From e4840f0db911eaf3aee1195030c6efca70d78f14 Mon Sep 17 00:00:00 2001
From: Gerald Carter In order for a Samba-2 server to join an NT domain,
- you must first add the NetBIOS name of the Samba server to the
- NT domain on the PDC using Server Manager for Domains. This creates
- the machine account in the domain (PDC) SAM. Note that you should
- add the Samba server as a "Windows NT Workstation or Server",
- NOT as a Primary or backup domain controller. Assume you have a Samba-2 server with a NetBIOS name of
+>Assume you have a Samba 2.x server with a NetBIOS name of
SERV1smbpasswd -j DOM -r DOMPDC
- Administrator%password as we are joining the domain DOM and the PDC for that domain
(the only machine that has write access to the domain SAM database)
- is DOMPDC. If this is successful you will see the message:
pam_smbpass.so module is provided by -Samba version 2.2.1 or later. It can be compiled only if the ---with-pam --with-pam_smbpass options are both -provided to the Samba configure program.
--with-pam_smbpass options when running Samba's +configure script. For more information +on the pam_smbpass module, see the documentation +in the source/pam_smbpass directory of the Samba +source distribution.Distributed Authentication
PAM Configuration in smb.conf
Windows 2000 Service Pack 2 Clients |
Samba 2.2.1 is required for PDC functionality when using Windows 2000 - SP2 clients. - |
The following pieces of functionality are not included in the 2.2 release:
Please note that Windows 9x clients are not true members of a domain for reasons outlined in this article. Therefore the protocol for -support Windows 9x style domain logons is completely different +support Windows 9x-style domain logons is completely different from NT4 domain logons and has been officially supported for some time.
. For convenience, the parameters have been linked with the actual smb.conf description.
Here is an example smb.conf for acting as a PDC:
Here is an example smb.conf for acting as a PDC:add user script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u[global] + # <...remainder of parameters...> + add user script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u |
The procedure for joining a client to the domain varies with the +version of Windows.
In Samba 2.2.1, only the root account can be used to create -machine accounts like this. Therefore, it is required to create -an entry in smbpasswd for root. The password -SHOULD be set to a different password that the -associated Windows 2000
When the user elects to join the client to a domain, Windows prompts for + an account and password that is privileged to join the domain. A + Samba administrative account (i.e., a Samba account that has root + privileges on the Samba server) must be entered here; the + operation will fail if an ordinary user account is given. + The password for this account should be + set to a different password than the associated + /etc/passwd entry for security reasons.
entry, for security + reasons.The session key of the Samba administrative account acts as an + encryption key for setting the password of the machine trust + account. The machine trust account will be created on-the-fly, or + updated if it already exists.
Windows NT
If the machine trust account was created manually, on the + Identification Changes menu enter the domain name, but do not + check the box "Create a Computer Account in the Domain." In this case, + the existing machine trust account is used to join the machine to + the domain.
If the machine trust account is to be created + on-the-fly, on the Identification Changes menu enter the domain + name, and check the box "Create a Computer Account in the Domain." In + this case, joining the domain proceeds as above for Windows 2000 + (i.e., you must supply a Samba administrative account when + prompted).
/etc/passwd of the machine name with a '$' appended. FreeBSD (and other BSD - systems ?) won't create a user with a '$' in their name. + systems?) won't create a user with a '$' in their name.
The problem is only in the program used to make the entry, once @@ -6202,7 +6296,7 @@ CLASS="COMMAND" >vipw to edit the entry, adding the '$'. Or create the whole entry with vipw if you like, make sure you use a - unique uid ! + unique User ID !
This happens if you try to create a machine account from the +> This happens if you try to create a machine trust account from the machine itself and already have a connection (e.g. mapped drive) to a share (or IPC$) on the Samba PDC. The following command will remove all network drive connections: @@ -6266,17 +6360,17 @@ CLASS="COMMAND" >
The machine account for this computer either does not +>The machine trust account for this computer either does not exist or is not accessible.
When I try to join the domain I get the message "The machine account - for this computer either does not exist or is not accessible". Whats + for this computer either does not exist or is not accessible". What's wrong?
This problem is caused by the PDC not having a suitable machine account. +> This problem is caused by the PDC not having a suitable machine trust account. If you are using the
Alternatively if you are creating account entries manually then they have not been created correctly. Make sure that you have the entry - correct for the machine account in smbpasswd file on the Samba PDC. + correct for the machine trust account in smbpasswd file on the Samba PDC. If you added the account using an editor rather than using the smbpasswd utility, make sure that the account name is the machine NetBIOS name with a '$' appended to it ( i.e. computer_name$ ). There must be an entry @@ -6371,7 +6465,7 @@ CLASS="SECT1" >
What about Windows NT Policy Editor ?What about Windows NT Policy Editor?
Can Win95 do Policies ?Can Win95 do Policies?
Since I don't need to buy an NT Server CD now, how do I get - the 'User Manager for Domains', the 'Server Manager' ? + the 'User Manager for Domains', the 'Server Manager'?
Microsoft distributes a version of these tools called nexus for @@ -6528,8 +6622,8 @@ CLASS="SECT1" >
There are many sources of information available in the form
@@ -6592,7 +6686,7 @@ HREF="http://www.tcpdump.org/"
TARGET="_top"
>http://www.tcpdup.org/.
- Ethereal, another good packet sniffer for UNIX and Win32
+ Ethereal, another good packet sniffer for Unix and Win32
hosts, can be downloaded from How do I get help from the mailing lists ?How do I get help from the mailing lists?
Please think carefully before attaching a document to an email.
Consider pasting the relevant parts into the body of the message. The samba
mailing lists go to a huge number of people, do they all need a copy of your
- smb.conf in their attach directory ?
How do I get off the mailing lists ?How do I get off the mailing lists?
Issues related to the single-logon network model are discussed in this -document. Samba supports domain logons, network logon scripts, and user -profiles for MS Windows for workgroups and MS Windows 9X clients.
When an SMB client in a domain wishes to logon it broadcast requests for a logon server. The first one to reply gets the job, and validates its @@ -6967,37 +7064,12 @@ servers advertising themselves as participating in a domain. This demonstrates how authentication is quite different from but closely involved with domains.
Another thing commonly associated with single-logon domains is remote -administration over the SMB protocol. Again, there is no reason why this -cannot be implemented with an underlying username database which is -different from the Windows NT SAM. Support for the Remote Administration -Protocol is planned for a future release of Samba.
Network logon support as discussed in this section is aimed at Window for -Workgroups, and Windows 9X clients.
Support for profiles is confirmed as working for Win95, NT 4.0 and NT 3.51. -It is possible to specify: the profile location; script file to be loaded -on login; the user's home directory; and for NT a kick-off time could also -now easily be supported. However, there are some differences between Win9X -profile support and WinNT profile support. These are discussed below.
With NT Workstations, all this does not require the use or intervention of -an NT 4.0 or NT 3.51 server: Samba can now replace the logon services -provided by an NT server, to a limited and experimental degree (for example, -running "User Manager for Domains" will not provide you with access to -a domain created by a Samba Server).
