From 6a4da84a0d7ac8dbf1fe250535e58cd24bb6d3bd Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Tue, 5 Nov 2002 22:28:45 +0000 Subject: correct make (This used to be commit 836bfb3a1bd0c91df8e39d22eb76740bda805310) --- docs/Samba-Developers-Guide.pdf | 4 +- docs/Samba-HOWTO-Collection.pdf | 4 +- docs/htmldocs/ENCRYPTION.html | 656 ------- docs/htmldocs/NT_Security.html | 783 --------- docs/htmldocs/Samba-HOWTO.html | 1440 ---------------- docs/htmldocs/Samba-PDC-HOWTO.html | 2284 ------------------------- docs/htmldocs/ads.html | 423 +++++ docs/htmldocs/oplocks.html | 208 +++ docs/htmldocs/p1346.html | 917 ++++++++++ docs/htmldocs/p18.html | 438 +++++ docs/htmldocs/p3106.html | 391 +++++ docs/htmldocs/p544.html | 388 +++++ docs/htmldocs/pdb-mysql.html | 286 ++++ docs/htmldocs/pdb-xml.html | 189 ++ docs/htmldocs/printingdebug.html | 522 ------ docs/htmldocs/pwencrypt.html | 445 +++++ docs/htmldocs/samba-howto-collection.html | 1117 ++++++++++++ docs/htmldocs/samba-pdc.html | 2649 +++++++++++++++++++++++++++++ docs/htmldocs/vfstest.1.html | 496 ++++++ docs/htmldocs/wfw_slip.htm | 175 -- docs/manpages/net.8 | 2 +- docs/manpages/smbcacls.1 | 2 +- docs/manpages/smbcontrol.1 | 2 +- docs/manpages/smbd.8 | 2 +- docs/manpages/smbgroupedit.8 | 2 +- docs/manpages/smbmnt.8 | 2 +- docs/manpages/smbmount.8 | 2 +- docs/manpages/smbpasswd.8 | 2 +- docs/manpages/smbsh.1 | 2 +- docs/manpages/smbspool.8 | 2 +- docs/manpages/smbstatus.1 | 2 +- docs/manpages/smbtar.1 | 2 +- docs/manpages/smbumount.8 | 2 +- docs/manpages/swat.8 | 2 +- docs/manpages/testparm.1 | 2 +- docs/manpages/testprns.1 | 2 +- docs/manpages/winbindd.8 | 2 +- 37 files changed, 7968 insertions(+), 5881 deletions(-) delete mode 100644 docs/htmldocs/ENCRYPTION.html delete mode 100644 docs/htmldocs/NT_Security.html delete mode 100644 docs/htmldocs/Samba-HOWTO.html delete mode 100644 docs/htmldocs/Samba-PDC-HOWTO.html create mode 100644 docs/htmldocs/ads.html create mode 100644 docs/htmldocs/oplocks.html create mode 100644 docs/htmldocs/p1346.html create mode 100644 docs/htmldocs/p18.html create mode 100644 docs/htmldocs/p3106.html create mode 100644 docs/htmldocs/p544.html create mode 100644 docs/htmldocs/pdb-mysql.html create mode 100644 docs/htmldocs/pdb-xml.html delete mode 100644 docs/htmldocs/printingdebug.html create mode 100644 docs/htmldocs/pwencrypt.html create mode 100644 docs/htmldocs/samba-howto-collection.html create mode 100644 docs/htmldocs/samba-pdc.html create mode 100644 docs/htmldocs/vfstest.1.html delete mode 100644 docs/htmldocs/wfw_slip.htm (limited to 'docs') diff --git a/docs/Samba-Developers-Guide.pdf b/docs/Samba-Developers-Guide.pdf index b99e559930..dcfec12242 100644 --- a/docs/Samba-Developers-Guide.pdf +++ b/docs/Samba-Developers-Guide.pdf @@ -1,6 +1,6 @@ %PDF-1.3 %âãÏÓ -1 0 obj<>endobj +1 0 obj<>endobj 2 0 obj<>endobj 3 0 obj<>endobj 4 0 obj<>endobj @@ -2546,7 +2546,7 @@ xref 0000174306 00000 n 0000174412 00000 n trailer -<<955c6f9456ba80fab20b3e98dc236de9>]>> +<<8ded901626010d73542ea94815423a1a>]>> startxref 174892 %%EOF diff --git a/docs/Samba-HOWTO-Collection.pdf b/docs/Samba-HOWTO-Collection.pdf index 8489ceff19..670e20457a 100644 --- a/docs/Samba-HOWTO-Collection.pdf +++ b/docs/Samba-HOWTO-Collection.pdf @@ -1,6 +1,6 @@ %PDF-1.3 %âãÏÓ -1 0 obj<>endobj +1 0 obj<>endobj 2 0 obj<>endobj 3 0 obj<>endobj 4 0 obj<>endobj @@ -6063,7 +6063,7 @@ xref 0000432961 00000 n 0000433075 00000 n trailer -<<76d8cbfae9241c16b40e8c09c0753e77>]>> +<<2961315c0e4068c07caa3948042c9821>]>> startxref 433984 %%EOF diff --git a/docs/htmldocs/ENCRYPTION.html b/docs/htmldocs/ENCRYPTION.html deleted file mode 100644 index e4d3ef5fed..0000000000 --- a/docs/htmldocs/ENCRYPTION.html +++ /dev/null @@ -1,656 +0,0 @@ -LanMan and NT Password Encryption in Samba 2.x

LanMan and NT Password Encryption in Samba 2.x

Introduction

With the development of LanManager and Windows NT - compatible password encryption for Samba, it is now able - to validate user connections in exactly the same way as - a LanManager or Windows NT server.

This document describes how the SMB password encryption - algorithm works and what issues there are in choosing whether - you want to use it. You should read it carefully, especially - the part about security and the "PROS and CONS" section.

How does it work?

LanManager encryption is somewhat similar to UNIX - password encryption. The server uses a file containing a - hashed value of a user's password. This is created by taking - the user's plaintext password, capitalising it, and either - truncating to 14 bytes or padding to 14 bytes with null bytes. - This 14 byte value is used as two 56 bit DES keys to encrypt - a 'magic' eight byte value, forming a 16 byte value which is - stored by the server and client. Let this value be known as - the "hashed password".

Windows NT encryption is a higher quality mechanism, - consisting of doing an MD4 hash on a Unicode version of the user's - password. This also produces a 16 byte hash value that is - non-reversible.

When a client (LanManager, Windows for WorkGroups, Windows - 95 or Windows NT) wishes to mount a Samba drive (or use a Samba - resource), it first requests a connection and negotiates the - protocol that the client and server will use. In the reply to this - request the Samba server generates and appends an 8 byte, random - value - this is stored in the Samba server after the reply is sent - and is known as the "challenge". The challenge is different for - every client connection.

The client then uses the hashed password (16 byte values - described above), appended with 5 null bytes, as three 56 bit - DES keys, each of which is used to encrypt the challenge 8 byte - value, forming a 24 byte value known as the "response".

In the SMB call SMBsessionsetupX (when user level security - is selected) or the call SMBtconX (when share level security is - selected), the 24 byte response is returned by the client to the - Samba server. For Windows NT protocol levels the above calculation - is done on both hashes of the user's password and both responses are - returned in the SMB call, giving two 24 byte values.

The Samba server then reproduces the above calculation, using - its own stored value of the 16 byte hashed password (read from the - smbpasswd file - described later) and the challenge - value that it kept from the negotiate protocol reply. It then checks - to see if the 24 byte value it calculates matches the 24 byte value - returned to it from the client.

If these values match exactly, then the client knew the - correct password (or the 16 byte hashed value - see security note - below) and is thus allowed access. If not, then the client did not - know the correct password and is denied access.

Note that the Samba server never knows or stores the cleartext - of the user's password - just the 16 byte hashed values derived from - it. Also note that the cleartext password or 16 byte hashed values - are never transmitted over the network - thus increasing security.

Important Notes About Security

The unix and SMB password encryption techniques seem similar - on the surface. This similarity is, however, only skin deep. The unix - scheme typically sends clear text passwords over the network when - logging in. This is bad. The SMB encryption scheme never sends the - cleartext password over the network but it does store the 16 byte - hashed values on disk. This is also bad. Why? Because the 16 byte hashed - values are a "password equivalent". You cannot derive the user's - password from them, but they could potentially be used in a modified - client to gain access to a server. This would require considerable - technical knowledge on behalf of the attacker but is perfectly possible. - You should thus treat the smbpasswd file as though it contained the - cleartext passwords of all your users. Its contents must be kept - secret, and the file should be protected accordingly.

