inetd.conf and have them started on demand @@ -16083,7 +16086,7 @@ example of what you would not want to see would be: Samba. In many cases you must be root.

The main advantage of starting smbd and nmbd using the recommended daemon method is that they will respond slightly more quickly to an initial connection - request.

`Starting from inetd.conf`

`Note`

The following will be different if + request.

`Starting from inetd.conf`

`Note`

The following will be different if you use NIS, NIS+ or LDAP to distribute services maps.

Look at your /etc/services. What is defined at port 139/tcp. If nothing is defined then add a line like this:

netbios-ssn     139/tcp

similarly for 137/udp you should have an entry like:

netbios-ns	137/udp

Next edit your /etc/inetd.conf @@ -16109,7 +16112,7 @@ example of what you would not want to see would be: arguments, or you should use a script, and start the script from inetd.

Restart inetd, perhaps just send it a HUP. If you have installed an earlier version of nmbd then - you may need to kill nmbd as well.

`Alternative: starting it as a daemon`

To start the server as a daemon you should create + you may need to kill nmbd as well.

`Alternative: starting it as a daemon`

To start the server as a daemon you should create a script something like this one, perhaps calling it startsmb.

 		#!/bin/sh
@@ -16121,7 +16124,7 @@ example of what you would not want to see would be:
 		
To kill it send a kill signal to the processes 
 			nmbd and smbd.
Note
If you use the SVR4 style init system then 
 		you may like to look at the examples/svr4-startup
-		script to make Samba fit into that system.

`Common Errors`

“ + script to make Samba fit into that system.

`Common Errors`

“ I'm using gcc 3 and I've compiled Samba-3 from the CVS and the binaries are very large files (40 Mb and 20 Mb). I've the same result with --enable-shared ? @@ -16129,9 +16132,9 @@ binaries are very large files (40 Mb and 20 Mb). I've the same result with

The dwarf format used by GCC 3 for storing debugging symbols is very inefficient. Strip the binaries, don't compile with -g or compile with -gstabs. -

`Chapter 37. Portability`

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

Table of Contents

HPUX

DNIX

AIX

Sequential Read Ahead

Locking improvements
Winbind on Solaris 9

Samba works on a wide range of platforms but the interface all the +

`Chapter 37. Portability`

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

Table of Contents

HPUX

DNIX

AIX

Sequential Read Ahead

Locking improvements
Winbind on Solaris 9

Samba works on a wide range of platforms but the interface all the platforms provide is not always compatible. This chapter contains -platform-specific information about compiling and using samba.

`HPUX`

+platform-specific information about compiling and using samba.

`HPUX`

HP's implementation of supplementary groups is, er, non-standard (for hysterical reasons). There are two group files, /etc/group and /etc/logingroup; the system maps UIDs to numbers using the former, but @@ -16151,7 +16154,7 @@ allowed range. On HPUX you must use gcc or the HP ANSI compiler. The free compiler that comes with HP-UX is not ANSI compliant and cannot compile Samba. -

`SCO Unix`

+

`SCO Unix`

If you run an old version of SCO Unix then you may need to get important TCP/IP patches for Samba to work correctly. Without the patch, you may encounter corrupt data transfers using samba. @@ -16159,7 +16162,7 @@ encounter corrupt data transfers using samba. The patch you need is UOD385 Connection Drivers SLS. It is available from SCO (ftp.sco.com, directory SLS, files uod385a.Z and uod385a.ltr.Z). -

`DNIX`

+

`DNIX`

DNIX has a problem with seteuid() and setegid(). These routines are needed for Samba to work correctly, but they were left out of the DNIX C library for some reason. @@ -16218,13 +16221,13 @@ LIBSM = setegid.o seteuid.o -ln You should then remove the line:

 #define NO_EID
-

from the DNIX section of includes.h

`RedHat Linux Rembrandt-II`

+

from the DNIX section of includes.h

`RedHat Linux Rembrandt-II`

By default RedHat Rembrandt-II during installation adds an entry to /etc/hosts as follows: - + 127.0.0.1 loopback "hostname"."domainname" - - + + This causes Samba to loop back onto the loopback interface. The result is that Samba fails to communicate correctly with the world and therefor may fail to correctly negotiate who @@ -16232,10 +16235,10 @@ is the master browse list holder and who is the master browser. Corrective Action: Delete the entry after the word loopback in the line starting 127.0.0.1 -

`AIX`

`Sequential Read Ahead`

+

`AIX`

`Sequential Read Ahead`

Disabling Sequential Read Ahead using vmtune -r 0 improves Samba performance significantly. -

`Solaris`

`Locking improvements`

Some people have been experiencing problems with F_SETLKW64/fcntl +

`Solaris`

`Locking improvements`

Some people have been experiencing problems with F_SETLKW64/fcntl when running Samba on Solaris. The built in file locking mechanism was not scalable. Performance would degrade to the point where processes would get into loops of trying to lock a file. It would try a lock, then fail, @@ -16256,10 +16259,10 @@ and rebuild samba. Nsswitch on Solaris 9 refuses to use the winbind nss module. This behavior is fixed by Sun in patch 113476-05 which as of March 2003 is not in any roll-up packages. -

`Chapter 38. Samba and other CIFS clients`

`Jim McDonough`

IBM <jmcd@us.ibm.com>

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

5 Mar 2001

Table of Contents

How can I configure OS/2 Warp Connect or - OS/2 Warp 4 as a client for Samba?
How can I configure OS/2 Warp 3 (not Connect), - OS/2 1.2, 1.3 or 2.x for Samba?
How do I get printer driver download working - for OS/2 clients?

Use latest TCP/IP stack from Microsoft
Delete .pwl files after password change
Configure WfW password handling
Case handling of passwords
Use TCP/IP as default protocol
Speed improvement

Speed improvement

This chapter contains client-specific information.

`Macintosh clients?`

+

`Chapter 38. Samba and other CIFS clients`

`Jim McDonough`

IBM <jmcd@us.ibm.com>

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

5 Mar 2001

Table of Contents

How can I configure OS/2 Warp Connect or + OS/2 Warp 4 as a client for Samba?
How can I configure OS/2 Warp 3 (not Connect), + OS/2 1.2, 1.3 or 2.x for Samba?
How do I get printer driver download working + for OS/2 clients?

Use latest TCP/IP stack from Microsoft
Delete .pwl files after password change
Configure WfW password handling
Case handling of passwords
Use TCP/IP as default protocol
Speed improvement

Speed improvement

This chapter contains client-specific information.

`Macintosh clients?`

Yes. Thursby now has a CIFS Client / Server called DAVE

They test it against Windows 95, Windows NT and samba for @@ -16279,7 +16282,7 @@ What Samba offers MS Windows users, these packages offer to Macs. For more info on these packages, Samba, and Linux (and other UNIX-based systems) see http://www.eats.com/linux_mac_win.html -

`OS2 Client`

`How can I configure OS/2 Warp Connect or +`

`OS2 Client`

`How can I configure OS/2 Warp Connect or OS/2 Warp 4 as a client for Samba?`

A more complete answer to this question can be found on http://carol.wins.uva.nl/~leeuw/samba/warp.html.

Basically, you need three components:

The File and Print Client ('IBM Peer')

TCP/IP ('Internet support')

The "NetBIOS over TCP/IP" driver ('TCPBEUI')

Installing the first two together with the base operating @@ -16297,7 +16300,7 @@ packages, Samba, and Linux (and other UNIX-based systems) see to the "Names List", or specify a WINS server ('NetBIOS Nameserver' in IBM and RFC terminology). For Warp Connect you may need to download an update for 'IBM Peer' to bring it on - the same level as Warp 4. See the webpage mentioned above.

`How can I configure OS/2 Warp 3 (not Connect), + the same level as Warp 4. See the webpage mentioned above.`

`How can I configure OS/2 Warp 3 (not Connect), OS/2 1.2, 1.3 or 2.x for Samba?`

You can use the free Microsoft LAN Manager 2.2c Client for OS/2 from @@ -16315,7 +16318,7 @@ packages, Samba, and Linux (and other UNIX-based systems) see or NS2000 driver from ftp://ftp.cdrom.com/pub/os2/network/ndis/ instead. -

`How do I get printer driver download working +`

`How do I get printer driver download working for OS/2 clients?`

First, create a share called [PRINTDRV] that is world-readable. Copy your OS/2 driver files there. Note that the .EA_ files must still be separate, so you will need @@ -16332,7 +16335,7 @@ packages, Samba, and Linux (and other UNIX-based systems) see you the driver is not available. On the second attempt, it will work. This is fixed simply by adding the device name to the mapping, after which it will work on the first attempt. -

`Windows for Workgroups`

`Use latest TCP/IP stack from Microsoft`

Use the latest TCP/IP stack from Microsoft if you use Windows +

`Windows for Workgroups`

`Use latest TCP/IP stack from Microsoft`

Use the latest TCP/IP stack from Microsoft if you use Windows for Workgroups.

The early TCP/IP stacks had lots of bugs.

Microsoft has released an incremental upgrade to their TCP/IP 32-Bit @@ -16347,7 +16350,7 @@ fixed. New files include WINSOCK.DLL, TRACERT.EXE, NETSTAT.EXE, and NBTSTAT.EXE. -

`Delete .pwl files after password change`

+

`Delete .pwl files after password change`

WfWg does a lousy job with passwords. I find that if I change my password on either the unix box or the PC the safest thing to do is to delete the .pwl files in the windows directory. The PC will complain about not finding the files, but will soon get over it, allowing you to enter the new password. @@ -16356,7 +16359,7 @@ If you don't do this you may find that WfWg remembers and uses the old password, even if you told it a new one.

Often WfWg will totally ignore a password you give it in a dialog box. -

`Configure WfW password handling`

+

`Configure WfW password handling`

There is a program call admincfg.exe on the last disk (disk 8) of the WFW 3.11 disk set. To install it type EXPAND A:\ADMINCFG.EX_ C:\WINDOWS\ADMINCFG.EXE. @@ -16364,11 +16367,11 @@ Then add an icon for it via the Program Manager New Menu. This program allows you to control how WFW handles passwords. ie disable Password Caching etc for use with security = user -

`Case handling of passwords`

Windows for Workgroups uppercases the password before sending it to the server. Unix passwords can be case-sensitive though. Check the smb.conf(5) information on password level to specify what characters samba should try to uppercase when checking.

`Use TCP/IP as default protocol`

To support print queue reporting you may find +

`Case handling of passwords`

`Windows 2000 Service Pack 2`

There are several annoyances with Windows 2000 SP2. One of which only appears when using a Samba server to host user profiles to Windows 2000 SP2 clients in a Windows domain. This assumes @@ -16438,10 +16441,10 @@ the Win2k client a response to the QuerySecurityDescriptor trans2 call which causes the client to set a default ACL for the profile. This default ACL includes

DOMAIN\user "Full Control">

`Note`

This bug does not occur when using winbind to -create accounts on the Samba host for Domain users.

`Windows NT 3.1`

If you have problems communicating across routers with Windows +create accounts on the Samba host for Domain users.

`Windows NT 3.1`

If you have problems communicating across routers with Windows NT 3.1 workstations, read this Microsoft Knowledge Base article. -

`Chapter 39. Samba Performance Tuning`

`Paul Cochrane`

Dundee Limb Fitting Centre <paulc@dth.scot.nhs.uk>

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

`John H. Terpstra`

Samba Team <jht@samba.org>

Table of Contents

Comparisons
Socket options
Read size
Max xmit
Log level
Read raw
Write raw
Slow Logins
Client tuning
Samba performance problem due changing kernel
Corrupt tdb Files

`Comparisons`

+

`Chapter 39. Samba Performance Tuning`

`Paul Cochrane`

Dundee Limb Fitting Centre <paulc@dth.scot.nhs.uk>

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

`John H. Terpstra`

Samba Team <jht@samba.org>

Table of Contents

Comparisons
Socket options
Read size
Max xmit
Log level
Read raw
Write raw
Slow Logins
Client tuning
Samba performance problem due changing kernel
Corrupt tdb Files

`Comparisons`

The Samba server uses TCP to talk to the client. Thus if you are trying to see if it performs well you should really compare it to programs that use the same protocol. The most readily available @@ -16463,7 +16466,7 @@ suspect the biggest factor is not Samba vs some other system but the hardware and drivers used on the various systems. Given similar hardware Samba should certainly be competitive in speed with other systems. -

`Socket options`

+

`Socket options`

There are a number of socket options that can greatly affect the performance of a TCP based server like Samba.

@@ -16482,7 +16485,7 @@ biggest single difference for most networks. Many people report that adding socket options = TCP_NODELAY doubles the read performance of a Samba drive. The best explanation I have seen for this is that the Microsoft TCP/IP stack is slow in sending tcp ACKs. -

`Read size`

+

`Read size`

The option read size affects the overlap of disk reads/writes with network reads/writes. If the amount of data being transferred in several of the SMB commands (currently SMBwrite, SMBwriteX and @@ -16499,7 +16502,7 @@ The default value is 16384, but very little experimentation has been done yet to determine the optimal value, and it is likely that the best value will vary greatly between systems anyway. A value over 65536 is pointless and will cause you to allocate memory unnecessarily. -

`Max xmit`

+

`Max xmit`

At startup the client and server negotiate a maximum transmit size, which limits the size of nearly all SMB commands. You can set the maximum size that Samba will negotiate using the max xmit = option @@ -16513,12 +16516,12 @@ clients may perform better with a smaller transmit unit. Trying values of less than 2048 is likely to cause severe problems.

The write raw operation is designed to be an optimised, low-latency file write operation. A server may choose to not support it, however. and Samba makes support for write raw optional, with it @@ -16539,15 +16542,15 @@ being enabled by default.

Well today it happened, Our first major problem using samba. Our samba PDC server has been hosting 3 TB of data to our 500+ users [Windows NT/XP] for the last 3 years using samba, no problem. @@ -16580,10 +16583,10 @@ Q2) What I also would like to mention is that the service latency seems a lot lower then before the locks cleanup, any ideas on keeping it top notch?

A2) Yes! Same answer as for Q1! -

`Chapter 40. DNS and DHCP Configuration Guide`

`John H. Terpstra`

Samba Team <jht@samba.org>

Table of Contents

Note

`Note`

+

`Chapter 40. DNS and DHCP Configuration Guide`

`John H. Terpstra`

Samba Team <jht@samba.org>

Table of Contents

Note

`Note`

This chapter did not make it into this release. It is planned for the published release of this document. -

`Chapter 41. Further Resources`

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

`David Lechnyr`

Unofficial HOWTO <david@lechnyr.com>

May 1, 2003

Table of Contents

Websites
Related updates from Microsoft
Books

`Websites`

`Chapter 41. Further Resources`

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

`David Lechnyr`

Unofficial HOWTO <david@lechnyr.com>

May 1, 2003

Table of Contents

Websites
Related updates from Microsoft
Books

`Websites`

CIFS: Common Insecurities Fail Scrutiny by "Hobbit"
@@ -16670,7 +16673,7 @@ It is planned for the published release of this document. WFWG: Password Caching and How It Affects LAN Manager Security at Microsoft Knowledge Base -

`Related updates from Microsoft`

Enhanced Encryption for Windows 95 Password Cache @@ -16682,4 +16685,4 @@ It is planned for the published release of this document. Windows for Workgroups Sharing Updates -

`Books`

`Index`

+

`Books`

`Index`

diff --git a/docs/htmldocs/SambaHA.html b/docs/htmldocs/SambaHA.html index ba82f6ad0f..d8614deeb7 100644 --- a/docs/htmldocs/SambaHA.html +++ b/docs/htmldocs/SambaHA.html @@ -1,4 +1,5 @@ -Chapter 29. High Availability OptionsChapter 29. High Availability Options Prev Part III. Advanced Configuration Next Chapter 29. High Availability Options John H. Terpstra Samba Team <jht@samba.org> Table of Contents Note Note + +Chapter 29. High Availability Options Chapter 29. High Availability Options Prev Part III. Advanced Configuration Next Chapter 29. High Availability Options John H. Terpstra Samba Team <jht@samba.org> Table of Contents Note Note This chapter did not make it into this release. It is planned for the published release of this document. Prev Up Next Chapter 28. Samba Backup Techniques Home Part IV. Migration and Updating diff --git a/docs/htmldocs/ServerType.html b/docs/htmldocs/ServerType.html index 01f03662ae..e624c5ee27 100644 --- a/docs/htmldocs/ServerType.html +++ b/docs/htmldocs/ServerType.html @@ -1,4 +1,5 @@ -Chapter 4. Server Types and Security ModesChapter 4. Server Types and Security Modes Prev Part II. Server Configuration Basics Next Chapter 4. Server Types and Security Modes Andrew Tridgell Samba Team <tridge@samba.org> Jelmer R. Vernooij The Samba Team <jelmer@samba.org> John H. Terpstra Samba Team <jht@samba.org> Table of Contents Features and Benefits Server Types Samba Security Modes User Level Security Share Level Security Domain Security Mode (User Level Security) ADS Security Mode (User Level Security) Server Security (User Level Security) Seamless Windows Network Integration Common Errors What makes Samba a SERVER? What makes Samba a Domain Controller? What makes Samba a Domain Member? Constantly Losing Connections to Password Server + +Chapter 4. Server Types and Security Modes Chapter 4. Server Types and Security Modes Prev Part II. Server Configuration Basics Next Chapter 4. Server Types and Security Modes Andrew Tridgell Samba Team <tridge@samba.org> Jelmer R. Vernooij The Samba Team <jelmer@samba.org> John H. Terpstra Samba Team <jht@samba.org> Table of Contents Features and Benefits Server Types Samba Security Modes User Level Security Share Level Security Domain Security Mode (User Level Security) ADS Security Mode (User Level Security) Server Security (User Level Security) Seamless Windows Network Integration Common Errors What makes Samba a SERVER? What makes Samba a Domain Controller? What makes Samba a Domain Member? Constantly Losing Connections to Password Server This chapter provides information regarding the types of server that Samba may be configured to be. A Microsoft network administrator who wishes to migrate to or to use Samba will want to know what, within a Samba context, terms familiar to MS Windows @@ -11,7 +12,7 @@ and how these relate to MS Windows servers and clients. Firstly we should recognise the question so often asked, "Why would I want to use Samba?" So, in those chapters where the answer may be important you will see a section that highlights features and benefits. These may be for or against Samba. - Features and Benefits + Features and Benefits Two men were walking down a dusty road, when one suddenly kicked up a small red stone. It hurt his toe and lodged in his sandal. He took the stone out and cursed it with a passion and fury fitting his anguish. The other looked at the stone and said, that is a garnet - I @@ -47,13 +48,13 @@ So now, what are the benefits of features mentioned in this chapter? greater flexibility than MS Windows NT4 and in many cases a significantly higher utility than Active Directory domains with MS Windows 200x. - Server Types Administrators of Microsoft networks often refer to three + Server Types Administrators of Microsoft networks often refer to three different type of servers: Domain Controller Primary Domain Controller Backup Domain Controller ADS Domain Controller Domain Member Server Active Directory Member Server NT4 Style Domain Member Server Stand Alone Server The chapters covering Domain Control, Backup Domain Control and Domain Membership provide pertinent information regarding Samba-3 configuration for each of these server roles. The reader is strongly encouraged to become intimately familiar with the information presented. - Samba Security Modes + Samba Security Modes In this section the function and purpose of Samba's security modes are described. An accurate understanding of how Samba implements each security mode as well as how to configure MS Windows clients for each mode will significantly @@ -77,7 +78,7 @@ the way the client then tries to authenticate itself. It does not directly affec but it fits in with the client/server approach of SMB. In SMB everything is initiated and controlled by the client, and the server can only tell the client what is available and whether an action is allowed. - User Level Security + User Level Security We will describe user level security first, as it's simpler. In user level security, the client will send a session setup command directly after the protocol negotiation. @@ -95,13 +96,13 @@ It is also possible for a client to send multiple ses requests. When the server responds, it gives the client a uid to use as an authentication tag for that username/password. The client can maintain multiple authentication contexts in this way (WinDD is an example of an application that does this). - Example Configuration + Example Configuration The smb.conf parameter that sets User Level Security is: security = user This is the default setting since samba-2.2.x. - Share Level Security + Share Level Security Ok, now for share level security. In share level security, the client authenticates itself separately for each share. It will send a password along with each tree connection (share mount). It does not explicitly send a @@ -124,18 +125,18 @@ of the share they try to connect to (useful for home directories) and any users listed in the user = smb.conf line. The password is then checked in turn against these possible usernames. If a match is found then the client is authenticated as that user. - Example Configuration + Example Configuration The smb.conf parameter that sets Share Level Security is: security = share Please note that there are reports that recent MS Windows clients do not like to work with share mode security servers. You are strongly discouraged from using share level security. - Domain Security Mode (User Level Security) + Domain Security Mode (User Level Security) When Samba is operating in security = domain mode, the Samba server has a domain security trust account (a machine account) and will cause all authentication requests to be passed through to the domain controllers. - Example Configuration + Example Configuration Samba as a Domain Member Server This method involves addition of the following parameters in the smb.conf file: @@ -147,24 +148,24 @@ In order for this method to work, the Samba server needs to join the MS Windows security domain. This is done as follows: On the MS Windows NT domain controller, using the Server Manager, add a machine account for the Samba server. - Next, on the Unix/Linux system execute: root# smbpasswd -j DOMAIN_NAME -r PDC_NAME (samba-2.x) root# net join -U administrator%password (samba-3) Note + Next, on the Unix/Linux system execute: root# smbpasswd -j DOMAIN_NAME -r PDC_NAME (samba-2.x) root# net join -U administrator%password (samba-3) Note As of Samba-2.2.4 the Samba 2.2.x series can auto-join a Windows NT4 style Domain just by executing: - + root# smbpasswd -j DOMAIN_NAME -r PDC_NAME -U Administrator%password - + As of Samba-3 the same can be done by executing: - + root# net join -U Administrator%password - + It is not necessary with Samba-3 to specify the DOMAIN_NAME or the PDC_NAME as it figures this out from the smb.conf file settings. - + Use of this mode of authentication does require there to be a standard Unix account -for each user in order to assign a uid once the account has been authenticated by +for each user in order to assign a UID once the account has been authenticated by the remote Windows DC. This account can be blocked to prevent logons by clients other than -MS Windows through things such as setting an invalid shell in the +MS Windows through means such as setting an invalid shell in the /etc/passwd entry. An alternative to assigning UIDs to Windows users on a Samba member server is @@ -173,7 +174,7 @@ in this HOWTO collection. For more information of being a domain member, see the Domain Member section of this Howto. - ADS Security Mode (User Level Security) + ADS Security Mode (User Level Security) Both Samba 2.2 and 3.0 can join an Active Directory domain. This is possible even if the domain is run in native mode. Active Directory in native mode perfectly allows NT4-style domain members, contrary to @@ -187,7 +188,7 @@ authentication protocols. All your machines are running Windows 2000 and above and all use full Kerberos. In this case Samba as a NT4-style domain would still require NT-compatible authentication data. Samba in AD-member mode can accept Kerberos. - Example Configuration + Example Configuration realm = your.kerberos.REALM security = ADS @@ -197,7 +198,7 @@ AD-member mode can accept Kerberos. Please refer to the Domain Membership and Active Directory Membership sections for more information regarding this configuration option. - Server Security (User Level Security) + Server Security (User Level Security) Server security mode is a left over from the time when Samba was not capable of acting as a domain member server. It is highly recommended NOT to use this feature. Server security mode has many draw backs. The draw backs include: @@ -229,7 +230,7 @@ lookups because the choice of the target authentication server is arbitrary and be determined from a domain name. In essence, a Samba server that is in server security mode is operating in what used to be known as workgroup mode. - Example Configuration + Example Configuration Using MS Windows NT as an authentication server This method involves the additions of the following parameters in the smb.conf file: @@ -238,8 +239,8 @@ This method involves the additions of the following parameters in the -There are two ways of identifying whether or not a username and password pair was valid -or not. One uses the reply information provided as part of the authentication messaging +There are two ways of identifying whether or not a username and password pair was valid. +One uses the reply information provided as part of the authentication messaging process, the other uses just an error code. The down-side of this mode of configuration is the fact that for security reasons Samba @@ -250,7 +251,7 @@ certain number of failed authentication attempts this will result in user lockou Use of this mode of authentication does require there to be a standard Unix account for the user, though this account can be blocked to prevent logons by non-SMB/CIFS clients. - Seamless Windows Network Integration +

`Seamless Windows Network Integration`

MS Windows clients may use encrypted passwords as part of a challenge/response authentication model (a.k.a. NTLMv1 and NTLMv2) or alone, or clear text strings for simple password based authentication. It should be realized that with the SMB protocol, @@ -293,23 +294,23 @@ when using clear text authentication.

By default Samba will lower case the username before attempting to lookup the user in the database of local system accounts. Because UNIX usernames conventionally -only contain lower case character, the username level parameter +only contain lower-case characters, the username level parameter is rarely needed.

-However, passwords on UNIX systems often make use of mixed case characters. +However, passwords on UNIX systems often make use of mixed-case characters. This means that in order for a user on a Windows 9x client to connect to a Samba server using clear text authentication, the password level -must be set to the maximum number of upper case letter which could -appear is a password. Note that the server OS uses the traditional DES version +must be set to the maximum number of upper case letters which could +appear in a password. Note that the server OS uses the traditional DES version of crypt(), a password level of 8 will result in case insensitive passwords as seen from Windows users. This will also result in longer login times as Samba has to compute the permutations of the password string and try them one by one until a match is located (or all combinations fail).

Why does server_validate() simply give up rather than re-establishing its connection to the password server? Though I am not fluent in the SMB protocol, perhaps the cluster server process passes along to its client workstation the session key it receives from the password diff --git a/docs/htmldocs/StandAloneServer.html b/docs/htmldocs/StandAloneServer.html index a3bdf439af..272df7a27b 100644 --- a/docs/htmldocs/StandAloneServer.html +++ b/docs/htmldocs/StandAloneServer.html @@ -1,9 +1,10 @@ -Chapter 8. Stand-Alone Servers

Chapter 8. Stand-Alone Servers
Prev	Part II. Server Configuration Basics	Next

`Chapter 8. Stand-Alone Servers`

`John H. Terpstra`

Samba Team <jht@samba.org>

Table of Contents

Example Configuration

Background

Reference Documentation Server
Central Print Serving

+ +Chapter 8. Stand-Alone Servers

Chapter 8. Stand-Alone Servers
Prev	Part II. Server Configuration Basics	Next

`Chapter 8. Stand-Alone Servers`

`John H. Terpstra`

Samba Team <jht@samba.org>

Table of Contents

Example Configuration

Background

Reference Documentation Server
Central Print Serving

Features And Benefits

Configuration of a simple print server is very simple if you have all the right tools on your system.

Assumptions:

@@ -98,27 +99,27 @@ In this example our print server will spool all incoming print jobs to /var/spool/samba until the job is ready to be submitted by Samba to the CUPS print processor. Since all incoming connections will be as the anonymous (guest) user, two things will be required: -
Enabling Anonymous Printing
- +
  Enabling Anonymous Printing
  - The Unix/Linux system must have a guest account. The default for this is usually the account nobody. To find the correct name to use for your version of Samba do the following: - + $ testparm -s -v | grep "guest account" - + Then make sure that this account exists in your system password database (/etc/passwd). -
  - +
  - The directory into which Samba will spool the file must have write access for the guest account. The following commands will ensure that this directory is available for use: - + root# mkdir /var/spool/samba root# chown nobody.nobody /var/spool/samba root# chmod a+rwt /var/spool/samba - -
  -
```
+	
```
  +
+ # Global parameters [global] workgroup = MYGROUP @@ -136,8 +137,8 @@ the anonymous (guest) user, two things will be required: printing = cups use client driver = Yes browseable = No - -

`Common Errors`

+ +

`Common Errors`

The greatest mistake so often made is to make a network configuration too complex. It pays to use the simplest solution that will meet the needs of the moment.