With Win95, the help of an NT server can be enlisted, both for profile storage -and for user authentication. For details on user authentication, see -security_level.txt. For details on profile storage, see below.
Using these features you can make your clients verify their logon via the Samba server; make clients run a batch file when they logon to the network and download their preferences, desktop and start menu.
Before launching into the configuration instructions, it is worthwhile looking -at how a Win9X client performs a logon:
Before launching into the configuration instructions, it is +worthwhile lookingat how a Windows 9x/ME client performs a logon:The client broadcasts (to the IP broadcast address of the subnet it is in) - a NetLogon request. This is sent to the NetBIOS address DOMAIN<00> at the + a NetLogon request. This is sent to the NetBIOS name DOMAIN<1c> at the NetBIOS layer. The client chooses the first response it receives, which contains the NetBIOS name of the logon server to use in the format of \\SERVER. @@ -7060,122 +7132,27 @@ CLASS="SECT2" >
To use domain logons and profiles you need to do the following:
Create a share called [netlogon] in your smb.conf. This share should - be readable by all users, and probably should not be writeable. This - share will hold your network logon scripts, and the CONFIG.POL file - (Note: for details on the CONFIG.POL file, how to use it, what it is, - refer to the Microsoft Windows NT Administration documentation. - The format of these files is not known, so you will need to use - Microsoft tools). -
For example I have used: -
[netlogon] - path = /data/dos/netlogon - writeable = no - guest ok = no |
Note that it is important that this share is not writeable by ordinary - users, in a secure environment: ordinary users should not be allowed - to modify or add files that another user's computer would then download - when they log in. -
in the [global] section of smb.conf set the following: -
domain logons = yes -logon script = %U.bat - |
The choice of batch file is, of course, up to you. The above would - give each user a separate batch file as the %U will be changed to - their username automatically. The other standard % macros may also be - used. You can make the batch files come from a subdirectory by using - something like: -
The main difference between a PDC and a Windows 9x logon +server configuration is thatlogon script = scripts\%U.bat - |
create the batch files to be run when the user logs in. If the batch - file doesn't exist then no batch file will be run. -
In the batch files you need to be careful to use DOS style cr/lf line - endings. If you don't then DOS may get confused. I suggest you use a - DOS editor to remotely edit the files if you don't know how to produce - DOS style files under unix. -
Password encryption is not required for a Windows 9x logon server.Use smbclient with the -U option for some users to make sure that - the \\server\NETLOGON share is available, the batch files are - visible and they are readable by the users. -
Windows 9x/ME clients do not possess machine trust accounts.you will probably find that your clients automatically mount the - \\SERVER\NETLOGON share as drive z: while logging in. You can put - some useful programs there to execute from the batch files. -
mode security is really just a variation on SMB user level security.
Actually, this issue is also closer tied to the debate on whether +>Actually, this issue is also closely tied to the debate on whether or not Samba must be the domain master browser for its workgroup when operating as a DC. While it may technically be possible to configure a server as such (after all, browsing and domain logons @@ -7249,7 +7226,7 @@ CLASS="SECT2" >
To support WinNT clients, inn the [global] section of smb.conf set the +>To support WinNT clients, in the [global] section of smb.conf set the following (for example):
This will, by default, install SAMBA in /usr/local/samba. See the -main SAMBA documentation if you want to install SAMBA somewhere else. +>This will, by default, install SAMBA in /usr/local/samba. +See the main SAMBA documentation if you want to install SAMBA somewhere else. It will also build the winbindd executable and libraries.
The libraries needed to run the winbind daemon through nsswitch -need to be copied to their proper locations, so
The libraries needed to run the winbindd daemon +through nsswitch need to be copied to their proper locations, soroot# cp ../samba/source/nsswitch/libnss_winbind.so /lib
root# cp ../samba/source/nsswitch/libnss_winbind.so /libI also found it necessary to make the following symbolic link:
root# ln -s /lib/libnss_winbind.so /lib/libnss_winbind.so.2
root# ln -s /lib/libnss_winbind.so /lib/libnss_winbind.so.2Now, as root you need to edit winbindd -daemon, as well as from your /etc/hosts files and NIS servers. My -/etc/nsswitch.conf file look like this after editing:
file look like +this after editing:root# /usr/local/samba/bin/smbpasswd -j DOMAIN -r PDC -U Administrator
root# /usr/local/samba/bin/smbpasswd -j DOMAIN -r PDC -U AdministratorThe proper response to the command should be: "Joined the domain
9.5.3.5. Start up the winbindd daemon and test it!
root# /usr/local/samba/bin/winbindd
root# /usr/local/samba/bin/winbinddI'm always paranoid and like to make sure the daemon is really running...
root# ps -ae | grep winbindd -3025 ? 00:00:00 winbindd
root# ps -ae | grep winbinddThis command should produce output like this, if the daemon is running
3025 ? 00:00:00 winbindd
Now... for the real test, try to get some information about the users on your PDC
root# # /usr/local/samba/bin/wbinfo -u
root# /usr/local/samba/bin/wbinfo -uThis should echo back a list of users on your Windows users on @@ -8656,7 +8743,13 @@ CEO+TsInternetUser
Obviously, I have named my domain 'CEO' and my winbindd separator is '+'.
Obviously, I have named my domain 'CEO' and my winbindd +separator is '+'.You can do the same sort of thing to get group information from the PDC:
root# /usr/local/samba/bin/wbinfo -g +>root# /usr/local/samba/bin/wbinfo -g CEO+Domain Admins CEO+Domain Users CEO+Domain Guests @@ -8693,8 +8789,11 @@ Try the following command:root# getent passwd
root# getent passwdYou should get a list that looks like your
root# getent group
root# getent groupThe
If you restart the smbd, nmbd, +and winbindd daemons at this point, you +should be able to connect to the samba server as a domain member just as +if you were a local user.
If you have made it this far, you know that winbindd is working. -Now it is time to integrate it into the operation of samba and other -services. The pam configuration files need to be altered in +>If you have made it this far, you know that winbindd and samba are working +together. If you want to use winbind to provide authentication for other +services, keep reading. The pam configuration files need to be altered in this step. (Did you remember to make backups of your original /etc/pam.d files? If not, do it now.)