Ideally we would like a password scheme which neither requires - plain text passwords on the net or on disk. Unfortunately this - is not available as Samba is stuck with being compatible with - other SMB systems (WinNT, WfWg, Win95 etc).

Warning

Note that Windows NT 4.0 Service pack 3 changed the - default for permissible authentication so that plaintext - passwords are never sent over the wire. - The solution to this is either to switch to encrypted passwords - with Samba or edit the Windows NT registry to re-enable plaintext - passwords. See the document WinNT.txt for details on how to do - this.

Other Microsoft operating systems which also exhibit - this behavior includes

  • MS DOS Network client 3.0 with - the basic network redirector installed

  • Windows 95 with the network redirector - update installed

  • Windows 98 [se]

  • Windows 2000

Note :All current release of - Microsoft SMB/CIFS clients support authentication via the - SMB Challenge/Response mechanism described here. Enabling - clear text authentication does not disable the ability - of the client to participate in encrypted authentication.

Advantages of SMB Encryption

  • plain text passwords are not passed across - the network. Someone using a network sniffer cannot just - record passwords going to the SMB server.

  • WinNT doesn't like talking to a server - that isn't using SMB encrypted passwords. It will refuse - to browse the server if the server is also in user level - security mode. It will insist on prompting the user for the - password on each connection, which is very annoying. The - only things you can do to stop this is to use SMB encryption. -

Advantages of non-encrypted passwords

  • plain text passwords are not kept - on disk.

  • uses same password file as other unix - services such as login and ftp

  • you are probably already using other - services (such as telnet and ftp) which send plain text - passwords over the net, so sending them for SMB isn't - such a big deal.

The smbpasswd file

In order for Samba to participate in the above protocol - it must be able to look up the 16 byte hashed values given a user name. - Unfortunately, as the UNIX password value is also a one way hash - function (ie. it is impossible to retrieve the cleartext of the user's - password given the UNIX hash of it), a separate password file - containing this 16 byte value must be kept. To minimise problems with - these two password files, getting out of sync, the UNIX /etc/passwd and the smbpasswd file, - a utility, mksmbpasswd.sh, is provided to generate - a smbpasswd file from a UNIX /etc/passwd file. -

To generate the smbpasswd file from your /etc/passwd - file use the following command :

$ cat /etc/passwd | mksmbpasswd.sh - > /usr/local/samba/private/smbpasswd

If you are running on a system that uses NIS, use

$ ypcat passwd | mksmbpasswd.sh - > /usr/local/samba/private/smbpasswd

The mksmbpasswd.sh program is found in - the Samba source directory. By default, the smbpasswd file is - stored in :

/usr/local/samba/private/smbpasswd

The owner of the /usr/local/samba/private/ - directory should be set to root, and the permissions on it should - be set to 0500 (chmod 500 /usr/local/samba/private). -

Likewise, the smbpasswd file inside the private directory should - be owned by root and the permissions on is should be set to 0600 - (chmod 600 smbpasswd).

The format of the smbpasswd file is (The line has been - wrapped here. It should appear as one entry per line in - your smbpasswd file.)

username:uid:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:
-	[Account type]:LCT-<last-change-time>:Long name
-

Although only the username, - uid, XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX, - [Account type] and last-change-time sections are significant - and are looked at in the Samba code.

It is VITALLY important that there by 32 - 'X' characters between the two ':' characters in the XXX sections - - the smbpasswd and Samba code will fail to validate any entries that - do not have 32 characters between ':' characters. The first XXX - section is for the Lanman password hash, the second is for the - Windows NT version.

When the password file is created all users have password entries - consisting of 32 'X' characters. By default this disallows any access - as this user. When a user has a password set, the 'X' characters change - to 32 ascii hexadecimal digits (0-9, A-F). These are an ascii - representation of the 16 byte hashed value of a user's password.

To set a user to have no password (not recommended), edit the file - using vi, and replace the first 11 characters with the ascii text - "NO PASSWORD" (minus the quotes).

For example, to clear the password for user bob, his smbpasswd file - entry would look like :

	bob:100:NO PASSWORDXXXXXXXXXXXXXXXXXXXXX:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:[U          ]:LCT-00000000:Bob's full name:/bobhome:/bobshell
-

If you are allowing users to use the smbpasswd command to set - their own passwords, you may want to give users NO PASSWORD initially - so they do not have to enter a previous password when changing to their - new password (not recommended). In order for you to allow this the - smbpasswd program must be able to connect to the - smbd daemon as that user with no password. Enable this - by adding the line :

null passwords = yes

to the [global] section of the smb.conf file (this is why - the above scenario is not recommended). Preferably, allocate your - users a default password to begin with, so you do not have - to enable this on your server.

Note : This file should be protected very - carefully. Anyone with access to this file can (with enough knowledge of - the protocols) gain access to your SMB server. The file is thus more - sensitive than a normal unix /etc/passwd file.

The smbpasswd Command

The smbpasswd command maintains the two 32 byte password fields - in the smbpasswd file. If you wish to make it similar to the unix - passwd or yppasswd programs, - install it in /usr/local/samba/bin/ (or your - main Samba binary directory).

Note that as of Samba 1.9.18p4 this program MUST NOT - BE INSTALLED setuid root (the new smbpasswd - code enforces this restriction so it cannot be run this way by - accident).

smbpasswd now works in a client-server mode - where it contacts the local smbd to change the user's password on its - behalf. This has enormous benefits - as follows.

  • smbpasswd no longer has to be setuid root - - an enormous range of potential security problems is - eliminated.

  • smbpasswd now has the capability - to change passwords on Windows NT servers (this only works when - the request is sent to the NT Primary Domain Controller if you - are changing an NT Domain user's password).

To run smbpasswd as a normal user just type :

$ smbpasswd

Old SMB password: <type old value here - - or hit return if there was no old password>

New SMB Password: <type new value> -

Repeat New SMB Password: <re-type new value -

If the old value does not match the current value stored for - that user, or the two new values do not match each other, then the - password will not be changed.

If invoked by an ordinary user it will only allow the user - to change his or her own Samba password.

If run by the root user smbpasswd may take an optional - argument, specifying the user name whose SMB password you wish to - change. Note that when run as root smbpasswd does not prompt for - or check the old password value, thus allowing root to set passwords - for users who have forgotten their passwords.

smbpasswd is designed to work in the same way - and be familiar to UNIX users who use the passwd or - yppasswd commands.

For more details on using smbpasswd refer - to the man page which will always be the definitive reference.

Setting up Samba to support LanManager Encryption

This is a very brief description on how to setup samba to - support password encryption.

  1. compile and install samba as usual

  2. enable encrypted passwords in smb.conf by adding the line encrypt - passwords = yes in the [global] section

  3. create the initial smbpasswd - password file in the place you specified in the Makefile - (--prefix=<dir>). See the notes under the The smbpasswd File - section earlier in the document for details.

Note that you can test things using smbclient.

\ No newline at end of file diff --git a/docs/htmldocs/NT_Security.html b/docs/htmldocs/NT_Security.html deleted file mode 100644 index ab8797563e..0000000000 --- a/docs/htmldocs/NT_Security.html +++ /dev/null @@ -1,783 +0,0 @@ -UNIX Permission Bits and Windows NT Access Control Lists

UNIX Permission Bits and Windows NT Access Control Lists

Viewing and changing UNIX permissions using the NT - security dialogs

New in the Samba 2.0.4 release is the ability for Windows - NT clients to use their native security settings dialog box to - view and modify the underlying UNIX permissions.

Note that this ability is careful not to compromise - the security of the UNIX host Samba is running on, and - still obeys all the file permission rules that a Samba - administrator can set.

In Samba 2.0.4 and above the default value of the - parameter nt acl support has been changed from - false to true, so - manipulation of permissions is turned on by default.

How to view file security on a Samba share

From an NT 4.0 client, single-click with the right - mouse button on any file or directory in a Samba mounted - drive letter or UNC path. When the menu pops-up, click - on the Properties entry at the bottom of - the menu. This brings up the normal file properties dialog - box, but with Samba 2.0.4 this will have a new tab along the top - marked Security. Click on this tab and you - will see three buttons, Permissions, - Auditing, and Ownership. - The Auditing button will cause either - an error message A requested privilege is not held - by the client to appear if the user is not the - NT Administrator, or a dialog which is intended to allow an - Administrator to add auditing requirements to a file if the - user is logged on as the NT Administrator. This dialog is - non-functional with a Samba share at this time, as the only - useful button, the Add button will not currently - allow a list of users to be seen.