Prev	Up	Next
Chapter 7. Domain Membership	Home	Chapter 9. MS Windows Network Configuration Guide

diff --git a/docs/htmldocs/VFS.html b/docs/htmldocs/VFS.html index 6b520d792a..0b22d2e1fb 100644 --- a/docs/htmldocs/VFS.html +++ b/docs/htmldocs/VFS.html @@ -1,38 +1,39 @@ -Chapter 20. Stackable VFS modulesChapter 20. Stackable VFS modules Prev Part III. Advanced Configuration Next Chapter 20. Stackable VFS modules Jelmer R. Vernooij The Samba Team <jelmer@samba.org> John H. Terpstra Samba Team <jht@samba.org> Tim Potter Simo Sorce original vfs_skel README Alexander Bokovoy original vfs_netatalk docs Stefan Metzmacher Update for multiple modules Table of Contents Features and Benefits Discussion Included modules audit extd_audit fake_perms recycle netatalk VFS modules available elsewhere DatabaseFS vscan Common ErrorsFeatures and Benefits + +Chapter 20. Stackable VFS modules Chapter 20. Stackable VFS modules Prev Part III. Advanced Configuration Next Chapter 20. Stackable VFS modules Jelmer R. Vernooij The Samba Team <jelmer@samba.org> John H. Terpstra Samba Team <jht@samba.org> Tim Potter Simo Sorce original vfs_skel README Alexander Bokovoy original vfs_netatalk docs Stefan Metzmacher Update for multiple modules Table of Contents Features and Benefits Discussion Included modules audit extd_audit fake_perms recycle netatalk VFS modules available elsewhere DatabaseFS vscan Common Errors Features and Benefits Since Samba-3, there is support for stackable VFS(Virtual File System) modules. Samba passes each request to access the unix file system thru the loaded VFS modules. This chapter covers all the modules that come with the samba source and references to some external modules. - Discussion + Discussion If not supplied with your platform distribution binary Samba package you may have problems to compile these modules, as shared libraries are compiled and linked in different ways on different systems. They currently have been tested against GNU/Linux and IRIX. - + To use the VFS modules, create a share similar to the one below. The important parameter is the vfs objects parameter where you can list one or more VFS modules by name. For example, to log all access to files and put deleted files in a recycle bin: - + [audit] comment = Audited /data directory path = /data vfs objects = audit recycle writeable = yes browseable = yes - - + + The modules are used in the order in which they are specified. Samba will attempt to load modules from the lib directory in the root directory of the samba installation (usually /usr/lib/samba/vfs or /usr/local/samba/lib/vfs ). - + Some modules can be used twice for the same share. This can be done using a configuration similar to the one below. - + [test] comment = VFS TEST path = /data @@ -42,12 +43,12 @@ This can be done using a configuration similar to the one below. example1: parameter = 1 example: parameter = 5 test: parameter = 7 - - Included modules audit + + Included modules audit A simple module to audit file access to the syslog facility. The following operations are logged: - share connect/disconnect directory opens/create/remove file open/close/rename/unlink/chmod - extd_audit + share connect/disconnect directory opens/create/remove file open/close/rename/unlink/chmod + extd_audit This module is identical with the audit module above except that it sends audit logs to both syslog as well as the smbd log file/s. The loglevel for this module is set in the smb.conf file. @@ -55,23 +56,23 @@ This can be done using a configuration similar to the one below. The logging information that will be written to the smbd log file is controlled by the log level parameter in smb.conf. The following information will be recorded: - Table 20.1. Extended Auditing Log Information Log Level Log Details - File and Directory Operations 0 Creation / Deletion 1 Create / Delete / Rename / Permission Changes 2 Create / Delete / Rename / Perm Change / Open / Close fake_perms + Table 20.1. Extended Auditing Log Information Log Level Log Details - File and Directory Operations 0 Creation / Deletion 1 Create / Delete / Rename / Permission Changes 2 Create / Delete / Rename / Perm Change / Open / Close fake_perms This module was created to allow Roaming Profile files and directories to be set (on the Samba server under Unix) as read only. This module will if installed on the Profiles share will report to the client that the Profile files and directories are writable. This satisfies the client even though the files will never be overwritten as the client logs out or shuts down. - recycle + recycle A recycle-bin like module. When used any unlink call will be intercepted and files moved to the recycle directory instead of being deleted. - Supported options: - recycle:repository FIXME recycle:keeptree FIXME recycle:versions FIXME recycle:touch FIXME recycle:maxsize FIXME recycle:exclude FIXME recycle:exclude_dir FIXME recycle:noversions FIXME - netatalk + Supported options: + recycle:repository FIXME recycle:keeptree FIXME recycle:versions FIXME recycle:touch FIXME recycle:maxsize FIXME recycle:exclude FIXME recycle:exclude_dir FIXME recycle:noversions FIXME + netatalk A netatalk module, that will ease co-existence of samba and netatalk file sharing services. - Advantages compared to the old netatalk module: - it doesn't care about creating of .AppleDouble forks, just keeps them in sync if a share in smb.conf doesn't contain .AppleDouble item in hide or veto list, it will be added automatically - VFS modules available elsewhere + Advantages compared to the old netatalk module: + it doesn't care about creating of .AppleDouble forks, just keeps them in sync if a share in smb.conf doesn't contain .AppleDouble item in hide or veto list, it will be added automatically + VFS modules available elsewhere This section contains a listing of various other VFS modules that have been posted but don't currently reside in the Samba CVS tree for one reason or another (e.g. it is easy for the maintainer @@ -79,7 +80,7 @@ to have his or her own CVS tree). No statements about the stability or functionality of any module should be implied due to its presence here. - DatabaseFS + DatabaseFS URL: http://www.css.tayloru.edu/~elorimer/databasefs/index.php By Eric Lorimer. I have created a VFS module which implements a fairly complete read-only @@ -94,12 +95,12 @@ should be implied due to its presence here. Any feedback would be appreciated: comments, suggestions, patches, etc... If nothing else, hopefully it might prove useful for someone else who wishes to create a virtual filesystem. - vscan URL: http://www.openantivirus.org/ + vscan URL: http://www.openantivirus.org/ samba-vscan is a proof-of-concept module for Samba, which uses the VFS (virtual file system) features of Samba 2.2.x/3.0 alphaX. Of course, Samba has to be compiled with VFS support. samba-vscan supports various virus scanners and is maintained by Rainer Link. - Common Errors + Common Errors There must be some gotchas we should record here! Jelmer??? Prev Up Next Chapter 19. CUPS Printing Support in Samba 3.0 Home Chapter 21. Integrated Logon Support using Winbind diff --git a/docs/htmldocs/bugreport.html b/docs/htmldocs/bugreport.html index 9ae4797d31..e8d7a8ccd3 100644 --- a/docs/htmldocs/bugreport.html +++ b/docs/htmldocs/bugreport.html @@ -1,4 +1,5 @@ -Chapter 35. Reporting BugsChapter 35. Reporting Bugs Prev Part V. Troubleshooting Next Chapter 35. Reporting Bugs Jelmer R. Vernooij The Samba Team <jelmer@samba.org> Someone; Tridge or Karl Auer perhaps? 27 June 1997 Table of Contents Introduction General info Debug levels Internal errors Attaching to a running process Patches Introduction Please report bugs using + +Chapter 35. Reporting Bugs Chapter 35. Reporting Bugs Prev Part V. Troubleshooting Next Chapter 35. Reporting Bugs Jelmer R. Vernooij The Samba Team <jelmer@samba.org> Someone; Tridge or Karl Auer perhaps? 27 June 1997 Table of Contents Introduction General info Debug levels Internal errors Attaching to a running process Patches Introduction Please report bugs using bugzilla. Please take the time to read this file before you submit a bug report. Also, please see if it has changed between releases, as we @@ -20,7 +21,7 @@ that list that may be able to help you. You may also like to look though the recent mailing list archives, which are conveniently accessible on the Samba web pages at http://samba.org/samba/. - General info + General info Before submitting a bug report check your config for silly errors. Look in your log files for obvious messages that tell you that you've misconfigured something and run testparm to test your config @@ -32,7 +33,7 @@ This is very important. If you include part of a log file with your bug report then be sure to annotate it with exactly what you were doing on the client at the time, and exactly what the results were. - Debug levels + Debug levels If the bug has anything to do with Samba behaving incorrectly as a server (like refusing to open a file) then the log files will probably be very useful. Depending on the problem a log level of between 3 and @@ -67,7 +68,7 @@ debugging operations you may not need a setting higher than 3. Nearly all bugs can be tracked at a setting of 10, but be prepared for a VERY large volume of log data. - Internal errors + Internal errors If you get a INTERNAL ERROR message in your log files it means that Samba got an unexpected signal while running. It is probably a segmentation fault and almost certainly means a bug in Samba (unless @@ -100,7 +101,7 @@ disassemble the routine that called it) and try to work out exactly where the problem is by looking at the surrounding code. Even if you don't know assembly, including this info in the bug report can be useful. - Attaching to a running process + Attaching to a running process Unfortunately some unixes (in particular some recent linux kernels) refuse to dump a core file if the task has changed uid (which smbd does often). To debug with this sort of system you could try to attach @@ -110,7 +111,7 @@ to the running process using Then use c to continue and try to cause the core dump using the client. The debugger should catch the fault and tell you where it occurred. - Patches + Patches The best sort of bug report is one that includes a fix! If you send us patches please use diff -u format if your version of diff supports it, otherwise use diff -c4. Make sure diff --git a/docs/htmldocs/compiling.html b/docs/htmldocs/compiling.html index d8b85602d9..836fb50bb8 100644 --- a/docs/htmldocs/compiling.html +++ b/docs/htmldocs/compiling.html @@ -1,8 +1,9 @@ -Chapter 36. How to compile SAMBA Chapter 36. How to compile SAMBA Prev Part VI. Appendixes Next Chapter 36. How to compile SAMBA Jelmer R. Vernooij The Samba Team <jelmer@samba.org> Someone; Jerry perhaps? 22 May 2001 18 March 2003 Table of Contents Access Samba source code via CVS Introduction CVS Access to samba.org Accessing the samba sources via rsync and ftp Verifying Samba's PGP signature Building the Binaries Compiling samba with Active Directory support Starting the smbd and nmbd Starting from inetd.conf Alternative: starting it as a daemon Common Errors + +Chapter 36. How to compile SAMBA Chapter 36. How to compile SAMBA Prev Part VI. Appendixes Next Chapter 36. How to compile SAMBA Jelmer R. Vernooij The Samba Team <jelmer@samba.org> Someone; Jerry perhaps? 22 May 2001 18 March 2003 Table of Contents Access Samba source code via CVS Introduction CVS Access to samba.org Accessing the samba sources via rsync and ftp Verifying Samba's PGP signature Building the Binaries Compiling samba with Active Directory support Starting the smbd and nmbd Starting from inetd.conf Alternative: starting it as a daemon Common Errors You can obtain the samba source from the samba website. To obtain a development version, you can download samba from CVS or using rsync. - Access Samba source code via CVS Introduction + Access Samba source code via CVS Introduction Samba is developed in an open environment. Developers use CVS (Concurrent Versioning System) to "checkin" (also known as "commit") new source code. Samba's various CVS branches can @@ -11,12 +12,12 @@ detailed in this chapter. This chapter is a modified version of the instructions found at http://samba.org/samba/cvs.html - CVS Access to samba.org + CVS Access to samba.org The machine samba.org runs a publicly accessible CVS repository for access to the source code of several packages, including samba, rsync, distcc, ccache and jitterbug. There are two main ways of accessing the CVS server on this host. - Access via CVSweb + Access via CVSweb You can access the source code via your favourite WWW browser. This allows you to access the contents of individual files in the repository and also to look at the revision @@ -24,7 +25,7 @@ history and commit logs of individual files. You can also ask for a diff listing between any two versions on the repository. Use the URL : http://samba.org/cgi-bin/cvsweb - Access via cvs + Access via cvs You can also access the source code via a normal cvs client. This gives you much more control over what you can do with the repository and allows you to checkout whole source trees @@ -74,7 +75,7 @@ on this system just substitute the correct package name the following command from within the samba directory: cvs update -d -P - Accessing the samba sources via rsync and ftp + Accessing the samba sources via rsync and ftp pserver.samba.org also exports unpacked copies of most parts of the CVS tree at ftp://pserver.samba.org/pub/unpacked and also via anonymous rsync at rsync://pserver.samba.org/ftp/unpacked/. I recommend using rsync rather than ftp. @@ -83,7 +84,7 @@ on this system just substitute the correct package name The disadvantage of the unpacked trees is that they do not support automatic merging of local changes like CVS does. rsync access is most convenient for an initial install. - Verifying Samba's PGP signature + Verifying Samba's PGP signature In these days of insecurity, it's strongly recommended that you verify the PGP signature for any source file before installing it. Even if you're not downloading from a mirror site, verifying PGP signatures should be a @@ -110,7 +111,7 @@ then all is well. The warnings about trust relationships can be ignored. An example of what you would not want to see would be: gpg: BAD signature from "Samba Distribution Verification Key" - Building the Binaries To do this, first run the program ./configure + Building the Binaries To do this, first run the program ./configure in the source directory. This should automatically configure Samba for your operating system. If you have unusual needs then you may wish to run root# ./configure --help @@ -123,7 +124,7 @@ example of what you would not want to see would be: of Samba you might like to know that the old versions of the binaries will be renamed with a ".old" extension. You can go back to the previous version with root# make revert - if you find this version a disaster! Compiling samba with Active Directory support In order to compile samba with ADS support, you need to have installed + if you find this version a disaster! Compiling samba with Active Directory support In order to compile samba with ADS support, you need to have installed on your system: the MIT kerberos development libraries (either install from the sources or use a package). The Heimdal libraries will not work. the OpenLDAP development libraries. If your kerberos libraries are in a non-standard location then @@ -135,12 +136,12 @@ example of what you would not want to see would be: #define HAVE_LDAP 1 If it doesn't then configure did not find your krb5 libraries or your ldap libraries. Look in config.log to figure - out why and fix it. Installing the required packages for Debian On Debian you need to install the following packages: - libkrb5-dev krb5-user - Installing the required packages for RedHat On RedHat this means you should have at least: - krb5-workstation (for kinit) krb5-libs (for linking with) krb5-devel (because you are compiling from source) - in addition to the standard development environment. Note that these are not standard on a RedHat install, and you may need - to get them off CD2. Starting the smbd and nmbd You must choose to start smbd and nmbd either + out why and fix it. Installing the required packages for Debian On Debian you need to install the following packages: + libkrb5-dev krb5-user + Installing the required packages for RedHat On RedHat this means you should have at least: + krb5-workstation (for kinit) krb5-libs (for linking with) krb5-devel (because you are compiling from source) + in addition to the standard development environment. Note that these are not standard on a RedHat install, and you may need + to get them off CD2. Starting the smbd and nmbd You must choose to start smbd and nmbd either as daemons or from inetd. Don't try to do both! Either you can put them in inetd.conf and have them started on demand @@ -152,7 +153,7 @@ example of what you would not want to see would be: Samba. In many cases you must be root. The main advantage of starting smbd and nmbd using the recommended daemon method is that they will respond slightly more quickly to an initial connection - request. Starting from inetd.conf Note The following will be different if + request. Starting from inetd.conf Note The following will be different if you use NIS, NIS+ or LDAP to distribute services maps. Look at your /etc/services. What is defined at port 139/tcp. If nothing is defined then add a line like this: netbios-ssn 139/tcp similarly for 137/udp you should have an entry like: netbios-ns 137/udp Next edit your /etc/inetd.conf @@ -178,7 +179,7 @@ example of what you would not want to see would be: arguments, or you should use a script, and start the script from inetd. Restart inetd, perhaps just send it a HUP. If you have installed an earlier version of nmbd then - you may need to kill nmbd as well. Alternative: starting it as a daemon To start the server as a daemon you should create + you may need to kill nmbd as well. Alternative: starting it as a daemon To start the server as a daemon you should create a script something like this one, perhaps calling it startsmb. #!/bin/sh @@ -190,7 +191,7 @@ example of what you would not want to see would be: To kill it send a kill signal to the processes nmbd and smbd. Note If you use the SVR4 style init system then you may like to look at the examples/svr4-startup - script to make Samba fit into that system. Common Errors “ + script to make Samba fit into that system. Common Errors “ I'm using gcc 3 and I've compiled Samba-3 from the CVS and the binaries are very large files (40 Mb and 20 Mb). I've the same result with --enable-shared ? diff --git a/docs/htmldocs/diagnosis.html b/docs/htmldocs/diagnosis.html index ff3099ac72..473f5e6985 100644 --- a/docs/htmldocs/diagnosis.html +++ b/docs/htmldocs/diagnosis.html @@ -1,4 +1,5 @@ -Chapter 33. The Samba checklist Chapter 33. The Samba checklist Prev Part V. Troubleshooting Next Chapter 33. The Samba checklist Andrew Tridgell Samba Team <tridge@samba.org> Jelmer R. Vernooij The Samba Team <jelmer@samba.org> Wed Jan 15 Table of Contents Introduction Assumptions The tests Still having troubles? Introduction + +Chapter 33. The Samba checklist Chapter 33. The Samba checklist Prev Part V. Troubleshooting Next Chapter 33. The Samba checklist Andrew Tridgell Samba Team <tridge@samba.org> Jelmer R. Vernooij The Samba Team <jelmer@samba.org> Wed Jan 15 Table of Contents Introduction Assumptions The tests Still having troubles? Introduction This file contains a list of tests you can perform to validate your Samba server. It also tells you what the likely cause of the problem is if it fails any one of these steps. If it passes all these tests @@ -13,7 +14,7 @@ to solve a problem. If you send one of the samba mailing lists an email saying "it doesn't work" and you have not followed this test procedure then you should not be surprised if your email is ignored. - Assumptions + Assumptions In all of the tests it is assumed you have a Samba server called BIGSERVER and a PC called ACLIENT both in workgroup TESTGROUP. @@ -30,8 +31,8 @@ following to smb.conf: path = /tmp read only = yes - - Note + + Note These tests assume version 3.0 or later of the samba suite. Some commands shown did not exist in earlier versions. @@ -54,7 +55,7 @@ depending on how or if you specified logging in your smb.co If you make changes to your smb.conf file while going through these test, don't forget to restart smbd and nmbd. - The tests Procedure 33.1. Diagnosing your samba server + The tests Procedure 33.1. Diagnosing your samba server In the directory in which you store your smb.conf file, run the command testparm smb.conf. If it reports any errors then your smb.conf configuration file is faulty. @@ -297,6 +298,6 @@ capability and is in user level security mode. In this case either set password server = Windows_NT_Machine in your smb.conf file, or make sure encrypted passwords is set to "yes". - Still having troubles? Read the chapter on + Still having troubles? Read the chapter on Analysing and Solving Problems. Prev Up Next Part V. Troubleshooting Home Chapter 34. Analysing and solving samba problems diff --git a/docs/htmldocs/domain-member.html b/docs/htmldocs/domain-member.html index 59040dfebc..19f8fd8677 100644 --- a/docs/htmldocs/domain-member.html +++ b/docs/htmldocs/domain-member.html @@ -1,4 +1,5 @@ -Chapter 7. Domain MembershipChapter 7. Domain Membership Prev Part II. Server Configuration Basics Next Chapter 7. Domain Membership John H. Terpstra Samba Team <jht@samba.org> Jeremy Allison Samba Team <jra@samba.org> Gerald (Jerry) Carter Samba Team <jerry@samba.org> Andrew Tridgell Samba Team <tridge@samba.org> Jelmer R. Vernooij The Samba Team <jelmer@samba.org> Table of Contents Features and Benefits MS Windows Workstation/Server Machine Trust Accounts Manual Creation of Machine Trust Accounts Using NT4 Server Manager to Add Machine Accounts to the Domain "On-the-Fly" Creation of Machine Trust Accounts Making an MS Windows Workstation or Server a Domain Member Domain Member Server Joining an NT4 type Domain with Samba-3 Why is this better than security = server? Samba ADS Domain Membership Setup your smb.conf Setup your /etc/krb5.conf Create the computer account Test your server setup Testing with smbclient Notes Common Errors Can Not Add Machine Back to Domain Adding Machine to Domain Fails + +Chapter 7. Domain Membership Chapter 7. Domain Membership Prev Part II. Server Configuration Basics Next Chapter 7. Domain Membership John H. Terpstra Samba Team <jht@samba.org> Jeremy Allison Samba Team <jra@samba.org> Gerald (Jerry) Carter Samba Team <jerry@samba.org> Andrew Tridgell Samba Team <tridge@samba.org> Jelmer R. Vernooij The Samba Team <jelmer@samba.org> Table of Contents Features and Benefits MS Windows Workstation/Server Machine Trust Accounts Manual Creation of Machine Trust Accounts Using NT4 Server Manager to Add Machine Accounts to the Domain "On-the-Fly" Creation of Machine Trust Accounts Making an MS Windows Workstation or Server a Domain Member Domain Member Server Joining an NT4 type Domain with Samba-3 Why is this better than security = server? Samba ADS Domain Membership Setup your smb.conf Setup your /etc/krb5.conf Create the computer account Test your server setup Testing with smbclient Notes Common Errors Can Not Add Machine Back to Domain Adding Machine to Domain Fails Domain Membership is a subject of vital concern, Samba must be able to participate as a member server in a Microsoft Domain security context, and Samba must be capable of providing Domain machine member trust accounts, @@ -11,7 +12,7 @@ within the current MS Windows networking world and particularly in the Unix/Linux networking and administration world, a considerable level of mis-information, incorrect understanding, and a lack of knowledge. Hopefully this chapter will fill the voids. - Features and Benefits + Features and Benefits MS Windows workstations and servers that want to participate in domain security need to be made Domain members. Participating in Domain security is often called @@ -48,7 +49,7 @@ Domain membership has many advantages: client or server, other than the central Domain database (either NT4/Samba SAM style Domain, NT4 Domain that is back ended with an LDAP directory, or via an Active Directory infrastructure) - MS Windows Workstation/Server Machine Trust Accounts + MS Windows Workstation/Server Machine Trust Accounts A machine trust account is an account that is used to authenticate a client machine (rather than a user) to the Domain Controller server. In Windows terminology, @@ -67,11 +68,11 @@ shared secret with the domain controller. A Windows NT4 PDC stores each machine trust account in the Windows Registry. The introduction of MS Windows 2000 saw the introduction of Active Directory, the new repository for machine trust accounts. - + A Samba PDC, however, stores each machine trust account in two parts, as follows: - + A Domain Security Account (stored in the passdb backend that has been configured in the smb.conf file. The precise nature of the account information that is @@ -91,8 +92,8 @@ as follows: /etc/passwd. Work is in progress to allow a simplified mode of operation that does not require Unix user accounts, but this may not be a feature of the early releases of Samba-3. - - + + There are three ways to create machine trust accounts: Manual creation from the Unix/Linux command line. Here, both the Samba and @@ -107,7 +108,7 @@ There are three ways to create machine trust accounts: created by Samba at the time the client is joined to the domain. (For security, this is the recommended method.) The corresponding Unix account may be created automatically or manually. - Manual Creation of Machine Trust Accounts + Manual Creation of Machine Trust Accounts The first step in manually creating a machine trust account is to manually create the corresponding Unix account in /etc/passwd. This can be done using vipw or another 'add user' command @@ -139,11 +140,11 @@ Now that the corresponding Unix account has been created, the next step is to cr the Samba account for the client containing the well-known initial machine trust account password. This can be done using the smbpasswd(8) command as shown here: - - + + root# smbpasswd -a -m machine_name - - + + where machine_name is the machine's NetBIOS name. The RID of the new machine account is generated from the UID of the corresponding Unix account. @@ -156,7 +157,7 @@ the corresponding Unix account. your domain using a machine with the same NetBIOS name. A PDC inherently trusts members of the domain and will serve out a large degree of user information to such clients. You have been warned! - Using NT4 Server Manager to Add Machine Accounts to the Domain + Using NT4 Server Manager to Add Machine Accounts to the Domain If the machine from which you are trying to manage the domain is an MS Windows NT4 workstation then the tool of choice is the package called SRVTOOLS.EXE. @@ -187,7 +188,7 @@ Launch the srvmgr.exe (Server Manager for Domains) and fo Add NT Workstation of Server, then enter the machine name in the field provided, then click the Add button. - "On-the-Fly" Creation of Machine Trust Accounts + "On-the-Fly" Creation of Machine Trust Accounts The second (and recommended) way of creating machine trust accounts is simply to allow the Samba server to create them as needed when the client is joined to the domain. @@ -202,10 +203,10 @@ Below is an example for a RedHat Linux system. [global] # <...remainder of parameters...> add machine script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u - Making an MS Windows Workstation or Server a Domain Member + Making an MS Windows Workstation or Server a Domain Member The procedure for making an MS Windows workstation of server a member of the domain varies with the version of Windows: - Windows 200x XP Professional + Windows 200x XP Professional When the user elects to make the client a domain member, Windows 200x prompts for an account and password that has privileges to create machine accounts in the domain. A Samba administrative account (i.e., a Samba account that has root privileges on the @@ -225,7 +226,7 @@ with the version of Windows: encryption key for setting the password of the machine trust account. The machine trust account will be created on-the-fly, or updated if it already exists. - Windows NT4 + Windows NT4 If the machine trust account was created manually, on the Identification Changes menu enter the domain name, but do not check the box Create a Computer Account in the Domain. @@ -238,7 +239,7 @@ with the version of Windows: Domain. In this case, joining the domain proceeds as above for Windows 2000 (i.e., you must supply a Samba administrative account when prompted). - Samba Joining a Samba client to a domain is documented in + Samba Joining a Samba client to a domain is documented in the Domain Member Server section of this chapter chapter. Domain Member Server This mode of server operation involves the Samba machine being made a member @@ -260,28 +261,28 @@ for more information regarding how to create a domain machine account for a domain member server as well as for information regarding how to enable the Samba domain member machine to join the domain and to be fully trusted by it. - Joining an NT4 type Domain with Samba-3 - Table 7.1. Assumptions NetBIOS name: SERV1 Win2K/NT domain name: DOM Domain's PDC NetBIOS name: DOMPDC Domain's BDC NetBIOS names: DOMBDC1 and DOMBDC2 - + Joining an NT4 type Domain with Samba-3 + Table 7.1. Assumptions NetBIOS name: SERV1 Win2K/NT domain name: DOM Domain's PDC NetBIOS name: DOMPDC Domain's BDC NetBIOS names: DOMBDC1 and DOMBDC2 + First, you must edit your smb.conf file to tell Samba it should now use domain security. Change (or add) your security line in the [global] section of your smb.conf to read: - - + + security = domain - - + + Next change the workgroup line in the [global] section to read: - - + + workgroup = DOM - - + + as this is the name of the domain we are joining. You must also have the parameter @@ -291,11 +292,11 @@ You must also have the parameter password server line in the [global] section to read: - - + + password server = DOMPDC DOMBDC1 DOMBDC2 - - + + These are the primary and backup domain controllers Samba will attempt to contact in order to authenticate users. Samba will try to contact each of these servers in order, so you may want to @@ -305,21 +306,21 @@ among domain controllers. Alternatively, if you want smbd to automatically determine the list of Domain controllers to use for authentication, you may set this line to be: - - + + password server = * - - + + This method allows Samba to use exactly the same mechanism that NT does. This method either broadcasts or uses a WINS database in order to find domain controllers to authenticate against. In order to actually join the domain, you must run this command: - - + + root# net join -S DOMPDC -UAdministrator%password - - + + If the -S DOMPDC argument is not given then the domain name will be obtained from smb.conf. @@ -354,7 +355,7 @@ as a shadow password file. Finally, restart your Samba daemons and get ready for clients to begin using domain security! - Why is this better than security = server? + Why is this better than security = server? Currently, domain security in Samba doesn't free you from having to create local Unix users to represent the users attaching to your server. This means that if domain user DOM\fred @@ -398,27 +399,30 @@ the NIS/NT Samba. Samba ADS Domain Membership This is a rough guide to setting up Samba 3.0 with Kerberos authentication against a Windows2000 KDC. A familiarity with Kerberos is assumed. - Setup your smb.conf + Setup your smb.conf You must use at least the following 3 options in smb.conf: realm = your.kerberos.REALM security = ADS encrypt passwords = yes - + In case samba can't figure out your ads server using your realm name, use the ads server option in smb.conf: - + ads server = your.kerberos.server - - Note + +Note You do not need a smbpasswd file, and older clients will be authenticated as if security = domain, although it won't do any harm and allows you to have local users not in the domain. It is expected that the above required options will change soon when active directory integration will get better. - Setup your /etc/krb5.conf + Setup your /etc/krb5.conf The minimal configuration for krb5.conf is: + [libdefaults] + default_realm = YOUR.KERBEROS.REALM + [realms] YOUR.KERBEROS.REALM = { kdc = your.kerberos.server @@ -451,20 +455,20 @@ straight to Creating a computer account and testing your servers is only needed if you want Kerberos support for smbd and winbindd. - Create the computer account + Create the computer account As a user that has write permission on the Samba private directory (usually root) run: - + root# net join -U Administrator%password - - Possible errors - ADS support not compiled in Samba must be reconfigured (remove config.cache) and recompiled + +Possible errors +ADS support not compiled in Samba must be reconfigured (remove config.cache) and recompiled (make clean all install) after the Kerberos libs and headers are installed. net join prompts for user name You need to login to the domain using kinit USERNAME@REALM. USERNAME must be a user who has rights to add a machine - to the domain. - Test your server setup + to the domain. + Test your server setup If the join was successful, you will see a new computer account with the NetBIOS name of your Samba server in Active Directory (in the "Computers" folder under Users and Computers. @@ -477,13 +481,13 @@ server? Does it have an encoding type of DES-CBC-MD5 ? On your Samba server try to login to a Win2000 server or your Samba server using smbclient and Kerberos. Use smbclient as usual, but specify the -k option to choose Kerberos authentication. - Notes + Notes You must change administrator password at least once after DC install, to create the right encoding types W2k doesn't seem to create the _kerberos._udp and _ldap._tcp in their defaults DNS setup. Maybe fixed in service packs? - Common Errors + Common Errors In the process of adding / deleting / re-adding domain member machine accounts there are many traps for the unwary player and there are many “little” things that can go wrong. It is particularly interesting how often subscribers on the samba mailing list have concluded @@ -491,7 +495,7 @@ after repeated failed attempts to add a machine account that it is necessary to MS Windows on t he machine. In truth, it is seldom necessary to reinstall because of this type of problem. The real solution is often very simple, and with understanding of how MS Windows networking functions. easily overcome. - Can Not Add Machine Back to Domain + Can Not Add Machine Back to Domain Problem: A Windows workstation was reinstalled. The original domain machine account was deleted and added immediately. The workstation will not join the domain if I use the same machine name. Attempts to add the machine fail with a message that the machine already @@ -500,7 +504,7 @@ exists on the network - I know it doesn't. Why is this failing? The original name is still in the NetBIOS name cache and must expire after machine account deletion BEFORE adding that same name as a domain member again. The best advice is to delete the old account and then to add the machine with a new name. - Adding Machine to Domain Fails + Adding Machine to Domain Fails Adding a Windows 200x or XP Professional machine to the Samba PDC Domain fails with a message that, The machine could not be added at this time, there is a network problem. Please try again later. Why? diff --git a/docs/htmldocs/groupmapping.html b/docs/htmldocs/groupmapping.html index 39fb34ce62..aebddeeb08 100644 --- a/docs/htmldocs/groupmapping.html +++ b/docs/htmldocs/groupmapping.html @@ -1,4 +1,5 @@ -Chapter 12. Mapping MS Windows and Unix Groups Chapter 12. Mapping MS Windows and Unix Groups Prev Part III. Advanced Configuration Next Chapter 12. Mapping MS Windows and Unix Groups Jean François Micouleau Gerald (Jerry) Carter Samba Team <jerry@samba.org> John H. Terpstra Samba Team <jht@samba.org> Table of Contents Features and Benefits Discussion Example Configuration Configuration Scripts Sample smb.conf add group script Script to configure Group Mapping Common Errors Adding Groups Fails Adding MS Windows Groups to MS Windows Groups Fails + +Chapter 12. Mapping MS Windows and Unix Groups Chapter 12. Mapping MS Windows and Unix Groups Prev Part III. Advanced Configuration Next Chapter 12. Mapping MS Windows and Unix Groups Jean François Micouleau Gerald (Jerry) Carter Samba Team <jerry@samba.org> John H. Terpstra Samba Team <jht@samba.org> Table of Contents Features and Benefits Discussion Example Configuration Configuration Scripts Sample smb.conf add group script Script to configure Group Mapping Common Errors Adding Groups Fails Adding MS Windows Groups to MS Windows Groups Fails Starting with Samba-3, new group mapping functionality is available to create associations between Windows group SIDs and UNIX groups. The groupmap subcommand included with the net tool can be used to manage these associations. @@ -8,7 +9,7 @@ be specified in smb.conf. This parameter was used to give the listed users membership in the Domain Admins Windows group which gave local admin rights on their workstations (in default configurations). - Features and Benefits + Features and Benefits Samba allows the administrator to create MS Windows NT4 / 200x group accounts and to arbitrarily associate them with Unix/Linux group accounts. @@ -31,7 +32,7 @@ Another work-around is to manually create a Unix/Linux group, then manually create the MS Windows NT4 / 200x group on the Samba server and then use the net groupmap tool to connect the two to each other. - Discussion + Discussion When installing MS Windows NT4 / 200x on a computer, the installation program creates default users and groups, notably the Administrators group, and gives that group privileges necessary privileges to perform essential system tasks. @@ -50,19 +51,19 @@ The following steps describe how to make Samba PDC users members of the 'Domain Admins' group? create a unix group (usually in /etc/group), let's call it domadm - add to this group the users that must be Administrators. For example + add to this group the users that must be Administrators. For example if you want joe, john and mary, your entry in /etc/group will look like: domadm:x:502:joe,john,mary - - + + Map this domadm group to the "Domain Admins" group by running the command: - - + + root# net groupmap add ntgroup="Domain Admins" unixgroup=domadm - - + + The quotes around "Domain Admins" are necessary due to the space in the group name. Also make sure to leave no whitespace surrounding the equal character (=). @@ -72,36 +73,36 @@ making any UNIX group a Windows domain group. For example, if you wanted to include a UNIX group (e.g. acct) in a ACL on a local file or printer on a domain member machine, you would flag that group as a domain group by running the following on the Samba PDC: - - + + root# net groupmap add rid=1000 ntgroup="Accounting" unixgroup=acct - - + + Be aware that the RID parameter is a unsigned 32 bit integer that should normally start at 1000. However, this rid must not overlap with any RID assigned to a user. Verifying this is done differently depending on on the passdb backend you are using. Future versions of the tools may perform the verification automatically, but for now the burden is on you. - Example Configuration + Example Configuration You can list the various groups in the mapping database by executing net groupmap list. Here is an example: - - + + root# net groupmap list System Administrators (S-1-5-21-2547222302-1596225915-2414751004-1002) -> sysadmin Domain Admins (S-1-5-21-2547222302-1596225915-2414751004-512) -> domadmin Domain Users (S-1-5-21-2547222302-1596225915-2414751004-513) -> domuser Domain Guests (S-1-5-21-2547222302-1596225915-2414751004-514) -> domguest - - + + For complete details on net groupmap, refer to the net(8) man page. - Configuration Scripts + Configuration Scripts Everyone needs tools. Some of us like to create our own, others prefer to use canned tools (ie: prepared by someone else for general use). - Sample smb.conf add group script + Sample smb.conf add group script A script to great complying group names for use by the Samba group interfaces: - - Example 12.1. smbgrpadd.sh + +Example 12.1. smbgrpadd.sh #!