To get samba to allow domain users and groups, I modified the +>You will need a pam module to use winbindd with these other services. This +module will be compiled in the ../source/nsswitch directory +by invoking the command
root# make nsswitch/pam_winbind.so
from the ../source directory. The /etc/pam.d/samba file from
pam_winbind.so file should be copied to the location of +your other pam security modules. On my RedHat system, this was the +/lib/security directory.auth required /lib/security/pam_stack.so service=system-auth -account required /lib/security/pam_stack.so service=system-auth |
to
The /etc/pam.d/samba file does not need to be changed. I +just left this fileas it was:auth required /lib/security/pam_winbind.so -auth required /lib/security/pam_stack.so service=system-auth -account required /lib/security/pam_winbind.so +>auth required /lib/security/pam_stack.so service=system-auth account required /lib/security/pam_stack.so service=system-auth | auth sufficient /lib/security/pam_winbind.so -auth required /lib/security/pam_listfile.so item=user sense=deny file=/etc/ftpusers onerr=succeed +>auth required /lib/security/pam_listfile.so item=user sense=deny file=/etc/ftpusers onerr=succeed +auth sufficient /lib/security/pam_winbind.so auth required /lib/security/pam_stack.so service=system-auth auth required /lib/security/pam_shells.so +account sufficient /lib/security/pam_winbind.so account required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_stack.so service=system-auth | winbind.so line to get rid of annoying
double prompts for passwords.
Windows 2000 Service Pack 2 Clients |
Samba 2.2.1 is required for PDC functionality when using Windows 2000 - SP2 clients. - |
The following pieces of functionality are not included in the 2.2 release:
Please note that Windows 9x clients are not true members of a domain for reasons outlined in this article. Therefore the protocol for -support Windows 9x style domain logons is completely different +support Windows 9x-style domain logons is completely different from NT4 domain logons and has been officially supported for some time.
. For convenience, the parameters have been linked with the actual smb.conf description.
Here is an example smb.conf for acting as a PDC:
Here is an example smb.conf for acting as a PDC:path = /usr/local/samba/lib/netlogon writeable = no +>read only = yes path = /export/smb/ntprofile writeable = yes +>read only = noAs Samba 2.2 does not offer a complete implementation of group mapping between -Windows NT groups and UNIX groups (this is really quite complicated to explain -in a short space), you should refer to the As Samba 2.2 does not offer a complete implementation of group mapping +between Windows NT groups and Unix groups (this is really quite +complicated to explain in a short space), you should refer to the +domain -admin group smb.conf parameter for information of creating "Domain Admins" -style accounts.
domain admin +group smb.conf parameter for information of creating "Domain +Admins" style accounts.Creating Machine Trust Accounts and Joining Clients -to the DomainCreating Machine Trust Accounts and Joining Clients to the +Domain
A machine trust account is a samba user account owned by a computer. -The account password acts as the shared secret for secure -communication with the Domain Controller. This is a security feature -to prevent an unauthorized machine with the same NetBIOS name from -joining the domain and gaining access to domain user/group accounts. -Hence a Windows 9x host is never a true member of a domain because it does -not posses a machine trust account, and thus has no shared secret with the DC.
On a Windows NT PDC, these machine trust account passwords are stored -in the registry. A Samba PDC stores these accounts in the same location -as user LanMan and NT password hashes (currently A machine trust account is a Samba account that is used to +authenticate a client machine (rather than a user) to the Samba +server. In Windows terminology, this is known as a "Computer +Account."
The password of a machine trust account acts as the shared secret for +secure communication with the Domain Controller. This is a security +feature to prevent an unauthorized machine with the same NetBIOS name +from joining the domain and gaining access to domain user/group +accounts. Windows NT and 2000 clients use machine trust accounts, but +Windows 9x clients do not. Hence, a Windows 9x client is never a true +member of a domain because it does not possess a machine trust +account, and thus has no shared secret with the domain controller.
A Windows PDC stores each machine trust account in the Windows +Registry. A Samba PDC, however, stores each machine trust account +in two parts, as follows: + +
A Samba account, stored in the same location as user + LanMan and NT password hashes (currently + smbpasswd). -However, machine trust accounts only possess and use the NT password hash.
). The Samba account + possesses and uses only the NT password hash.Because Samba requires machine accounts to possess a UNIX uid from -which an Windows NT SID can be generated, all of these accounts -must have an entry in A corresponding Unix account, typically stored in + /etc/passwd and smbpasswd. -Future releases will alleviate the need to create -. (Future releases will alleviate the need to + create /etc/passwd entries.
entries.)There are two means of creating machine trust accounts.
There are two ways to create machine trust accounts:
Manual creation before joining the client to the domain. In this case, - the password is set to a known value -- the lower case of the - machine's NetBIOS name. -
Manual creation. Both the Samba and corresponding + Unix account are created by hand.Creation of the account at the time of joining the domain. In - this case, the session key of the administrative account used to join - the client to the domain acts as an encryption key for setting the - password to a random value (This is the recommended method). -
"On-the-fly" creation. The Samba machine trust + account is automatically created by Samba at the time the client + is joined to the domain. (For security, this is the + recommended method.) The corresponding Unix account may be + created automatically or manually.Manually creating machine trust accountsManual Creation of Machine Trust Accounts
The first step in creating a machine trust account by hand is to -create an entry for the machine in /etc/passwd. This can be done -using The first step in manually creating a machine trust account is to +manually create the corresponding Unix account in +/etc/passwd. This can be done using +vipw or any 'add userr' command which is normally -used to create new UNIX accounts. The following is an example for a Linux -based Samba server:
or other 'add user' command that is normally +used to create new Unix accounts. The following is an example for a +Linux based Samba server:root# /usr/sbin/useradd -g 100 -d /dev/null -c machine_name$
$root# passwd -l machine_name$
$The /etc/passwd entry will list the machine name -with a $ appended, won't have a passwd, will have a null shell and no -home directory. For example a machine called 'doppy' would have an +with a "$" appended, won't have a password, will have a null shell and no +home directory. For example a machine named 'doppy' would have an /etc/passwd entry like this :
entry like this:machine_nickname can be any descriptive name for the -pc i.e. BasementComputer. The can be any +descriptive name for the client, i.e., BasementComputer. +machine_name absolutely must be -the NetBIOS name of the pc to be added to the domain. The "$" must append the NetBIOS -name of the pc or samba will not recognize this as a machine accountNow that the UNIX account has been created, the next step is to create -the smbpasswd entry for the machine containing the well known initial -trust account password. This can be done using the absolutely must be the NetBIOS +name of the client to be joined to the domain. The "$" must be +appended to the NetBIOS name of the client or Samba will not recognize +this as a machine trust account.
Now that the corresponding Unix account has been created, the next step is to create +the Samba account for the client containing the well-known initial +machine trust account password. This can be done using the root# smbpasswd -a -m smbpasswd -a -m machine_name
where machine_name is the machine's NetBIOS -name.
Manually creating a machine trust account using this method is the - equivalent of creating a machine account on a Windows NT PDC using + equivalent of creating a machine trust account on a Windows NT PDC using the "Server Manager". From the time at which the account is created - to the time which th client joins the domain and changes the password, + to the time which the client joins the domain and changes the password, your domain is vulnerable to an intruder joining your domain using a a machine with the same NetBIOS name. A PDC inherently trusts members of the domain and will serve out a large degree of user @@ -622,41 +633,98 @@ CLASS="SECT2" >
Creating machine trust accounts "on the fly""On-the-Fly" Creation of Machine Trust Accounts
The second, and most recommended way of creating machine trust accounts -is to create them as needed at the time the client is joined to -the domain. You will need to include a value for the The second (and recommended) way of creating machine trust accounts is +simply to allow the Samba server to create them as needed when the client +is joined to the domain.