Viewing file ownership

Clicking on the "Ownership" button - brings up a dialog box telling you who owns the given file. The - owner name will be of the form :

"SERVER\user (Long name)"

Where SERVER is the NetBIOS name of - the Samba server, user is the user name of - the UNIX user who owns the file, and (Long name) - is the descriptive string identifying the user (normally found in the - GECOS field of the UNIX password database). Click on the Close - button to remove this dialog.

If the parameter nt acl support - is set to false then the file owner will - be shown as the NT user "Everyone".

The Take Ownership button will not allow - you to change the ownership of this file to yourself (clicking on - it will display a dialog box complaining that the user you are - currently logged onto the NT client cannot be found). The reason - for this is that changing the ownership of a file is a privileged - operation in UNIX, available only to the root - user. As clicking on this button causes NT to attempt to change - the ownership of a file to the current user logged into the NT - client this will not work with Samba at this time.

There is an NT chown command that will work with Samba - and allow a user with Administrator privilege connected - to a Samba 2.0.4 server as root to change the ownership of - files on both a local NTFS filesystem or remote mounted NTFS - or Samba drive. This is available as part of the Seclib - NT security library written by Jeremy Allison of - the Samba Team, available from the main Samba ftp site.

Viewing file or directory permissions

The third button is the "Permissions" - button. Clicking on this brings up a dialog box that shows both - the permissions and the UNIX owner of the file or directory. - The owner is displayed in the form :

"SERVER\user (Long name)"

Where SERVER is the NetBIOS name of - the Samba server, user is the user name of - the UNIX user who owns the file, and (Long name) - is the descriptive string identifying the user (normally found in the - GECOS field of the UNIX password database).

If the parameter nt acl support - is set to false then the file owner will - be shown as the NT user "Everyone" and the - permissions will be shown as NT "Full Control".

The permissions field is displayed differently for files - and directories, so I'll describe the way file permissions - are displayed first.

File Permissions

The standard UNIX user/group/world triple and - the corresponding "read", "write", "execute" permissions - triples are mapped by Samba into a three element NT ACL - with the 'r', 'w', and 'x' bits mapped into the corresponding - NT permissions. The UNIX world permissions are mapped into - the global NT group Everyone, followed - by the list of permissions allowed for UNIX world. The UNIX - owner and group permissions are displayed as an NT - user icon and an NT local - group icon respectively followed by the list - of permissions allowed for the UNIX user and group.

As many UNIX permission sets don't map into common - NT names such as "read", "change" or "full control" then - usually the permissions will be prefixed by the words "Special Access" in the NT display list.

But what happens if the file has no permissions allowed - for a particular UNIX user group or world component ? In order - to allow "no permissions" to be seen and modified then Samba - overloads the NT "Take Ownership" ACL attribute - (which has no meaning in UNIX) and reports a component with - no permissions as having the NT "O" bit set. - This was chosen of course to make it look like a zero, meaning - zero permissions. More details on the decision behind this will - be given below.

Directory Permissions

Directories on an NT NTFS file system have two - different sets of permissions. The first set of permissions - is the ACL set on the directory itself, this is usually displayed - in the first set of parentheses in the normal "RW" - NT style. This first set of permissions is created by Samba in - exactly the same way as normal file permissions are, described - above, and is displayed in the same way.

The second set of directory permissions has no real meaning - in the UNIX permissions world and represents the "inherited" permissions that any file created within - this directory would inherit.

Samba synthesises these inherited permissions for NT by - returning as an NT ACL the UNIX permission mode that a new file - created by Samba on this share would receive.

Modifying file or directory permissions

Modifying file and directory permissions is as simple - as changing the displayed permissions in the dialog box, and - clicking the OK button. However, there are - limitations that a user needs to be aware of, and also interactions - with the standard Samba permission masks and mapping of DOS - attributes that need to also be taken into account.

If the parameter nt acl support - is set to false then any attempt to set - security permissions will fail with an "Access Denied" - message.

The first thing to note is that the "Add" - button will not return a list of users in Samba 2.0.4 (it will give - an error message of "The remote procedure call failed - and did not execute"). This means that you can only - manipulate the current user/group/world permissions listed in - the dialog box. This actually works quite well as these are the - only permissions that UNIX actually has.

If a permission triple (either user, group, or world) - is removed from the list of permissions in the NT dialog box, - then when the "OK" button is pressed it will - be applied as "no permissions" on the UNIX side. If you then - view the permissions again the "no permissions" entry will appear - as the NT "O" flag, as described above. This - allows you to add permissions back to a file or directory once - you have removed them from a triple component.

As UNIX supports only the "r", "w" and "x" bits of - an NT ACL then if other NT security attributes such as "Delete - access" are selected then they will be ignored when applied on - the Samba server.

When setting permissions on a directory the second - set of permissions (in the second set of parentheses) is - by default applied to all files within that directory. If this - is not what you want you must uncheck the "Replace - permissions on existing files" checkbox in the NT - dialog before clicking "OK".

If you wish to remove all permissions from a - user/group/world component then you may either highlight the - component and click the "Remove" button, - or set the component to only have the special "Take - Ownership" permission (displayed as "O" - ) highlighted.

Interaction with the standard Samba create mask - parameters

Note that with Samba 2.0.5 there are four new parameters - to control this interaction. These are :

security mask

force security mode

directory security mask

force directory security mode

Once a user clicks "OK" to apply the - permissions Samba maps the given permissions into a user/group/world - r/w/x triple set, and then will check the changed permissions for a - file against the bits set in the - security mask parameter. Any bits that - were changed that are not set to '1' in this parameter are left alone - in the file permissions.

Essentially, zero bits in the security mask - mask may be treated as a set of bits the user is not - allowed to change, and one bits are those the user is allowed to change. -

If not set explicitly this parameter is set to the same value as - the create mask - parameter to provide compatibility with Samba 2.0.4 - where this permission change facility was introduced. To allow a user to - modify all the user/group/world permissions on a file, set this parameter - to 0777.

Next Samba checks the changed permissions for a file against - the bits set in the force security mode parameter. Any bits - that were changed that correspond to bits set to '1' in this parameter - are forced to be set.

Essentially, bits set in the force security mode - parameter may be treated as a set of bits that, when - modifying security on a file, the user has always set to be 'on'.

If not set explicitly this parameter is set to the same value - as the force - create mode parameter to provide compatibility - with Samba 2.0.4 where the permission change facility was introduced. - To allow a user to modify all the user/group/world permissions on a file - with no restrictions set this parameter to 000.

The security mask and force - security mode parameters are applied to the change - request in that order.

For a directory Samba will perform the same operations as - described above for a file except using the parameter directory security mask instead of security - mask, and force directory security mode - parameter instead of force security mode - .

The directory security mask parameter - by default is set to the same value as the directory mask - parameter and the force directory security - mode parameter by default is set to the same value as - the force directory mode parameter to provide - compatibility with Samba 2.0.4 where the permission change facility - was introduced.

In this way Samba enforces the permission restrictions that - an administrator can set on a Samba share, whilst still allowing users - to modify the permission bits within that restriction.

If you want to set up a share that allows users full control - in modifying the permission bits on their files and directories and - doesn't force any particular bits to be set 'on', then set the following - parameters in the smb.conf(5) - file in that share specific section :

security mask = 0777

force security mode = 0

directory security mask = 0777

force directory security mode = 0

As described, in Samba 2.0.4 the parameters :

create mask

force create mode

directory mask

force directory mode

were used instead of the parameters discussed here.

Interaction with the standard Samba file attribute - mapping

Samba maps some of the DOS attribute bits (such as "read - only") into the UNIX permissions of a file. This means there can - be a conflict between the permission bits set via the security - dialog and the permission bits set by the file attribute mapping. -

One way this can show up is if a file has no UNIX read access - for the owner it will show up as "read only" in the standard - file attributes tabbed dialog. Unfortunately this dialog is - the same one that contains the security info in another tab.

What this can mean is that if the owner changes the permissions - to allow themselves read access using the security dialog, clicks - "OK" to get back to the standard attributes tab - dialog, and then clicks "OK" on that dialog, then - NT will set the file permissions back to read-only (as that is what - the attributes still say in the dialog). This means that after setting - permissions and clicking "OK" to get back to the - attributes dialog you should always hit "Cancel" - rather than "OK" to ensure that your changes - are not overridden.