/bin/bash @@ -117,17 +118,17 @@ cat /etc/group.bak | sed s/smbtmpgrp00/$1/g > /etc/group # Now return the GID as would normally happen. echo $thegid exit 0 - - + + The smb.conf entry for the above script would look like: - + add group script = /path_to_tool/smbgrpadd.sh %g - - Script to configure Group Mapping + + Script to configure Group Mapping In our example we have created a Unix/Linux group called ntadmin. Our script will create the additional groups Engineers, Marketoids, Gnomes: - - + + #!/bin/bash net groupmap modify ntgroup="Domain Admins" unixgroup=ntadmin @@ -150,16 +151,16 @@ net groupmap modify ntgroup="Power Users" unixgroup=sys #net groupmap add ntgroup="Engineers" unixgroup=Engineers type=d #net groupmap add ntgroup="Marketoids" unixgroup=Marketoids type=d #net groupmap add ntgroup="Gnomes" unixgroup=Gnomes type=d - - + + Of course it is expected that the administrator will modify this to suit local needs. For information regarding the use of the net groupmap tool please refer to the man page. - Common Errors + Common Errors At this time there are many little surprises for the unwary administrator. In a real sense it is imperative that every step of automated control scripts must be carefully tested manually before putting them into active service. - Adding Groups Fails + Adding Groups Fails This is a common problem when the groupadd is called directly by the Samba interface script for the add group script in the smb.conf file. @@ -173,6 +174,6 @@ manually before putting them into active service. third option is to manually create a Unix/Linux group account that can substitute for the MS Windows group name, then use the procedure listed above to map that group to the MS Windows group. - Adding MS Windows Groups to MS Windows Groups Fails + Adding MS Windows Groups to MS Windows Groups Fails Samba-3 does NOT support nested groups from the MS Windows control environment. Prev Up Next Chapter 11. Account Information Databases Home Chapter 13. File, Directory and Share Access Controls diff --git a/docs/htmldocs/index.html b/docs/htmldocs/index.html index f7bc47b7c8..fb21bbe639 100755 --- a/docs/htmldocs/index.html +++ b/docs/htmldocs/index.html @@ -1,3 +1,4 @@ + SAMBA Project DocumentationSAMBA Project Documentation Next SAMBA Project Documentation Edited by Jelmer R. Vernooij John H. Terpstra Gerald (Jerry) Carter +"> SAMBA Project Documentation Next SAMBA Project Documentation Edited by Jelmer R. Vernooij John H. Terpstra Gerald (Jerry) Carter This documentation is distributed under the GNU General Public License (GPL) version 2. A copy of the license is included with the Samba source distribution. A copy can be found on-line at http://www.fsf.org/licenses/gpl.txt - Attributions. - Introduction to Samba David Lechnyr <david@lechnyr.com> How to Install and Test SAMBA Andrew Tridgell <tridge@samba.org> Jelmer Vernooij <jelmer@samba.org> John Terpstra <jht@samba.org> Karl Auer Fast Start for the Impatient John Terpstra <jht@samba.org> Server Types and Security Modes Andrew Tridgell <tridge@samba.org> Jelmer Vernooij <jelmer@samba.org> John Terpstra <jht@samba.org> Domain Control John Terpstra <jht@samba.org> Gerald Carter <jerry@samba.org> David Bannon <dbannon@samba.org> Backup Domain Control John Terpstra <jht@samba.org> Volker Lendecke <Volker.Lendecke@SerNet.DE> Domain Membership John Terpstra <jht@samba.org> Jeremy Allison <jra@samba.org> Gerald Carter <jerry@samba.org> Andrew Tridgell <tridge@samba.org> Jelmer Vernooij <jelmer@samba.org> Stand-Alone Servers John Terpstra <jht@samba.org> MS Windows Network Configuration Guide John Terpstra <jht@samba.org> Samba / MS Windows Network Browsing Guide John Terpstra <jht@samba.org> Account Information Databases Jelmer Vernooij <jelmer@samba.org> Gerald Carter <jerry@samba.org> Jeremy Allison <jra@samba.org> John Terpstra <jht@samba.org> Olivier (lem) Lemaire <olem@IDEALX.org> Mapping MS Windows and Unix Groups Jean François Micouleau Gerald Carter <jerry@samba.org> John Terpstra <jht@samba.org> File, Directory and Share Access Controls John Terpstra <jht@samba.org> Jeremy Allison <jra@samba.org> File and Record Locking Jeremy Allison <jra@samba.org> Jelmer Vernooij <jelmer@samba.org> John Terpstra <jht@samba.org> Eric Roseme <eric.roseme@hp.com> Securing Samba Andrew Tridgell <tridge@samba.org> John Terpstra <jht@samba.org> Interdomain Trust Relationships John Terpstra <jht@samba.org> Rafal Szczesniak <mimir@samba.org> Hosting a Microsoft Distributed File System tree on Samba Shirish Kalele <samba@samba.org> Classical Printing Support Kurt Pfeifle <kpfeifle@danka.de> Gerald Carter <jerry@samba.org> CUPS Printing Support in Samba 3.0 Kurt Pfeifle <kpfeifle@danka.de> Ciprian Vizitiu <CVizitiu@gbif.org> (drawings) Stackable VFS modules Jelmer Vernooij <jelmer@samba.org> John Terpstra <jht@samba.org> Tim Potter Simo Sorce (original vfs_skel README) Alexander Bokovoy (original vfs_netatalk docs) Stefan Metzmacher (Update for multiple modules) Integrated Logon Support using Winbind Tim Potter <tpot@linuxcare.com.au> Andrew Tridgell <tridge@samba.org> Naag Mummaneni <getnag@rediffmail.com> Jelmer Vernooij <jelmer@samba.org> John Terpstra <jht@samba.org> Advanced Network Management John Terpstra <jht@samba.org> System and Account Policies John Terpstra <jht@samba.org> Desktop Profile Management John Terpstra <jht@samba.org> PAM based Distributed Authentication John Terpstra <jht@samba.org> Stephen Langasek <vorlon@netexpress.net> Integrating MS Windows networks with Samba John Terpstra <jht@samba.org> Unicode/Charsets Jelmer Vernooij <jelmer@samba.org> TAKAHASHI Motonobu <monyo@home.monyo.com> Samba Backup Techniques John Terpstra <jht@samba.org> High Availability Options John Terpstra <jht@samba.org> Upgrading from Samba-2.x to Samba-3.0.0 Jelmer Vernooij <jelmer@samba.org> Migration from NT4 PDC to Samba-3 PDC John Terpstra <jht@samba.org> SWAT - The Samba Web Administration Tool John Terpstra <jht@samba.org> The Samba checklist Andrew Tridgell <tridge@samba.org> Jelmer Vernooij <jelmer@samba.org> Analysing and solving samba problems Gerald Carter <jerry@samba.org> Jelmer Vernooij <jelmer@samba.org> David Bannon <dbannon@samba.org> Reporting Bugs Jelmer Vernooij <jelmer@samba.org> Someone; Tridge or Karl Auer perhaps? How to compile SAMBA Jelmer Vernooij <jelmer@samba.org> Someone; Jerry perhaps? Portability Jelmer Vernooij <jelmer@samba.org> Samba and other CIFS clients Jim McDonough <jmcd@us.ibm.com> Jelmer Vernooij <jelmer@samba.org> Samba Performance Tuning Paul Cochrane <paulc@dth.scot.nhs.uk> Jelmer Vernooij <jelmer@samba.org> John Terpstra <jht@samba.org> DNS and DHCP Configuration Guide John Terpstra <jht@samba.org> Further Resources Jelmer Vernooij <jelmer@samba.org> David Lechnyr <david@lechnyr.com> + Attributions. + Introduction to Samba David Lechnyr <david@lechnyr.com> How to Install and Test SAMBA Andrew Tridgell <tridge@samba.org> Jelmer Vernooij <jelmer@samba.org> John Terpstra <jht@samba.org> Karl Auer Fast Start for the Impatient John Terpstra <jht@samba.org> Server Types and Security Modes Andrew Tridgell <tridge@samba.org> Jelmer Vernooij <jelmer@samba.org> John Terpstra <jht@samba.org> Domain Control John Terpstra <jht@samba.org> Gerald Carter <jerry@samba.org> David Bannon <dbannon@samba.org> Backup Domain Control John Terpstra <jht@samba.org> Volker Lendecke <Volker.Lendecke@SerNet.DE> Domain Membership John Terpstra <jht@samba.org> Jeremy Allison <jra@samba.org> Gerald Carter <jerry@samba.org> Andrew Tridgell <tridge@samba.org> Jelmer Vernooij <jelmer@samba.org> Stand-Alone Servers John Terpstra <jht@samba.org> MS Windows Network Configuration Guide John Terpstra <jht@samba.org> Samba / MS Windows Network Browsing Guide John Terpstra <jht@samba.org> Account Information Databases Jelmer Vernooij <jelmer@samba.org> Gerald Carter <jerry@samba.org> Jeremy Allison <jra@samba.org> John Terpstra <jht@samba.org> Olivier (lem) Lemaire <olem@IDEALX.org> Mapping MS Windows and Unix Groups Jean François Micouleau Gerald Carter <jerry@samba.org> John Terpstra <jht@samba.org> File, Directory and Share Access Controls John Terpstra <jht@samba.org> Jeremy Allison <jra@samba.org> File and Record Locking Jeremy Allison <jra@samba.org> Jelmer Vernooij <jelmer@samba.org> John Terpstra <jht@samba.org> Eric Roseme <eric.roseme@hp.com> Securing Samba Andrew Tridgell <tridge@samba.org> John Terpstra <jht@samba.org> Interdomain Trust Relationships John Terpstra <jht@samba.org> Rafal Szczesniak <mimir@samba.org> Hosting a Microsoft Distributed File System tree on Samba Shirish Kalele <samba@samba.org> Classical Printing Support Kurt Pfeifle <kpfeifle@danka.de> Gerald Carter <jerry@samba.org> CUPS Printing Support in Samba 3.0 Kurt Pfeifle <kpfeifle@danka.de> Ciprian Vizitiu <CVizitiu@gbif.org> (drawings) Stackable VFS modules Jelmer Vernooij <jelmer@samba.org> John Terpstra <jht@samba.org> Tim Potter Simo Sorce (original vfs_skel README) Alexander Bokovoy (original vfs_netatalk docs) Stefan Metzmacher (Update for multiple modules) Integrated Logon Support using Winbind Tim Potter <tpot@samba.org> Andrew Tridgell <tridge@samba.org> Naag Mummaneni <getnag@rediffmail.com> Jelmer Vernooij <jelmer@samba.org> John Terpstra <jht@samba.org> Advanced Network Management John Terpstra <jht@samba.org> System and Account Policies John Terpstra <jht@samba.org> Desktop Profile Management John Terpstra <jht@samba.org> PAM based Distributed Authentication John Terpstra <jht@samba.org> Stephen Langasek <vorlon@netexpress.net> Integrating MS Windows networks with Samba John Terpstra <jht@samba.org> Unicode/Charsets Jelmer Vernooij <jelmer@samba.org> TAKAHASHI Motonobu <monyo@home.monyo.com> Samba Backup Techniques John Terpstra <jht@samba.org> High Availability Options John Terpstra <jht@samba.org> Upgrading from Samba-2.x to Samba-3.0.0 Jelmer Vernooij <jelmer@samba.org> Migration from NT4 PDC to Samba-3 PDC John Terpstra <jht@samba.org> SWAT - The Samba Web Administration Tool John Terpstra <jht@samba.org> The Samba checklist Andrew Tridgell <tridge@samba.org> Jelmer Vernooij <jelmer@samba.org> Analysing and solving samba problems Gerald Carter <jerry@samba.org> Jelmer Vernooij <jelmer@samba.org> David Bannon <dbannon@samba.org> Reporting Bugs Jelmer Vernooij <jelmer@samba.org> Someone; Tridge or Karl Auer perhaps? How to compile SAMBA Jelmer Vernooij <jelmer@samba.org> Someone; Jerry perhaps? Portability Jelmer Vernooij <jelmer@samba.org> Samba and other CIFS clients Jim McDonough <jmcd@us.ibm.com> Jelmer Vernooij <jelmer@samba.org> Samba Performance Tuning Paul Cochrane <paulc@dth.scot.nhs.uk> Jelmer Vernooij <jelmer@samba.org> John Terpstra <jht@samba.org> DNS and DHCP Configuration Guide John Terpstra <jht@samba.org> Further Resources Jelmer Vernooij <jelmer@samba.org> David Lechnyr <david@lechnyr.com> - Monday April 21, 2003 Abstract + Monday April 21, 2003 Abstract This book is a collection of HOWTOs added to Samba documentation over the years. Samba is always under development, and so is its' documentation. This release of the documentation represents a major revision or layout as well as contents. @@ -41,36 +42,36 @@ insignificant number of ideas for inclusion (if not content itself) has been obt from a number of Unofficial HOWTOs - to each such author a big "Thank-you" is also offered. Please keep publishing your Unofficial HOWTOs - they are a source of inspiration and application knowledge that is most to be desired by many Samba users and administrators. - Table of Contents I. General Installation 1. Introduction to Samba Background Terminology Related Projects SMB Methodology Epilogue Miscellaneous 2. How to Install and Test SAMBA Obtaining and installing samba Configuring samba (smb.conf) Example Configuration SWAT Try listing the shares available on your - server Try connecting with the unix client Try connecting from a DOS, WfWg, Win9x, WinNT, - Win2k, OS/2, etc... client What If Things Don't Work? Common Errors Why are so many smbd processes eating memory? I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs 3. Fast Start for the Impatient Note II. Server Configuration Basics 4. Server Types and Security Modes Features and Benefits Server Types Samba Security Modes User Level Security Share Level Security Domain Security Mode (User Level Security) ADS Security Mode (User Level Security) Server Security (User Level Security) Seamless Windows Network Integration Common Errors What makes Samba a SERVER? What makes Samba a Domain Controller? What makes Samba a Domain Member? Constantly Losing Connections to Password Server 5. Domain Control Features and Benefits Basics of Domain Control Domain Controller Types Preparing for Domain Control Domain Control - Example Configuration Samba ADS Domain Control Domain and Network Logon Configuration Domain Network Logon Service Security Mode and Master Browsers Common Problems and Errors I cannot include a '$' in a machine name I get told "You already have a connection to the Domain...." + Table of Contents I. General Installation 1. Introduction to Samba Background Terminology Related Projects SMB Methodology Epilogue Miscellaneous 2. How to Install and Test SAMBA Obtaining and installing samba Configuring samba (smb.conf) Example Configuration SWAT Try listing the shares available on your + server Try connecting with the unix client Try connecting from a DOS, WfWg, Win9x, WinNT, + Win2k, OS/2, etc... client What If Things Don't Work? Common Errors Why are so many smbd processes eating memory? I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs 3. Fast Start for the Impatient Note II. Server Configuration Basics 4. Server Types and Security Modes Features and Benefits Server Types Samba Security Modes User Level Security Share Level Security Domain Security Mode (User Level Security) ADS Security Mode (User Level Security) Server Security (User Level Security) Seamless Windows Network Integration Common Errors What makes Samba a SERVER? What makes Samba a Domain Controller? What makes Samba a Domain Member? Constantly Losing Connections to Password Server 5. Domain Control Features and Benefits Basics of Domain Control Domain Controller Types Preparing for Domain Control Domain Control - Example Configuration Samba ADS Domain Control Domain and Network Logon Configuration Domain Network Logon Service Security Mode and Master Browsers Common Problems and Errors I cannot include a '$' in a machine name I get told "You already have a connection to the Domain...." or "Cannot join domain, the credentials supplied conflict with an -existing set.." when creating a machine trust account. The system can not log you on (C000019B).... The machine trust account for this computer either does not -exist or is not accessible. When I attempt to login to a Samba Domain from a NT4/W2K workstation, -I get a message about my account being disabled. Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable" 6. Backup Domain Control Features And Benefits Essential Background Information MS Windows NT4 Style Domain Control Active Directory Domain Control What qualifies a Domain Controller on the network? How does a Workstation find its domain controller? Backup Domain Controller Configuration Example Configuration Common Errors Machine Accounts keep expiring, what can I do? Can Samba be a Backup Domain Controller to an NT4 PDC? How do I replicate the smbpasswd file? Can I do this all with LDAP? 7. Domain Membership Features and Benefits MS Windows Workstation/Server Machine Trust Accounts Manual Creation of Machine Trust Accounts Using NT4 Server Manager to Add Machine Accounts to the Domain "On-the-Fly" Creation of Machine Trust Accounts Making an MS Windows Workstation or Server a Domain Member Domain Member Server Joining an NT4 type Domain with Samba-3 Why is this better than security = server? Samba ADS Domain Membership Setup your smb.conf Setup your /etc/krb5.conf Create the computer account Test your server setup Testing with smbclient Notes Common Errors Can Not Add Machine Back to Domain Adding Machine to Domain Fails 8. Stand-Alone Servers Features and Benefits Background Example Configuration Reference Documentation Server Central Print Serving Common Errors 9. MS Windows Network Configuration Guide Note III. Advanced Configuration 10. Samba / MS Windows Network Browsing Guide Features and Benefits What is Browsing? Discussion NetBIOS over TCP/IP TCP/IP - without NetBIOS DNS and Active Directory How Browsing Functions Setting up WORKGROUP Browsing Setting up DOMAIN Browsing Forcing Samba to be the master Making Samba the domain master Note about broadcast addresses Multiple interfaces Use of the Remote Announce parameter Use of the Remote Browse Sync parameter WINS - The Windows Internetworking Name Server Setting up a WINS server WINS Replication Static WINS Entries Helpful Hints Windows Networking Protocols Name Resolution Order Technical Overview of browsing Browsing support in Samba Problem resolution Browsing across subnets Common Errors How can one flush the Samba NetBIOS name cache without restarting Samba? My client reports "This server is not configured to list shared resources" 11. Account Information Databases Features and Benefits Technical Information Important Notes About Security Mapping User Identifiers between MS Windows and Unix Account Management Tools The smbpasswd Command The pdbedit Command Password Backends Plain Text smbpasswd - Encrypted Password Database tdbsam ldapsam MySQL XML Common Errors Users can not logon - Users not in Samba SAM Users are being added to the wrong backend database auth methods does not work 12. Mapping MS Windows and Unix Groups Features and Benefits Discussion Example Configuration Configuration Scripts Sample smb.conf add group script Script to configure Group Mapping Common Errors Adding Groups Fails Adding MS Windows Groups to MS Windows Groups Fails 13. File, Directory and Share Access Controls Features and Benefits File System Access Controls MS Windows NTFS Comparison with Unix File Systems Managing Directories File and Directory Access Control Share Definition Access Controls User and Group Based Controls File and Directory Permissions Based Controls Miscellaneous Controls Access Controls on Shares Share Permissions Management MS Windows Access Control Lists and Unix Interoperability Managing UNIX permissions Using NT Security Dialogs Viewing File Security on a Samba Share Viewing file ownership Viewing File or Directory Permissions Modifying file or directory permissions Interaction with the standard Samba create mask - parameters Interaction with the standard Samba file attribute - mapping Common Errors Users can not write to a public share I have set force user and Samba still makes root the owner of all the files - I touch! 14. File and Record Locking Features and Benefits Discussion Opportunistic Locking Overview Samba Opportunistic Locking Control Example Configuration MS Windows Opportunistic Locking and Caching Controls Workstation Service Entries Server Service Entries Persistent Data Corruption Common Errors locking.tdb error messages Additional Reading 15. Securing Samba Introduction Features and Benefits Technical Discussion of Protective Measures and Issues Using host based protection User based protection Using interface protection Using a firewall Using a IPC$ share deny NTLMv2 Security Upgrading Samba Common Errors Smbclient works on localhost, but the network is dead Why can users access home directories of other users? 16. Interdomain Trust Relationships Features and Benefits Trust Relationship Background Native MS Windows NT4 Trusts Configuration NT4 as the Trusting Domain (ie. creating the trusted account) NT4 as the Trusted Domain (ie. creating trusted account's password) Configuring Samba NT-style Domain Trusts Samba-3 as the Trusting Domain Samba-3 as the Trusted Domain Common Errors Tell me about Trust Relationships using Samba 17. Hosting a Microsoft Distributed File System tree on Samba Features and Benefits Common Errors 18. Classical Printing Support Features and Benefits Technical Introduction What happens if you send a Job from a Client Printing Related Configuration Parameters Parameters Recommended for Use Parameters for Backwards Compatibility Parameters no longer in use A simple Configuration to Print with Samba-3 Verification of "Settings in Use" with testparm A little Experiment to warn you Extended Sample Configuration to Print with Samba-3 Detailed Explanation of the Example's Settings The [global] Section The [printers] Section Any [my_printer_name] Section Print Commands Default Print Commands for various Unix Print Subsystems Setting up your own Print Commands Innovations in Samba Printing since 2.2 Client Drivers on Samba Server for Point'n'Print The [printer$] Section is removed from Samba-3 Creating the [print$] Share Parameters in the [print$] Section Subdirectory Structure in [print$] Installing Drivers into [print$] Setting Drivers for existing Printers with a Client GUI Setting Drivers for existing Printers with -rpcclient "The Proof of the Pudding lies in the Eating" (Client Driver Install -Procedure) The first Client Driver Installation IMPORTANT! Setting Device Modes on new Printers Further Client Driver Install Procedures Always make first Client Connection as root or "printer admin" Other Gotchas Setting Default Print Options for the Client Drivers Supporting large Numbers of Printers Adding new Printers with the Windows NT APW Weird Error Message Cannot connect under a -different Name Be careful when assembling Driver Files Samba and Printer Ports Avoiding the most common Misconfigurations of the Client Driver The Imprints Toolset What is Imprints? Creating Printer Driver Packages The Imprints Server The Installation Client Add Network Printers at Logon without User Interaction The addprinter command Migration of "Classical" printing to Samba-3 Publishing Printer Information in Active Directory or LDAP Common Errors and Problems I give my root password but I don't get access My printjobs get spooled into the spooling directory, but then get lost 19. CUPS Printing Support in Samba 3.0 Introduction Features and Benefits Overview Basic Configuration of CUPS support Linking of smbd with libcups.so Simple smb.conf Settings for CUPS More complex smb.conf Settings for -CUPS Advanced Configuration Central spooling vs. "Peer-to-Peer" printing CUPS/Samba as a "spooling-only" Print Server; "raw" printing -with Vendor Drivers on Windows Clients Driver Installation Methods on Windows Clients Explicitly enable "raw" printing for -application/octet-stream! Three familiar Methods for driver upload plus a new one Using CUPS/Samba in an advanced Way -- intelligent printing -with PostScript Driver Download GDI on Windows -- PostScript on Unix Windows Drivers, GDI and EMF Unix Printfile Conversion and GUI Basics PostScript and Ghostscript Ghostscript -- the Software RIP for non-PostScript Printers PostScript Printer Description (PPD) Specification CUPS can use all Windows-formatted Vendor PPDs CUPS also uses PPDs for non-PostScript Printers The CUPS Filtering Architecture MIME types and CUPS Filters MIME type Conversion Rules Filter Requirements Prefilters pstops pstoraster imagetops and imagetoraster rasterto [printers specific] CUPS Backends cupsomatic/Foomatic -- how do they fit into the Picture? The Complete Picture mime.convs "Raw" printing "application/octet-stream" printing PostScript Printer Descriptions (PPDs) for non-PS Printers Difference between cupsomatic/foomatic-rip and -native CUPS printing Examples for filtering Chains Sources of CUPS drivers / PPDs Printing with Interface Scripts Network printing (purely Windows) From Windows Clients to an NT Print Server Driver Execution on the Client Driver Execution on the Server Network Printing (Windows clients -- UNIX/Samba Print -Servers) From Windows Clients to a CUPS/Samba Print Server Samba receiving Jobfiles and passing them to CUPS Network PostScript RIP: CUPS Filters on Server -- clients use -PostScript Driver with CUPS-PPDs PPDs for non-PS Printers on UNIX PPDs for non-PS Printers on Windows Windows Terminal Servers (WTS) as CUPS Clients Printer Drivers running in "Kernel Mode" cause many -Problems Workarounds impose Heavy Limitations CUPS: a "Magical Stone"? PostScript Drivers with no major problems -- even in Kernel -Mode Setting up CUPS for driver Download cupsaddsmb: the unknown Utility Prepare your smb.conf for -cupsaddsmb CUPS Package of "PostScript Driver for WinNT/2k/XP" Recognize the different Driver Files Acquiring the Adobe Driver Files ESP Print Pro Package of "PostScript Driver for -WinNT/2k/XP" Caveats to be considered What are the Benefits of using the "CUPS PostScript Driver for -Windows NT/2k/XP" as compared to the Adobe Driver? Run "cupsaddsmb" (quiet Mode) Run "cupsaddsmb" with verbose Output Understanding cupsaddsmb How to recognize if cupsaddsm completed successfully cupsaddsmb with a Samba PDC cupsaddsmb Flowchart Installing the PostScript Driver on a Client Avoiding critical PostScript Driver Settings on the -Client Installing PostScript Driver Files manually (using -rpcclient) A Check of the rpcclient man Page Understanding the rpcclient man Page Producing an Example by querying a Windows Box What is required for adddriver and setdriver to succeed Manual Commandline Driver Installation in 15 little Steps Troubleshooting revisited The printing *.tdb Files Trivial DataBase Files Binary Format Losing *.tdb Files Using tdbbackup CUPS Print Drivers from Linuxprinting.org foomatic-rip and Foomatic explained foomatic-rip and Foomatic-PPD Download and Installation Page Accounting with CUPS Setting up Quotas Correct and incorrect Accounting Adobe and CUPS PostScript Drivers for Windows Clients The page_log File Syntax Possible Shortcomings Future Developments Other Accounting Tools Additional Material Auto-Deletion or Preservation of CUPS Spool Files CUPS Configuration Settings explained Pre-conditions Manual Configuration When not to use Samba to print to -CUPS In Case of Trouble..... Where to find Documentation How to ask for Help Where to find Help Appendix Printing from CUPS to Windows attached -Printers More CUPS filtering Chains Trouble Shooting Guidelines to fix typical Samba printing -Problems An Overview of the CUPS Printing Processes 20. Stackable VFS modules Features and Benefits Discussion Included modules audit extd_audit fake_perms recycle netatalk VFS modules available elsewhere DatabaseFS vscan Common Errors 21. Integrated Logon Support using Winbind Features and Benefits Introduction What Winbind Provides Target Uses How Winbind Works Microsoft Remote Procedure Calls Microsoft Active Directory Services Name Service Switch Pluggable Authentication Modules User and Group ID Allocation Result Caching Installation and Configuration Introduction Requirements Testing Things Out Conclusion Common Errors 22. Advanced Network Management Features and Benefits Remote Server Administration Remote Desktop Management Remote Management from NoMachines.Com Network Logon Script Magic Adding printers without user intervention Common Errors 23. System and Account Policies Features and Benefits Creating and Managing System Policies Windows 9x/Me Policies Windows NT4 Style Policy Files MS Windows 200x / XP Professional Policies Managing Account/User Policies Samba Editreg Toolset Windows NT4/200x Samba PDC System Startup and Logon Processing Overview Common Errors Policy Does Not Work 24. Desktop Profile Management Features and Benefits Roaming Profiles Samba Configuration for Profile Handling Windows Client Profile Configuration Information Sharing Profiles between W9x/Me and NT4/200x/XP workstations Profile Migration from Windows NT4/200x Server to Samba Mandatory profiles Creating/Managing Group Profiles Default Profile for Windows Users MS Windows 9x/Me MS Windows NT4 Workstation MS Windows 200x/XP Common Errors How does one set up roaming profiles for just one (or a few) user/s or group/s? Can NOT use Roaming Profiles Changing the default profile 25. PAM based Distributed Authentication Features and Benefits Technical Discussion PAM Configuration Syntax Example System Configurations smb.conf PAM Configuration Remote CIFS Authentication using winbindd.so Password Synchronization using pam_smbpass.so Common Errors pam_winbind problem 26. Integrating MS Windows networks with Samba Features and Benefits Background Information Name Resolution in a pure Unix/Linux world /etc/hosts /etc/resolv.conf /etc/host.conf /etc/nsswitch.conf Name resolution as used within MS Windows networking The NetBIOS Name Cache The LMHOSTS file HOSTS file DNS Lookup WINS Lookup Common Errors My Boomerang Won't Come Back Very Slow Network Connections Samba server name change problem 27. Unicode/Charsets Features and Benefits What are charsets and unicode? Samba and charsets Conversion from old names Japanese charsets 28. Samba Backup Techniques Note Features and Benefits 29. High Availability Options Note IV. Migration and Updating 30. Upgrading from Samba-2.x to Samba-3.0.0 Charsets Obsolete configuration options Password Backend 31. Migration from NT4 PDC to Samba-3 PDC Planning and Getting Started Objectives Steps In Migration Process Migration Options Planning for Success Samba Implementation Choices 32. SWAT - The Samba Web Administration Tool Features and Benefits Enabling SWAT for use Securing SWAT through SSL The SWAT Home Page Global Settings Share Settings Printers Settings The SWAT Wizard The Status Page The View Page The Password Change Page V. Troubleshooting 33. The Samba checklist Introduction Assumptions The tests Still having troubles? 