Since each Samba machine trust account requires a corresponding +Unix account, a method for automatically creating the +Unix account is usually supplied; this requires configuration of the +add user script -parameter. Below is an example from a RedHat 6.2 Linux system.
+option in smb.conf. This +method is not required, however; corresponding Unix accounts may also +be created manually.Below is an example for a RedHat 6.2 Linux system.
add user script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u[global] + # <...remainder of parameters...> + add user script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %uJoining the Client to the Domain
In Samba 2.2.1, only the root account can be used to create -machine accounts like this. Therefore, it is required to create -an entry in smbpasswd for root. The password -The procedure for joining a client to the domain varies with the +version of Windows.
SHOULD be set to a different password that the -associated Windows 2000
When the user elects to join the client to a domain, Windows prompts for + an account and password that is privileged to join the domain. A + Samba administrative account (i.e., a Samba account that has root + privileges on the Samba server) must be entered here; the + operation will fail if an ordinary user account is given. + The password for this account should be + set to a different password than the associated + /etc/passwd entry for security reasons.
entry, for security + reasons.The session key of the Samba administrative account acts as an + encryption key for setting the password of the machine trust + account. The machine trust account will be created on-the-fly, or + updated if it already exists.
Windows NT
If the machine trust account was created manually, on the + Identification Changes menu enter the domain name, but do not + check the box "Create a Computer Account in the Domain." In this case, + the existing machine trust account is used to join the machine to + the domain.
If the machine trust account is to be created + on-the-fly, on the Identification Changes menu enter the domain + name, and check the box "Create a Computer Account in the Domain." In + this case, joining the domain proceeds as above for Windows 2000 + (i.e., you must supply a Samba administrative account when + prompted).
Common Problems and Errors
/etc/passwd of the machine name with a '$' appended. FreeBSD (and other BSD - systems ?) won't create a user with a '$' in their name. + systems?) won't create a user with a '$' in their name.
The problem is only in the program used to make the entry, once @@ -695,7 +763,7 @@ CLASS="COMMAND" >vipw to edit the entry, adding the '$'. Or create the whole entry with vipw if you like, make sure you use a - unique uid ! + unique User ID !
- I get told "You already have a connection to the Domain...." or "Cannot join domain, the credentials supplied conflict with an - existing set.." when creating a machine account.
This happens if you try to create a machine account from the +> This happens if you try to create a machine trust account from the machine itself and already have a connection (e.g. mapped drive) to a share (or IPC$) on the Samba PDC. The following command will remove all network drive connections: @@ -762,17 +830,17 @@ CLASS="COMMAND" >
The machine account for this computer either does not +>The machine trust account for this computer either does not exist or is not accessible.
When I try to join the domain I get the message "The machine account - for this computer either does not exist or is not accessible". Whats + for this computer either does not exist or is not accessible". What's wrong?
This problem is caused by the PDC not having a suitable machine account. +> This problem is caused by the PDC not having a suitable machine trust account. If you are using the
Alternatively if you are creating account entries manually then they have not been created correctly. Make sure that you have the entry - correct for the machine account in smbpasswd file on the Samba PDC. + correct for the machine trust account in smbpasswd file on the Samba PDC. If you added the account using an editor rather than using the smbpasswd utility, make sure that the account name is the machine NetBIOS name with a '$' appended to it ( i.e. computer_name$ ). There must be an entry @@ -859,7 +927,7 @@ CLASS="SECT1" >
System Policies and Profiles
What about Windows NT Policy Editor ?What about Windows NT Policy Editor?
Can Win95 do Policies ?Can Win95 do Policies?
Since I don't need to buy an NT Server CD now, how do I get - the 'User Manager for Domains', the 'Server Manager' ? + the 'User Manager for Domains', the 'Server Manager'?
Microsoft distributes a version of these tools called nexus for @@ -1021,8 +1089,8 @@ CLASS="SECT1" >
What other help can I get ?What other help can I get?
There are many sources of information available in the form @@ -1086,7 +1154,7 @@ HREF="http://www.tcpdump.org/" TARGET="_top" >http://www.tcpdup.org/. - Ethereal, another good packet sniffer for UNIX and Win32 + Ethereal, another good packet sniffer for Unix and Win32 hosts, can be downloaded from
How do I get help from the mailing lists ?How do I get help from the mailing lists?
Please think carefully before attaching a document to an email. Consider pasting the relevant parts into the body of the message. The samba mailing lists go to a huge number of people, do they all need a copy of your - smb.conf in their attach directory ?
How do I get off the mailing lists ?How do I get off the mailing lists?
Domain Control for Windows 9x/ME
Note: The following section contains much of the original DOMAIN.txt file previously included with Samba. Much of -the material is based on what went into the book Special -Edition, Using Samba. (Richard Sharpe)Special +Edition, Using Samba, by Richard Sharpe.Issues related to the single-logon network model are discussed in this -document. Samba supports domain logons, network logon scripts, and user -profiles for MS Windows for workgroups and MS Windows 9X clients.
When an SMB client in a domain wishes to logon it broadcast requests for a logon server. The first one to reply gets the job, and validates its @@ -1466,37 +1538,12 @@ servers advertising themselves as participating in a domain. This demonstrates how authentication is quite different from but closely involved with domains.
Another thing commonly associated with single-logon domains is remote -administration over the SMB protocol. Again, there is no reason why this -cannot be implemented with an underlying username database which is -different from the Windows NT SAM. Support for the Remote Administration -Protocol is planned for a future release of Samba.
Network logon support as discussed in this section is aimed at Window for -Workgroups, and Windows 9X clients.
Support for profiles is confirmed as working for Win95, NT 4.0 and NT 3.51. -It is possible to specify: the profile location; script file to be loaded -on login; the user's home directory; and for NT a kick-off time could also -now easily be supported. However, there are some differences between Win9X -profile support and WinNT profile support. These are discussed below.
With NT Workstations, all this does not require the use or intervention of -an NT 4.0 or NT 3.51 server: Samba can now replace the logon services -provided by an NT server, to a limited and experimental degree (for example, -running "User Manager for Domains" will not provide you with access to -a domain created by a Samba Server).
With Win95, the help of an NT server can be enlisted, both for profile storage -and for user authentication. For details on user authentication, see -security_level.txt. For details on profile storage, see below.
Using these features you can make your clients verify their logon via the Samba server; make clients run a batch file when they logon to the network and download their preferences, desktop and start menu.
Before launching into the configuration instructions, it is worthwhile looking -at how a Win9X client performs a logon:
Before launching into the configuration instructions, it is +worthwhile lookingat how a Windows 9x/ME client performs a logon:Therefore, a Samba PDC will also act as a Windows 9x logon +server.