\ No newline at end of file diff --git a/docs/htmldocs/Samba-HOWTO.html b/docs/htmldocs/Samba-HOWTO.html deleted file mode 100644 index da69705bc3..0000000000 --- a/docs/htmldocs/Samba-HOWTO.html +++ /dev/null @@ -1,1440 +0,0 @@ - -SAMBA Project Documentation

SAMBA Project Documentation

SAMBA Team

Abstract

Last Update : Thu Aug 15 12:48:45 CDT 2002

This book is a collection of HOWTOs added to Samba documentation over the years. -I try to ensure that all are current, but sometimes the is a larger job -than one person can maintain. The most recent version of this document -can be found at http://www.samba.org/ -on the "Documentation" page. Please send updates to jerry@samba.org.

This documentation is distributed under the GNU General Public License (GPL) -version 2. A copy of the license is included with the Samba source -distribution. A copy can be found on-line at http://www.fsf.org/licenses/gpl.txt

Cheers, jerry

Table of Contents
1. How to Install and Test SAMBA
1.1. Step 0: Read the man pages
1.2. Step 1: Building the Binaries
1.3. Step 2: The all important step
1.4. Step 3: Create the smb configuration file.
1.5. Step 4: Test your config file with - testparm
1.6. Step 5: Starting the smbd and nmbd
1.6.1. Step 5a: Starting from inetd.conf
1.6.2. Step 5b. Alternative: starting it as a daemon
1.7. Step 6: Try listing the shares available on your - server
1.8. Step 7: Try connecting with the unix client
1.9. Step 8: Try connecting from a DOS, WfWg, Win9x, WinNT, - Win2k, OS/2, etc... client
1.10. What If Things Don't Work?
1.10.1. Diagnosing Problems
1.10.2. Scope IDs
1.10.3. Choosing the Protocol Level
1.10.4. Printing from UNIX to a Client PC
1.10.5. Locking
1.10.6. Mapping Usernames
2. Diagnosing your samba server
2.1. Introduction
2.2. Assumptions
2.3. Tests
2.3.1. Test 1
2.3.2. Test 2
2.3.3. Test 3
2.3.4. Test 4
2.3.5. Test 5
2.3.6. Test 6
2.3.7. Test 7
2.3.8. Test 8
2.3.9. Test 9
2.3.10. Test 10
2.3.11. Test 11
2.4. Still having troubles?
3. Integrating MS Windows networks with Samba
3.1. Agenda
3.2. Name Resolution in a pure Unix/Linux world
3.2.1. /etc/hosts
3.2.2. /etc/resolv.conf
3.2.3. /etc/host.conf
3.2.4. /etc/nsswitch.conf
3.3. Name resolution as used within MS Windows networking
3.3.1. The NetBIOS Name Cache
3.3.2. The LMHOSTS file
3.3.3. HOSTS file
3.3.4. DNS Lookup
3.3.5. WINS Lookup
3.4. How browsing functions and how to deploy stable and -dependable browsing using Samba
3.5. MS Windows security options and how to configure -Samba for seemless integration
3.5.1. Use MS Windows NT as an authentication server
3.5.2. Make Samba a member of an MS Windows NT security domain
3.5.3. Configure Samba as an authentication server
3.6. Conclusions
4. Configuring PAM for distributed but centrally -managed authentication
4.1. Samba and PAM
4.2. Distributed Authentication
4.3. PAM Configuration in smb.conf
5. Hosting a Microsoft Distributed File System tree on Samba
5.1. Instructions
5.1.1. Notes
6. UNIX Permission Bits and Windows NT Access Control Lists
6.1. Viewing and changing UNIX permissions using the NT - security dialogs
6.2. How to view file security on a Samba share
6.3. Viewing file ownership
6.4. Viewing file or directory permissions
6.4.1. File Permissions
6.4.2. Directory Permissions
6.5. Modifying file or directory permissions
6.6. Interaction with the standard Samba create mask - parameters
6.7. Interaction with the standard Samba file attribute - mapping
7. Printing Support in Samba 2.2.x
7.1. Introduction
7.2. Configuration
7.2.1. Creating [print$]
7.2.2. Setting Drivers for Existing Printers
7.2.3. Support a large number of printers
7.2.4. Adding New Printers via the Windows NT APW
7.2.5. Samba and Printer Ports
7.3. The Imprints Toolset
7.3.1. What is Imprints?
7.3.2. Creating Printer Driver Packages
7.3.3. The Imprints server
7.3.4. The Installation Client
7.4. Migration to from Samba 2.0.x to 2.2.x
8. Debugging Printing Problems
8.1. Introduction
8.2. Debugging printer problems
8.3. What printers do I have?
8.4. Setting up printcap and print servers
8.5. Job sent, no output
8.6. Job sent, strange output
8.7. Raw PostScript printed
8.8. Advanced Printing
8.9. Real debugging
9. Security levels
9.1. Introduction
9.2. More complete description of security levels
10. security = domain in Samba 2.x
10.1. Joining an NT Domain with Samba 2.2
10.2. Samba and Windows 2000 Domains
10.3. Why is this better than security = server?
11. Unified Logons between Windows NT and UNIX using Winbind
11.1. Abstract
11.2. Introduction
11.3. What Winbind Provides
11.3.1. Target Uses
11.4. How Winbind Works
11.4.1. Microsoft Remote Procedure Calls
11.4.2. Name Service Switch
11.4.3. Pluggable Authentication Modules
11.4.4. User and Group ID Allocation
11.4.5. Result Caching
11.5. Installation and Configuration
11.5.1. Introduction
11.5.2. Requirements
11.5.3. Testing Things Out
11.6. Limitations
11.7. Conclusion
12. How to Configure Samba 2.2 as a Primary Domain Controller
12.1. Prerequisite Reading
12.2. Background
12.3. Configuring the Samba Domain Controller
12.4. Creating Machine Trust Accounts and Joining Clients to the -Domain
12.4.1. Manual Creation of Machine Trust Accounts
12.4.2. "On-the-Fly" Creation of Machine Trust Accounts
12.4.3. Joining the Client to the Domain
12.5. Common Problems and Errors
12.6. System Policies and Profiles
12.7. What other help can I get?
12.8. Domain Control for Windows 9x/ME
12.8.1. Configuration Instructions: Network Logons
12.8.2. Configuration Instructions: Setting up Roaming User Profiles
12.9. DOMAIN_CONTROL.txt : Windows NT Domain Control & Samba
13. How to Act as a Backup Domain Controller in a Purely Samba Controlled Domain
13.1. Prerequisite Reading
13.2. Background
13.3. What qualifies a Domain Controller on the network?
13.3.1. How does a Workstation find its domain controller?
13.3.2. When is the PDC needed?
13.4. Can Samba be a Backup Domain Controller?
13.5. How do I set up a Samba BDC?
13.5.1. How do I replicate the smbpasswd file?
14. Storing Samba's User/Machine Account information in an LDAP Directory
14.1. Purpose
14.2. Introduction
14.3. Supported LDAP Servers
14.4. Schema and Relationship to the RFC 2307 posixAccount
14.5. Configuring Samba with LDAP
14.5.1. OpenLDAP configuration
14.5.2. Configuring Samba
14.6. Accounts and Groups management
14.7. Security and sambaAccount
14.8. LDAP specials attributes for sambaAccounts
14.9. Example LDIF Entries for a sambaAccount
14.10. Comments
15. Improved browsing in samba
15.1. Overview of browsing
15.2. Browsing support in samba
15.3. Problem resolution
15.4. Browsing across subnets
15.4.1. How does cross subnet browsing work ?
15.5. Setting up a WINS server
15.6. Setting up Browsing in a WORKGROUP
15.7. Setting up Browsing in a DOMAIN
15.8. Forcing samba to be the master
15.9. Making samba the domain master
15.10. Note about broadcast addresses
15.11. Multiple interfaces
16. Samba performance issues
16.1. Comparisons
16.2. Oplocks
16.2.1. Overview
16.2.2. Level2 Oplocks
16.2.3. Old 'fake oplocks' option - deprecated
16.3. Socket options
16.4. Read size
16.5. Max xmit
16.6. Locking
16.7. Share modes
16.8. Log level
16.9. Wide lines
16.10. Read raw
16.11. Write raw
16.12. Read prediction
16.13. Memory mapping
16.14. Slow Clients
16.15. Slow Logins
16.16. Client tuning
16.17. My Results
17. Samba and other CIFS clients
17.1. Macintosh clients?
17.2. OS2 Client
17.2.1. How can I configure OS/2 Warp Connect or - OS/2 Warp 4 as a client for Samba?
17.2.2. How can I configure OS/2 Warp 3 (not Connect), - OS/2 1.2, 1.3 or 2.x for Samba?
17.2.3. Are there any other issues when OS/2 (any version) - is used as a client?
17.2.4. How do I get printer driver download working - for OS/2 clients?
17.3. Windows for Workgroups
17.3.1. Use latest TCP/IP stack from Microsoft
17.3.2. Delete .pwl files after password change
17.3.3. Configure WfW password handling
17.3.4. Case handling of passwords
17.4. Windows '95/'98
17.5. Windows 2000 Service Pack 2
18. HOWTO Access Samba source code via CVS
18.1. Introduction
18.2. CVS Access to samba.org
18.2.1. Access via CVSweb
18.2.2. Access via cvs
19. Reporting Bugs
19.1. Introduction
19.2. General info
19.3. Debug levels
19.4. Internal errors
19.5. Attaching to a running process
19.6. Patches
20. Group mapping HOWTO
21. Portability
21.1. HPUX
21.2. SCO Unix
21.3. DNIX
  Next
  How to Install and Test SAMBA
\ No newline at end of file diff --git a/docs/htmldocs/Samba-PDC-HOWTO.html b/docs/htmldocs/Samba-PDC-HOWTO.html deleted file mode 100644 index ae4f545800..0000000000 --- a/docs/htmldocs/Samba-PDC-HOWTO.html +++ /dev/null @@ -1,2284 +0,0 @@ -How to Configure Samba 2.2 as a Primary Domain Controller