34. Analysing and solving samba problems Diagnostics tools Installing 'Network Monitor' on an NT Workstation or a Windows 9x box Useful URLs Getting help from the mailing lists How to get off the mailing lists 35. Reporting Bugs Introduction General info Debug levels Internal errors Attaching to a running process Patches VI. Appendixes 36. How to compile SAMBA Access Samba source code via CVS Introduction CVS Access to samba.org Accessing the samba sources via rsync and ftp Verifying Samba's PGP signature Building the Binaries Compiling samba with Active Directory support Starting the smbd and nmbd Starting from inetd.conf Alternative: starting it as a daemon Common Errors 37. Portability HPUX SCO Unix DNIX RedHat Linux Rembrandt-II AIX Sequential Read Ahead Solaris Locking improvements Winbind on Solaris 9 38. Samba and other CIFS clients Macintosh clients? OS2 Client How can I configure OS/2 Warp Connect or - OS/2 Warp 4 as a client for Samba? How can I configure OS/2 Warp 3 (not Connect), - OS/2 1.2, 1.3 or 2.x for Samba? How do I get printer driver download working - for OS/2 clients? Windows for Workgroups Use latest TCP/IP stack from Microsoft Delete .pwl files after password change Configure WfW password handling Case handling of passwords Use TCP/IP as default protocol Speed improvement Windows '95/'98 Speed improvement Windows 2000 Service Pack 2 Windows NT 3.1 39. Samba Performance Tuning Comparisons Socket options Read size Max xmit Log level Read raw Write raw Slow Logins Client tuning Samba performance problem due changing kernel Corrupt tdb Files 40. DNS and DHCP Configuration Guide Note 41. Further Resources Websites Related updates from Microsoft Books Index List of Figures 19.1. Windows Printing to a local Printer 19.2. Printing to a Postscript Printer 19.3. Ghostscript as a RIP for non-postscript printers 19.4. Prefiltering in CUPS to form Postscript 19.5. Adding Device-specific Print Options 19.6. Postscript to intermediate Raster format 19.7. CUPS-raster production using Ghostscript 19.8. Image format to CUPS-raster format conversion 19.9. Raster to Printer Specific formats 19.10. cupsomatic/foomatic processing versus Native CUPS 19.11. Print Driver execution on the Client 19.12. Print Driver execution on the Server 19.13. Printing via CUPS/samba server 19.14. cupsaddsmb flowchart 19.15. CUPS Printing Overview List of Tables 7.1. Assumptions 10.1. Browse subnet example 1 10.2. Browse subnet example 2 10.3. Browse subnet example 3 10.4. Browse subnet example 4 11.1. Attributes in the sambaSamAccount objectclass (LDAP) 11.2. Basic smb.conf options for MySQL passdb backend 11.3. MySQL field names for MySQL passdb backend 13.1. Managing directories with unix and windows 13.2. User and Group Based Controls 13.3. File and Directory Permission Based Controls 13.4. Other Controls 20.1. Extended Auditing Log Information 24.1. User Shell Folder registry keys default values 24.2. Defaults of profile settings registry keys 24.3. Defaults of default user profile paths registry keys 25.1. Options recognized by pam_smbpass 31.1. The 3 Major Site Types 31.2. Nature of the Conversion Choices List of Examples 12.1. smbgrpadd.sh 13.1. Example File Next Part I. General Installation +existing set.." when creating a machine trust account.The system can not log you on (C000019B).... The machine trust account for this computer either does not +exist or is not accessible. When I attempt to login to a Samba Domain from a NT4/W2K workstation, +I get a message about my account being disabled. Until a few minutes after Samba has started, clients get the error "Domain Controller Unavailable" 6. Backup Domain Control Features And Benefits Essential Background Information MS Windows NT4 Style Domain Control Active Directory Domain Control What qualifies a Domain Controller on the network? How does a Workstation find its domain controller? Backup Domain Controller Configuration Example Configuration Common Errors Machine Accounts keep expiring, what can I do? Can Samba be a Backup Domain Controller to an NT4 PDC? How do I replicate the smbpasswd file? Can I do this all with LDAP? 7. Domain Membership Features and Benefits MS Windows Workstation/Server Machine Trust Accounts Manual Creation of Machine Trust Accounts Using NT4 Server Manager to Add Machine Accounts to the Domain "On-the-Fly" Creation of Machine Trust Accounts Making an MS Windows Workstation or Server a Domain Member Domain Member Server Joining an NT4 type Domain with Samba-3 Why is this better than security = server? Samba ADS Domain Membership Setup your smb.conf Setup your /etc/krb5.conf Create the computer account Test your server setup Testing with smbclient Notes Common Errors Can Not Add Machine Back to Domain Adding Machine to Domain Fails 8. Stand-Alone Servers Features and Benefits Background Example Configuration Reference Documentation Server Central Print Serving Common Errors 9. MS Windows Network Configuration Guide Note III. Advanced Configuration 10. Samba / MS Windows Network Browsing Guide Features and Benefits What is Browsing? Discussion NetBIOS over TCP/IP TCP/IP - without NetBIOS DNS and Active Directory How Browsing Functions Setting up WORKGROUP Browsing Setting up DOMAIN Browsing Forcing Samba to be the master Making Samba the domain master Note about broadcast addresses Multiple interfaces Use of the Remote Announce parameter Use of the Remote Browse Sync parameter WINS - The Windows Internetworking Name Server Setting up a WINS server WINS Replication Static WINS Entries Helpful Hints Windows Networking Protocols Name Resolution Order Technical Overview of browsing Browsing support in Samba Problem resolution Browsing across subnets Common Errors How can one flush the Samba NetBIOS name cache without restarting Samba? My client reports "This server is not configured to list shared resources" 11. Account Information Databases Features and Benefits Technical Information Important Notes About Security Mapping User Identifiers between MS Windows and Unix Account Management Tools The smbpasswd Command The pdbedit Command Password Backends Plain Text smbpasswd - Encrypted Password Database tdbsam ldapsam MySQL XML Common Errors Users can not logon - Users not in Samba SAM Users are being added to the wrong backend database auth methods does not work 12. Mapping MS Windows and Unix Groups Features and Benefits Discussion Example Configuration Configuration Scripts Sample smb.conf add group script Script to configure Group Mapping Common Errors Adding Groups Fails Adding MS Windows Groups to MS Windows Groups Fails 13. File, Directory and Share Access Controls Features and Benefits File System Access Controls MS Windows NTFS Comparison with Unix File Systems Managing Directories File and Directory Access Control Share Definition Access Controls User and Group Based Controls File and Directory Permissions Based Controls Miscellaneous Controls Access Controls on Shares Share Permissions Management MS Windows Access Control Lists and Unix Interoperability Managing UNIX permissions Using NT Security Dialogs Viewing File Security on a Samba Share Viewing file ownership Viewing File or Directory Permissions Modifying file or directory permissions Interaction with the standard Samba create mask + parameters Interaction with the standard Samba file attribute + mapping Common Errors Users can not write to a public share I have set force user and Samba still makes root the owner of all the files + I touch! 14. File and Record Locking Features and Benefits Discussion Opportunistic Locking Overview Samba Opportunistic Locking Control Example Configuration MS Windows Opportunistic Locking and Caching Controls Workstation Service Entries Server Service Entries Persistent Data Corruption Common Errors locking.tdb error messages Additional Reading 15. Securing Samba Introduction Features and Benefits Technical Discussion of Protective Measures and Issues Using host based protection User based protection Using interface protection Using a firewall Using a IPC$ share deny NTLMv2 Security Upgrading Samba Common Errors Smbclient works on localhost, but the network is dead Why can users access home directories of other users? 16. Interdomain Trust Relationships Features and Benefits Trust Relationship Background Native MS Windows NT4 Trusts Configuration NT4 as the Trusting Domain (ie. creating the trusted account) NT4 as the Trusted Domain (ie. creating trusted account's password) Configuring Samba NT-style Domain Trusts Samba-3 as the Trusting Domain Samba-3 as the Trusted Domain Common Errors Tell me about Trust Relationships using Samba 17. Hosting a Microsoft Distributed File System tree on Samba Features and Benefits Common Errors 18. Classical Printing Support Features and Benefits Technical Introduction What happens if you send a Job from a Client Printing Related Configuration Parameters Parameters Recommended for Use Parameters for Backwards Compatibility Parameters no longer in use A simple Configuration to Print with Samba-3 Verification of "Settings in Use" with testparm A little Experiment to warn you Extended Sample Configuration to Print with Samba-3 Detailed Explanation of the Example's Settings The [global] Section The [printers] Section Any [my_printer_name] Section Print Commands Default Print Commands for various Unix Print Subsystems Setting up your own Print Commands Innovations in Samba Printing since 2.2 Client Drivers on Samba Server for Point'n'Print The [printer$] Section is removed from Samba-3 Creating the [print$] Share Parameters in the [print$] Section Subdirectory Structure in [print$] Installing Drivers into [print$] Setting Drivers for existing Printers with a Client GUI Setting Drivers for existing Printers with +rpcclient "The Proof of the Pudding lies in the Eating" (Client Driver Install +Procedure) The first Client Driver Installation IMPORTANT! Setting Device Modes on new Printers Further Client Driver Install Procedures Always make first Client Connection as root or "printer admin" Other Gotchas Setting Default Print Options for the Client Drivers Supporting large Numbers of Printers Adding new Printers with the Windows NT APW Weird Error Message Cannot connect under a +different Name Be careful when assembling Driver Files Samba and Printer Ports Avoiding the most common Misconfigurations of the Client Driver The Imprints Toolset What is Imprints? Creating Printer Driver Packages The Imprints Server The Installation Client Add Network Printers at Logon without User Interaction The addprinter command Migration of "Classical" printing to Samba-3 Publishing Printer Information in Active Directory or LDAP Common Errors and Problems I give my root password but I don't get access My printjobs get spooled into the spooling directory, but then get lost 19. CUPS Printing Support in Samba 3.0 Introduction Features and Benefits Overview Basic Configuration of CUPS support Linking of smbd with libcups.so Simple smb.conf Settings for CUPS More complex smb.conf Settings for +CUPS Advanced Configuration Central spooling vs. "Peer-to-Peer" printing CUPS/Samba as a "spooling-only" Print Server; "raw" printing +with Vendor Drivers on Windows Clients Driver Installation Methods on Windows Clients Explicitly enable "raw" printing for +application/octet-stream! Three familiar Methods for driver upload plus a new one Using CUPS/Samba in an advanced Way -- intelligent printing +with PostScript Driver Download GDI on Windows -- PostScript on Unix Windows Drivers, GDI and EMF Unix Printfile Conversion and GUI Basics PostScript and Ghostscript Ghostscript -- the Software RIP for non-PostScript Printers PostScript Printer Description (PPD) Specification CUPS can use all Windows-formatted Vendor PPDs CUPS also uses PPDs for non-PostScript Printers The CUPS Filtering Architecture MIME types and CUPS Filters MIME type Conversion Rules Filter Requirements Prefilters pstops pstoraster imagetops and imagetoraster rasterto [printers specific] CUPS Backends cupsomatic/Foomatic -- how do they fit into the Picture? The Complete Picture mime.convs "Raw" printing "application/octet-stream" printing PostScript Printer Descriptions (PPDs) for non-PS Printers Difference between cupsomatic/foomatic-rip and +native CUPS printing Examples for filtering Chains Sources of CUPS drivers / PPDs Printing with Interface Scripts Network printing (purely Windows) From Windows Clients to an NT Print Server Driver Execution on the Client Driver Execution on the Server Network Printing (Windows clients -- UNIX/Samba Print +Servers) From Windows Clients to a CUPS/Samba Print Server Samba receiving Jobfiles and passing them to CUPS Network PostScript RIP: CUPS Filters on Server -- clients use +PostScript Driver with CUPS-PPDs PPDs for non-PS Printers on UNIX PPDs for non-PS Printers on Windows Windows Terminal Servers (WTS) as CUPS Clients Printer Drivers running in "Kernel Mode" cause many +Problems Workarounds impose Heavy Limitations CUPS: a "Magical Stone"? PostScript Drivers with no major problems -- even in Kernel +Mode Setting up CUPS for driver Download cupsaddsmb: the unknown Utility Prepare your smb.conf for +cupsaddsmb CUPS Package of "PostScript Driver for WinNT/2k/XP" Recognize the different Driver Files Acquiring the Adobe Driver Files ESP Print Pro Package of "PostScript Driver for +WinNT/2k/XP" Caveats to be considered What are the Benefits of using the "CUPS PostScript Driver for +Windows NT/2k/XP" as compared to the Adobe Driver? Run "cupsaddsmb" (quiet Mode) Run "cupsaddsmb" with verbose Output Understanding cupsaddsmb How to recognize if cupsaddsm completed successfully cupsaddsmb with a Samba PDC cupsaddsmb Flowchart Installing the PostScript Driver on a Client Avoiding critical PostScript Driver Settings on the +Client Installing PostScript Driver Files manually (using +rpcclient) A Check of the rpcclient man Page Understanding the rpcclient man Page Producing an Example by querying a Windows Box What is required for adddriver and setdriver to succeed Manual Commandline Driver Installation in 15 little Steps Troubleshooting revisited The printing *.tdb Files Trivial DataBase Files Binary Format Losing *.tdb Files Using tdbbackup CUPS Print Drivers from Linuxprinting.org foomatic-rip and Foomatic explained foomatic-rip and Foomatic-PPD Download and Installation Page Accounting with CUPS Setting up Quotas Correct and incorrect Accounting Adobe and CUPS PostScript Drivers for Windows Clients The page_log File Syntax Possible Shortcomings Future Developments Other Accounting Tools Additional Material Auto-Deletion or Preservation of CUPS Spool Files CUPS Configuration Settings explained Pre-conditions Manual Configuration When not to use Samba to print to +CUPS In Case of Trouble..... Where to find Documentation How to ask for Help Where to find Help Appendix Printing from CUPS to Windows attached +Printers More CUPS filtering Chains Trouble Shooting Guidelines to fix typical Samba printing +Problems An Overview of the CUPS Printing Processes 20. Stackable VFS modules Features and Benefits Discussion Included modules audit extd_audit fake_perms recycle netatalk VFS modules available elsewhere DatabaseFS vscan Common Errors 21. Integrated Logon Support using Winbind Features and Benefits Introduction What Winbind Provides Target Uses How Winbind Works Microsoft Remote Procedure Calls Microsoft Active Directory Services Name Service Switch Pluggable Authentication Modules User and Group ID Allocation Result Caching Installation and Configuration Introduction Requirements Testing Things Out Conclusion Common Errors 22. Advanced Network Management Features and Benefits Remote Server Administration Remote Desktop Management Remote Management from NoMachines.Com Network Logon Script Magic Adding printers without user intervention Common Errors 23. System and Account Policies Features and Benefits Creating and Managing System Policies Windows 9x/Me Policies Windows NT4 Style Policy Files MS Windows 200x / XP Professional Policies Managing Account/User Policies Samba Editreg Toolset Windows NT4/200x Samba PDC System Startup and Logon Processing Overview Common Errors Policy Does Not Work 24. Desktop Profile Management Features and Benefits Roaming Profiles Samba Configuration for Profile Handling Windows Client Profile Configuration Information Sharing Profiles between W9x/Me and NT4/200x/XP workstations Profile Migration from Windows NT4/200x Server to Samba Mandatory profiles Creating/Managing Group Profiles Default Profile for Windows Users MS Windows 9x/Me MS Windows NT4 Workstation MS Windows 200x/XP Common Errors How does one set up roaming profiles for just one (or a few) user/s or group/s? Can NOT use Roaming Profiles Changing the default profile 25. PAM based Distributed Authentication Features and Benefits Technical Discussion PAM Configuration Syntax Example System Configurations smb.conf PAM Configuration Remote CIFS Authentication using winbindd.so Password Synchronization using pam_smbpass.so Common Errors pam_winbind problem 26. Integrating MS Windows networks with Samba Features and Benefits Background Information Name Resolution in a pure Unix/Linux world /etc/hosts /etc/resolv.conf /etc/host.conf /etc/nsswitch.conf Name resolution as used within MS Windows networking The NetBIOS Name Cache The LMHOSTS file HOSTS file DNS Lookup WINS Lookup Common Errors My Boomerang Won't Come Back Very Slow Network Connections Samba server name change problem 27. Unicode/Charsets Features and Benefits What are charsets and unicode? Samba and charsets Conversion from old names Japanese charsets 28. Samba Backup Techniques Note Features and Benefits 29. High Availability Options Note IV. Migration and Updating 30. Upgrading from Samba-2.x to Samba-3.0.0 Charsets Obsolete configuration options Password Backend 31. Migration from NT4 PDC to Samba-3 PDC Planning and Getting Started Objectives Steps In Migration Process Migration Options Planning for Success Samba Implementation Choices 32. SWAT - The Samba Web Administration Tool Features and Benefits Enabling SWAT for use Securing SWAT through SSL The SWAT Home Page Global Settings Share Settings Printers Settings The SWAT Wizard The Status Page The View Page The Password Change Page V. Troubleshooting 33. The Samba checklist Introduction Assumptions The tests Still having troubles? 34. Analysing and solving samba problems Diagnostics tools Installing 'Network Monitor' on an NT Workstation or a Windows 9x box Useful URLs Getting help from the mailing lists How to get off the mailing lists 35. Reporting Bugs Introduction General info Debug levels Internal errors Attaching to a running process Patches VI. Appendixes 36. How to compile SAMBA Access Samba source code via CVS Introduction CVS Access to samba.org Accessing the samba sources via rsync and ftp Verifying Samba's PGP signature Building the Binaries Compiling samba with Active Directory support Starting the smbd and nmbd Starting from inetd.conf Alternative: starting it as a daemon Common Errors 37. Portability HPUX SCO Unix DNIX RedHat Linux Rembrandt-II AIX Sequential Read Ahead Solaris Locking improvements Winbind on Solaris 9 38. Samba and other CIFS clients Macintosh clients? OS2 Client How can I configure OS/2 Warp Connect or + OS/2 Warp 4 as a client for Samba? How can I configure OS/2 Warp 3 (not Connect), + OS/2 1.2, 1.3 or 2.x for Samba? How do I get printer driver download working + for OS/2 clients? Windows for Workgroups Use latest TCP/IP stack from Microsoft Delete .pwl files after password change Configure WfW password handling Case handling of passwords Use TCP/IP as default protocol Speed improvement Windows '95/'98 Speed improvement Windows 2000 Service Pack 2 Windows NT 3.1 39. Samba Performance Tuning Comparisons Socket options Read size Max xmit Log level Read raw Write raw Slow Logins Client tuning Samba performance problem due changing kernel Corrupt tdb Files 40. DNS and DHCP Configuration Guide Note 41. Further Resources Websites Related updates from Microsoft Books Index List of Figures 19.1. Windows Printing to a local Printer 19.2. Printing to a Postscript Printer 19.3. Ghostscript as a RIP for non-postscript printers 19.4. Prefiltering in CUPS to form Postscript 19.5. Adding Device-specific Print Options 19.6. Postscript to intermediate Raster format 19.7. CUPS-raster production using Ghostscript 19.8. Image format to CUPS-raster format conversion 19.9. Raster to Printer Specific formats 19.10. cupsomatic/foomatic processing versus Native CUPS 19.11. Print Driver execution on the Client 19.12. Print Driver execution on the Server 19.13. Printing via CUPS/samba server 19.14. cupsaddsmb flowchart 19.15. CUPS Printing Overview List of Tables 7.1. Assumptions 10.1. Browse subnet example 1 10.2. Browse subnet example 2 10.3. Browse subnet example 3 10.4. Browse subnet example 4 11.1. Attributes in the sambaSamAccount objectclass (LDAP) 11.2. Basic smb.conf options for MySQL passdb backend 11.3. MySQL field names for MySQL passdb backend 13.1. Managing directories with unix and windows 13.2. User and Group Based Controls 13.3. File and Directory Permission Based Controls 13.4. Other Controls 20.1. Extended Auditing Log Information 24.1. User Shell Folder registry keys default values 24.2. Defaults of profile settings registry keys 24.3. Defaults of default user profile paths registry keys 25.1. Options recognized by pam_smbpass 31.1. The 3 Major Site Types 31.2. Nature of the Conversion Choices List of Examples 12.1. smbgrpadd.sh 13.1. Example File Next Part I. General Installation diff --git a/docs/htmldocs/install.html b/docs/htmldocs/install.html index 154b9705e1..d602d123c7 100644 --- a/docs/htmldocs/install.html +++ b/docs/htmldocs/install.html @@ -1,6 +1,7 @@ -Chapter 2. How to Install and Test SAMBAChapter 2. How to Install and Test SAMBA Prev Part I. General Installation Next Chapter 2. How to Install and Test SAMBA Andrew Tridgell Samba Team <tridge@samba.org> Jelmer R. Vernooij The Samba Team <jelmer@samba.org> John H. Terpstra Samba Team <jht@samba.org> Karl Auer Table of Contents Obtaining and installing samba Configuring samba (smb.conf) Example Configuration SWAT Try listing the shares available on your - server Try connecting with the unix client Try connecting from a DOS, WfWg, Win9x, WinNT, - Win2k, OS/2, etc... client What If Things Don't Work? Common Errors Why are so many smbd processes eating memory? I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logsObtaining and installing samba + +Chapter 2. How to Install and Test SAMBA Chapter 2. How to Install and Test SAMBA Prev Part I. General Installation Next Chapter 2. How to Install and Test SAMBA Andrew Tridgell Samba Team <tridge@samba.org> Jelmer R. Vernooij The Samba Team <jelmer@samba.org> John H. Terpstra Samba Team <jht@samba.org> Karl Auer Table of Contents Obtaining and installing samba Configuring samba (smb.conf) Example Configuration SWAT Try listing the shares available on your + server Try connecting with the unix client Try connecting from a DOS, WfWg, Win9x, WinNT, + Win2k, OS/2, etc... client What If Things Don't Work? Common Errors Why are so many smbd processes eating memory? I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs Obtaining and installing samba Binary packages of samba are included in almost any Linux or Unix distribution. There are also some packages available at the samba homepage. @@ -8,29 +9,29 @@ appropriate appendix chapter. If you have already installed samba, or if your operating system was pre-installed with samba, then you may not need to bother with this chapter. On the other hand, you may want to read this chapter anyhow - for information about updating samba. Configuring samba (smb.conf) + for information about updating samba.Configuring samba (smb.conf) Samba's configuration is stored in the smb.conf file, that usually resides in /etc/samba/smb.conf or /usr/local/samba/lib/smb.conf. You can either edit this file yourself or do it using one of the many graphical tools that are available, such as the web-based interface swat, that is included with samba. - Example Configuration + Example Configuration There are sample configuration files in the examples subdirectory in the distribution. I suggest you read them carefully so you can see how the options go together in practice. See the man page for all the options. The simplest useful configuration file would be something like this: - - + + [global] workgroup = MYGROUP [homes] guest ok = no read only = no - - + + This will allow connections by anyone with an account on the server, using either their login name or "homes" as the service name. (Note that the workgroup that Samba must also be set.) @@ -42,7 +43,7 @@ For more information about security settings for the [homes] share please refer to the chapter Securing Samba. - Test your config file with testparm + Test your config file with testparm It's important that you test the validity of your smb.conf file using the testparm program. If testparm runs OK then it will list the loaded services. If not it will give an error message. @@ -50,7 +51,7 @@ Make sure it runs OK and that the services look reasonable before proceeding. Always run testparm again when you change smb.conf! - SWAT + SWAT SWAT is a web-based interface that helps you configure samba. SWAT might not be available in the samba package on your platform, but in a separate package. Please read the swat manpage @@ -66,7 +67,7 @@ machine but connecting from a remote machine leaves your connection open to password sniffing as passwords will be sent in the clear over the wire. - Try listing the shares available on your + Try listing the shares available on your server $ smbclient -L yourhostname You should get back a list of shares available on your server. If you don't then something is incorrectly setup. @@ -76,7 +77,7 @@ See the smbclient man page for details. (you can force it to list the shares without a password by adding the option -U% to the command line. This will not work - with non-Samba servers) Try connecting with the unix client $ smbclient + with non-Samba servers) Try connecting with the unix client $ smbclient //yourhostname/aservice Typically the yourhostname would be the name of the host where you installed smbd. The aservice is @@ -85,18 +86,18 @@ section in smb.conf. For example if your unix host is bambi and your login name is fred you would type: $ smbclient //bambi/fred - Try connecting from a DOS, WfWg, Win9x, WinNT, + Try connecting from a DOS, WfWg, Win9x, WinNT, Win2k, OS/2, etc... client Try mounting disks. eg: C:\WINDOWS\> net use d: \\servername\service Try printing. eg: C:\WINDOWS\> net use lpt1: \\servername\spoolservice C:\WINDOWS\> print filename - What If Things Don't Work? Then you might read the file chapter + What If Things Don't Work? Then you might read the file chapter Diagnosis and the FAQ. If you are still stuck then try to follow the Analysing and Solving Problems chapter Samba has been successfully installed at thousands of sites worldwide, - so maybe someone else has hit your problem and has overcome it. Common Errors + so maybe someone else has hit your problem and has overcome it. Common Errors The following questions and issues get raised on the samba mailing list over and over again. - Why are so many smbd processes eating memory? + Why are so many smbd processes eating memory? “ Site that is running Samba on an AIX box. They are sharing out about 2 terabytes using samba. Samba was installed using smitty and the binaries. We seem to be experiencing a memory problem @@ -108,8 +109,8 @@ processes of smbd running: Is samba suppose to start this many different smbd processes? Or does it run as one smbd process? Also is it normal for it to be taking up this much memory? ” - - + + Inuse * 4096 = amount of memory being used by this process Pid Command Inuse Pin Pgsp Virtual 64-bit Mthrd @@ -136,8 +137,8 @@ Inuse * 4096 = amount of memory being used by this process 19110 smbd 8404 1906 181 4862 N N Total memory used: 841,592,832 bytes - - + + Samba consists on three core programs: nmbd, smbd, winbindd. nmbd is the name server message daemon, smbd is the server message daemon, winbindd is the daemon that @@ -152,4 +153,4 @@ connection made. That is why you are seeing so many of them, one (1) per client winbindd will run as one or two daemons, depending on whether or not it is being run in "split mode" (in which case there will be two instances). - I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs Your loopback device isn't working correctly. Make sure it's running. Prev Up Next Chapter 1. Introduction to Samba Home Chapter 3. Fast Start for the Impatient + I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs Your loopback device isn't working correctly. Make sure it's running. Prev Up Next Chapter 1. Introduction to Samba Home Chapter 3. Fast Start for the Impatient diff --git a/docs/htmldocs/integrate-ms-networks.html b/docs/htmldocs/integrate-ms-networks.html index 083aeed9f3..07331fd9d0 100644 --- a/docs/htmldocs/integrate-ms-networks.html +++ b/docs/htmldocs/integrate-ms-networks.html @@ -1,4 +1,5 @@ -Chapter 26. Integrating MS Windows networks with SambaChapter 26. Integrating MS Windows networks with Samba Prev Part III. Advanced Configuration Next Chapter 26. Integrating MS Windows networks with Samba John H. Terpstra Samba Team <jht@samba.org> (Jan 01 2001) Table of Contents Features and Benefits Background Information Name Resolution in a pure Unix/Linux world /etc/hosts /etc/resolv.conf /etc/host.conf /etc/nsswitch.conf Name resolution as used within MS Windows networking The NetBIOS Name Cache The LMHOSTS file HOSTS file DNS Lookup WINS Lookup Common Errors My Boomerang Won't Come Back Very Slow Network Connections Samba server name change problem + +Chapter 26. Integrating MS Windows networks with Samba Chapter 26. Integrating MS Windows networks with Samba Prev Part III. Advanced Configuration Next Chapter 26. Integrating MS Windows networks with Samba John H. Terpstra Samba Team <jht@samba.org> (Jan 01 2001) Table of Contents Features and Benefits Background Information Name Resolution in a pure Unix/Linux world /etc/hosts /etc/resolv.conf /etc/host.conf /etc/nsswitch.conf Name resolution as used within MS Windows networking The NetBIOS Name Cache The LMHOSTS file HOSTS file DNS Lookup WINS Lookup Common Errors My Boomerang Won't Come Back Very Slow Network Connections Samba server name change problem This section deals with NetBIOS over TCP/IP name to IP address resolution. If your MS Windows clients are NOT configured to use NetBIOS over TCP/IP then this section does not apply to your installation. If your installation involves use of @@ -9,7 +10,7 @@ NetBIOS over TCP/IP then this section may help you to resolve networking problem to NOT run NetBEUI at all. Note also that there is NO such thing as NetBEUI over TCP/IP - the existence of such a protocol is a complete and utter mis-apprehension. - Features and Benefits + Features and Benefits Many MS Windows network administrators have never been exposed to basic TCP/IP networking as it is implemented in a Unix/Linux operating system. Likewise, many Unix and Linux administrators have not been exposed to the intricacies of MS Windows TCP/IP based @@ -17,7 +18,7 @@ networking (and may have no desire to be either). This chapter gives a short introduction to the basics of how a name can be resolved to it's IP address for each operating system environment. - Background Information + Background Information Since the introduction of MS Windows 2000 it is possible to run MS Windows networking without the use of NetBIOS over TCP/IP. NetBIOS over TCP/IP uses UDP port 137 for NetBIOS name resolution and uses TCP port 139 for NetBIOS session services. When NetBIOS over @@ -33,10 +34,10 @@ disable NetBIOS over TCP/IP today use MS Active Directory Service (ADS). ADS req Dynamic DNS with Service Resource Records (SRV RR) and with Incremental Zone Transfers (IXFR). Use of DHCP with ADS is recommended as a further means of maintaining central control over client workstation network configuration. - Name Resolution in a pure Unix/Linux world + Name Resolution in a pure Unix/Linux world The key configuration files covered in this section are: - /etc/hosts /etc/resolv.conf /etc/host.conf /etc/nsswitch.conf /etc/hosts -Contains a static list of IP Addresses and names. + /etc/hosts /etc/resolv.conf /etc/host.conf /etc/nsswitch.conf /etc/hosts +Contains a static list of IP addresses and names. eg: 127.0.0.1 localhost localhost.localdomain @@ -48,7 +49,7 @@ IP addresses. Network packets that are sent over the physical network transport layer communicate not via IP addresses but rather using the Media -Access Control address, or MAC address. IP Addresses are currently +Access Control address, or MAC address. IP addresses are currently 32 bits in length and are typically presented as four (4) decimal numbers that are separated by a dot (or period). eg: 168.192.1.1. @@ -92,7 +93,7 @@ primary names by which they are known within the local machine. This file helps to prime the pump so that a basic level of name resolution can exist before any other method of name resolution becomes available. - /etc/resolv.conf + /etc/resolv.conf This file tells the name resolution libraries: The name of the domain to which the machine belongs @@ -102,7 +103,7 @@ This file tells the name resolution libraries: The name or IP address of available Domain Name Servers that may be asked to perform name to address translation lookups - /etc/host.conf + /etc/host.conf /etc/host.conf is the primary means by which the setting in /etc/resolv.conf may be affected. It is a critical configuration file. This file controls the order by @@ -113,7 +114,7 @@ which name resolution may proceed. The typical structure is: then both addresses should be returned. Please refer to the man page for host.conf for further details. - /etc/nsswitch.conf + /etc/nsswitch.conf This file controls the actual name resolution targets. The file typically has resolver object specifications as follows: @@ -149,22 +150,22 @@ Starting with version 2.2.0 samba has Linux support for extensions to the name service switch infrastructure so that linux clients will be able to obtain resolution of MS Windows NetBIOS names to IP Addresses. To gain this functionality Samba needs to be compiled -with appropriate arguments to the make command (ie: make +with appropriate arguments to the make command (i.e.: make nsswitch/libnss_wins.so). The resulting library should then be installed in the /lib directory and the "wins" parameter needs to be added to the "hosts:" line in the /etc/nsswitch.conf file. At this point it -will be possible to ping any MS Windows machine by it's NetBIOS +will be possible to ping any MS Windows machine by its NetBIOS machine name, so long as that machine is within the workgroup to which both the samba machine and the MS Windows machine belong. - Name resolution as used within MS Windows networking + Name resolution as used within MS Windows networking MS Windows networking is predicated about the name each machine is given. This name is known variously (and inconsistently) as the "computer name", "machine name", "networking name", "netbios name", -"SMB name". All terms mean the same thing with the exception of +or "SMB name". All terms mean the same thing with the exception of "netbios name" which can apply also to the name of the workgroup or the domain name. The terms "workgroup" and "domain" are really just a -simply name with which the machine is associated. All NetBIOS names +simple name with which the machine is associated. All NetBIOS names are exactly 16 characters in length. The 16th character is reserved. It is used to store a one byte value that indicates service level information for the NetBIOS name that is registered. A NetBIOS machine @@ -199,8 +200,8 @@ wants to locate a domain logon server. It finds this service and the IP address of a server that provides it by performing a lookup (via a NetBIOS broadcast) for enumeration of all machines that have registered the name type *<1c>. A logon request is then sent to each -IP address that is returned in the enumerated list of IP addresses. Which -ever machine first replies then ends up providing the logon services. +IP address that is returned in the enumerated list of IP addresses. +Whichever machine first replies then ends up providing the logon services. The name "workgroup" or "domain" really can be confusing since these have the added significance of indicating what is the security @@ -228,7 +229,7 @@ NBT or NetBT, the NetBIOS over TCP/IP. MS Windows machines use a complex array of name resolution mechanisms. Since we are primarily concerned with TCP/IP this demonstration is limited to this area. - The NetBIOS Name Cache + The NetBIOS Name Cache All MS Windows machines employ an in memory buffer in which is stored the NetBIOS names and IP addresses for all external machines that that machine has communicated with over the @@ -246,7 +247,7 @@ frustrating for users - but it is a characteristic of the protocol. The MS Windows utility that allows examination of the NetBIOS name cache is called "nbtstat". The Samba equivalent of this is called nmblookup. - The LMHOSTS file + The LMHOSTS file This file is usually located in MS Windows NT 4.0 or 2000 in C:\WINNT\SYSTEM32\DRIVERS\ETC and contains the IP Address and the machine name in matched pairs. The @@ -331,25 +332,25 @@ It typically looks like: # so keeping the number of comments to a minimum will improve performance. # Therefore it is not advisable to simply add lmhosts file entries onto the # end of this file. - HOSTS file + HOSTS file This file is usually located in MS Windows NT 4.0 or 2000 in C:\WINNT\SYSTEM32\DRIVERS\ETC and contains the IP Address and the IP hostname in matched pairs. It can be used by the name resolution infrastructure in MS Windows, depending on how the TCP/IP environment is configured. This file is in every way the equivalent of the Unix/Linux /etc/hosts file. - DNS Lookup + DNS Lookup This capability is configured in the TCP/IP setup area in the network -configuration facility. If enabled an elaborate name resolution sequence -is followed the precise nature of which is dependant on what the NetBIOS -Node Type parameter is configured to. A Node Type of 0 means use -NetBIOS broadcast (over UDP broadcast) is first used if the name +configuration facility. If enabled, an elaborate name resolution sequence +is followed the precise nature of which is dependant on how the NetBIOS +Node Type parameter is configured. A Node Type of 0 means that +NetBIOS broadcast (over UDP broadcast) is used if the name that is the subject of a name lookup is not found in the NetBIOS name cache. If that fails then DNS, HOSTS and LMHOSTS are checked. If set to Node Type 8, then a NetBIOS Unicast (over UDP Unicast) is sent to the WINS Server to obtain a lookup before DNS, HOSTS, LMHOSTS, or broadcast lookup is used. - WINS Lookup + WINS Lookup A WINS (Windows Internet Name Server) service is the equivalent of the rfc1001/1002 specified NBNS (NetBIOS Name Server). A WINS server stores the names and IP addresses that are registered by a Windows client @@ -368,11 +369,11 @@ needed in the smb.conf file: where xxx.xxx.xxx.xxx is the IP address of the WINS server. - Common Errors + Common Errors