The client broadcasts (to the IP broadcast address of the subnet it is in) - a NetLogon request. This is sent to the NetBIOS address DOMAIN<00> at the + a NetLogon request. This is sent to the NetBIOS name DOMAIN<1c> at the NetBIOS layer. The client chooses the first response it receives, which contains the NetBIOS name of the logon server to use in the format of \\SERVER. @@ -1559,95 +1606,27 @@ CLASS="SECT2" >
Configuration Instructions: Network Logons
To use domain logons and profiles you need to do the following:
The main difference between a PDC and a Windows 9x logon +server configuration is that
Create a share called [netlogon] in your smb.conf. This share should - be readable by all users, and probably should not be writeable. This - share will hold your network logon scripts, and the CONFIG.POL file - (Note: for details on the CONFIG.POL file, how to use it, what it is, - refer to the Microsoft Windows NT Administration documentation. - The format of these files is not known, so you will need to use - Microsoft tools). -
For example I have used: -
[netlogon] - path = /data/dos/netlogon - writeable = no - guest ok = noNote that it is important that this share is not writeable by ordinary - users, in a secure environment: ordinary users should not be allowed - to modify or add files that another user's computer would then download - when they log in. -
in the [global] section of smb.conf set the following: -
domain logons = yes -logon script = %U.bat -The choice of batch file is, of course, up to you. The above would - give each user a separate batch file as the %U will be changed to - their username automatically. The other standard % macros may also be - used. You can make the batch files come from a subdirectory by using - something like: -
logon script = scripts\%U.bat -
create the batch files to be run when the user logs in. If the batch - file doesn't exist then no batch file will be run. -
In the batch files you need to be careful to use DOS style cr/lf line - endings. If you don't then DOS may get confused. I suggest you use a - DOS editor to remotely edit the files if you don't know how to produce - DOS style files under unix. -
Password encryption is not required for a Windows 9x logon server.Use smbclient with the -U option for some users to make sure that - the \\server\NETLOGON share is available, the batch files are - visible and they are readable by the users. -
Windows 9x/ME clients do not possess machine trust accounts.you will probably find that your clients automatically mount the - \\SERVER\NETLOGON share as drive z: while logging in. You can put - some useful programs there to execute from the batch files. -
mode security is really just a variation on SMB user level security.
Actually, this issue is also closer tied to the debate on whether +>Actually, this issue is also closely tied to the debate on whether or not Samba must be the domain master browser for its workgroup when operating as a DC. While it may technically be possible to configure a server as such (after all, browsing and domain logons @@ -1721,7 +1700,7 @@ CLASS="SECT2" >
Configuration Instructions: Setting up Roaming User Profiles
Windows NT Configuration
To support WinNT clients, inn the [global] section of smb.conf set the +>To support WinNT clients, in the [global] section of smb.conf set the following (for example):
Windows 9X Configuration
Win9X and WinNT Configuration
Windows 9X Profile Setup
If you have made the folders / files read-only on the samba server, then you will get errors from the w95 machine on logon and logout, as it attempts to merge the local and the remote profile. Basically, if -you have any errors reported by the w95 machine, check the unix file +you have any errors reported by the w95 machine, check the Unix file permissions and ownership rights on the profile directory contents, on the samba server.
Windows NT Workstation 4.0
Windows NT Server
Sharing Profiles between W95 and NT Workstation 4.0
DOMAIN_CONTROL.txt : Windows NT Domain Control & Samba
nmbd [-D] [-a] [-o] [-P] [-h] [-V] [-d <debug level>] [-H <lmhosts file>] [-l <log file>] [-n <primary netbios name>] [-p <port number>] [-s <configuration file>] [-D] [-a] [-o] [-P] [-h] [-V] [-d <debug level>] [-H <lmhosts file>] [-l <log directory>] [-n <primary netbios name>] [-p <port number>] [-s <configuration file>]file.- -l <log file>
-l <log directory>The -l parameter specifies a path - and base filename into which operational data from - the running The -l parameter specifies a directory + into which the "log.nmbd" log file will be created + for operational data from the running + nmbd server will - be logged. The actual log file name is generated by - appending the extension ".nmb" to the specified base - name. For example, if the name specified was "log" - then the file log.nmb would contain the debugging data.
The default log file path is compiled into Samba as - part of the build process. Common defaults are server.
The default log directory is compiled into Samba + as part of the build process. Common defaults are /usr/local/samba/var/log.nmb,
Sets the SMB username or username and password.
If %password is not specified, The user will be prompted. The +>If %password is not specified, the user will be prompted. The client will first check the USER
The Samba 2.2 PDC FAQ This is the FAQ for Samba 2.2 as an NTDomain controller. - This document is derived from the origional FAQ that was built and - maintained by Gerald Carter from the early days of Samba NTDomain development - up until recently. It is now being updated as significent changes are - made to 2.2.0. -
Please note it does not apply to the SAMBA_TNG nor the HEAD branch. -
Also available is a Samba 2.2 PDC HOWTO - that takes you, step by step, over the process of setting up a very basic Samba - 2.2 Primary Domain Controller -
- Table of Contents
- 1. Introduction
- 2. General Information
- 3. Establishing Connections
- How do I get my NT4 or W2000 Workstation to login to the Samba -controlled Domain?
- What is a 'machine account' ?
- "The machine account for this computer either does not -exist or is not accessable."
- How do I create machine accounts manually ?
- I cannot include a '$' in a machine name.
- I get told "You already have a connection to the Domain...." -when creating a machine account.
- I get told "Cannot join domain, the credentials supplied -conflict with an existing set.."
- "The system can not log you on (C000019B)...."
- 4. User Account Management
- 5. Miscellaneous
- What editor can I use in DOS/Windows that won't -mess with my unix EOF
- How do I get 'User Manager' and 'Server Manager'
- The time setting from a Samba server does not work.
- "trust account xxx should be in DOMAIN_GROUP_RID_USERS"
- How do I get my samba server to become a member ( not PDC ) of an NT domain?
- 6. Troubleshooting and Bug Reporting
Chapter 1. Introduction
State of Play
Much of the related code does work. For example, if an NT is removed from the - domain and then rejoins, the Create a Computer Account in the Domain dialog - will let you reset the smbpasswd. That is you don't need to do it from - the unix box. However, at the present, you do need to have root as an - administrator and use the root user name and password.
Policies do work on a W2K machine. MS says that recent - builds of W2K dont observe an NT policy but it appears it does in 'legacy' - mode.
Introduction
This FAQ was origionally compiled by Jerry Carter (gc) chiefly dealing - with the 'old HEAD' version of Samba and its NTDomain facilities. It is - being rewritten by David Bannon (drb) so that it addresses more - accurately the Samba 2.2.x release. -
This document probably still contains some material that does not apply - to Samba 2.2 but most (all?) of the really misleading stuff has been - removed. Some issues are not dealt with or are dealt with badly. Please - send corrections and additions to David Bannon. -
Hopefully, as we all become familiar with the Samba 2.2 as a - PDC this document will become much more usefull.
Chapter 2. General Information
What can we do ?
What can Samba 2.2.x Primary Domain Controller (PDC) do ?