How to Configure Samba 2.2 as a Primary Domain Controller

Prerequisite Reading

Before you continue reading in this chapter, please make sure -that you are comfortable with configuring basic files services -in smb.conf and how to enable and administer password -encryption in Samba. Theses two topics are covered in the -smb.conf(5) -manpage and the Encryption chapter -of this HOWTO Collection.

Background

Note: Author's Note: This document is a combination -of David Bannon's "Samba 2.2 PDC HOWTO" and "Samba NT Domain FAQ". -Both documents are superseded by this one.

Versions of Samba prior to release 2.2 had marginal capabilities to act -as a Windows NT 4.0 Primary Domain Controller - -(PDC). With Samba 2.2.0, we are proud to announce official support for -Windows NT 4.0-style domain logons from Windows NT 4.0 and Windows -2000 clients. This article outlines the steps -necessary for configuring Samba as a PDC. It is necessary to have a -working Samba server prior to implementing the PDC functionality. If -you have not followed the steps outlined in UNIX_INSTALL.html, please make sure -that your server is configured correctly before proceeding. Another -good resource in the smb.conf(5) man -page. The following functionality should work in 2.2:

  • domain logons for Windows NT 4.0/2000 clients. -

  • placing a Windows 9x client in user level security -

  • retrieving a list of users and groups from a Samba PDC to - Windows 9x/NT/2000 clients -

  • roving (roaming) user profiles -

  • Windows NT 4.0-style system policies -

The following pieces of functionality are not included in the 2.2 release:

  • Windows NT 4 domain trusts -

  • SAM replication with Windows NT 4.0 Domain Controllers - (i.e. a Samba PDC and a Windows NT BDC or vice versa) -

  • Adding users via the User Manager for Domains -

  • Acting as a Windows 2000 Domain Controller (i.e. Kerberos and - Active Directory) -

Please note that Windows 9x clients are not true members of a domain -for reasons outlined in this article. Therefore the protocol for -support Windows 9x-style domain logons is completely different -from NT4 domain logons and has been officially supported for some -time.

Implementing a Samba PDC can basically be divided into 2 broad -steps.

  1. Configuring the Samba PDC -

  2. Creating machine trust accounts and joining clients - to the domain -

There are other minor details such as user profiles, system -policies, etc... However, these are not necessarily specific -to a Samba PDC as much as they are related to Windows NT networking -concepts. They will be mentioned only briefly here.

Configuring the Samba Domain Controller

The first step in creating a working Samba PDC is to -understand the parameters necessary in smb.conf. I will not -attempt to re-explain the parameters here as they are more that -adequately covered in the smb.conf -man page. For convenience, the parameters have been -linked with the actual smb.conf description.

Here is an example smb.conf for acting as a PDC:

[global]
-    ; Basic server settings
-    netbios name = POGO
-    workgroup = NARNIA
-
-    ; we should act as the domain and local master browser
-    os level = 64
-    preferred master = yes
-    domain master = yes
-    local master = yes
-    
-    ; security settings (must user security = user)
-    security = user
-    
-    ; encrypted passwords are a requirement for a PDC
-    encrypt passwords = yes
-    
-    ; support domain logons
-    domain logons = yes
-    
-    ; where to store user profiles?
-    logon path = \\%N\profiles\%u
-    
-    ; where is a user's home directory and where should it
-    ; be mounted at?
-    logon drive = H:
-    logon home = \\homeserver\%u
-    
-    ; specify a generic logon script for all users
-    ; this is a relative **DOS** path to the [netlogon] share
-    logon script = logon.cmd
-
-; necessary share for domain controller
-[netlogon]
-    path = /usr/local/samba/lib/netlogon
-    read only = yes
-    write list = ntadmin
-    
-; share for storing user profiles
-[profiles]
-    path = /export/smb/ntprofile
-    read only = no
-    create mask = 0600
-    directory mask = 0700

There are a couple of points to emphasize in the above configuration.

  • Encrypted passwords must be enabled. For more details on how - to do this, refer to ENCRYPTION.html. -

  • The server must support domain logons and a - [netlogon] share -

  • The server must be the domain master browser in order for Windows - client to locate the server as a DC. Please refer to the various - Network Browsing documentation included with this distribution for - details. -

As Samba 2.2 does not offer a complete implementation of group mapping -between Windows NT groups and Unix groups (this is really quite -complicated to explain in a short space), you should refer to the -domain admin -group smb.conf parameter for information of creating "Domain -Admins" style accounts.

Creating Machine Trust Accounts and Joining Clients to the -Domain

A machine trust account is a Samba account that is used to -authenticate a client machine (rather than a user) to the Samba -server. In Windows terminology, this is known as a "Computer -Account."

The password of a machine trust account acts as the shared secret for -secure communication with the Domain Controller. This is a security -feature to prevent an unauthorized machine with the same NetBIOS name -from joining the domain and gaining access to domain user/group -accounts. Windows NT and 2000 clients use machine trust accounts, but -Windows 9x clients do not. Hence, a Windows 9x client is never a true -member of a domain because it does not possess a machine trust -account, and thus has no shared secret with the domain controller.

A Windows PDC stores each machine trust account in the Windows -Registry. A Samba PDC, however, stores each machine trust account -in two parts, as follows: - -

  • A Samba account, stored in the same location as user - LanMan and NT password hashes (currently - smbpasswd). The Samba account - possesses and uses only the NT password hash.

  • A corresponding Unix account, typically stored in - /etc/passwd. (Future releases will alleviate the need to - create /etc/passwd entries.)

There are two ways to create machine trust accounts:

  • Manual creation. Both the Samba and corresponding - Unix account are created by hand.

  • "On-the-fly" creation. The Samba machine trust - account is automatically created by Samba at the time the client - is joined to the domain. (For security, this is the - recommended method.) The corresponding Unix account may be - created automatically or manually.

Manual Creation of Machine Trust Accounts

The first step in manually creating a machine trust account is to -manually create the corresponding Unix account in -/etc/passwd. This can be done using -vipw or other 'add user' command that is normally -used to create new Unix accounts. The following is an example for a -Linux based Samba server:

root# /usr/sbin/useradd -g 100 -d /dev/null -c "machine -nickname" -s /bin/false machine_name$

root# passwd -l machine_name$

The /etc/passwd entry will list the machine name -with a "$" appended, won't have a password, will have a null shell and no -home directory. For example a machine named 'doppy' would have an -/etc/passwd entry like this:

doppy$:x:505:501:machine_nickname:/dev/null:/bin/false

Above, machine_nickname can be any -descriptive name for the client, i.e., BasementComputer. -machine_name absolutely must be the NetBIOS -name of the client to be joined to the domain. The "$" must be -appended to the NetBIOS name of the client or Samba will not recognize -this as a machine trust account.

Now that the corresponding Unix account has been created, the next step is to create -the Samba account for the client containing the well-known initial -machine trust account password. This can be done using the smbpasswd(8) command -as shown here:

root# smbpasswd -a -m machine_name

where machine_name is the machine's NetBIOS -name. The RID of the new machine account is generated from the UID of -the corresponding Unix account.