TCP/IP network configuration problems find every network administrator sooner or later. The cause can be anything from keyboard mishaps, forgetfulness, simple mistakes, and carelessness. Of course, no one is every deliberately careless! - My Boomerang Won't Come Back + My Boomerang Won't Come Back Well, the real complaint said, "I can ping my samba server from Windows, but I can not ping my Windows machine from the samba server." @@ -382,9 +383,9 @@ carelessness. Of course, no one is every deliberately careless! Due to inconsistent netmasks, the Windows machine was on network 192.168.1.0/24, while the Samba server was on network 192.168.1.128/25 - logically a different network. - Very Slow Network Connections + Very Slow Network Connections A common causes of slow network response includes: - Client is configured to use DNS and DNS server is down Client is configured to use remote DNS server, but remote connection is down Client is configured to use a WINS server, but there is no WINS server Client is NOT configured to use a WINS server, but there is a WINS server Firewall is filtering our DNS or WINS traffic Samba server name change problem + Client is configured to use DNS and DNS server is down Client is configured to use remote DNS server, but remote connection is down Client is configured to use a WINS server, but there is no WINS server Client is NOT configured to use a WINS server, but there is a WINS server Firewall is filtering our DNS or WINS traffic Samba server name change problem The name of the samba server was changed, samba was restarted, samba server can not be pinged by new name from MS Windows NT4 Workstation, but it does still respond to ping using the old name. Why? @@ -393,8 +394,8 @@ carelessness. Of course, no one is every deliberately careless! WINS is NOT in use, only broadcast based name resolution is used The samba server was renamed and restarted within the last 10-15 minutes The old samba server name is still in the NetBIOS name cache on the MS Windows NT4 Workstation To find what names are present in the NetBIOS name cache on the MS Windows NT4 machine, open a cmd shell, then: - - + + C:\temp\>nbtstat -n NetBIOS Local Name Table @@ -418,10 +419,10 @@ carelessness. Of course, no one is every deliberately careless! FRODO <20> UNIQUE 192.168.1.1 240 C:\Temp\> - - + + In the above example, FRODO is the Samba server and SLACK is the MS Windows NT4 Workstation. - The first listing shows the contents of the Local Name Table (ie: Identity information on + The first listing shows the contents of the Local Name Table (i.e.: Identity information on the MS Windows workstation), the second shows the NetBIOS name in the NetBIOS name cache. The name cache contains the remote machines known to this workstation. Prev Up Next Chapter 25. PAM based Distributed Authentication Home Chapter 27. Unicode/Charsets diff --git a/docs/htmldocs/introduction.html b/docs/htmldocs/introduction.html index 94419cff04..f2e9d6f63f 100644 --- a/docs/htmldocs/introduction.html +++ b/docs/htmldocs/introduction.html @@ -1,5 +1,6 @@ -Part I. General InstallationPart I. General Installation Prev Next General Installation Preparing Samba for Configuration This section of the Samba-HOWTO-Collection contains general info on how to install samba + +Part I. General Installation Part I. General Installation Prev Next General Installation Preparing Samba for Configuration This section of the Samba-HOWTO-Collection contains general info on how to install samba and how to configure the parts of samba you will most likely need. -PLEASE read this. Table of Contents 1. Introduction to Samba Background Terminology Related Projects SMB Methodology Epilogue Miscellaneous 2. How to Install and Test SAMBA Obtaining and installing samba Configuring samba (smb.conf) Example Configuration SWAT Try listing the shares available on your - server Try connecting with the unix client Try connecting from a DOS, WfWg, Win9x, WinNT, - Win2k, OS/2, etc... client What If Things Don't Work? Common Errors Why are so many smbd processes eating memory? I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs 3. Fast Start for the Impatient Note Prev Up Next SAMBA Project Documentation Home Chapter 1. Introduction to Samba +PLEASE read this. Table of Contents 1. Introduction to Samba Background Terminology Related Projects SMB Methodology Epilogue Miscellaneous 2. How to Install and Test SAMBA Obtaining and installing samba Configuring samba (smb.conf) Example Configuration SWAT Try listing the shares available on your + server Try connecting with the unix client Try connecting from a DOS, WfWg, Win9x, WinNT, + Win2k, OS/2, etc... client What If Things Don't Work? Common Errors Why are so many smbd processes eating memory? I'm getting "open_oplock_ipc: Failed to get local UDP socket for address 100007f. Error was Cannot assign requested" in the logs 3. Fast Start for the Impatient Note Prev Up Next SAMBA Project Documentation Home Chapter 1. Introduction to Samba diff --git a/docs/htmldocs/ix01.html b/docs/htmldocs/ix01.html index 4f706aed70..6d8bfe0633 100644 --- a/docs/htmldocs/ix01.html +++ b/docs/htmldocs/ix01.html @@ -1 +1,2 @@ -IndexIndex Prev Index Prev Up Chapter 41. Further Resources Home + +IndexIndex Prev Index Prev Up Chapter 41. Further Resources Home diff --git a/docs/htmldocs/locking.html b/docs/htmldocs/locking.html index a128cac7ce..6214254ce0 100644 --- a/docs/htmldocs/locking.html +++ b/docs/htmldocs/locking.html @@ -1,7 +1,8 @@ -Chapter 14. File and Record LockingChapter 14. File and Record Locking Prev Part III. Advanced Configuration Next Chapter 14. File and Record Locking Jeremy Allison Samba Team <jra@samba.org> Jelmer R. Vernooij The Samba Team <jelmer@samba.org> John H. Terpstra Samba Team <jht@samba.org> Eric Roseme HP Oplocks Usage Recommendations Whitepaper <eric.roseme@hp.com> Table of Contents Features and Benefits Discussion Opportunistic Locking Overview Samba Opportunistic Locking Control Example Configuration MS Windows Opportunistic Locking and Caching Controls Workstation Service Entries Server Service Entries Persistent Data Corruption Common Errors locking.tdb error messages Additional Reading + +Chapter 14. File and Record Locking Chapter 14. File and Record Locking Prev Part III. Advanced Configuration Next Chapter 14. File and Record Locking Jeremy Allison Samba Team <jra@samba.org> Jelmer R. Vernooij The Samba Team <jelmer@samba.org> John H. Terpstra Samba Team <jht@samba.org> Eric Roseme HP Oplocks Usage Recommendations Whitepaper <eric.roseme@hp.com> Table of Contents Features and Benefits Discussion Opportunistic Locking Overview Samba Opportunistic Locking Control Example Configuration MS Windows Opportunistic Locking and Caching Controls Workstation Service Entries Server Service Entries Persistent Data Corruption Common Errors locking.tdb error messages Additional Reading One area which causes trouble for many network administrators is locking. The extent of the problem is readily evident from searches over the internet. - Features and Benefits + Features and Benefits Samba provides all the same locking semantics that MS Windows clients expect and that MS Windows NT4 / 200x servers provide also. @@ -23,13 +24,13 @@ settings on the MS Windows client. Note Sometimes it is necessary to disable locking control settings BOTH on the Samba server as well as on each MS Windows client! - Discussion + Discussion There are two types of locking which need to be performed by a SMB server. The first is record locking which allows a client to lock a range of bytes in a open file. The second is the deny modes that are specified when a file is open. -Record locking semantics under Unix is very different from record locking under +Record locking semantics under Unix are very different from record locking under Windows. Versions of Samba before 2.2 have tried to use the native fcntl() unix system call to implement proper record locking between different Samba clients. This can not be fully correct due to several reasons. The simplest is the fact @@ -51,7 +52,7 @@ important to them. By default Samba only makes locking calls when explicitly ask to by a client, but if you set strict locking = yes then it will make lock checking calls on every read and write. -You can also disable by range locking completely using locking = no. +You can also disable byte range locking completely using locking = no. This is useful for those shares that don't support locking or don't need it (such as cdroms). In this case Samba fakes the return codes of locking calls to tell clients that everything is OK. @@ -62,7 +63,7 @@ access should be allowed simultaneously with its open. A client may ask for DENY_NONE, DENY_READ, DENY_WRITE or DENY_ALL. There are also special compatibility modes called DENY_FCB and DENY_DOS. - Opportunistic Locking Overview + Opportunistic Locking Overview Opportunistic locking (Oplocks) is invoked by the Windows file system (as opposed to an API) via registry entries (on the server AND client) for the purpose of enhancing network performance when accessing a file @@ -185,7 +186,7 @@ In mission critical high availability environments, careful attention should be given to opportunistic locking. Ideally, comprehensive testing should be done with all affected applications with oplocks enabled and disabled. - Exclusively Accessed Shares + Exclusively Accessed Shares Opportunistic locking is most effective when it is confined to shares that are exclusively accessed by a single user, or by only one user at a time. Because the true value of opportunistic locking is the local @@ -194,7 +195,7 @@ mechanism will cause a delay. Home directories are the most obvious examples of where the performance benefit of opportunistic locking can be safely realized. - Multiple-Accessed Shares or Files + Multiple-Accessed Shares or Files As each additional user accesses a file in a share with opportunistic locking enabled, the potential for delays and resulting perceived poor performance increases. When multiple users are accessing a file on a @@ -206,7 +207,7 @@ of the caching user. As each additional client attempts to access a file with oplocks set, the potential performance improvement is negated and eventually results in a performance bottleneck. - Unix or NFS Client Accessed Files + Unix or NFS Client Accessed Files Local Unix and NFS clients access files without a mandatory file locking mechanism. Thus, these client platforms are incapable of initiating an oplock break request from the server to a Windows client @@ -216,7 +217,7 @@ exposes the file to likely data corruption. If files are shared between Windows clients, and either local Unix or NFS users, then turn opportunistic locking off. - Slow and/or Unreliable Networks + Slow and/or Unreliable Networks The biggest potential performance improvement for opportunistic locking occurs when the client-side caching of reads and writes delivers the most differential over sending those reads and writes over the wire. @@ -231,7 +232,7 @@ the most advantageous scenario to utilize opportunistic locking. If the network is slow, unreliable, or a WAN, then do not configure opportunistic locking if there is any chance of multiple users regularly opening the same file. - Multi-User Databases + Multi-User Databases Multi-user databases clearly pose a risk due to their very nature - they are typically heavily accessed by numerous users at random intervals. Placing a multi-user database on a share with opportunistic @@ -239,7 +240,7 @@ locking enabled will likely result in a locking management bottleneck on the Samba server. Whether the database application is developed in-house or a commercially available product, ensure that the share has opportunistic locking disabled. - PDM Data Shares + PDM Data Shares Process Data Management (PDM) applications such as IMAN, Enovia, and Clearcase, are increasing in usage with Windows client platforms, and therefore SMB data stores. PDM applications manage multi-user @@ -252,7 +253,7 @@ application and PDM server to negotiate and maintain. It is appropriate to eliminate the client OS from any caching tasks, and the server from any oplock management, by disabling opportunistic locking on the share. - Beware of Force User + Beware of Force User Samba includes an smb.conf parameter called force user that changes the user accessing a share from the incoming user to whatever user is defined by the smb.conf variable. If opportunistic locking is enabled @@ -270,7 +271,7 @@ Avoid the combination of the following: Slow or unreliable networks Opportunistic Locking Enabled - Advanced Samba Opportunistic Locking Parameters + Advanced Samba Opportunistic Locking Parameters Samba provides opportunistic locking parameters that allow the administrator to adjust various properties of the oplock mechanism to account for timing and usage levels. These parameters provide good @@ -284,7 +285,7 @@ are required, then the better option is to simply turn oplocks off. The samba SWAT help text for both parameters reads "DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ AND UNDERSTOOD THE SAMBA OPLOCK CODE." This is good advice. - Mission Critical High Availability + Mission Critical High Availability In mission critical high availability environments, data integrity is often a priority. Complex and expensive configurations are implemented to ensure that if a client loses connectivity with a file server, a @@ -314,7 +315,7 @@ In mission critical high availability environments, careful attention should be given to opportunistic locking. Ideally, comprehensive testing should be done with all affected applications with oplocks enabled and disabled. - Samba Opportunistic Locking Control + Samba Opportunistic Locking Control Opportunistic Locking is a unique Windows file locking feature. It is not really file locking, but is included in most discussions of Windows file locking, so is considered a defacto locking feature. @@ -364,29 +365,29 @@ of your client sending oplock breaks and will instead want to disable oplocks fo Another factor to consider is the perceived performance of file access. If oplocks provide no measurable speed benefit on your network, it might not be worth the hassle of dealing with them. - Example Configuration + Example Configuration In the following we examine two distinct aspects of Samba locking controls. - Disabling Oplocks + Disabling Oplocks You can disable oplocks on a per-share basis with the following: - - + + [acctdata] oplocks = False level2 oplocks = False - - + + The default oplock type is Level1. Level2 Oplocks are enabled on a per-share basis in the smb.conf file. Alternately, you could disable oplocks on a per-file basis within the share: - - + + veto oplock files = /*.mdb/*.MDB/*.dbf/*.DBF/ - - + + If you are experiencing problems with oplocks as apparent from Samba's log entries, you may want to play it safe and disable oplocks and level2 oplocks. - Disabling Kernel OpLocks + Disabling Kernel OpLocks Kernel OpLocks is an smb.conf parameter that notifies Samba (if the UNIX kernel has the capability to send a Windows client an oplock break) when a UNIX process is attempting to open the file that is @@ -398,13 +399,13 @@ to the risk of data corruption. If the UNIX kernel has the ability to send an oplock break, then the kernel oplocks parameter enables Samba to send the oplock break. Kernel oplocks are enabled on a per-server basis in the smb.conf file. - - + + [global] kernel oplocks = yes - + The default is "no". - + Veto OpLocks is an smb.conf parameter that identifies specific files for which Oplocks are disabled. When a Windows client opens a file that has been configured for veto oplocks, the client will not be granted @@ -416,26 +417,26 @@ allow Windows clients to utilize the performance benefit of file caching without the risk of data corruption. Veto Oplocks can be enabled on a per-share basis, or globally for the entire server, in the smb.conf file: - - <title>Example Veto OpLock Settings</title> + +<title>Example Veto OpLock Settings</title> [global] veto oplock files = /filename.htm/*.txt/ [share_name] veto oplock files = /*.exe/filename.ext/ - - + + Oplock break wait time is an smb.conf parameter that adjusts the time interval for Samba to reply to an oplock break request. Samba recommends "DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ AND UNDERSTOOD THE SAMBA OPLOCK CODE." Oplock Break Wait Time can only be configured globally in the smb.conf file: - - + + [global] oplock break wait time = 0 (default) - - + + Oplock break contention limit is an smb.conf parameter that limits the response of the Samba server to grant an oplock if the configured number of contending clients reaches the limit specified by the @@ -443,15 +444,15 @@ parameter. Samba recommends "DO NOT CHANGE THIS PARAMETER UNLESS YOU HAVE READ AND UNDERSTOOD THE SAMBA OPLOCK CODE." Oplock Break Contention Limit can be enable on a per-share basis, or globally for the entire server, in the smb.conf file: - - + + [global] oplock break contention limit = 2 (default) [share_name] oplock break contention limit = 2 (default) - - MS Windows Opportunistic Locking and Caching Controls + + MS Windows Opportunistic Locking and Caching Controls There is a known issue when running applications (like Norton Anti-Virus) on a Windows 2000/ XP workstation computer that can affect any application attempting to access shared database files across a network. This is a result of a default setting configured in the Windows 2000/XP @@ -488,20 +489,20 @@ Windows 2000 will still respect the EnableOplocks registry value used to disable in earlier versions of Windows. You can also deny the granting of opportunistic locks by changing the following registry entries: - - + + HKEY_LOCAL_MACHINE\System\ CurrentControlSet\Services\MRXSmb\Parameters\ OplocksDisabled REG_DWORD 0 or 1 Default: 0 (not disabled) - - Note + +Note The OplocksDisabled registry value configures Windows clients to either request or not request opportunistic locks on a remote file. To disable oplocks, the value of OplocksDisabled must be set to 1. - - + + HKEY_LOCAL_MACHINE\System\ CurrentControlSet\Services\LanmanServer\Parameters @@ -510,8 +511,8 @@ request opportunistic locks on a remote file. To disable oplocks, the value of EnableOpLockForceClose REG_DWORD 0 or 1 Default: 0 (Disabled by Default) - - Note + + Note The EnableOplocks value configures Windows-based servers (including Workstations sharing files) to allow or deny opportunistic locks on local files. @@ -543,7 +544,7 @@ An illustration of how level II oplocks work: station holds any oplock on the file. Because the workstations can have no cached writes or locks at this point, they need not respond to the break-to-none advisory; all they need do is invalidate locally cashed read-ahead data. - Workstation Service Entries + Workstation Service Entries \HKEY_LOCAL_MACHINE\System\ CurrentControlSet\Services\LanmanWorkstation\Parameters @@ -552,7 +553,7 @@ An illustration of how level II oplocks work: Indicates whether the redirector should use opportunistic-locking (oplock) performance enhancement. This parameter should be disabled only to isolate problems. - Server Service Entries + Server Service Entries \HKEY_LOCAL_MACHINE\System\ CurrentControlSet\Services\LanmanServer\Parameters @@ -581,7 +582,7 @@ the server disables raw I/O and opportunistic locking for this connection. Specifies the time that the server waits for a client to respond to an oplock break request. Smaller values can allow detection of crashed clients more quickly but can potentially cause loss of cached data. - Persistent Data Corruption + Persistent Data Corruption If you have applied all of the settings discussed in this paper but data corruption problems and other symptoms persist, here are some additional things to check out: @@ -592,7 +593,7 @@ rebuild the data files in question. This involves creating a new data file with same definition as the file to be rebuilt and transferring the data from the old file to the new one. There are several known methods for doing this that can be found in our Knowledge Base. - Common Errors + Common Errors In some sites locking problems surface as soon as a server is installed, in other sites locking problems may not surface for a long time. Almost without exception, when a locking problem does surface it will cause embarrassment and potential data corruption. @@ -622,18 +623,18 @@ so far: report on https://bugzilla.samba.org without delay. Make sure that you give as much information as you possibly can to help isolate the cause and to allow reproduction of the problem (an essential step in problem isolation and correction). - locking.tdb error messages - + locking.tdb error messages + > We are seeing lots of errors in the samba logs like: > > tdb(/usr/local/samba_2.2.7/var/locks/locking.tdb): rec_read bad magic > 0x4d6f4b61 at offset=36116 > > What do these mean? - - + + Corrupted tdb. Stop all instances of smbd, delete locking.tdb, restart smbd. - Additional Reading + Additional Reading You may want to check for an updated version of this white paper on our Web site from time to time. Many of our white papers are updated as information changes. For those papers, the Last Edited date is always at the top of the paper. diff --git a/docs/htmldocs/migration.html b/docs/htmldocs/migration.html index b8027a62ea..c099bb5137 100644 --- a/docs/htmldocs/migration.html +++ b/docs/htmldocs/migration.html @@ -1 +1,2 @@ -Part IV. Migration and Updating Part IV. Migration and Updating Prev Next Migration and Updating Table of Contents 30. Upgrading from Samba-2.x to Samba-3.0.0 Charsets Obsolete configuration options Password Backend 31. Migration from NT4 PDC to Samba-3 PDC Planning and Getting Started Objectives Steps In Migration Process Migration Options Planning for Success Samba Implementation Choices 32. SWAT - The Samba Web Administration Tool Features and Benefits Enabling SWAT for use Securing SWAT through SSL The SWAT Home Page Global Settings Share Settings Printers Settings The SWAT Wizard The Status Page The View Page The Password Change Page Prev Up Next Chapter 29. High Availability Options Home Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0 + +Part IV. Migration and UpdatingPart IV. Migration and Updating Prev Next Migration and Updating Table of Contents 30. Upgrading from Samba-2.x to Samba-3.0.0 Charsets Obsolete configuration options Password Backend 31. Migration from NT4 PDC to Samba-3 PDC Planning and Getting Started Objectives Steps In Migration Process Migration Options Planning for Success Samba Implementation Choices 32. SWAT - The Samba Web Administration Tool Features and Benefits Enabling SWAT for use Securing SWAT through SSL The SWAT Home Page Global Settings Share Settings Printers Settings The SWAT Wizard The Status Page The View Page The Password Change Page Prev Up Next Chapter 29. High Availability Options Home Chapter 30. Upgrading from Samba-2.x to Samba-3.0.0 diff --git a/docs/htmldocs/msdfs.html b/docs/htmldocs/msdfs.html index d01b8f4c5d..fc05fee538 100644 --- a/docs/htmldocs/msdfs.html +++ b/docs/htmldocs/msdfs.html @@ -1,6 +1,7 @@ + Chapter 17. Hosting a Microsoft Distributed File System tree on SambaChapter 17. Hosting a Microsoft Distributed File System tree on Samba Prev Part III. Advanced Configuration Next Chapter 17. Hosting a Microsoft Distributed File System tree on Samba Shirish Kalele Samba Team & Veritas Software <samba@samba.org> - 12 Jul 2000 Table of Contents Features and Benefits Common Errors Features and Benefits + 12 Jul 2000 Table of Contents Features and Benefits Common Errors Features and Benefits The Distributed File System (or DFS) provides a means of separating the logical view of files and directories that users see from the actual physical locations of these resources on the network. It allows for higher availability, smoother @@ -52,7 +53,7 @@ network shares you want, and start Samba. Users on DFS-aware clients can now browse the DFS tree on the Samba server at \\samba\dfs. Accessing links linka or linkb (which appear as directories to the client) - takes users directly to the appropriate shares on the network. Common Errors Windows clients need to be rebooted + takes users directly to the appropriate shares on the network. Common Errors Windows clients need to be rebooted if a previously mounted non-dfs share is made a dfs root or vice versa. A better way is to introduce a new share and make it the dfs root. Currently there's a restriction that msdfs diff --git a/docs/htmldocs/net.8.html b/docs/htmldocs/net.8.html index 13e4be81be..dd7c0165ad 100644 --- a/docs/htmldocs/net.8.html +++ b/docs/htmldocs/net.8.html @@ -95,12 +95,12 @@ The type defaults to 0x20 (workstation). LOOKUP LDAP [DOMAIN Give IP address of LDAP server of specified DOMAIN. Defaults to local domain. LOOKUP KDC [REALM] Give IP address of KDC for the specified REALM. Defaults to local realm. LOOKUP DC [DOMAIN] Give IP's of Domain Controllers for specified DOMAIN. Defaults to local domain. LOOKUP MASTER DOMAIN Give IP of master browser for specified DOMAIN -or workgroup. Defaults to local domain. CACHE Samba uses a general caching interface called 'gencache'. It -can be controlled using 'NET CACHE'. All the timeout parameters support the suffixes: +or workgroup. Defaults to local domain. CACHE Samba uses a general caching interface called 'gencache'. It +can be controlled using 'NET CACHE'. All the timeout parameters support the suffixes: - s - Seconds m - Minutes h - Hours d - Days w - Weeks +s - Seconds m - Minutes h - Hours d - Days w - Weeks - CACHE ADD key data time-out Add specified key+data to the cache with the given timeout. CACHE DEL key Delete key from the cache. CACHE SET key data time-out Update data of existing cache entry. CACHE SEARCH PATTERN Search for the specified pattern in the cache data. CACHE LIST + CACHE ADD key data time-out Add specified key+data to the cache with the given timeout. CACHE DEL key Delete key from the cache. CACHE SET key data time-out Update data of existing cache entry. CACHE SEARCH PATTERN Search for the specified pattern in the cache data. CACHE LIST List all current items in the cache. CACHE FLUSH Remove all the current items from the cache. GETLOCALSID [DOMAIN] Print the SID of the specified domain, or if the parameter is omitted, the SID of the domain the local server is in. SETLOCALSID S-1-5-21-x-y-z Sets domain sid for the local server to the specified SID. GROUPMAP Manage the mappings between Windows group SIDs and UNIX groups. diff --git a/docs/htmldocs/optional.html b/docs/htmldocs/optional.html index 1c300521bc..1a6d971f5f 100644 --- a/docs/htmldocs/optional.html +++ b/docs/htmldocs/optional.html @@ -1,26 +1,27 @@ -Part III. Advanced Configuration Part III. Advanced Configuration Prev Next Advanced Configuration Valuable Nuts and Bolts Information + +Part III. Advanced Configuration Part III. Advanced Configuration Prev Next Advanced Configuration Valuable Nuts and Bolts Information Samba has several features that you might want or might not want to use. The chapters in this part each cover specific Samba features. - Table of Contents 10. Samba / MS Windows Network Browsing Guide Features and Benefits What is Browsing? Discussion NetBIOS over TCP/IP TCP/IP - without NetBIOS DNS and Active Directory How Browsing Functions Setting up WORKGROUP Browsing Setting up DOMAIN Browsing Forcing Samba to be the master Making Samba the domain master Note about broadcast addresses Multiple interfaces Use of the Remote Announce parameter Use of the Remote Browse Sync parameter WINS - The Windows Internetworking Name Server Setting up a WINS server WINS Replication Static WINS Entries Helpful Hints Windows Networking Protocols Name Resolution Order Technical Overview of browsing Browsing support in Samba Problem resolution Browsing across subnets Common Errors How can one flush the Samba NetBIOS name cache without restarting Samba? My client reports "This server is not configured to list shared resources" 11. Account Information Databases Features and Benefits Technical Information Important Notes About Security Mapping User Identifiers between MS Windows and Unix Account Management Tools The smbpasswd Command The pdbedit Command Password Backends Plain Text smbpasswd - Encrypted Password Database tdbsam ldapsam MySQL XML Common Errors Users can not logon - Users not in Samba SAM Users are being added to the wrong backend database auth methods does not work 12. Mapping MS Windows and Unix Groups Features and Benefits Discussion Example Configuration Configuration Scripts Sample smb.conf add group script Script to configure Group Mapping Common Errors Adding Groups Fails Adding MS Windows Groups to MS Windows Groups Fails 13. File, Directory and Share Access Controls Features and Benefits File System Access Controls MS Windows NTFS Comparison with Unix File Systems Managing Directories File and Directory Access Control Share Definition Access Controls User and Group Based Controls File and Directory Permissions Based Controls Miscellaneous Controls Access Controls on Shares Share Permissions Management MS Windows Access Control Lists and Unix Interoperability Managing UNIX permissions Using NT Security Dialogs Viewing File Security on a Samba Share Viewing file ownership Viewing File or Directory Permissions Modifying file or directory permissions Interaction with the standard Samba create mask - parameters Interaction with the standard Samba file attribute - mapping Common Errors Users can not write to a public share I have set force user and Samba still makes root the owner of all the files - I touch! 14. File and Record Locking Features and Benefits Discussion Opportunistic Locking Overview Samba Opportunistic Locking Control Example Configuration MS Windows Opportunistic Locking and Caching Controls Workstation Service Entries Server Service Entries Persistent Data Corruption Common Errors locking.tdb error messages Additional Reading 15. Securing Samba Introduction Features and Benefits Technical Discussion of Protective Measures and Issues Using host based protection User based protection Using interface protection Using a firewall Using a IPC$ share deny NTLMv2 Security Upgrading Samba Common Errors Smbclient works on localhost, but the network is dead Why can users access home directories of other users? 16. Interdomain Trust Relationships Features and Benefits Trust Relationship Background Native MS Windows NT4 Trusts Configuration NT4 as the Trusting Domain (ie. creating the trusted account) NT4 as the Trusted Domain (ie. creating trusted account's password) Configuring Samba NT-style Domain Trusts Samba-3 as the Trusting Domain Samba-3 as the Trusted Domain Common Errors Tell me about Trust Relationships using Samba 17. Hosting a Microsoft Distributed File System tree on Samba Features and Benefits Common Errors 18. Classical Printing Support Features and Benefits Technical Introduction What happens if you send a Job from a Client Printing Related Configuration Parameters Parameters Recommended for Use Parameters for Backwards Compatibility Parameters no longer in use A simple Configuration to Print with Samba-3 Verification of "Settings in Use" with testparm A little Experiment to warn you Extended Sample Configuration to Print with Samba-3 Detailed Explanation of the Example's Settings The [global] Section The [printers] Section Any [my_printer_name] Section Print Commands Default Print Commands for various Unix Print Subsystems Setting up your own Print Commands Innovations in Samba Printing since 2.2 Client Drivers on Samba Server for Point'n'Print The [printer$] Section is removed from Samba-3 Creating the [print$] Share Parameters in the [print$] Section Subdirectory Structure in [print$] Installing Drivers into [print$] Setting Drivers for existing Printers with a Client GUI Setting Drivers for existing Printers with -rpcclient "The Proof of the Pudding lies in the Eating" (Client Driver Install -Procedure) The first Client Driver Installation IMPORTANT! Setting Device Modes on new Printers Further Client Driver Install Procedures Always make first Client Connection as root or "printer admin" Other Gotchas Setting Default Print Options for the Client Drivers Supporting large Numbers of Printers Adding new Printers with the Windows NT APW Weird Error Message Cannot connect under a -different Name Be careful when assembling Driver Files Samba and Printer Ports Avoiding the most common Misconfigurations of the Client Driver The Imprints Toolset What is Imprints? Creating Printer Driver Packages The Imprints Server The Installation Client Add Network Printers at Logon without User Interaction The addprinter command Migration of "Classical" printing to Samba-3 Publishing Printer Information in Active Directory or LDAP Common Errors and Problems I give my root password but I don't get access My printjobs get spooled into the spooling directory, but then get lost 19. CUPS Printing Support in Samba 3.0 Introduction Features and Benefits Overview Basic Configuration of CUPS support Linking of smbd with libcups.so Simple smb.conf Settings for CUPS More complex smb.conf Settings for -CUPS Advanced Configuration Central spooling vs. "Peer-to-Peer" printing CUPS/Samba as a "spooling-only" Print Server; "raw" printing -with Vendor Drivers on Windows Clients Driver Installation Methods on Windows Clients Explicitly enable "raw" printing for -application/octet-stream! Three familiar Methods for driver upload plus a new one Using CUPS/Samba in an advanced Way -- intelligent printing -with PostScript Driver Download GDI on Windows -- PostScript on Unix Windows Drivers, GDI and EMF Unix Printfile Conversion and GUI Basics PostScript and Ghostscript Ghostscript -- the Software RIP for non-PostScript Printers PostScript Printer Description (PPD) Specification CUPS can use all Windows-formatted Vendor PPDs CUPS also uses PPDs for non-PostScript Printers The CUPS Filtering Architecture MIME types and CUPS Filters MIME type Conversion Rules Filter Requirements Prefilters pstops pstoraster imagetops and imagetoraster rasterto [printers specific] CUPS Backends cupsomatic/Foomatic -- how do they fit into the Picture? The Complete Picture mime.convs "Raw" printing "application/octet-stream" printing PostScript Printer Descriptions (PPDs) for non-PS Printers Difference between cupsomatic/foomatic-rip and -native CUPS printing Examples for filtering Chains Sources of CUPS drivers / PPDs Printing with Interface Scripts Network printing (purely Windows) From Windows Clients to an NT Print Server Driver Execution on the Client Driver Execution on the Server Network Printing (Windows clients -- UNIX/Samba Print -Servers) From Windows Clients to a CUPS/Samba Print Server Samba receiving Jobfiles and passing them to CUPS Network PostScript RIP: CUPS Filters on Server -- clients use -PostScript Driver with CUPS-PPDs PPDs for non-PS Printers on UNIX PPDs for non-PS Printers on Windows Windows Terminal Servers (WTS) as CUPS Clients Printer Drivers running in "Kernel Mode" cause many -Problems Workarounds impose Heavy Limitations CUPS: a "Magical Stone"? PostScript Drivers with no major problems -- even in Kernel -Mode Setting up CUPS for driver Download cupsaddsmb: the unknown Utility Prepare your smb.conf for -cupsaddsmb CUPS Package of "PostScript Driver for WinNT/2k/XP" Recognize the different Driver Files Acquiring the Adobe Driver Files ESP Print Pro Package of "PostScript Driver for -WinNT/2k/XP" Caveats to be considered What are the Benefits of using the "CUPS PostScript Driver for -Windows NT/2k/XP" as compared to the Adobe Driver? Run "cupsaddsmb" (quiet Mode) Run "cupsaddsmb" with verbose Output Understanding cupsaddsmb How to recognize if cupsaddsm completed successfully cupsaddsmb with a Samba PDC cupsaddsmb Flowchart Installing the PostScript Driver on a Client Avoiding critical PostScript Driver Settings on the -Client Installing PostScript Driver Files manually (using -rpcclient) A Check of the rpcclient man Page Understanding the rpcclient man Page Producing an Example by querying a Windows Box What is required for adddriver and setdriver to succeed Manual Commandline Driver Installation in 15 little Steps Troubleshooting revisited The printing *.tdb Files Trivial DataBase Files Binary Format Losing *.tdb Files Using tdbbackup CUPS Print Drivers from Linuxprinting.org foomatic-rip and Foomatic explained foomatic-rip and Foomatic-PPD Download and Installation Page Accounting