If you wish to have Samba act as a PDC for Windows NT 4.0/2000 client, - then you will need to obtain the 2.2.0 version. Release of a stable, - full featured Samba PDC is currently slated for version 3.0. -
The following is a list of included features currently in - Samba 2.2: -
The ability to act as a limited PDC for - Windows NT and W2000 clients. This includes adding NT and - W2K machines to the domain and authenticating users logging - into the domain.
Domain account can be viewed using the User - Manager for Domains
Viewing/adding/deleting resources on the Samba - PDC via the Server Manager for Domains from the NT client. -
Windows 95/98/ME clients will allow user - level security to be set and browsing of domain accounts. -
Machine account password updates.
Changing of user passwords from an NT client. -
Partial support for Windows NT username mapping. - Group name mapping is slated for a later release.
These things are note expected to work in the forseeable future: -
Trust relationships
PDC and BDC integration
Can I have a Windows 2000 client logon to a Samba -controlled domain?
The 2.2 release branch of Samba supports Windows 2000 domain - clients in legacy mode, ie as if the PDC is a NTServer, not a - W2K server. -
CVS
CVS is a programme (publically available) that the Samba developers - use to maintain the central source code. Non developers can get - access to the source in a read only capacity. Many flavours of unix - now arrive with cvs installed.
What are the different Samba branches available in CVS ?
You can find out more about obtaining Samba's via anonymous - CVS from http://pserver.samba.org/samba/cvs.html. -
There are basically four branches to watch at the moment : -
- HEAD
Samba 3.0 ? This code boasts all the main - development work in Samba. Due to its developmental - nature, its not really suitable for production work. -
- SAMBA_2_0
This branch contains the previous stable - release. At the moment it contains 2.0.8, a version that - will do some limited PDC stuff. If you are really going to - do PDC things, you consider 2.2 instead. -
- SAMBA_2_2
The 2.2.x release branch which is a subset - of the features of the HEAD branch. This document addresses - only SAMBA_2_2. -
- SAMBA_TNG
This branch is no longer maintained from the Samba - sites. Please see http://www.samba-tng.org/. It has been requested - that questions about TNG are not posted to the regular Samba - mailing lists including samba-ntdom and samba-technical. -
What are the CVS commands ?
See http://pserver.samba.org/samba/cvs.html for instructions - on obtaining the SAMBA_2_2 or HEAD cvs code. -
Chapter 3. Establishing Connections
How do I get my NT4 or W2000 Workstation to login to the Samba -controlled Domain?
There is a comprehensive Samba PDC HOWTO accessable from the samba web - site under 'Documentation'. Read it. -
What is a 'machine account' ?
Every NT, W2K or Samba machine that joins a Samba controlled - domain must be known to the Samba PDC. There are two entries - required, one in (typically) /etc/passwd - and the other in (typically) /usr/local/samba/private/smbpasswd. - Under some circumstances these entries are made - manually, the HOWTO - discusses ways of creating them automatically.
"The machine account for this computer either does not -exist or is not accessable."
When I try to join the domain I get the message "The machine account - for this computer either does not exist or is not accessable". Whats - wrong ? -
This problem is caused by the PDC not having a suitable machine account. - If you are using the add user script = method to create - accounts then this would indicate that it has not worked. Ensure the domain - admin user system is working. -
Alternatively if you are creating account entries manually then they - have not been created correctly. Make sure that you have the entry - correct for the machine account in smbpasswd file on the Samba PDC. - If you added the account using an editor rather than using the smbpasswd - utility, make sure that the account name is the machine netbios name - with a '$' appended to it ( ie. computer_name$ ). There must be an entry - in both /etc/passwd and the smbpasswd file. Some people have reported - that inconsistent subnet masks between the Samba server and the NT - client have caused this problem. Make sure that these are consistent - for both client and server. -
How do I create machine accounts manually ?
This was the only option until recently, now in version 2.2 better - means are available. You might still need to do it manually for a - couple of reasons. A machine account consists of two entries (assuming - a standard install and /etc/passwd use), one in /etc/passwd and the - other in /usr/local/samba/private/smbpasswd. The /etc/passwd - entry will list the machine name with a $ appended, won't have a - passwd, will have a null shell and no home directory. For example - a machine called 'doppy' would have an /etc/passwd entry like this :
doppy$:x:505:501:NTMachine:/dev/null:/bin/false -
On a linux system for example, you would typically add it like - this : -
adduser -g machines -c NTMachine -d /dev/null -s /bin/false -n - doppy$ -
Then you need to add that entry to smbpasswd, assuming you have a suitable - path to the smbpasswd programme, do this : -
smbpasswd -a -m doppy$ -
The entry will be created with a well known password, so any machine that - says its doppy could join the domain as long as it gets in first. So - don't create the accounts any earlier than you need them. -
I cannot include a '$' in a machine name.
A 'machine name' in (typically) /etc/passwd consists - of the machine name with a '$' appended. FreeBSD (and other BSD - systems ?) won't create a user with a '$' in their name. -
The problem is only in the program used to make the entry, once - made, it works perfectly. So create a user without the '$' and - use vipw to edit the entry, adding the '$'. Or create - the whole entry with vipw if you like, make sure you use a - unique uid !
I get told "You already have a connection to the Domain...." -when creating a machine account.
This happens if you try to create a machine account from the - machine itself and use a user name that does not work (for whatever - reason) and then try another (possibly valid) user name. - Exit out of the network applet to close the initial connection - and try again. -
Further, if the machine is a already a 'member of a workgroup' that - is the same name as the domain you are joining (bad idea) you will - get this message. Change the workgroup name to something else, it - does not matter what, reboot, and try again.
I get told "Cannot join domain, the credentials supplied -conflict with an existing set.."
This is the same basic problem as mentioned above, "You already have a connection..." -
"The system can not log you on (C000019B)...."
I joined the domain successfully but after upgrading - to a newer version of the Samba code I get the message, "The system - can not log you on (C000019B), Please try a gain or consult your - system administrator" when attempting to logon. -
This occurs when the domain SID stored in private/WORKGROUP.SID is - changed. For example, you remove the file and smbd automatically - creates a new one. Or you are swapping back and forth between - versions 2.0.7, TNG and the HEAD branch code (not recommended). The - only way to correct the problem is to restore the original domain - SID or remove the domain client from the domain and rejoin. -
Chapter 4. User Account Management
Profiles
Why is it bad to set "logon path = \\%N\%U\profile" in -smb.conf?
Sometimes Windows clients will maintain a connection to - the \\homes\ ( or [%U] ) share even after the user has logged out. - Consider the following scenario. -
user1 logs into the Windows NT machine. - Therefore the [homes] share is set to \\server\user1. -
user1 works for a while and then logs - out.
user2 logs into the same Windows NT - machine.
However, since the NT box has maintained a connection to [homes] - which was previously set to \\server\user1, when the operating system - attempts to get the profile and if it can read users1's profile, will - get it otherwise it will return an error. You get the picture. -
A better solution is to use a separate [profiles] share and - set the "logon path = \\%N\profiles\%U" -
Why are all the users listed in the "domain admin users" using the -same profile?