Join the client to the domain immediately

Manually creating a machine trust account using this method is the - equivalent of creating a machine trust account on a Windows NT PDC using - the "Server Manager". From the time at which the account is created - to the time which the client joins the domain and changes the password, - your domain is vulnerable to an intruder joining your domain using a - a machine with the same NetBIOS name. A PDC inherently trusts - members of the domain and will serve out a large degree of user - information to such clients. You have been warned! -

"On-the-Fly" Creation of Machine Trust Accounts

The second (and recommended) way of creating machine trust accounts is -simply to allow the Samba server to create them as needed when the client -is joined to the domain.

Since each Samba machine trust account requires a corresponding -Unix account, a method for automatically creating the -Unix account is usually supplied; this requires configuration of the -add user script -option in smb.conf. This -method is not required, however; corresponding Unix accounts may also -be created manually.

Below is an example for a RedHat 6.2 Linux system.

[global]
-   # <...remainder of parameters...>
-   add user script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u

Joining the Client to the Domain

The procedure for joining a client to the domain varies with the -version of Windows.

  • Windows 2000

    When the user elects to join the client to a domain, Windows prompts for - an account and password that is privileged to join the domain. A - Samba administrative account (i.e., a Samba account that has root - privileges on the Samba server) must be entered here; the - operation will fail if an ordinary user account is given. - The password for this account should be - set to a different password than the associated - /etc/passwd entry, for security - reasons.

    The session key of the Samba administrative account acts as an - encryption key for setting the password of the machine trust - account. The machine trust account will be created on-the-fly, or - updated if it already exists.

  • Windows NT

    If the machine trust account was created manually, on the - Identification Changes menu enter the domain name, but do not - check the box "Create a Computer Account in the Domain." In this case, - the existing machine trust account is used to join the machine to - the domain.

    If the machine trust account is to be created - on-the-fly, on the Identification Changes menu enter the domain - name, and check the box "Create a Computer Account in the Domain." In - this case, joining the domain proceeds as above for Windows 2000 - (i.e., you must supply a Samba administrative account when - prompted).

Common Problems and Errors

  • I cannot include a '$' in a machine name. -

    A 'machine name' in (typically) /etc/passwd - of the machine name with a '$' appended. FreeBSD (and other BSD - systems?) won't create a user with a '$' in their name. -

    The problem is only in the program used to make the entry, once - made, it works perfectly. So create a user without the '$' and - use vipw to edit the entry, adding the '$'. Or create - the whole entry with vipw if you like, make sure you use a - unique User ID ! -

  • I get told "You already have a connection to the Domain...." - or "Cannot join domain, the credentials supplied conflict with an - existing set.." when creating a machine trust account. -

    This happens if you try to create a machine trust account from the - machine itself and already have a connection (e.g. mapped drive) - to a share (or IPC$) on the Samba PDC. The following command - will remove all network drive connections: -

    C:\WINNT\> net use * /d -

    Further, if the machine is a already a 'member of a workgroup' that - is the same name as the domain you are joining (bad idea) you will - get this message. Change the workgroup name to something else, it - does not matter what, reboot, and try again. -

  • The system can not log you on (C000019B).... -

    I joined the domain successfully but after upgrading - to a newer version of the Samba code I get the message, "The system - can not log you on (C000019B), Please try a gain or consult your - system administrator" when attempting to logon. -

    This occurs when the domain SID stored in - private/WORKGROUP.SID is - changed. For example, you remove the file and smbd automatically - creates a new one. Or you are swapping back and forth between - versions 2.0.7, TNG and the HEAD branch code (not recommended). The - only way to correct the problem is to restore the original domain - SID or remove the domain client from the domain and rejoin. -

  • The machine trust account for this computer either does not - exist or is not accessible. -

    When I try to join the domain I get the message "The machine account - for this computer either does not exist or is not accessible". What's - wrong? -

    This problem is caused by the PDC not having a suitable machine trust account. - If you are using the add user script method to create - accounts then this would indicate that it has not worked. Ensure the domain - admin user system is working. -

    Alternatively if you are creating account entries manually then they - have not been created correctly. Make sure that you have the entry - correct for the machine trust account in smbpasswd file on the Samba PDC. - If you added the account using an editor rather than using the smbpasswd - utility, make sure that the account name is the machine NetBIOS name - with a '$' appended to it ( i.e. computer_name$ ). There must be an entry - in both /etc/passwd and the smbpasswd file. Some people have reported - that inconsistent subnet masks between the Samba server and the NT - client have caused this problem. Make sure that these are consistent - for both client and server. -

  • When I attempt to login to a Samba Domain from a NT4/W2K workstation, - I get a message about my account being disabled. -

    This problem is caused by a PAM related bug in Samba 2.2.0. This bug is - fixed in 2.2.1. Other symptoms could be unaccessible shares on - NT/W2K member servers in the domain or the following error in your smbd.log: - passdb/pampass.c:pam_account(268) PAM: UNKNOWN ERROR for User: %user% -

    At first be ensure to enable the useraccounts with smbpasswd -e - %user%, this is normally done, when you create an account. -

    In order to work around this problem in 2.2.0, configure the - account control flag in - /etc/pam.d/samba file as follows: - 

    	account required        pam_permit.so
-

    If you want to remain backward compatibility to samba 2.0.x use - pam_permit.so, it's also possible to use - pam_pwdb.so. There are some bugs if you try to - use pam_unix.so, if you need this, be ensure to use - the most recent version of this file. -

System Policies and Profiles

Much of the information necessary to implement System Policies and -Roving User Profiles in a Samba domain is the same as that for -implementing these same items in a Windows NT 4.0 domain. -You should read the white paper Implementing -Profiles and Policies in Windows NT 4.0 available from Microsoft.

Here are some additional details:

  • What about Windows NT Policy Editor? -

    To create or edit ntconfig.pol you must use - the NT Server Policy Editor, poledit.exe which - is included with NT Server but not NT Workstation. - There is a Policy Editor on a NTws - but it is not suitable for creating Domain Policies. - Further, although the Windows 95 - Policy Editor can be installed on an NT Workstation/Server, it will not - work with NT policies because the registry key that are set by the policy templates. - However, the files from the NT Server will run happily enough on an NTws. - You need poledit.exe, common.adm and winnt.adm. It is convenient - to put the two *.adm files in c:\winnt\inf which is where - the binary will look for them unless told otherwise. Note also that that - directory is 'hidden'. -

    The Windows NT policy editor is also included with the Service Pack 3 (and - later) for Windows NT 4.0. Extract the files using servicepackname /x, - i.e. that's Nt4sp6ai.exe /x for service pack 6a. The policy editor, - poledit.exe and the associated template files (*.adm) should - be extracted as well. It is also possible to downloaded the policy template - files for Office97 and get a copy of the policy editor. Another possible - location is with the Zero Administration Kit available for download from Microsoft. -

  • Can Win95 do Policies? -

    Install the group policy handler for Win9x to pick up group - policies. Look on the Win98 CD in \tools\reskit\netadmin\poledit. - Install group policies on a Win9x client by double-clicking - grouppol.inf. Log off and on again a couple of - times and see if Win98 picks up group policies. Unfortunately this needs - to be done on every Win9x machine that uses group policies.... -

    If group policies don't work one reports suggests getting the updated - (read: working) grouppol.dll for Windows 9x. The group list is grabbed - from /etc/group. -

  • How do I get 'User Manager' and 'Server Manager' -

    Since I don't need to buy an NT Server CD now, how do I get - the 'User Manager for Domains', the 'Server Manager'? -

    Microsoft distributes a version of these tools called nexus for - installation on Windows 95 systems. The tools set includes -

    • Server Manager

    • User Manager for Domains

    • Event Viewer

    Click here to download the archived file ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE -

    The Windows NT 4.0 version of the 'User Manager for - Domains' and 'Server Manager' are available from Microsoft via ftp - from ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE -

What other help can I get?

There are many sources of information available in the form -of mailing lists, RFC's and documentation. The docs that come -with the samba distribution contain very good explanations of -general SMB topics such as browsing.