with CUPS Setting up Quotas Correct and incorrect Accounting Adobe and CUPS PostScript Drivers for Windows Clients The page_log File Syntax Possible Shortcomings Future Developments Other Accounting Tools Additional Material Auto-Deletion or Preservation of CUPS Spool Files CUPS Configuration Settings explained Pre-conditions Manual Configuration When not to use Samba to print to -CUPS In Case of Trouble..... Where to find Documentation How to ask for Help Where to find Help Appendix Printing from CUPS to Windows attached -Printers More CUPS filtering Chains Trouble Shooting Guidelines to fix typical Samba printing -Problems An Overview of the CUPS Printing Processes 20. Stackable VFS modules Features and Benefits Discussion Included modules audit extd_audit fake_perms recycle netatalk VFS modules available elsewhere DatabaseFS vscan Common Errors 21. Integrated Logon Support using Winbind Features and Benefits Introduction What Winbind Provides Target Uses How Winbind Works Microsoft Remote Procedure Calls Microsoft Active Directory Services Name Service Switch Pluggable Authentication Modules User and Group ID Allocation Result Caching Installation and Configuration Introduction Requirements Testing Things Out Conclusion Common Errors 22. Advanced Network Management Features and Benefits Remote Server Administration Remote Desktop Management Remote Management from NoMachines.Com Network Logon Script Magic Adding printers without user intervention Common Errors 23. System and Account Policies Features and Benefits Creating and Managing System Policies Windows 9x/Me Policies Windows NT4 Style Policy Files MS Windows 200x / XP Professional Policies Managing Account/User Policies Samba Editreg Toolset Windows NT4/200x Samba PDC System Startup and Logon Processing Overview Common Errors Policy Does Not Work 24. Desktop Profile Management Features and Benefits Roaming Profiles Samba Configuration for Profile Handling Windows Client Profile Configuration Information Sharing Profiles between W9x/Me and NT4/200x/XP workstations Profile Migration from Windows NT4/200x Server to Samba Mandatory profiles Creating/Managing Group Profiles Default Profile for Windows Users MS Windows 9x/Me MS Windows NT4 Workstation MS Windows 200x/XP Common Errors How does one set up roaming profiles for just one (or a few) user/s or group/s? Can NOT use Roaming Profiles Changing the default profile 25. PAM based Distributed Authentication Features and Benefits Technical Discussion PAM Configuration Syntax Example System Configurations smb.conf PAM Configuration Remote CIFS Authentication using winbindd.so Password Synchronization using pam_smbpass.so Common Errors pam_winbind problem 26. Integrating MS Windows networks with Samba Features and Benefits Background Information Name Resolution in a pure Unix/Linux world /etc/hosts /etc/resolv.conf /etc/host.conf /etc/nsswitch.conf Name resolution as used within MS Windows networking The NetBIOS Name Cache The LMHOSTS file HOSTS file DNS Lookup WINS Lookup Common Errors My Boomerang Won't Come Back Very Slow Network Connections Samba server name change problem 27. Unicode/Charsets Features and Benefits What are charsets and unicode? Samba and charsets Conversion from old names Japanese charsets 28. Samba Backup Techniques Note Features and Benefits 29. High Availability Options Note Prev Up Next Chapter 9. MS Windows Network Configuration Guide Home Chapter 10. Samba / MS Windows Network Browsing Guide + Table of Contents 10. Samba / MS Windows Network Browsing Guide Features and Benefits What is Browsing? Discussion NetBIOS over TCP/IP TCP/IP - without NetBIOS DNS and Active Directory How Browsing Functions Setting up WORKGROUP Browsing Setting up DOMAIN Browsing Forcing Samba to be the master Making Samba the domain master Note about broadcast addresses Multiple interfaces Use of the Remote Announce parameter Use of the Remote Browse Sync parameter WINS - The Windows Internetworking Name Server Setting up a WINS server WINS Replication Static WINS Entries Helpful Hints Windows Networking Protocols Name Resolution Order Technical Overview of browsing Browsing support in Samba Problem resolution Browsing across subnets Common Errors How can one flush the Samba NetBIOS name cache without restarting Samba? My client reports "This server is not configured to list shared resources" 11. Account Information Databases Features and Benefits Technical Information Important Notes About Security Mapping User Identifiers between MS Windows and Unix Account Management Tools The smbpasswd Command The pdbedit Command Password Backends Plain Text smbpasswd - Encrypted Password Database tdbsam ldapsam MySQL XML Common Errors Users can not logon - Users not in Samba SAM Users are being added to the wrong backend database auth methods does not work 12. Mapping MS Windows and Unix Groups Features and Benefits Discussion Example Configuration Configuration Scripts Sample smb.conf add group script Script to configure Group Mapping Common Errors Adding Groups Fails Adding MS Windows Groups to MS Windows Groups Fails 13. File, Directory and Share Access Controls Features and Benefits File System Access Controls MS Windows NTFS Comparison with Unix File Systems Managing Directories File and Directory Access Control Share Definition Access Controls User and Group Based Controls File and Directory Permissions Based Controls Miscellaneous Controls Access Controls on Shares Share Permissions Management MS Windows Access Control Lists and Unix Interoperability Managing UNIX permissions Using NT Security Dialogs Viewing File Security on a Samba Share Viewing file ownership Viewing File or Directory Permissions Modifying file or directory permissions Interaction with the standard Samba create mask + parameters Interaction with the standard Samba file attribute + mapping Common Errors Users can not write to a public share I have set force user and Samba still makes root the owner of all the files + I touch! 14. File and Record Locking Features and Benefits Discussion Opportunistic Locking Overview Samba Opportunistic Locking Control Example Configuration MS Windows Opportunistic Locking and Caching Controls Workstation Service Entries Server Service Entries Persistent Data Corruption Common Errors locking.tdb error messages Additional Reading 15. Securing Samba Introduction Features and Benefits Technical Discussion of Protective Measures and Issues Using host based protection User based protection Using interface protection Using a firewall Using a IPC$ share deny NTLMv2 Security Upgrading Samba Common Errors Smbclient works on localhost, but the network is dead Why can users access home directories of other users? 16. Interdomain Trust Relationships Features and Benefits Trust Relationship Background Native MS Windows NT4 Trusts Configuration NT4 as the Trusting Domain (ie. creating the trusted account) NT4 as the Trusted Domain (ie. creating trusted account's password) Configuring Samba NT-style Domain Trusts Samba-3 as the Trusting Domain Samba-3 as the Trusted Domain Common Errors Tell me about Trust Relationships using Samba 17. Hosting a Microsoft Distributed File System tree on Samba Features and Benefits Common Errors 18. Classical Printing Support Features and Benefits Technical Introduction What happens if you send a Job from a Client Printing Related Configuration Parameters Parameters Recommended for Use Parameters for Backwards Compatibility Parameters no longer in use A simple Configuration to Print with Samba-3 Verification of "Settings in Use" with testparm A little Experiment to warn you Extended Sample Configuration to Print with Samba-3 Detailed Explanation of the Example's Settings The [global] Section The [printers] Section Any [my_printer_name] Section Print Commands Default Print Commands for various Unix Print Subsystems Setting up your own Print Commands Innovations in Samba Printing since 2.2 Client Drivers on Samba Server for Point'n'Print The [printer$] Section is removed from Samba-3 Creating the [print$] Share Parameters in the [print$] Section Subdirectory Structure in [print$] Installing Drivers into [print$] Setting Drivers for existing Printers with a Client GUI Setting Drivers for existing Printers with +rpcclient "The Proof of the Pudding lies in the Eating" (Client Driver Install +Procedure) The first Client Driver Installation IMPORTANT! Setting Device Modes on new Printers Further Client Driver Install Procedures Always make first Client Connection as root or "printer admin" Other Gotchas Setting Default Print Options for the Client Drivers Supporting large Numbers of Printers Adding new Printers with the Windows NT APW Weird Error Message Cannot connect under a +different Name Be careful when assembling Driver Files Samba and Printer Ports Avoiding the most common Misconfigurations of the Client Driver The Imprints Toolset What is Imprints? Creating Printer Driver Packages The Imprints Server The Installation Client Add Network Printers at Logon without User Interaction The addprinter command Migration of "Classical" printing to Samba-3 Publishing Printer Information in Active Directory or LDAP Common Errors and Problems I give my root password but I don't get access My printjobs get spooled into the spooling directory, but then get lost 19. CUPS Printing Support in Samba 3.0 Introduction Features and Benefits Overview Basic Configuration of CUPS support Linking of smbd with libcups.so Simple smb.conf Settings for CUPS More complex smb.conf Settings for +CUPS Advanced Configuration Central spooling vs. "Peer-to-Peer" printing CUPS/Samba as a "spooling-only" Print Server; "raw" printing +with Vendor Drivers on Windows Clients Driver Installation Methods on Windows Clients Explicitly enable "raw" printing for +application/octet-stream! Three familiar Methods for driver upload plus a new one Using CUPS/Samba in an advanced Way -- intelligent printing +with PostScript Driver Download GDI on Windows -- PostScript on Unix Windows Drivers, GDI and EMF Unix Printfile Conversion and GUI Basics PostScript and Ghostscript Ghostscript -- the Software RIP for non-PostScript Printers PostScript Printer Description (PPD) Specification CUPS can use all Windows-formatted Vendor PPDs CUPS also uses PPDs for non-PostScript Printers The CUPS Filtering Architecture MIME types and CUPS Filters MIME type Conversion Rules Filter Requirements Prefilters pstops pstoraster imagetops and imagetoraster rasterto [printers specific] CUPS Backends cupsomatic/Foomatic -- how do they fit into the Picture? The Complete Picture mime.convs "Raw" printing "application/octet-stream" printing PostScript Printer Descriptions (PPDs) for non-PS Printers Difference between cupsomatic/foomatic-rip and +native CUPS printing Examples for filtering Chains Sources of CUPS drivers / PPDs Printing with Interface Scripts Network printing (purely Windows) From Windows Clients to an NT Print Server Driver Execution on the Client Driver Execution on the Server Network Printing (Windows clients -- UNIX/Samba Print +Servers) From Windows Clients to a CUPS/Samba Print Server Samba receiving Jobfiles and passing them to CUPS Network PostScript RIP: CUPS Filters on Server -- clients use +PostScript Driver with CUPS-PPDs PPDs for non-PS Printers on UNIX PPDs for non-PS Printers on Windows Windows Terminal Servers (WTS) as CUPS Clients Printer Drivers running in "Kernel Mode" cause many +Problems Workarounds impose Heavy Limitations CUPS: a "Magical Stone"? PostScript Drivers with no major problems -- even in Kernel +Mode Setting up CUPS for driver Download cupsaddsmb: the unknown Utility Prepare your smb.conf for +cupsaddsmb CUPS Package of "PostScript Driver for WinNT/2k/XP" Recognize the different Driver Files Acquiring the Adobe Driver Files ESP Print Pro Package of "PostScript Driver for +WinNT/2k/XP" Caveats to be considered What are the Benefits of using the "CUPS PostScript Driver for +Windows NT/2k/XP" as compared to the Adobe Driver? Run "cupsaddsmb" (quiet Mode) Run "cupsaddsmb" with verbose Output Understanding cupsaddsmb How to recognize if cupsaddsm completed successfully cupsaddsmb with a Samba PDC cupsaddsmb Flowchart Installing the PostScript Driver on a Client Avoiding critical PostScript Driver Settings on the +Client Installing PostScript Driver Files manually (using +rpcclient) A Check of the rpcclient man Page Understanding the rpcclient man Page Producing an Example by querying a Windows Box What is required for adddriver and setdriver to succeed Manual Commandline Driver Installation in 15 little Steps Troubleshooting revisited The printing *.tdb Files Trivial DataBase Files Binary Format Losing *.tdb Files Using tdbbackup CUPS Print Drivers from Linuxprinting.org foomatic-rip and Foomatic explained foomatic-rip and Foomatic-PPD Download and Installation Page Accounting with CUPS Setting up Quotas Correct and incorrect Accounting Adobe and CUPS PostScript Drivers for Windows Clients The page_log File Syntax Possible Shortcomings Future Developments Other Accounting Tools Additional Material Auto-Deletion or Preservation of CUPS Spool Files CUPS Configuration Settings explained Pre-conditions Manual Configuration When not to use Samba to print to +CUPS In Case of Trouble..... Where to find Documentation How to ask for Help Where to find Help Appendix Printing from CUPS to Windows attached +Printers More CUPS filtering Chains Trouble Shooting Guidelines to fix typical Samba printing +Problems An Overview of the CUPS Printing Processes 20. Stackable VFS modules Features and Benefits Discussion Included modules audit extd_audit fake_perms recycle netatalk VFS modules available elsewhere DatabaseFS vscan Common Errors 21. Integrated Logon Support using Winbind Features and Benefits Introduction What Winbind Provides Target Uses How Winbind Works Microsoft Remote Procedure Calls Microsoft Active Directory Services Name Service Switch Pluggable Authentication Modules User and Group ID Allocation Result Caching Installation and Configuration Introduction Requirements Testing Things Out Conclusion Common Errors 22. Advanced Network Management Features and Benefits Remote Server Administration Remote Desktop Management Remote Management from NoMachines.Com Network Logon Script Magic Adding printers without user intervention Common Errors 23. System and Account Policies Features and Benefits Creating and Managing System Policies Windows 9x/Me Policies Windows NT4 Style Policy Files MS Windows 200x / XP Professional Policies Managing Account/User Policies Samba Editreg Toolset Windows NT4/200x Samba PDC System Startup and Logon Processing Overview Common Errors Policy Does Not Work 24. Desktop Profile Management Features and Benefits Roaming Profiles Samba Configuration for Profile Handling Windows Client Profile Configuration Information Sharing Profiles between W9x/Me and NT4/200x/XP workstations Profile Migration from Windows NT4/200x Server to Samba Mandatory profiles Creating/Managing Group Profiles Default Profile for Windows Users MS Windows 9x/Me MS Windows NT4 Workstation MS Windows 200x/XP Common Errors How does one set up roaming profiles for just one (or a few) user/s or group/s? Can NOT use Roaming Profiles Changing the default profile 25. PAM based Distributed Authentication Features and Benefits Technical Discussion PAM Configuration Syntax Example System Configurations smb.conf PAM Configuration Remote CIFS Authentication using winbindd.so Password Synchronization using pam_smbpass.so Common Errors pam_winbind problem 26. Integrating MS Windows networks with Samba Features and Benefits Background Information Name Resolution in a pure Unix/Linux world /etc/hosts /etc/resolv.conf /etc/host.conf /etc/nsswitch.conf Name resolution as used within MS Windows networking The NetBIOS Name Cache The LMHOSTS file HOSTS file DNS Lookup WINS Lookup Common Errors My Boomerang Won't Come Back Very Slow Network Connections Samba server name change problem 27. Unicode/Charsets Features and Benefits What are charsets and unicode? Samba and charsets Conversion from old names Japanese charsets 28. Samba Backup Techniques Note Features and Benefits 29. High Availability Options Note Prev Up Next Chapter 9. MS Windows Network Configuration Guide Home Chapter 10. Samba / MS Windows Network Browsing Guide diff --git a/docs/htmldocs/pam.html b/docs/htmldocs/pam.html index a0221b57e0..b3d0314add 100644 --- a/docs/htmldocs/pam.html +++ b/docs/htmldocs/pam.html @@ -1,4 +1,5 @@ -Chapter 25. PAM based Distributed AuthenticationChapter 25. PAM based Distributed Authentication Prev Part III. Advanced Configuration Next Chapter 25. PAM based Distributed Authentication John H. Terpstra Samba Team <jht@samba.org> Stephen Langasek <vorlon@netexpress.net> May 31, 2003 Table of Contents Features and Benefits Technical Discussion PAM Configuration Syntax Example System Configurations smb.conf PAM Configuration Remote CIFS Authentication using winbindd.so Password Synchronization using pam_smbpass.so Common Errors pam_winbind problem + +Chapter 25. PAM based Distributed Authentication Chapter 25. PAM based Distributed Authentication Prev Part III. Advanced Configuration Next Chapter 25. PAM based Distributed Authentication John H. Terpstra Samba Team <jht@samba.org> Stephen Langasek <vorlon@netexpress.net> May 31, 2003 Table of Contents Features and Benefits Technical Discussion PAM Configuration Syntax Example System Configurations smb.conf PAM Configuration Remote CIFS Authentication using winbindd.so Password Synchronization using pam_smbpass.so Common Errors pam_winbind problem This chapter you should help you to deploy winbind based authentication on any PAM enabled Unix/Linux system. Winbind can be used to enable user level application access authentication from any MS Windows NT Domain, MS Windows 200x Active Directory based domain, or any Samba @@ -9,7 +10,7 @@ In addition to knowing how to configure winbind into PAM, you will learn generic possibilities and in particular how to deploy tools like pam_smbpass.so to your advantage. Note The use of Winbind require more than PAM configuration alone. Please refer to the Winbind chapter. - Features and Benefits + Features and Benefits A number of Unix systems (eg: Sun Solaris), as well as the xxxxBSD family and Linux, now utilize the Pluggable Authentication Modules (PAM) facility to provide all authentication, authorization and resource control services. Prior to the introduction of PAM, a decision @@ -67,12 +68,12 @@ of distributed samba domain controllers that can provide wide are network bandwi efficient authentication services for PAM capable systems. In effect, this allows the deployment of centrally managed and maintained distributed authentication from a single user account database. - Technical Discussion + Technical Discussion PAM is designed to provide the system administrator with a great deal of flexibility in configuration of the privilege granting applications of their system. The local configuration of system security controlled by PAM is contained in one of two places: either the single system file, /etc/pam.conf; or the /etc/pam.d/ directory. - PAM Configuration Syntax + PAM Configuration Syntax In this section we discuss the correct syntax of and generic options respected by entries to these files. PAM specific tokens in the configuration file are case insensitive. The module paths, however, are case sensitive since they indicate a file's name and reflect the case dependence of typical file-systems. @@ -86,22 +87,22 @@ If the PAM authentication module (loadable link library file) is located in the default location then it is not necessary to specify the path. In the case of Linux, the default location is /lib/security. If the module is located outside the default then the path must be specified as: - - + + auth required /other_path/pam_strange_module.so - - Anatomy of /etc/pam.d Entries + +Anatomy of /etc/pam.d Entries The remaining information in this subsection was taken from the documentation of the Linux-PAM project. For more information on PAM, see http://ftp.kernel.org/pub/linux/libs/pam The Official Linux-PAM home page. A general configuration line of the /etc/pam.conf file has the following form: - - + + service-name module-type control-flag module-path args - - + + Below, we explain the meaning of each of these tokens. The second (and more recently adopted) way of configuring Linux-PAM is via the contents of the /etc/pam.d/ directory. Once we have explained the meaning of the above tokens, we will describe this method. @@ -218,8 +219,8 @@ Once we have explained the meaning of the above tokens, we will describe this me Each of the four keywords: required; requisite; sufficient; and optional, have an equivalent expression in terms of the [...] syntax. They are as follows: - - + + required is equivalent to [success=ok new_authtok_reqd=ok ignore=ignore default=bad] requisite is equivalent to [success=ok new_authtok_reqd=ok ignore=ignore default=die] @@ -227,8 +228,8 @@ Once we have explained the meaning of the above tokens, we will describe this me sufficient is equivalent to [success=done new_authtok_reqd=done default=ignore] optional is equivalent to [success=ok new_authtok_reqd=ok default=ignore] - - + + Just to get a feel for the power of this new syntax, here is a taste of what you can do with it. With Linux-PAM-0.63, the notion of client plug-in agents was introduced. This is something that makes it possible for PAM to support machine-machine authentication using the transport protocol inherent to the client/server application. With the @@ -260,13 +261,13 @@ squid auth required pam_mysql.so user=passwd_query passwd=mada \ Any line in (one of) the configuration file(s), that is not formatted correctly, will generally tend (erring on the side of caution) to make the authentication process fail. A corresponding error is written to the system log files with a call to syslog(3). - Example System Configurations + Example System Configurations The following is an example /etc/pam.d/login configuration file. This example had all options been uncommented is probably not usable as it stacks many conditions before allowing successful completion of the login process. Essentially all conditions can be disabled by commenting them out except the calls to pam_pwdb.so. - PAM: original login config + PAM: original login config #%PAM-1.0 # The PAM configuration file for the `login' service # @@ -281,10 +282,10 @@ session required pam_pwdb.so # session optional pam_lastlog.so # password required pam_cracklib.so retry=3 password required pam_pwdb.so shadow md5 - PAM: login using pam_smbpass + PAM: login using pam_smbpass PAM allows use of replaceable modules. Those available on a sample system include: - $/bin/ls /lib/security - + $/bin/ls /lib/security + pam_access.so pam_ftp.so pam_limits.so pam_ncp_auth.so pam_rhosts_auth.so pam_stress.so pam_cracklib.so pam_group.so pam_listfile.so @@ -360,7 +361,7 @@ authentication to be configured in a single central file. The on the basis that it allows for easier administration. As with all issues in life though, every decision makes trade-offs, so you may want examine the PAM documentation for further helpful information. - smb.conf PAM Configuration + smb.conf PAM Configuration There is an option in smb.conf called obey pam restrictions. The following is from the on-line help for this option in SWAT; @@ -375,7 +376,7 @@ ignores PAM for authentication in the case of The reason is that PAM modules cannot support the challenge/response authentication mechanism needed in the presence of SMB password encryption. - Default: obey pam restrictions = no Remote CIFS Authentication using winbindd.so + Default: obey pam restrictions = no Remote CIFS Authentication using winbindd.so All operating systems depend on the provision of users credentials acceptable to the platform. Unix requires the provision of a user identifier (UID) as well as a group identifier (GID). These are both simple integer type numbers that are obtained from a password backend such @@ -401,7 +402,7 @@ Microsoft Active Directory Service (ADS) in so far as reduction of wide area net The rid to unix id database is the only location where the user and group mappings are stored by winbindd. If this file is deleted or corrupted, there is no way for winbindd to determine which user and group ids correspond to Windows NT user and group rids. - Password Synchronization using pam_smbpass.so + Password Synchronization using pam_smbpass.so pam_smbpass is a PAM module which can be used on conforming systems to keep the smbpasswd (Samba password) database in sync with the unix password file. PAM (Pluggable Authentication Modules) is an API supported @@ -412,21 +413,21 @@ This module authenticates a local smbpasswd user database. If you require support for authenticating against a remote SMB server, or if you're concerned about the presence of suid root binaries on your system, it is recommended that you use pam_winbind instead. - + Options recognized by this module are as follows: - Table 25.1. Options recognized by pam_smbpass debug log more debugging info audit like debug, but also logs unknown usernames use_first_pass don't prompt the user for passwords; take them from PAM_ items instead try_first_pass try to get the password from a previous PAM module, fall back to prompting the user use_authtok like try_first_pass, but *fail* if the new PAM_AUTHTOK has not been previously set. (intended for stacking password modules only) not_set_pass don't make passwords used by this module available to other modules. nodelay don't insert ~1 second delays on authentication failure. nullok null passwords are allowed. nonull null passwords are not allowed. Used to override the Samba configuration. migrate only meaningful in an "auth" context; used to update smbpasswd file with a password used for successful authentication. smbconf=file specify an alternate path to the smb.conf file. - + Table 25.1. Options recognized by pam_smbpass debug log more debugging info audit like debug, but also logs unknown usernames use_first_pass don't prompt the user for passwords; take them from PAM_ items instead try_first_pass try to get the password from a previous PAM module, fall back to prompting the user use_authtok like try_first_pass, but *fail* if the new PAM_AUTHTOK has not been previously set. (intended for stacking password modules only) not_set_pass don't make passwords used by this module available to other modules. nodelay don't insert ~1 second delays on authentication failure. nullok null passwords are allowed. nonull null passwords are not allowed. Used to override the Samba configuration. migrate only meaningful in an "auth" context; used to update smbpasswd file with a password used for successful authentication. smbconf=file specify an alternate path to the smb.conf file. + Thanks go to the following people: - Andrew Morgan, for providing the Linux-PAM +Andrew Morgan, for providing the Linux-PAM framework, without which none of this would have happened Christian Gafton and Andrew Morgan again, for the pam_pwdb module upon which pam_smbpass was originally based Luke Leighton for being receptive to the idea, and for the occasional good-natured complaint about the project's status - that keep me working on it :) . - + that keep me working on it :) . + The following are examples of the use of pam_smbpass.so in the format of Linux /etc/pam.d/ files structure. Those wishing to implement this tool on other platforms will need to adapt this appropriately. - Password Synchronisation Configuration + Password Synchronisation Configuration A sample PAM configuration that shows the use of pam_smbpass to make sure private/smbpasswd is kept in sync when /etc/passwd (/etc/shadow) is changed. Useful when an expired password might be changed by an @@ -442,7 +443,7 @@ password requisite pam_cracklib.so retry=3 password requisite pam_unix.so shadow md5 use_authtok try_first_pass password required pam_smbpass.so nullok use_authtok try_first_pass session required pam_unix.so - Password Migration Configuration + Password Migration Configuration A sample PAM configuration that shows the use of pam_smbpass to migrate from plaintext to encrypted passwords for Samba. Unlike other methods, this can be used for users who have never connected to Samba shares: @@ -461,7 +462,7 @@ password requisite pam_cracklib.so retry=3 password requisite pam_unix.so shadow md5 use_authtok try_first_pass password optional pam_smbpass.so nullok use_authtok try_first_pass session required pam_unix.so - Mature Password Configuration + Mature Password Configuration A sample PAM configuration for a 'mature' smbpasswd installation. private/smbpasswd is fully populated, and we consider it an error if the smbpasswd doesn't exist or doesn't match the Unix password. @@ -476,7 +477,7 @@ password requisite pam_cracklib.so retry=3 password requisite pam_unix.so shadow md5 use_authtok try_first_pass password required pam_smbpass.so use_authtok use_first_pass session required pam_unix.so - Kerberos Password Integration Configuration + Kerberos Password Integration Configuration A sample PAM configuration that shows pam_smbpass used together with pam_krb5. This could be useful on a Samba PDC that is also a member of a Kerberos realm. @@ -492,13 +493,13 @@ password requisite pam_cracklib.so retry=3 password optional pam_smbpass.so nullok use_authtok try_first_pass password required pam_krb5.so use_authtok try_first_pass session required pam_krb5.so - Common Errors +Common Errors PAM can be a very fickle and sensitive to configuration glitches. Here we look at a few cases from the Samba mailing list. - pam_winbind problem + pam_winbind problem I have the following PAM configuration: - - + + auth required /lib/security/pam_securetty.so auth sufficient /lib/security/pam_winbind.so auth sufficient /lib/security/pam_unix.so use_first_pass nullok @@ -507,8 +508,8 @@ auth required /lib/security/pam_nologin.so account required /lib/security/pam_stack.so service=system-auth account required /lib/security/pam_winbind.so password required /lib/security/pam_stack.so service=system-auth - - + + When I open a new console with [ctrl][alt][F1], then I cant log in with my user "pitie". I've tried with user "scienceu+pitie" also. diff --git a/docs/htmldocs/passdb.html b/docs/htmldocs/passdb.html index 2c68f50c87..e627eb015f 100644 --- a/docs/htmldocs/passdb.html +++ b/docs/htmldocs/passdb.html @@ -1,4 +1,5 @@ -Chapter 11. Account Information Databases Chapter 11. Account Information Databases Prev Part III. Advanced Configuration Next Chapter 11. Account Information Databases Jelmer R. Vernooij The Samba Team <jelmer@samba.org> Gerald (Jerry) Carter Samba Team <jerry@samba.org> Jeremy Allison Samba Team <jra@samba.org> John H. Terpstra Samba Team <jht@samba.org> Olivier (lem) Lemaire IDEALX <olem@IDEALX.org> May 24, 2003 Table of Contents Features and Benefits Technical Information Important Notes About Security Mapping User Identifiers between MS Windows and Unix Account Management Tools The smbpasswd Command The pdbedit Command Password Backends Plain Text smbpasswd - Encrypted Password Database tdbsam ldapsam MySQL XML Common Errors Users can not logon - Users not in Samba SAM Users are being added to the wrong backend database auth methods does not work + +Chapter 11. Account Information Databases Chapter 11. Account Information Databases Prev Part III. Advanced Configuration Next Chapter 11. Account Information Databases Jelmer R. Vernooij The Samba Team <jelmer@samba.org> Gerald (Jerry) Carter Samba Team <jerry@samba.org> Jeremy Allison Samba Team <jra@samba.org> John H. Terpstra Samba Team <jht@samba.org> Olivier (lem) Lemaire IDEALX <olem@IDEALX.org> May 24, 2003 Table of Contents Features and Benefits Technical Information Important Notes About Security Mapping User Identifiers between MS Windows and Unix Account Management Tools The smbpasswd Command The pdbedit Command Password Backends Plain Text smbpasswd - Encrypted Password Database tdbsam ldapsam MySQL XML Common Errors Users can not logon - Users not in Samba SAM Users are being added to the wrong backend database auth methods does not work Samba-3 implements a new capability to work concurrently with multiple account backends. The possible new combinations of password backends allows Samba-3 a degree of flexibility and scalability that previously could be achieved only with MS Windows Active Directory. @@ -16,7 +17,7 @@ deliver this functionality until a better method of recognising NT Group SIDs fr SIDs could be found. This feature may thus return during the life cycle for the Samba-3 series. Note Samba-3.0.0 does NOT support Non-Unix Account (NUA) operation. - Features and Benefits + Features and Benefits Samba-3 provides for complete backwards compatibility with Samba-2.2.x functionality as follows: Backwards Compatibility Backends Plain Text: @@ -93,7 +94,7 @@ Samba-3 introduces the following new password backend capabilities: nisplussam: The NIS+ based passdb backend. Takes name NIS domain as an optional argument. Only works with Sun NIS+ servers. - Technical Information + Technical Information Old windows clients send plain text passwords over the wire. Samba can check these passwords by crypting them and comparing them to the hash stored in the unix user database. @@ -111,7 +112,7 @@ Samba-3 introduces the following new password backend capabilities: information using a passdb backend. Commonly available backends are LDAP, plain text file, MySQL and nisplus. For more information, see the man page for smb.conf regarding the passdb backend parameter. - Important Notes About Security + Important Notes About Security The unix and SMB password encryption techniques seem similar on the surface. This similarity is, however, only skin deep. The unix scheme typically sends clear text passwords over the network when logging in. This is bad. The SMB encryption scheme @@ -153,7 +154,7 @@ Samba-3 introduces the following new password backend capabilities: (broken) only the cached (encrypted) password will be sent to the resource server to affect a auto-reconnect. If the resource server does not support encrypted passwords the auto-reconnect will fail. USE OF ENCRYPTED PASSWORDS IS STRONGLY ADVISED. - Advantages of Encrypted Passwords Plain text passwords are not passed across + Advantages of Encrypted Passwords Plain text passwords are not passed across the network. Someone using a network sniffer cannot just record passwords going to the SMB server. Plain text passwords are not stored anywhere in memory or on disk. WinNT doesn't like talking to a server @@ -164,11 +165,11 @@ Samba-3 introduces the following new password backend capabilities: only things you can do to stop this is to use SMB encryption. Encrypted password support allows automatic share (resource) reconnects. Encrypted passwords are essential for PDC/BDC - operation. Advantages of non-encrypted passwords Plain text passwords are not kept + operation. Advantages of non-encrypted passwords Plain text passwords are not kept on disk, and are NOT cached in memory. Uses same password file as other unix services such as login and ftp Use of other services (such as telnet and ftp) which send plain text passwords over the net, so sending them for SMB - isn't such a big deal. Mapping User Identifiers between MS Windows and Unix + isn't such a big deal. Mapping User Identifiers between MS Windows and Unix Every operation in Unix/Linux requires a user identifier (UID), just as in MS Windows NT4 / 200x this requires a Security Identifier (SID). Samba provides two means for mapping an MS Windows user to a Unix/Linux UID. @@ -183,13 +184,13 @@ Samba-3 introduces the following new password backend capabilities: idmap uid, idmap gid parameters in smb.conf. Please refer to the man page for information about these parameters. These parameters are essential when mapping users from a remote SAM server. - Account Management Tools + Account Management Tools Samba-3 provides two (2) tools for management of User and machine accounts. These tools are called smbpasswd and pdbedit. A third tool is under development but is NOT expected to ship in time for Samba-3.0.0. The new tool will be a TCL/TK GUI tool that looks much like the MS Windows NT4 Domain User Manager - hopefully this will be announced in time for the Samba-3.0.1 release. - The smbpasswd Command + The smbpasswd Command The smbpasswd utility is a utility similar to the passwd or yppasswd programs. It