You are using a very very old development version of Samba. - Upgrade. -
The roaming profiles do not seem to be updating on the -server.
There can be several reasons for this. -
Make sure that the time on the client and the PDC are synchronized. You - can accomplish this by executing a net time \\server /set /yes - replacing server with the name of your PDC (or another synchronized SMB server). - See about Setting Time -
Make sure that the "logon path" is writeable by the user and make sure - that the connection to the logon path location is by the current user. - Sometimes Windows client do not drop the connection immediately upon - logoff. -
Some people have reported that the logon path location should - also be browseable. I (GC) have yet to emperically verify this, - but you can try.
Policies
What are 'Policies' ?.
When a user logs onto the domain via a client machine, the PDC - sends the client machine a list of things contained in the - 'policy' (if it exists). This list may do things like suppress - a splach screen, format the dates the way you like them or perhaps - remove locally stored profiles. -
On a samba PDC this list is obtained from a file called - ntconfig.pol and located in the [netlogon] - share. The file is created with a policy editor and must be readable - by anyone and writeable by only root. See below for how to get a suitable editor. -
I can't get system policies to work.
There are two possible reasons for system policies not - functioning correctly. Make sure that you have the following - parameters set in smb.conf -
[netlogon] - .... - locking = no - public = no - browseable = yes - .... -A policy file must be in the [netlogon] share and must be - readable by everyone and writeable by only root. The file - must be created by an NTServer Policy - Editor. -
Last time I (drb) looked in the source, it was looking for - ntconfig.pol first then several other - combinations of upper and lower case. People have reported - success using NTconfig.pol, NTconfig.POL - and ntconfig.pol. These are the case settings that - I (GC) use with the filename ntconfig.pol: -
case sensitive = no - case preserve = yes - short preserve case = no - default case = yes -What about Windows NT Policy Editor ?
To create or edit ntconfig.pol you must use - the NT Server Policy Editor, poledit.exe which - is included with NT Server but not NT Workstation. - There is a Policy Editor on a NTws - but it is not suitable for creating Domain Policies. - Further, although the Windows 95 - Policy Editor can be installed on an NT Workstation/Server, it will not - work with NT policies because the registry key that are set by the policy templates. - However, the files from the NT Server will run happily enough on an NTws. - You need poledit.exe, common.adm and winnt.adm. It is convenient - to put the two *.adm files in c:\winnt\inf which is where - the binary will look for them unless told otherwise. Note also that that - directory is 'hidden'. -
The Windows NT policy editor is also included with the - Service Pack 3 (and later) for Windows NT 4.0. Extract the files using - servicepackname /x, ie thats Nt4sp6ai.exe - /x for service pack 6a. The policy editor, poledt.exe and the - associated template files (*.adm) should - be extracted as well. It is also possible to downloaded the policy template - files for Office97 and get a copy of the policy editor. Another possible - location is with the Zero Administration Kit available for download from Microsoft. -
Can Win95 do Policies ?
Install the group policy handler for Win9x to pick up group - policies. Look on the Win98 CD in \tools\reskit\netadmin\poledit. - Install group policies on a Win9x client by double-clicking - grouppol.inf. Log off and on again a couple of - times and see if Win98 picks up group policies. Unfortunately this needs - to be done on every Win9x machine that uses group policies.... -
If group policies don't work one reports suggests getting the updated - (read: working) grouppol.dll for Windows 9x. The group list is grabbed - from /etc/group. -
Passwords
What is password sync and should I use it ?
NTws users can change their domain password by pressing Ctrl-Alt-Del - and choosing 'Change Password'. By default however, this does not change the unix password - (typically in /etc/passwd or /etc/shadow). - In lots of situations thats OK, for example : -
The server is only accessible to the user via - samba.
Pam_smb or similar is installed so other applications - still refer to the samba password.
But sometimes you really do need to maintain two seperate password - databases and there are good reasons to keep then in sync. Trying - to explain to users that they need to change their passwords in two - seperate places or use two seperate passwords is not fun. -
However do understand that setting up password sync is not without - problems either. The chief difficulty is the interface between Samba - and the passwd command, it can be a fiddle to set - up and if the password the user has entered fails, the resulting errors - are ambiguously reported and the user is confused. Further, you need - to take steps to ensure that users only ever change their passwords - via samba (or use smbpasswd), otherwise they will - only be changing the unix password.
How do I get remote password (unix and SMB) changing working ?
Have a practice changing a user's password (as root) to see - what discussion takes place and change the text in the 'passwd chat' - line below as necessary. The line as shown works for recent RH Linux - but most other systems seem to like to do something different. The '*' is - a wild card and will match anything (or nothing). -
Add these lines to smb.conf under [Global] -
- - unix password sync = true - passwd program = /usr/bin/passwd %u - passwd chat = *password* %n\n *password* %n\n *successful* -As mentioned above, the change to the unix password happens as root, - not as the user, as is indicated in ~/smbd/chgpasswd.c If - you are using NIS, the Samba server must be running on the NIS - master machine. -
Chapter 5. Miscellaneous
What editor can I use in DOS/Windows that won't -mess with my unix EOF
There are a number of Windows or DOS based editors that will - understand, and leave intact, the unix eof (as opposed to a DOS CL/LF). - List members suggested : -
UltraEdit at www.ultraedit.com
VI for windows at home.snafu.de/ramo/WinViEn.htm
The author prefers PFE at www.lancs.ac.uk/people/cpaap/pfe/ but its no longer being developed...
How do I get 'User Manager' and 'Server Manager'
Since I don't need to buy an NT Server CD now, how do I get - the 'User Manager for Domains', the 'Server Manager' ? -
Microsoft distributes a version of - these tools called nexus for installation on Windows 95 systems. The - tools set includes -
Server Manager
User Manager for Domains
Event Viewer
Click here to download the archived file ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE -
The Windows NT 4.0 version of the 'User Manager for - Domains' and 'Server Manager' are available from Microsoft via ftp - from ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE -
The time setting from a Samba server does not work.
If it works OK when you log on as Domain Admin then the problem is that ordinary users - don't have permission to change the time. (The system is running with their permission - at logon time.) This is not a Samba problem, you will have the same problem where ever - you connect. You can give 'everyone' permission to change the time from the User Manager. -
Anyone know what the registry settings are so this could be done with a Policy ?
"trust account xxx should be in DOMAIN_GROUP_RID_USERS"
I keep getting the message "trust account xxx should be in DOMAIN_GROUP_RID_USERS." - in the logs. What do I need to do?
You are using one of the old development versions. Upgrade. - (The message is unimportant, was a reminder to a developer)
How do I get my samba server to become a member ( not PDC ) of an NT domain?
Please refer to the Domain Member - HOWTO for more information on this. -
Chapter 6. Troubleshooting and Bug Reporting
Diagnostic tools
What are some diagnostics tools I can use to debug the domain logon process and where can I - find them?