  • What are some diagnostics tools I can use to debug the domain logon - process and where can I find them? -

    One of the best diagnostic tools for debugging problems is Samba itself. - You can use the -d option for both smbd and nmbd to specify what - 'debug level' at which to run. See the man pages on smbd, nmbd and - smb.conf for more information on debugging options. The debug - level can range from 1 (the default) to 10 (100 for debugging passwords). -

    Another helpful method of debugging is to compile samba using the - gcc -g flag. This will include debug - information in the binaries and allow you to attach gdb to the - running smbd / nmbd process. In order to attach gdb to an smbd - process for an NT workstation, first get the workstation to make the - connection. Pressing ctrl-alt-delete and going down to the domain box - is sufficient (at least, on the first time you join the domain) to - generate a 'LsaEnumTrustedDomains'. Thereafter, the workstation - maintains an open connection, and therefore there will be an smbd - process running (assuming that you haven't set a really short smbd - idle timeout) So, in between pressing ctrl alt delete, and actually - typing in your password, you can gdb attach and continue. -

    Some useful samba commands worth investigating: -

    • testparam | more

    • smbclient -L //{netbios name of server}

    An SMB enabled version of tcpdump is available from - http://www.tcpdup.org/. - Ethereal, another good packet sniffer for Unix and Win32 - hosts, can be downloaded from http://www.ethereal.com. -

    For tracing things on the Microsoft Windows NT, Network Monitor - (aka. netmon) is available on the Microsoft Developer Network CD's, - the Windows NT Server install CD and the SMS CD's. The version of - netmon that ships with SMS allows for dumping packets between any two - computers (i.e. placing the network interface in promiscuous mode). - The version on the NT Server install CD will only allow monitoring - of network traffic directed to the local NT box and broadcasts on the - local subnet. Be aware that Ethereal can read and write netmon - formatted files. -

  • How do I install 'Network Monitor' on an NT Workstation - or a Windows 9x box? -

    Installing netmon on an NT workstation requires a couple - of steps. The following are for installing Netmon V4.00.349, which comes - with Microsoft Windows NT Server 4.0, on Microsoft Windows NT - Workstation 4.0. The process should be similar for other version of - Windows NT / Netmon. You will need both the Microsoft Windows - NT Server 4.0 Install CD and the Workstation 4.0 Install CD. -

    Initially you will need to install 'Network Monitor Tools and Agent' - on the NT Server. To do this -

    • Goto Start - Settings - Control Panel - - Network - Services - Add

    • Select the 'Network Monitor Tools and Agent' and - click on 'OK'.

    • Click 'OK' on the Network Control Panel. -

    • Insert the Windows NT Server 4.0 install CD - when prompted.

    At this point the Netmon files should exist in - %SYSTEMROOT%\System32\netmon\*.*. - Two subdirectories exist as well, parsers\ - which contains the necessary DLL's for parsing the netmon packet - dump, and captures\. -

    In order to install the Netmon tools on an NT Workstation, you will - first need to install the 'Network Monitor Agent' from the Workstation - install CD. -

    • Goto Start - Settings - Control Panel - - Network - Services - Add

    • Select the 'Network Monitor Agent' and click - on 'OK'.

    • Click 'OK' on the Network Control Panel. -

    • Insert the Windows NT Workstation 4.0 install - CD when prompted.

    Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.* - to %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set - permissions as you deem appropriate for your site. You will need - administrative rights on the NT box to run netmon. -

    To install Netmon on a Windows 9x box install the network monitor agent - from the Windows 9x CD (\admin\nettools\netmon). There is a readme - file located with the netmon driver files on the CD if you need - information on how to do this. Copy the files from a working - Netmon installation. -

  • The following is a list if helpful URLs and other links: -

  • How do I get help from the mailing lists? -

    There are a number of Samba related mailing lists. Go to http://samba.org, click on your nearest mirror - and then click on Support and then click on Samba related mailing lists. -

    For questions relating to Samba TNG go to - http://www.samba-tng.org/ - It has been requested that you don't post questions about Samba-TNG to the - main stream Samba lists.

    If you post a message to one of the lists please observe the following guide lines : -

    • Always remember that the developers are volunteers, they are - not paid and they never guarantee to produce a particular feature at - a particular time. Any time lines are 'best guess' and nothing more. -

    • Always mention what version of samba you are using and what - operating system its running under. You should probably list the - relevant sections of your smb.conf file, at least the options - in [global] that affect PDC support.

    • In addition to the version, if you obtained Samba via - CVS mention the date when you last checked it out.

    • Try and make your question clear and brief, lots of long, - convoluted questions get deleted before they are completely read ! - Don't post html encoded messages (if you can select colour or font - size its html).

    • If you run one of those nifty 'I'm on holidays' things when - you are away, make sure its configured to not answer mailing lists. -

    • Don't cross post. Work out which is the best list to post to - and see what happens, i.e. don't post to both samba-ntdom and samba-technical. - Many people active on the lists subscribe to more - than one list and get annoyed to see the same message two or more times. - Often someone will see a message and thinking it would be better dealt - with on another, will forward it on for you.

    • You might include partial - log files written at a debug level set to as much as 20. - Please don't send the entire log but enough to give the context of the - error messages.

    • (Possibly) If you have a complete netmon trace ( from the opening of - the pipe to the error ) you can send the *.CAP file as well.

    • Please think carefully before attaching a document to an email. - Consider pasting the relevant parts into the body of the message. The samba - mailing lists go to a huge number of people, do they all need a copy of your - smb.conf in their attach directory?

  • How do I get off the mailing lists? -

    To have your name removed from a samba mailing list, go to the - same place you went to to get on it. Go to http://lists.samba.org, - click on your nearest mirror and then click on Support and - then click on Samba related mailing lists. Or perhaps see - here -

    Please don't post messages to the list asking to be removed, you will just - be referred to the above address (unless that process failed in some way...) -

Domain Control for Windows 9x/ME

Note: The following section contains much of the original -DOMAIN.txt file previously included with Samba. Much of -the material is based on what went into the book Special -Edition, Using Samba, by Richard Sharpe.

A domain and a workgroup are exactly the same thing in terms of network -browsing. The difference is that a distributable authentication -database is associated with a domain, for secure login access to a -network. Also, different access rights can be granted to users if they -successfully authenticate against a domain logon server (NT server and -other systems based on NT server support this, as does at least Samba TNG now).

The SMB client logging on to a domain has an expectation that every other -server in the domain should accept the same authentication information. -Network browsing functionality of domains and workgroups is -identical and is explained in BROWSING.txt. It should be noted, that browsing -is totally orthogonal to logon support.

Issues related to the single-logon network model are discussed in this -section. Samba supports domain logons, network logon scripts, and user -profiles for MS Windows for workgroups and MS Windows 9X/ME clients -which will be the focus of this section.

When an SMB client in a domain wishes to logon it broadcast requests for a -logon server. The first one to reply gets the job, and validates its -password using whatever mechanism the Samba administrator has installed. -It is possible (but very stupid) to create a domain where the user -database is not shared between servers, i.e. they are effectively workgroup -servers advertising themselves as participating in a domain. This -demonstrates how authentication is quite different from but closely -involved with domains.

Using these features you can make your clients verify their logon via -the Samba server; make clients run a batch file when they logon to -the network and download their preferences, desktop and start menu.

Before launching into the configuration instructions, it is -worthwhile lookingat how a Windows 9x/ME client performs a logon:

  1. The client broadcasts (to the IP broadcast address of the subnet it is in) - a NetLogon request. This is sent to the NetBIOS name DOMAIN<1c> at the - NetBIOS layer. The client chooses the first response it receives, which - contains the NetBIOS name of the logon server to use in the format of - \\SERVER. -

  2. The client then connects to that server, logs on (does an SMBsessetupX) and - then connects to the IPC$ share (using an SMBtconX). -

  3. The client then does a NetWkstaUserLogon request, which retrieves the name - of the user's logon script. -

  4. The client then connects to the NetLogon share and searches for this - and if it is found and can be read, is retrieved and executed by the client. - After this, the client disconnects from the NetLogon share. -

  5. The client then sends a NetUserGetInfo request to the server, to retrieve - the user's home share, which is used to search for profiles. Since the - response to the NetUserGetInfo request does not contain much more - the user's home share, profiles for Win9X clients MUST reside in the user - home directory. -

  6. The client then connects to the user's home share and searches for the - user's profile. As it turns out, you can specify the user's home share as - a sharename and path. For example, \\server\fred\.profile. - If the profiles are found, they are implemented. -

  7. The client then disconnects from the user's home share, and reconnects to - the NetLogon share and looks for CONFIG.POL, the policies file. If this is - found, it is read and implemented. -

Configuration Instructions: Network Logons

The main difference between a PDC and a Windows 9x logon -server configuration is that

  • Password encryption is not required for a Windows 9x logon server.

  • Windows 9x/ME clients do not possess machine trust accounts.

Therefore, a Samba PDC will also act as a Windows 9x logon -server.

security mode and master browsers

There are a few comments to make in order to tie up some -loose ends. There has been much debate over the issue of whether -or not it is ok to configure Samba as a Domain Controller in security -modes other than USER. The only security mode -which will not work due to technical reasons is SHARE -mode security. DOMAIN and SERVER -mode security is really just a variation on SMB user level security.