maintains the two 32 byte password fields in the passdb backend. @@ -205,18 +206,18 @@ be announced in time for the Samba-3.0.1 release. smbpasswd can be used to: add user or machine accounts delete user or machine accounts enable user or machine accounts disable user or machine accounts set to NULL user passwords manage interdomain trust accounts To run smbpasswd as a normal user just type: - - + + $ smbpasswd Old SMB password: secret - + For secret type old value here - or hit return if there was no old password - + New SMB Password: new secret Repeat New SMB Password: new secret - - + + If the old value does not match the current value stored for that user, or the two new values do not match each other, then the password will not be changed. @@ -235,7 +236,7 @@ be announced in time for the Samba-3.0.1 release. For more details on using smbpasswd refer to the man page (the definitive reference). - The pdbedit Command + The pdbedit Command pdbedit is a tool that can be used only by root. It is used to manage the passdb backend. pdbedit can be used to: add, remove or modify user accounts listing user accounts migrate user accounts @@ -271,27 +272,27 @@ be announced in time for the Samba-3.0.1 release. Password last set: Sat, 14 Dec 2002 14:37:03 GMT Password can change: Sat, 14 Dec 2002 14:37:03 GMT Password must change: Mon, 18 Jan 2038 20:14:07 GMT - Password Backends + Password Backends Samba-3 offers the greatest flexibility in backend account database design of any SMB/CIFS server technology available today. The flexibility is immediately obvious as one begins to explore this capability. It is possible to specify not only multiple different password backends, but even multiple backends of the same type. For example, to use two different tdbsam databases: - - + + [globals] passdb backend = tdbsam:/etc/samba/passdb.tdb, \ tdbsam:/etc/samba/old-passdb.tdb, guest - - Plain Text + +Plain Text Older versions of Samba retrieved user information from the unix user database and eventually some other fields from the file /etc/samba/smbpasswd or /etc/smbpasswd. When password encryption is disabled, no SMB specific data is stored at all. Instead all operations are conducted via the way that the Samba host OS will access its /etc/passwd database. eg: On Linux systems that is done via PAM. - smbpasswd - Encrypted Password Database + smbpasswd - Encrypted Password Database Traditionally, when configuring encrypt passwords = yes in Samba's smb.conf file, user account information such as username, LM/NT password hashes, password change times, and account @@ -322,7 +323,7 @@ backends of the same type. For example, to use two different tdbsam databases: Samba-3 provides an enhanced set of passdb backends that overcome the deficiencies of the smbpasswd plain text database. These are tdbsam, ldapsam, and xmlsam. Of these ldapsam will be of most interest to large corporate or enterprise sites. - tdbsam Samba can store user and machine account data in a "TDB" (Trivial Database). + tdbsam Samba can store user and machine account data in a "TDB" (Trivial Database). Using this backend doesn't require any additional configuration. This backend is recommended for new installations that do not require LDAP. @@ -330,7 +331,7 @@ backends of the same type. For example, to use two different tdbsam databases: that have 250 or more users. Additionally, tdbsam is not capable of scaling for use in sites that require PDB/BDC implementations that requires replication of the account database. Clearly, for reason of scalability, the use of ldapsam should be encouraged. - ldapsam + ldapsam There are a few points to stress that the ldapsam does not provide. The LDAP support referred to in the this documentation does not include: A means of retrieving user account information from @@ -358,16 +359,16 @@ backends of the same type. For example, to use two different tdbsam databases: The Samba-PDC-LDAP-HOWTO maintained by Ignacio Coupeau. The NT migration scripts from IDEALX that are geared to manage users and group in such a Samba-LDAP Domain Controller configuration. - Supported LDAP Servers + Supported LDAP Servers The LDAP ldapsam code has been developed and tested using the OpenLDAP 2.0 and 2.1 server and client libraries. The same code should work with Netscape's Directory Server and client SDK. However, there are bound to be compile errors and bugs. These should not be hard to fix. Please submit fixes via Bug reporting facility. - Schema and Relationship to the RFC 2307 posixAccount + Schema and Relationship to the RFC 2307 posixAccount Samba 3.0 includes the necessary schema file for OpenLDAP 2.0 in examples/LDAP/samba.schema. The sambaSamAccount objectclass is given here: - - + + objectclass ( 1.3.6.1.4.1.7165.2.2.3 NAME 'sambaSamAccount' SUP top AUXILIARY DESC 'Samba Auxiliary Account' MUST ( uid $ rid ) @@ -375,8 +376,8 @@ objectclass ( 1.3.6.1.4.1.7165.2.2.3 NAME 'sambaSamAccount' SUP top AUXILIARY logoffTime $ kickoffTime $ pwdCanChange $ pwdMustChange $ acctFlags $ displayName $ smbHome $ homeDrive $ scriptPath $ profilePath $ description $ userWorkstations $ primaryGroupID $ domain )) - - + + The samba.schema file has been formatted for OpenLDAP 2.0/2.1. The OID's are owned by the Samba Team and as such is legal to be openly published. If you translate the schema to be used with Netscape DS, please @@ -398,23 +399,23 @@ objectclass ( 1.3.6.1.4.1.7165.2.2.3 NAME 'sambaSamAccount' SUP top AUXILIARY and functioning correctly. This division of information makes it possible to store all Samba account information in LDAP, but still maintain UNIX account information in NIS while the network is transitioning to a full LDAP infrastructure. - OpenLDAP configuration + OpenLDAP configuration To include support for the sambaSamAccount object in an OpenLDAP directory server, first copy the samba.schema file to slapd's configuration directory. The samba.schema file can be found in the directory examples/LDAP in the samba source distribution. - - + + root# cp samba.schema /etc/openldap/schema/ - - + + Next, include the samba.schema file in slapd.conf. The sambaSamAccount object contains two attributes which depend upon other schema files. The 'uid' attribute is defined in cosine.schema and the 'displayName' attribute is defined in the inetorgperson.schema file. Both of these must be included before the samba.schema file. - - + + ## /etc/openldap/slapd.conf ## schema files (core.schema is required by default) @@ -426,13 +427,13 @@ include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/samba.schema include /etc/openldap/schema/nis.schema .... - - + + It is recommended that you maintain some indices on some of the most useful attributes, like in the following example, to speed up searches made on sambaSamAccount objectclasses (and possibly posixAccount and posixGroup as well). - - + + # Indices to maintain ## required by OpenLDAP index objectclass eq @@ -454,25 +455,25 @@ index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq index default sub - - + + Create the new index by executing: - - + + ./sbin/slapindex -f slapd.conf - - + + Remember to restart slapd after making these changes: - - + + root# /etc/init.d/slapd restart - - Initialise the LDAP database + + Initialise the LDAP database Before you can add accounts to the LDAP database you must create the account containers that they will be stored in. The following LDIF file should be modified to match your needs (ie: Your DNS entries, etc.). - - + + # Organization for Samba Base dn: dc=plainjoe,dc=org objectclass: dcObject @@ -500,26 +501,26 @@ objectclass: top objectclass: organizationalRole objectclass: simpleSecurityObject userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz - - + + The userPassword shown above should be generated using slappasswd. The following command will then load the contents of the LDIF file into the LDAP database. - - + + $ slapadd -v -l initldap.dif - - + + Do not forget to secure your LDAP server with an adequate access control list, as well as an admin password. - Note + Note Before Samba can access the LDAP server you need to store the LDAP admin password into the Samba-3 secrets.tdb database by: - + root# smbpasswd -w secret - - Configuring Samba + + Configuring Samba The following parameters are available in smb.conf only if your version of samba was built with LDAP support. Samba automatically builds with LDAP support if the LDAP libraries are found. @@ -527,8 +528,8 @@ userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz These are described in the smb.conf man page and so will not be repeated here. However, a sample smb.conf file for use with an LDAP directory could appear as - - + + ## /usr/local/samba/lib/smb.conf [global] security = user @@ -570,8 +571,8 @@ userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz # generally the default ldap search filter is ok # ldap filter = "(&(uid=%u)(objectclass=sambaSamAccount))" - - Accounts and Groups management + + Accounts and Groups management As users accounts are managed through the sambaSamAccount objectclass, you should modify your existing administration tools to deal with sambaSamAccount attributes. @@ -587,7 +588,7 @@ userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz groups. This means that Samba makes use of the posixGroup objectclass. For now, there is no NT-like group system management (global and local groups). - Security and sambaSamAccount + Security and sambaSamAccount There are two important points to remember when discussing the security of sambaSamAccount entries in the directory. Never retrieve the lmPassword or @@ -613,17 +614,17 @@ userPassword: {SSHA}c3ZM9tBaBo9autm1dL3waDS21+JSfQVz The second security precaution is to prevent non-administrative users from harvesting password hashes from the directory. This can be done using the following ACL in slapd.conf: - - + + ## allow the "ldap admin dn" access, but deny everyone else access to attrs=lmPassword,ntPassword by dn="cn=Samba Admin,ou=people,dc=plainjoe,dc=org" write by * none - - LDAP special attributes for sambaSamAccounts + + LDAP special attributes for sambaSamAccounts The sambaSamAccount objectclass is composed of the following attributes: - - Table 11.1. Attributes in the sambaSamAccount objectclass (LDAP) lmPassword the LANMAN password 16-byte hash stored as a character + + Table 11.1. Attributes in the sambaSamAccount objectclass (LDAP) lmPassword the LANMAN password 16-byte hash stored as a character representation of a hexadecimal string. ntPassword the NT password hash 16-byte stored as a character representation of a hexadecimal string. pwdLastSet The integer time in seconds since 1970 when the lmPassword and ntPassword attributes were last set. @@ -646,8 +647,8 @@ access to attrs=lmPassword,ntPassword userWorkstation character string value currently unused. rid the integer representation of the user's relative identifier (RID). primaryGroupID the relative identifier (RID) of the primary group - of the user. domain domain the user is part of. - + of the user. domain domain the user is part of. + The majority of these parameters are only used when Samba is acting as a PDC of a domain (refer to the Samba as a primary domain controller chapter for details on how to configure Samba as a Primary Domain Controller). The following four attributes @@ -663,10 +664,10 @@ access to attrs=lmPassword,ntPassword of the logon home parameter is used in its place. Samba will only write the attribute value to the directory entry if the value is something other than the default (e.g. \\MOBY\becky). - Example LDIF Entries for a sambaSamAccount + Example LDIF Entries for a sambaSamAccount The following is a working LDIF with the inclusion of the posixAccount objectclass: - - + + dn: uid=guest2, ou=people,dc=plainjoe,dc=org ntPassword: 878D8014606CDA29677A44EFA1353FC7 pwdMustChange: 2147483647 @@ -681,12 +682,12 @@ access to attrs=lmPassword,ntPassword logoffTime: 2147483647 rid: 19006 pwdCanChange: 0 - - + + The following is an LDIF entry for using both the sambaSamAccount and posixAccount objectclasses: - - + + dn: uid=gcarter, ou=people,dc=plainjoe,dc=org logonTime: 0 displayName: Gerald Carter @@ -709,53 +710,53 @@ access to attrs=lmPassword,ntPassword pwdCanChange: 0 pwdMustChange: 2147483647 ntPassword: 878D8014606CDA29677A44EFA1353FC7 - - Password synchronisation + + Password synchronisation Since version 3.0 samba can update the non-samba (LDAP) password stored with an account. When using pam_ldap, this allows changing both unix and windows passwords at once. The ldap passwd sync options can have the following values: yes When the user changes his password, update ntPassword, lmPassword and the password fields. no Only update ntPassword and lmPassword. only Only update the LDAP password and let the LDAP server worry about the other fields. This option is only available when the LDAP server supports LDAP_EXOP_X_MODIFY_PASSWD. More information can be found in the smb.conf manpage. - MySQL + MySQL Every so often someone will come along with a great new idea. Storing of user accounts in an SQL backend is one of them. Those who want to do this are in the best position to know what the specific benefits are to them. This may sound like a cop-out, but in truth we can not attempt to document every nitty little detail why certain things of marginal utility to the bulk of Samba users might make sense to the rest. In any case, the following instructions should help the determined SQL user to implement a working system. - Creating the database + Creating the database You either can set up your own table and specify the field names to pdb_mysql (see below for the column names) or use the default table. The file examples/pdb/mysql/mysql.dump contains the correct queries to create the required tables. Use the command : - $ mysql -uusername -hhostname -ppassword \ -databasename < /path/to/samba/examples/pdb/mysql/mysql.dump - Configuring This plugin lacks some good documentation, but here is some short info: Add a the following to the passdb backend variable in your smb.conf: - + $ mysql -uusername -hhostname -ppassword \ +databasename < /path/to/samba/examples/pdb/mysql/mysql.dump + Configuring This plugin lacks some good documentation, but here is some short info: Add a the following to the passdb backend variable in your smb.conf: + passdb backend = [other-plugins] mysql:identifier [other-plugins] - - The identifier can be any string you like, as long as it doesn't collide with + + The identifier can be any string you like, as long as it doesn't collide with the identifiers of other plugins or other instances of pdb_mysql. If you specify multiple pdb_mysql.so entries in passdb backend, you also need to use different identifiers! Additional options can be given through the smb.conf file in the [global] section. - - Table 11.2. Basic smb.conf options for MySQL passdb backend Field Contents identifier:mysql host host name, defaults to 'localhost' identifier:mysql password identifier:mysql user defaults to 'samba' identifier:mysql database defaults to 'samba' identifier:mysql port defaults to 3306 identifier:table Name of the table containing users - Warning + + Table 11.2. Basic smb.conf options for MySQL passdb backend Field Contents identifier:mysql host host name, defaults to 'localhost' identifier:mysql password identifier:mysql user defaults to 'samba' identifier:mysql database defaults to 'samba' identifier:mysql port defaults to 3306 identifier:table Name of the table containing users + Warning Since the password for the MySQL user is stored in the smb.conf file, you should make the the smb.conf file readable only to the user that runs Samba This is considered a security bug and will be fixed soon. - Names of the columns in this table (I've added column types those columns should have first): - Table 11.3. MySQL field names for MySQL passdb backend Field Type Contents identifier:logon time column int(9) identifier:logoff time column int(9) identifier:kickoff time column int(9) identifier:pass last set time column int(9) identifier:pass can change time column int(9) identifier:pass must change time column int(9) identifier:username column varchar(255) unix username identifier:domain column varchar(255) NT domain user is part of identifier:nt username column varchar(255) NT username identifier:fullname column varchar(255) Full name of user identifier:home dir column varchar(255) Unix homedir path identifier:dir drive column varchar(2) Directory drive path (eg: 'H:') identifier:logon script column varchar(255) Batch file to run on client side when logging on identifier:profile path column varchar(255) Path of profile identifier:acct desc column varchar(255) Some ASCII NT user data identifier:workstations column varchar(255) Workstations user can logon to (or NULL for all) identifier:unknown string column varchar(255) unknown string identifier:munged dial column varchar(255) ? identifier:user sid column varchar(255) NT user SID identifier:group sid column varchar(255) NT group ID identifier:lanman pass column varchar(255) encrypted lanman password identifier:nt pass column varchar(255) encrypted nt passwd identifier:plain pass column varchar(255) plaintext password identifier:acct control column int(9) nt user data identifier:unknown 3 column int(9) unknown identifier:logon divs column int(9) ? identifier:hours len column int(9) ? identifier:unknown 5 column int(9) unknown identifier:unknown 6 column int(9) unknown - + Names of the columns in this table (I've added column types those columns should have first): + Table 11.3. MySQL field names for MySQL passdb backend Field Type Contents identifier:logon time column int(9) identifier:logoff time column int(9) identifier:kickoff time column int(9) identifier:pass last set time column int(9) identifier:pass can change time column int(9) identifier:pass must change time column int(9) identifier:username column varchar(255) unix username identifier:domain column varchar(255) NT domain user is part of identifier:nt username column varchar(255) NT username identifier:fullname column varchar(255) Full name of user identifier:home dir column varchar(255) Unix homedir path identifier:dir drive column varchar(2) Directory drive path (eg: 'H:') identifier:logon script column varchar(255) Batch file to run on client side when logging on identifier:profile path column varchar(255) Path of profile identifier:acct desc column varchar(255) Some ASCII NT user data identifier:workstations column varchar(255) Workstations user can logon to (or NULL for all) identifier:unknown string column varchar(255) unknown string identifier:munged dial column varchar(255) ? identifier:user sid column varchar(255) NT user SID identifier:group sid column varchar(255) NT group ID identifier:lanman pass column varchar(255) encrypted lanman password identifier:nt pass column varchar(255) encrypted nt passwd identifier:plain pass column varchar(255) plaintext password identifier:acct control column int(9) nt user data identifier:unknown 3 column int(9) unknown identifier:logon divs column int(9) ? identifier:hours len column int(9) ? identifier:unknown 5 column int(9) unknown identifier:unknown 6 column int(9) unknown + Eventually, you can put a colon (:) after the name of each column, which should specify the column to update when updating the table. You can also specify nothing behind the colon - then the data from the field will not be updated. - Using plaintext passwords or encrypted password + Using plaintext passwords or encrypted password I strongly discourage the use of plaintext passwords, however, you can use them: If you would like to use plaintext passwords, set @@ -765,7 +766,7 @@ access to attrs=lmPassword,ntPassword If you use encrypted passwords, set the 'identifier:plain pass column' to 'NULL' (without the quotes). This is the default. - Getting non-column data from the table + Getting non-column data from the table It is possible to have not all data in the database and making some 'constant'. For example, you can set 'identifier:fullname column' to : @@ -780,30 +781,30 @@ access to attrs=lmPassword,ntPassword To import data, use: $ pdbedit -i xml:filename - Common Errors Users can not logon - Users not in Samba SAM + Common Errors Users can not logon - Users not in Samba SAM People forget to put their users in their backend and then complain Samba won't authorize them. - Users are being added to the wrong backend database + Users are being added to the wrong backend database A few complaints have been received from users that just moved to Samba-3. The following smb.conf file entries were causing problems, new accounts were being added to the old smbpasswd file, not to the tdbsam passdb.tdb file: - - + + [globals] ... passdb backend = smbpasswd, tdbsam, guest ... - - + + Samba will add new accounts to the first entry in the passdb backend parameter entry. If you want to update to the tdbsam, then change the entry to: - - + + [globals] ... passdb backend = tdbsam, smbpasswd, guest ... - - auth methods does not work + + auth methods does not work If you explicitly set an 'auth methods' parameter, guest must be specified as the first entry on the line. Eg: auth methods = guest sam. diff --git a/docs/htmldocs/pdbedit.8.html b/docs/htmldocs/pdbedit.8.html index 368a6911b7..54068305a1 100644 --- a/docs/htmldocs/pdbedit.8.html +++ b/docs/htmldocs/pdbedit.8.html @@ -65,14 +65,14 @@ samba:45:0F2B255F7B67A7A9AAD3B435B51404EE:BC281CE3F53B6A5146629CD4751D3490:[UX rid. Example: -U S-1-5-21-2447931902-1787058256-3961074038-5004 -c account-control This option can be used while adding or modifying a user account. It will specify the users' account control property. Possible flags that can be set are: N, D, H, L, X. - Example: -c "[X ]" -a This option is used to add a user into the + Example: -c "[X ]" -a This option is used to add a user into the database. This command needs a user name specified with the -u switch. When adding a new user, pdbedit will also - ask for the password to be used. Example: pdbedit -a -u sorce - new password: + ask for the password to be used. Example: pdbedit -a -u sorce +new password: retype new password - - -r This option is used to modify an existing user + + -r This option is used to modify an existing user in the database. This command needs a user name specified with the -u switch. Other options can be specified to modify the properties of the specified user. This flag is kept for backwards compatibility, but diff --git a/docs/htmldocs/printing.html b/docs/htmldocs/printing.html index 089bba6e0f..578e078371 100644 --- a/docs/htmldocs/printing.html +++ b/docs/htmldocs/printing.html @@ -1,7 +1,8 @@ -Chapter 18. Classical Printing Support Chapter 18. Classical Printing Support Prev Part III. Advanced Configuration Next Chapter 18. Classical Printing Support Kurt Pfeifle Danka Deutschland GmbH <kpfeifle@danka.de> Gerald (Jerry) Carter Samba Team <jerry@samba.org> May 32, 2003 Table of Contents Features and Benefits Technical Introduction What happens if you send a Job from a Client Printing Related Configuration Parameters Parameters Recommended for Use Parameters for Backwards Compatibility Parameters no longer in use A simple Configuration to Print with Samba-3 Verification of "Settings in Use" with testparm A little Experiment to warn you Extended Sample Configuration to Print with Samba-3 Detailed Explanation of the Example's Settings The [global] Section The [printers] Section Any [my_printer_name] Section Print Commands Default Print Commands for various Unix Print Subsystems Setting up your own Print Commands Innovations in Samba Printing since 2.2 Client Drivers on Samba Server for Point'n'Print The [printer$] Section is removed from Samba-3 Creating the [print$] Share Parameters in the [print$] Section Subdirectory Structure in [print$] Installing Drivers into [print$] Setting Drivers for existing Printers with a Client GUI Setting Drivers for existing Printers with -rpcclient "The Proof of the Pudding lies in the Eating" (Client Driver Install -Procedure) The first Client Driver Installation IMPORTANT! Setting Device Modes on new Printers Further Client Driver Install Procedures Always make first Client Connection as root or "printer admin" Other Gotchas Setting Default Print Options for the Client Drivers Supporting large Numbers of Printers Adding new Printers with the Windows NT APW Weird Error Message Cannot connect under a -different Name Be careful when assembling Driver Files Samba and Printer Ports Avoiding the most common Misconfigurations of the Client Driver The Imprints Toolset What is Imprints? Creating Printer Driver Packages The Imprints Server The Installation Client Add Network Printers at Logon without User Interaction The addprinter command Migration of "Classical" printing to Samba-3 Publishing Printer Information in Active Directory or LDAP Common Errors and Problems I give my root password but I don't get access My printjobs get spooled into the spooling directory, but then get lost Features and Benefits + +Chapter 18. Classical Printing Support Chapter 18. Classical Printing Support Prev Part III. Advanced Configuration Next Chapter 18. Classical Printing Support Kurt Pfeifle Danka Deutschland GmbH <kpfeifle@danka.de> Gerald (Jerry) Carter Samba Team <jerry@samba.org> May 32, 2003 Table of Contents Features and Benefits Technical Introduction What happens if you send a Job from a Client Printing Related Configuration Parameters Parameters Recommended for Use Parameters for Backwards Compatibility Parameters no longer in use A simple Configuration to Print with Samba-3 Verification of "Settings in Use" with testparm A little Experiment to warn you Extended Sample Configuration to Print with Samba-3 Detailed Explanation of the Example's Settings The [global] Section The [printers] Section Any [my_printer_name] Section Print Commands Default Print Commands for various Unix Print Subsystems Setting up your own Print Commands Innovations in Samba Printing since 2.2 Client Drivers on Samba Server for Point'n'Print The [printer$] Section is removed from Samba-3 Creating the [print$] Share Parameters in the [print$] Section Subdirectory Structure in [print$] Installing Drivers into [print$] Setting Drivers for existing Printers with a Client GUI Setting Drivers for existing Printers with +rpcclient "The Proof of the Pudding lies in the Eating" (Client Driver Install +Procedure) The first Client Driver Installation IMPORTANT! Setting Device Modes on new Printers Further Client Driver Install Procedures Always make first Client Connection as root or "printer admin" Other Gotchas Setting Default Print Options for the Client Drivers Supporting large Numbers of Printers Adding new Printers with the Windows NT APW Weird Error Message Cannot connect under a +different Name Be careful when assembling Driver Files Samba and Printer Ports Avoiding the most common Misconfigurations of the Client Driver The Imprints Toolset What is Imprints? Creating Printer Driver Packages The Imprints Server The Installation Client Add Network Printers at Logon without User Interaction The addprinter command Migration of "Classical" printing to Samba-3 Publishing Printer Information in Active Directory or LDAP Common Errors and Problems I give my root password but I don't get access My printjobs get spooled into the spooling directory, but then get lost Features and Benefits Printing is often a mission-critical service for the users. Samba can provide this service reliably and seamlessly for a client network consisting of Windows workstations. @@ -37,7 +38,7 @@ Professional clients. Where this document describes the responses to commands given, bear in mind that Windows 2000 clients are very similar, but may differ in details. Windows NT is somewhat different again. - Technical Introduction + Technical Introduction Samba's printing support always relies on the installed print subsystem of the Unix OS it runs on. Samba is a "middleman". It takes printfiles from Windows (or other SMB) clients and passes them to the @@ -52,10 +53,10 @@ the next chapter covers in great detail the more modern Common UNIX Printing System (CUPS). - Important CUPS users, be warned: don't just jump on to the next + Important CUPS users, be warned: don't just jump on to the next chapter. You might miss important information contained only -here! - What happens if you send a Job from a Client +here! +What happens if you send a Job from a Client To successfully print a job from a Windows client via a Samba print server to a UNIX printer, there are 6 (potentially 7) stages: @@ -63,7 +64,7 @@ stages: into Samba's spooling area Windows closes the connection again Samba invokes the print command to hand the file over to the UNIX print subsystem's spooling area The Unix print subsystem processes the print job The printfile may need to be explicitly deleted -from the Samba spooling area. Printing Related Configuration Parameters +from the Samba spooling area. Printing Related Configuration Parameters There are a number of configuration parameters in controlling Samba's printing behaviour. Please also refer to the man page for smb.conf to @@ -77,20 +78,20 @@ behaviour of all individual or service level shares (provided those don't have a different setting defined for the same parameter, thus overriding the global default). Global Parameters These may not go into individual shares. If they go in by error, the "testparm" utility can discover -this (if you run it) and tell you so. Parameters Recommended for Use The following smb.conf parameters directly +this (if you run it) and tell you so. Parameters Recommended for Use The following smb.conf parameters directly related to printing are used in Samba-3. See also the smb.conf man page for detailed explanations: - List of printing related parameters in Samba-3. - Global level parameters: addprinter command (G) deleteprinter command (G) disable spoolss (G) enumports command (G) load printers (G) lpq cache time (G) os2 driver map (G) printcap name (G), printcap (G) show add printer wizard (G) total print jobs (G) use client driver (G) + List of printing related parameters in Samba-3. +Global level parameters: addprinter command (G) deleteprinter command (G) disable spoolss (G) enumports command (G) load printers (G) lpq cache time (G) os2 driver map (G) printcap name (G), printcap (G) show add printer wizard (G) total print jobs (G) use client driver (G) - Service level parameters: hosts allow (S) hosts deny (S) lppause command (S) lpq command (S) lpresume command (S) lprm command (S) max print jobs (S) min print space (S) print command (S) printable (S), print ok (S) printer name (S), printer (S) printer admin (S) printing = [cups|bsd|lprng...] (S) queuepause command (S) queueresume command (S) total print jobs (S) - + Service level parameters: hosts allow (S) hosts deny (S) lppause command (S) lpq command (S) lpresume command (S) lprm command (S) max print jobs (S) min print space (S) print command (S) printable (S), print ok (S) printer name (S), printer (S) printer admin (S) printing = [cups|bsd|lprng...] (S) queuepause command (S) queueresume command (S) total print jobs (S) + Samba's printing support implements the Microsoft Remote Procedure Calls (MS-RPC) methods for printing. These are used by Windows NT (and later) print servers. The old "LanMan" protocol is still supported as a fallback resort, and for older clients to use. More details will follow further beneath. - Parameters for Backwards Compatibility + Parameters for Backwards Compatibility Two new parameters that were added in Samba 2.2.2, are still present in Samba-3.0. Both of these options are described in the smb.conf man page and are disabled by @@ -100,19 +101,19 @@ provided for better support of Samba 2.0.x backwards capability. It will disable Samba's support for MS-RPC printing and yield identical printing behaviour to Samba 2.0.x. use client driver (G) was provided for using local printer drivers on Windows NT/2000 clients. It does -not apply to Windows 95/98/ME clients. Parameters "for backward compatibility only", use with caution. - disable spoolss (G) use client driver (S) - Parameters no longer in use +not apply to Windows 95/98/ME clients. Parameters "for backward compatibility only", use with caution. +disable spoolss (G) use client driver (S) + Parameters no longer in use Samba users upgrading from 2.2.x to 3.0 need to be aware that some previously available settings are no longer supported (as was announced some time ago). Here is a list of them: - "old" parameters, removed in Samba-3. + "old" parameters, removed in Samba-3. The following smb.conf parameters have been deprecated already in Samba 2.2 and are now completely removed from Samba-3. You cannot use them in new 3.0 installations: - printer driver file (G) total print jobs (G) postscript (S) printer driver (S) printer driver location (S) - A simple Configuration to Print with Samba-3 + printer driver file (G) total print jobs (G) postscript (S) printer driver (S) printer driver location (S) +A simple Configuration to Print with Samba-3 Here is a very simple example configuration for print related settings in the file. If you compare it with your own system's , you probably find some @@ -147,7 +148,7 @@ reminder: It even tolerates some spelling errors (like "browsable" instead of "browseable"). Most spelling is case-insensitive. Also, you can use "Yes|No" or "True|False" for boolean settings. Lists of names may be separated by commas, spaces or tabs. -Verification of "Settings in Use" with testparm +Verification of "Settings in Use" with testparm To see all (or at least most) printing related settings in Samba, including the implicitly used ones, try the command outlined below (hit "ENTER" twice!). It greps for all occurrences of "lp", "print", @@ -201,7 +202,7 @@ be important in your future dealings with Samba. Note testparm in Samba-3.0 behaves differently from 2.2.x: used without the "-v" switch it only shows you the settings actually written into ! To see the complete -configuration used, add the "-v" parameter to testparm. A little Experiment to warn you +configuration used, add the "-v" parameter to testparm. A little Experiment to warn you Should you need to troubleshoot at any stage, please always come back to this point first and verify if "testparm" shows the parameters you expect! To give you an example from personal experience as a warning, @@ -310,7 +311,7 @@ printing = lprng #This defines LPRng as the printing system" will regard the whole of the string after the "=" sign as the value you want to define. And this is an invalid value that will be ignored, and a default value used instead.] - Extended Sample Configuration to Print with Samba-3 + Extended Sample Configuration to Print with Samba-3 Here we show a more verbose example configuration for print related settings in an . Below is a discussion and explanation of the various parameters. We chose to use BSD-style @@ -368,9 +369,9 @@ default, because these have been compiled in. To see all settings, let root use the testparm utility. testparm also gives warnings if you have mis-configured certain things.. - Detailed Explanation of the Example's Settings + Detailed Explanation of the Example's Settings Following is a discussion of the settings from above shown example. - The [global] Section + The [global] Section The [global] section is one of 4 special sections (along with [[homes], [printers] and @@ -444,7 +445,7 @@ It must not be enabled on print shares (with a yes or true setting) which have valid drivers installed on the Samba server! For more detailed explanations see the man page of smb.conf. - The [printers] Section + The [printers] Section This is the second special section. If a section with this name appears in the smb.conf, users are able to connect to any printer specified in the Samba host's printcap file, @@ -504,7 +505,7 @@ write to the directory (if user privileges allow the connection), but only via print spooling operations. "Normal" write operations are not allowed. writeable = no synonym for read only = yes - Any [my_printer_name] Section + Any [my_printer_name] Section If a section appears in the , which is tagged as printable = yes, Samba presents it as a printer share to its clients. Note, that Win95/98/ME clients may @@ -539,7 +540,7 @@ belong to the "allowed subnets"). As you can see, you could name IP addresses as well as NetBIOS hostnames here. guest ok = no this printer is not open for the guest account! -