One of the best diagnostic tools for debugging problems is Samba itself. - You can use the -d option for both smbd and nmbd to specifiy what - 'debug level' at which to run. See the man pages on smbd, nmbd and - smb.conf for more information on debugging options. The debug - level can range from 1 (the default) to 10 (100 for debugging passwords). -
Another helpful method of debugging is to compile samba using the - gcc -g flag. This will include debug - information in the binaries and allow you to attch gdb to the - running smbd / nmbd process. In order to attach gdb to an smbd - process for an NT workstation, first get the workstation to make the - connection. Pressing ctrl-alt-delete and going down to the domain box - is sufficient (at least, on the first time you join the domain) to - generate a 'LsaEnumTrustedDomains'. Thereafter, the workstation - maintains an open connection, and therefore there will be an smbd - process running (assuming that you haven't set a really short smbd - idle timeout) So, in between pressing ctrl alt delete, and actually - typing in your password, you can gdb attach and continue. -
Some usefull samba commands worth investigating: -
testparam | more
smbclient -L //{netbios name of server}
An SMB enabled version of tcpdump is available from - http://www.tcpdup.org/. - Ethereal, another good packet sniffer for UNIX and Win32 - hosts, can be downloaded from http://www.ethereal.com. -
For tracing things on the Microsoft Windows NT, Network Monitor - (aka. netmon) is available on the Microsoft Developer Network CD's, - the Windows NT Server install CD and the SMS CD's. The version of - netmon that ships with SMS allows for dumping packets between any two - computers (ie. placing the network interface in promiscuous mode). - The version on the NT Server install CD will only allow monitoring - of network traffic directed to the local NT box and broadcasts on the - local subnet. Be aware that Ethereal can read and write netmon - formatted files. -
How do I install 'Network Monitor' on an NT Workstation -or a Windows 9x box?
Installing netmon on an NT workstation requires a couple - of steps. The following are for installing Netmon V4.00.349, which comes - with Microsoft Windows NT Server 4.0, on Microsoft Windows NT - Workstation 4.0. The process should be similar for other version of - Windows NT / Netmon. You will need both the Microsoft Windows - NT Server 4.0 Install CD and the Workstation 4.0 Install CD. -
Initially you will need to install 'Network Monitor Tools and Agent' - on the NT Server. To do this -
Goto Start - Settings - Control Panel - - Network - Services - Add
Select the 'Network Monitor Tools and Agent' and - click on 'OK'.
Click 'OK' on the Network Control Panel. -
Insert the Windows NT Server 4.0 install CD - when prompted.
At this point the Netmon files should exist in - %SYSTEMROOT%\System32\netmon\*.*. - Two subdirectories exist as well, parsers\ - which contains the necessary DLL's for parsing the netmon packet - dump, and captures\. -
In order to install the Netmon tools on an NT Workstation, you will - first need to install the 'Network Monitor Agent' from the Workstation - install CD. -
Goto Start - Settings - Control Panel - - Network - Services - Add
Select the 'Network Monitor Agent' and click - on 'OK'.
Click 'OK' on the Network Control Panel. -
Insert the Windows NT Workstation 4.0 install - CD when prompted.
Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.* - to %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set - permissions as you deem appropriate for your site. You will need - administrative rights on the NT box to run netmon. -
To install Netmon on a Windows 9x box install the network monitor agent - from the Windows 9x CD (\admin\nettools\netmon). There is a readme - file located with the netmon driver files on the CD if you need - information on how to do this. Copy the files from a working - Netmon installation. -
What other help can I get ?
There are many sources of information available in the form - of mailing lists, RFC's and documentation. The docs that come - with the samba distribution contain very good explanations of - general SMB topics such as browsing.
URLs and similar
Home of Samba site http://samba.org. We have a mirror near you !
The Development document - on the Samba mirrors might mention your problem. If so, - it might mean that the developers are working on it.
Ignacio Coupeau has a very comprehesive look at LDAP with Samba at - http://www.unav.es/cti/ldap-smb-howto.html - Be a little carefull however, I suspect that it does not specificly - address samba 2.2.x. The HEAD pre-2.1 may possibly be the best - stream to look at.
Lars Kneschke's site covers Samba-TNG at - http://www.kneschke.de/projekte/samba_tng, but again, a - lot of it does not apply to the main stream Samba.
See how Scott Merrill simulates a BDC behaviour at - http://www.skippy.net/linux/smb-howto.html.
Although 2.0.7 has almost had its day as a PDC, I (drb) will - keep the 2.0.7 PDC pages at http://bioserve.latrobe.edu.au/samba going for a while yet.
Misc links to CIFS information - http://samba.org/cifs/
NT Domains for Unix http://mailhost.cb1.com/~lkcl/ntdom/
FTP site for older SMB specs: - ftp://ftp.microsoft.com/developr/drg/CIFS/
You should also refer to the MS archives at - ftp://ftp.microsoft.com/developr/drg/CIFS/" -
How do I get help from the mailing lists ?
There are a number of Samba related mailing lists. Go to http://samba.org, click on your nearest mirror - and then click on Support and then click on Samba related mailing lists.
For questions relating to Samba TNG go to - http://www.samba-tng.org/ - It has been requested that you don't post questions about Samba-TNG to the - main stream Samba lists.
If you post a message to one of the lists please - observe the following guide lines :
Always remember that the developers are volunteers, they are - not paid and they never guarantee to produce a particular feature at - a particular time. Any time lines are 'best guess' and nothing more. -
Always mention what version of samba you are using and what - operating system its running under. You should probably list the - relevant sections of your smb.conf file, at least the options - in [global] that affect PDC support.
In addition to the version, if you obtained Samba via - CVS mention the date when you last checked it out.
Try and make your question clear and brief, lots of long, - convoluted questions get deleted before they are completely read ! - Don't post html encoded messages (if you can select colour or font - size its html).
If you run one of those niffy 'I'm on holidays' things when - you are away, make sure its configured to not answer mailing lists. -
Don't cross post. Work out which is the best list to post to - and see what happens, ie don't post to both samba-ntdom and samba-technical. - Many people active on the lists subscribe to more - than one list and get annoyed to see the same message two or more times. - Often someone will see a message and thinking it would be better dealt - with on another, will forward it on for you.
You might include partial - log files written at a debug level set to as much as 20. - Please don't send the entire log but enough to give the context of the - error messages.
(Possibly) If you have a complete netmon trace ( from the opening of - the pipe to the error ) you can send the *.CAP file as well.
Please think carefully before attaching a document to an email. - Consider pasting the relevant parts into the body of the message. The samba - mailing lists go to a huge number of people, do they all need a copy of your - smb.conf in their attach directory ?
How do I get off the mailing lists ?
To have your name removed from a samba mailing list, go to the - same place you went to to get on it. Go to http://lists.samba.org, click - on your nearest mirror and then click on Support and - then click on Samba related mailing lists. Or perhaps see - here
Please don't post messages to the list asking to be removed, you will just - be refered to the above address (unless that process failed in some way...) -