`Print Commands`

+

`Print Commands`

In each section defining a printer (or in the [printers] section), a print command parameter may be defined. It sets a command to @@ -557,7 +558,7 @@ your own print commands (or even develop print command shell scripts), make sure you pay attention to the need to remove the files from the Samba spool directory. Otherwise your hard disk may soon suffer from shortage of free space. -

`Default Print Commands for various Unix Print Subsystems`

+

`Default Print Commands for various Unix Print Subsystems`

You learned earlier on, that Samba in most cases uses its built-in settings for many parameters if it can not find an explicitly stated one in its configuration file. The same is true for the @@ -597,7 +598,7 @@ check which command takes effect. Then check that this command is adequate and actually works for your installed print subsystem. It is always a good idea to explicitly set up your configuration files the way you want them to work and not rely on any built-in defaults. -

`Setting up your own Print Commands`

+

`Setting up your own Print Commands`

After a print job has finished spooling to a service, the print command will be used by Samba via a system() call to process the spool file. Usually @@ -667,7 +668,7 @@ for the print command parameter varies dependi the printing parameter. Another example is:

  print command = /usr/local/samba/bin/myprintscript %p %s
-

Of course, you also need to ensure that the directory named by the path parameter exists on the Unix file system. -

`Parameters in the [print$] Section`

+

`Parameters in the [print$] Section`

[print$] is a special section in . It contains settings relevant to potential printer driver download and local installation by clients. @@ -851,7 +852,7 @@ sure these accounts can copy files to the share. If this is a non-root account, then the account should also be mentioned in the global printer admin parameter. See the man page for more information on -configuring file shares.

`Subdirectory Structure in [print$]`

+configuring file shares.

`Subdirectory Structure in [print$]`

In order for a Windows NT print server to support the downloading of driver files by multiple client architectures, you must create several subdirectories within the [print$] service @@ -890,7 +891,7 @@ client workstation. Open Network Neighbourhood or Once you have located the server, navigate to its Printers and Faxes folder. You should see an initial listing of printers that matches the printer shares defined on your Samba host. -

`Installing Drivers into [print$]`

+

`Installing Drivers into [print$]`

You have successfully created the [print$] share in ? And Samba has re-read its configuration? Good. But you are not yet ready to take off. The @@ -908,7 +909,7 @@ Properties and Add Printer Wizard

The latter option is probably the easier one (even if the only entrance to this realm seems a little bit weird at first). -

`Setting Drivers for existing Printers with a Client GUI`

+

`Setting Drivers for existing Printers with a Client GUI`

The initial listing of printers in the Samba host's Printers folder accessed from a client's Explorer will have no real printer driver assigned to them. By default, in @@ -954,7 +955,7 @@ Assuming you have connected with an administrative (or root) account you will also be able to modify other printer properties such as ACLs and default device settings using this dialog. For the default device settings, please consider the advice given further below. -

`Setting Drivers for existing Printers with +`

`Setting Drivers for existing Printers with rpcclient`

The second way to install printer drivers into [print$] and set them up in a valid way can be @@ -969,7 +970,7 @@ time with the setdriver subcommand.

We will provide detailed hints for each of these steps in the next few paragraphs. -

`Identifying the Driver Files`

+

`Identifying the Driver Files`

To find out about the driver files, you have two options: you could investigate the driver CD which comes with your printer. Study the *.inf file on the CD, if it is contained. This @@ -1072,7 +1073,7 @@ Windows 2000 changed this. While it still can use the Kernel Mode drivers (if this is enabled by the Admin), its native mode for printer drivers is User Mode execution. This requires drivers designed for this. These type of drivers install into the "3" subdirectory. -

`Collecting the Driver Files from a Windows Host's +`

`Collecting the Driver Files from a Windows Host's [print$] Share`

Now we need to collect all the driver files we identified. in our previous step. Where do we get them from? Well, why not retrieve them @@ -1108,7 +1109,7 @@ files for these architectures are in the WIN40/0/ subdir. Once we are complete, we can run smbclient ... put to store the collected files on the Samba server's [print$] share. -

`Depositing the Driver Files into [print$]`

+

`Depositing the Driver Files into [print$]`

So, now we are going to put the driver files into the [print$] share. Remember, the UNIX path to this share has been defined previously in your @@ -1169,7 +1170,7 @@ re-location will automatically be done by the don't forget to also put the files for the Win95/98/ME architecture into the WIN40/ subdirectory should you need them). -

`Check if the Driver Files are there (with smbclient)`

+

`Check if the Driver Files are there (with smbclient)`

For now we verify that our files are there. This can be done with smbclient too (but of course you can log in via SSH also and do this through a standard UNIX shell access too): @@ -1222,7 +1223,7 @@ Point'n'Print. The reason is: Samba doesn't know yet that these files are something special, namely printer driver files and it doesn't know yet to which print queue(s) these driver files belong. -

`Running rpcclient with +`

`Running rpcclient with adddriver`

So, next you must tell Samba about the special category of the files you just uploaded into the [print$] share. This @@ -1257,7 +1258,7 @@ files successfully, but render the driver unworkable. So take care! Hints about the syntax of the adddriver command are in the man page. The CUPS printing chapter of this HOWTO collection provides a more detailed description, if you should need it. -

`Check how Driver Files have been moved after +`

`Check how Driver Files have been moved after adddriver finished`

One indication for Samba's recognition of the files as driver files is the successfully installed message. @@ -1305,7 +1306,7 @@ subdirectory. You can check this again with

Another verification is that the timestamp of the printing TDB files is now updated (and possibly their filesize has increased). -

`Check if the Driver is recognized by Samba`

+

`Check if the Driver is recognized by Samba`

Now the driver should be registered with Samba. We can easily verify this, and will do so in a moment. However, this driver is not yet associated with a particular @@ -1349,7 +1350,7 @@ time. Our new driver only shows up for Windows NT 4.0 or 2000. To have it present for Windows 95, 98 and ME you'll have to repeat the whole procedure with the WIN40 architecture and subdirectory. -

`A side note: you are not bound to specific driver names`

+

`A side note: you are not bound to specific driver names`

You can name the driver as you like. If you repeat the adddriver step, with the same files as before, but with a different driver name, it will work the same: @@ -1383,7 +1384,7 @@ repeatedly. Each run "consumes" the files you had put into the respective subdirectories. So you must precede an smbclient ... put command before each rpcclient ... adddriver" command. -

`La Grande Finale: Running rpcclient with +`

`La Grande Finale: Running rpcclient with setdriver`

Samba still needs to know which printer's driver this is. It needs to create a mapping of the driver to a printer, and @@ -1413,13 +1414,13 @@ known to Samba already. A bug in 2.2.x prevented Samba from recognizing freshly installed printers. You had to restart Samba, or at least send a HUP signal to all running smbd processes to work around this: -kill -HUP `pidof smbd`.

"The Proof of the Pudding lies in the Eating" (Client Driver Install +kill -HUP `pidof smbd`.

`"The Proof of the Pudding lies in the Eating" (Client Driver Install Procedure)`

`The first Client Driver Installation`

+

`The first Client Driver Installation`

You must now make sure that a valid "Device Mode" is set for the driver. Don't fear -- we will explain now what that means. -

`IMPORTANT! Setting Device Modes on new Printers`

+

`IMPORTANT! Setting Device Modes on new Printers`

In order for a printer to be truly usable by a Windows NT/2K/XP client, it must possess:

a valid Device Mode generated by @@ -1534,7 +1535,7 @@ properties. Others may crash the client's spooler service. So use this parameter with caution. It is always better to have the client generate a valid device mode for the printer and store it on the server for you. -

`Supporting large Numbers of Printers`

One issue that has arisen during the recent development phase of Samba is the need to support driver downloads for 100's of printers. Using Windows NT APW here is somewhat awkward (to say the least). If you @@ -1722,9 +1723,9 @@ following is an example of how this could be accomplished: Driver Name: [myphantasydrivername] [....] -

+ -

+ root# rpcclient SAMBA-CUPS -U root%secret -c 'enumprinters'
  cmd = enumprinters
    flags:[0x800000]
@@ -1732,15 +1733,15 @@ following is an example of how this could be accomplished:
    description:[\\SAMBA-CUPS\dm9110,,110ppm HiVolume DANKA Stuttgart]
    comment:[110 ppm HiVolume DANKA Stuttgart]
  [....]
-

+

- + root# rpcclient SAMBA-CUPS -U root%secret -c 'setdriver dm9110 "Heidelberg Digimaster 9110 (PS)"' cmd = setdriver dm9110 Heidelberg Digimaster 9110 (PPD) Successfully set dm9110 to driver Heidelberg Digimaster 9110 (PS). - + - + root# rpcclient SAMBA-CUPS -U root%secret -c 'enumprinters' cmd = enumprinters flags:[0x800000] @@ -1748,15 +1749,15 @@ following is an example of how this could be accomplished: description:[\\SAMBA-CUPS\dm9110,Heidelberg Digimaster 9110 (PS),110ppm HiVolume DANKA Stuttgart] comment:[110ppm HiVolume DANKA Stuttgart] [....] - + - + root# rpcclient SAMBA-CUPS -U root%secret -c 'setdriver dm9110 myphantasydrivername' cmd = setdriver dm9110 myphantasydrivername Successfully set dm9110 to myphantasydrivername. - + - + root# rpcclient SAMBA-CUPS -U root%secret -c 'enumprinters' cmd = enumprinters flags:[0x800000] @@ -1772,7 +1773,7 @@ commas in the "description" field). After the setdriver command succeeded, all is well. (The CUPS Printing chapter has more info about the installation of printer drivers with the help of rpcclient). -

`Adding new Printers with the Windows NT APW`

+

`Adding new Printers with the Windows NT APW`

By default, Samba exhibits all printer shares defined in smb.conf in the Printers... folder. Also located in this folder @@ -1818,7 +1819,7 @@ user, not necessarily a root account. A map to guest = user may have connected you unwittingly under the wrong privilege; you should check it by using the smbstatus command. -

`Weird Error Message Cannot connect under a +`

`Avoiding the most common Misconfigurations of the Client Driver`

`The Imprints Toolset`

+

`The Imprints Toolset`

The Imprints tool set provides a UNIX equivalent of the Windows NT Add Printer Wizard. For complete information, please refer to the Imprints web site @@ -2034,20 +2035,20 @@ coordinate your efforts on the samba-technical mailing list. The toolset is still in usable form; but only for a series of older printer models, where there are prepared packages to use. Packages for more up to date print devices are needed if Imprints should have a -future.

`What is Imprints?`

+future.

`What is Imprints?`

Imprints is a collection of tools for supporting these goals:

Providing a central repository information regarding Windows NT and 95/98 printer driver packages
Providing the tools necessary for creating the Imprints printer driver packages.
Providing an installation client which will obtain printer drivers from a central internet (or intranet) Imprints Server repository and install them on remote Samba and Windows NT4 print -servers.

`Creating Printer Driver Packages`

+servers.

`Creating Printer Driver Packages`

`The Imprints Server`

+

`The Imprints Server`

The Imprints server is really a database server that may be queried via standard HTTP mechanisms. Each printer entry in the database has an associated URL for the actual downloading of the package. Each @@ -2055,7 +2056,7 @@ package is digitally signed via GnuPG which can be used to verify that package downloaded is actually the one referred in the Imprints database. It is strongly recommended that this security check not be disabled. -

`The Installation Client`

+

`The Installation Client`

More information regarding the Imprints installation client is available in the Imprints-Client-HOWTO.ps file included with the imprints source package. @@ -2070,10 +2071,10 @@ remote Samba and Windows NT print servers.

The basic installation process is in four steps and perl code is wrapped around smbclient and rpcclient -

+
- foreach (supported architecture for a given driver) - rpcclient: Get the appropriate upload directory on the remote server smbclient: Upload the driver files rpcclient: Issues an AddPrinterDriver() MS-RPC -
- rpcclient: Issue an AddPrinterEx() MS-RPC to actually create the printer
+
1. rpcclient: Get the appropriate upload directory on the remote server
2. smbclient: Upload the driver files
3. rpcclient: Issues an AddPrinterDriver() MS-RPC
+
rpcclient: Issue an AddPrinterEx() MS-RPC to actually create the printer

Chapter 34. Analysing and solving samba problems
Prev	Part V. Troubleshooting	Next

`Chapter 34. Analysing and solving samba problems`

`Gerald (Jerry) Carter`

Samba Team <jerry@samba.org>

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

`David Bannon`

Samba Team <dbannon@samba.org>

8 Apr 2003

Table of Contents

Diagnostics tools
Installing 'Network Monitor' on an NT Workstation or a Windows 9x box
Useful URLs
Getting help from the mailing lists
How to get off the mailing lists

+ +Chapter 34. Analysing and solving samba problems

Chapter 34. Analysing and solving samba problems
Prev	Part V. Troubleshooting	Next

`Chapter 34. Analysing and solving samba problems`

`Gerald (Jerry) Carter`

Samba Team <jerry@samba.org>

`Jelmer R. Vernooij`

The Samba Team <jelmer@samba.org>

`David Bannon`

Samba Team <dbannon@samba.org>

8 Apr 2003

Table of Contents

Diagnostics tools
Installing 'Network Monitor' on an NT Workstation or a Windows 9x box
Useful URLs
Getting help from the mailing lists
How to get off the mailing lists

`Diagnostics tools`

+general SMB topics such as browsing.

`Diagnostics tools`

One of the best diagnostic tools for debugging problems is Samba itself. You can use the -d option for both smbd and nmbd to specify what debug level at which to run. See the man pages on smbd, nmbd and @@ -41,7 +42,7 @@ The version on the NT Server install CD will only allow monitoring of network traffic directed to the local NT box and broadcasts on the local subnet. Be aware that Ethereal can read and write netmon formatted files. -

`Installing 'Network Monitor' on an NT Workstation or a Windows 9x box`

+

`Installing 'Network Monitor' on an NT Workstation or a Windows 9x box`

Installing netmon on an NT workstation requires a couple of steps. The following are for installing Netmon V4.00.349, which comes with Microsoft Windows NT Server 4.0, on Microsoft Windows NT @@ -80,11 +81,11 @@ from the Windows 9x CD (\admin\nettools\netmon). Ther file located with the netmon driver files on the CD if you need information on how to do this. Copy the files from a working Netmon installation. -

`Useful URLs`

See how Scott Merrill simulates a BDC behavior at +

`Useful URLs`

See how Scott Merrill simulates a BDC behavior at http://www.skippy.net/linux/smb-howto.html.
FTP site for older SMB specs: - ftp://ftp.microsoft.com/developr/drg/CIFS/

`Getting help from the mailing lists`

+ ftp://ftp.microsoft.com/developr/drg/CIFS/

`Getting help from the mailing lists`

(Possibly) If you have a complete netmon trace ( the pipe to the error ) you can send the *.CAP file as well.

`How to get off the mailing lists`

To have your name removed from a samba mailing list, go to the +smb.conf in their attach directory?

`How to get off the mailing lists`

To have your name removed from a samba mailing list, go to the same place you went to to get on it. Go to http://lists.samba.org, click on your nearest mirror and then click on Support and then click on Samba related mailing lists. Or perhaps see diff --git a/docs/htmldocs/samba-bdc.html b/docs/htmldocs/samba-bdc.html index 4c2045642d..b317fe124b 100644 --- a/docs/htmldocs/samba-bdc.html +++ b/docs/htmldocs/samba-bdc.html @@ -1,8 +1,9 @@ -Chapter 6. Backup Domain Control

Chapter 6. Backup Domain Control
Prev	Part II. Server Configuration Basics	Next

`Chapter 6. Backup Domain Control`

`John H. Terpstra`

Samba Team <jht@samba.org>

`Volker Lendecke`

Samba Team <Volker.Lendecke@SerNet.DE>

Table of Contents

Essential Background Information

MS Windows NT4 Style Domain Control
Active Directory Domain Control
What qualifies a Domain Controller on the network?
How does a Workstation find its domain controller?

Backup Domain Controller Configuration

Example Configuration

Features And Benefits

Machine Accounts keep expiring, what can I do?
Can Samba be a Backup Domain Controller to an NT4 PDC?
How do I replicate the smbpasswd file?
Can I do this all with LDAP?

+ +Chapter 6. Backup Domain Control

Chapter 6. Backup Domain Control
Prev	Part II. Server Configuration Basics	Next

`Chapter 6. Backup Domain Control`

`John H. Terpstra`

Samba Team <jht@samba.org>

`Volker Lendecke`

Samba Team <Volker.Lendecke@SerNet.DE>

Table of Contents

Essential Background Information

MS Windows NT4 Style Domain Control
Active Directory Domain Control
What qualifies a Domain Controller on the network?
How does a Workstation find its domain controller?

Backup Domain Controller Configuration

Example Configuration

Machine Accounts keep expiring, what can I do?
Can Samba be a Backup Domain Controller to an NT4 PDC?
How do I replicate the smbpasswd file?
Can I do this all with LDAP?

Several things have to be done:

The domain SID has to be the same on the PDC and the BDC. This used to @@ -199,7 +200,7 @@ Several things have to be done: BDC. This can be done manually whenever login scripts are changed, or it can be done automatically together with the smbpasswd synchronization. -

`Example Configuration`

+

`Example Configuration`

Finally, the BDC has to be found by the workstations. This can be done by setting:

 	workgroup = SAMBA
@@ -212,10 +213,10 @@ problem as the name SAMBA<#1c> is a NetBIOS group name that is meant to
 be registered by more than one machine. The parameter 'domain master =
 no' forces the BDC not to register SAMBA<#1b> which as a unique NetBIOS
 name is reserved for the Primary Domain Controller.
-

`Common Errors`

+

`Common Errors`

As this is a rather new area for Samba there are not many examples that we may refer to. Keep watching for updates to this section. -

`Machine Accounts keep expiring, what can I do?`

+

`Machine Accounts keep expiring, what can I do?`

This problem will occur when occur when the passdb (SAM) files are copied from a central server but the local Backup Domain Controllers. Local machine trust account password updates are not copied back to the central server. The newer machine account password is then over @@ -226,7 +227,7 @@ to proceed and the account expiry error will be reported.

The simple answer is YES. Samba's pdb_ldap code supports binding to a replica LDAP server, and will also follow referrals and rebind to the master if it ever needs to make a modification to the database. (Normally BDCs are read only, so diff --git a/docs/htmldocs/samba-pdc.html b/docs/htmldocs/samba-pdc.html index 930315b3f5..aee179737d 100644 --- a/docs/htmldocs/samba-pdc.html +++ b/docs/htmldocs/samba-pdc.html @@ -1,8 +1,9 @@ -Chapter 5. Domain Control

Chapter 5. Domain Control
Prev	Part II. Server Configuration Basics	Next

`Chapter 5. Domain Control`

`John H. Terpstra`

Samba Team <jht@samba.org>

`Gerald (Jerry) Carter`

Samba Team <jerry@samba.org>

`David Bannon`

Samba Team <dbannon@samba.org>

Table of Contents