Actually, this issue is also closely tied to the debate on whether -or not Samba must be the domain master browser for its workgroup -when operating as a DC. While it may technically be possible -to configure a server as such (after all, browsing and domain logons -are two distinctly different functions), it is not a good idea to -so. You should remember that the DC must register the DOMAIN#1b NetBIOS -name. This is the name used by Windows clients to locate the DC. -Windows clients do not distinguish between the DC and the DMB. -For this reason, it is very wise to configure the Samba DC as the DMB.

Now back to the issue of configuring a Samba DC to use a mode other -than "security = user". If a Samba host is configured to use -another SMB server or DC in order to validate user connection -requests, then it is a fact that some other machine on the network -(the "password server") knows more about user than the Samba host. -99% of the time, this other host is a domain controller. Now -in order to operate in domain mode security, the "workgroup" parameter -must be set to the name of the Windows NT domain (which already -has a domain controller, right?)

Therefore configuring a Samba box as a DC for a domain that -already by definition has a PDC is asking for trouble. -Therefore, you should always configure the Samba DC to be the DMB -for its domain.

Configuration Instructions: Setting up Roaming User Profiles

Warning

NOTE! Roaming profiles support is different -for Win9X and WinNT.

Before discussing how to configure roaming profiles, it is useful to see how -Win9X and WinNT clients implement these features.

Win9X clients send a NetUserGetInfo request to the server to get the user's -profiles location. However, the response does not have room for a separate -profiles location field, only the user's home share. This means that Win9X -profiles are restricted to being in the user's home directory.

WinNT clients send a NetSAMLogon RPC request, which contains many fields, -including a separate field for the location of the user's profiles. -This means that support for profiles is different for Win9X and WinNT.

Windows NT Configuration

To support WinNT clients, in the [global] section of smb.conf set the -following (for example):

logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath

The default for this option is \\%N\%U\profile, namely -\\sambaserver\username\profile. The \\N%\%U service is created -automatically by the [homes] service. -If you are using a samba server for the profiles, you _must_ make the -share specified in the logon path browseable.

Note: [lkcl 26aug96 - we have discovered a problem where Windows clients can -maintain a connection to the [homes] share in between logins. The -[homes] share must NOT therefore be used in a profile path.]

Windows 9X Configuration

To support Win9X clients, you must use the "logon home" parameter. Samba has -now been fixed so that "net use/home" now works as well, and it, too, relies -on the "logon home" parameter.

By using the logon home parameter, you are restricted to putting Win9X -profiles in the user's home directory. But wait! There is a trick you -can use. If you set the following in the [global] section of your -smb.conf file:

logon home = \\%L\%U\.profiles

then your Win9X clients will dutifully put their clients in a subdirectory -of your home directory called .profiles (thus making them hidden).

Not only that, but 'net use/home' will also work, because of a feature in -Win9X. It removes any directory stuff off the end of the home directory area -and only uses the server and share portion. That is, it looks like you -specified \\%L\%U for "logon home".

Win9X and WinNT Configuration

You can support profiles for both Win9X and WinNT clients by setting both the -"logon home" and "logon path" parameters. For example:

logon home = \\%L\%U\.profiles
-logon path = \\%L\profiles\%U

Note: I have not checked what 'net use /home' does on NT when "logon home" is -set as above.

Windows 9X Profile Setup

When a user first logs in on Windows 9X, the file user.DAT is created, -as are folders "Start Menu", "Desktop", "Programs" and "Nethood". -These directories and their contents will be merged with the local -versions stored in c:\windows\profiles\username on subsequent logins, -taking the most recent from each. You will need to use the [global] -options "preserve case = yes", "short preserve case = yes" and -"case sensitive = no" in order to maintain capital letters in shortcuts -in any of the profile folders.

The user.DAT file contains all the user's preferences. If you wish to -enforce a set of preferences, rename their user.DAT file to user.MAN, -and deny them write access to this file.

  1. On the Windows 95 machine, go to Control Panel | Passwords and - select the User Profiles tab. Select the required level of - roaming preferences. Press OK, but do _not_ allow the computer - to reboot. -

  2. On the Windows 95 machine, go to Control Panel | Network | - Client for Microsoft Networks | Preferences. Select 'Log on to - NT Domain'. Then, ensure that the Primary Logon is 'Client for - Microsoft Networks'. Press OK, and this time allow the computer - to reboot. -

Under Windows 95, Profiles are downloaded from the Primary Logon. -If you have the Primary Logon as 'Client for Novell Networks', then -the profiles and logon script will be downloaded from your Novell -Server. If you have the Primary Logon as 'Windows Logon', then the -profiles will be loaded from the local machine - a bit against the -concept of roaming profiles, if you ask me.

You will now find that the Microsoft Networks Login box contains -[user, password, domain] instead of just [user, password]. Type in -the samba server's domain name (or any other domain known to exist, -but bear in mind that the user will be authenticated against this -domain and profiles downloaded from it, if that domain logon server -supports it), user name and user's password.

Once the user has been successfully validated, the Windows 95 machine -will inform you that 'The user has not logged on before' and asks you -if you wish to save the user's preferences? Select 'yes'.

Once the Windows 95 client comes up with the desktop, you should be able -to examine the contents of the directory specified in the "logon path" -on the samba server and verify that the "Desktop", "Start Menu", -"Programs" and "Nethood" folders have been created.

These folders will be cached locally on the client, and updated when -the user logs off (if you haven't made them read-only by then :-). -You will find that if the user creates further folders or short-cuts, -that the client will merge the profile contents downloaded with the -contents of the profile directory already on the local client, taking -the newest folders and short-cuts from each set.

If you have made the folders / files read-only on the samba server, -then you will get errors from the w95 machine on logon and logout, as -it attempts to merge the local and the remote profile. Basically, if -you have any errors reported by the w95 machine, check the Unix file -permissions and ownership rights on the profile directory contents, -on the samba server.

If you have problems creating user profiles, you can reset the user's -local desktop cache, as shown below. When this user then next logs in, -they will be told that they are logging in "for the first time".

  1. instead of logging in under the [user, password, domain] dialog, - press escape. -

  2. run the regedit.exe program, and look in: -

    HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList -

    you will find an entry, for each user, of ProfilePath. Note the - contents of this key (likely to be c:\windows\profiles\username), - then delete the key ProfilePath for the required user. -

    [Exit the registry editor]. -

  3. WARNING - before deleting the contents of the - directory listed in - the ProfilePath (this is likely to be c:\windows\profiles\username), - ask them if they have any important files stored on their desktop - or in their start menu. delete the contents of the directory - ProfilePath (making a backup if any of the files are needed). -

    This will have the effect of removing the local (read-only hidden - system file) user.DAT in their profile directory, as well as the - local "desktop", "nethood", "start menu" and "programs" folders. -

  4. search for the user's .PWL password-caching file in the c:\windows - directory, and delete it. -

  5. log off the windows 95 client. -

  6. check the contents of the profile path (see "logon path" described - above), and delete the user.DAT or user.MAN file for the user, - making a backup if required. -

If all else fails, increase samba's debug log levels to between 3 and 10, -and / or run a packet trace program such as tcpdump or netmon.exe, and -look for any error reports.

If you have access to an NT server, then first set up roaming profiles -and / or netlogons on the NT server. Make a packet trace, or examine -the example packet traces provided with NT server, and see what the -differences are with the equivalent samba trace.

Windows NT Workstation 4.0

When a user first logs in to a Windows NT Workstation, the profile -NTuser.DAT is created. The profile location can be now specified -through the "logon path" parameter.

Note: [lkcl 10aug97 - i tried setting the path to -\\samba-server\homes\profile, and discovered that this fails because -a background process maintains the connection to the [homes] share -which does _not_ close down in between user logins. you have to -have \\samba-server\%L\profile, where user is the username created -from the [homes] share].

There is a parameter that is now available for use with NT Profiles: -"logon drive". This should be set to "h:" or any other drive, and -should be used in conjunction with the new "logon home" parameter.

The entry for the NT 4.0 profile is a _directory_ not a file. The NT -help on profiles mentions that a directory is also created with a .PDS -extension. The user, while logging in, must have write permission to -create the full profile path (and the folder with the .PDS extension) -[lkcl 10aug97 - i found that the creation of the .PDS directory failed, -and had to create these manually for each user, with a shell script. -also, i presume, but have not tested, that the full profile path must -be browseable just as it is for w95, due to the manner in which they -attempt to create the full profile path: test existence of each path -component; create path component].

In the profile directory, NT creates more folders than 95. It creates -"Application Data" and others, as well as "Desktop", "Nethood", -"Start Menu" and "Programs". The profile itself is stored in a file -NTuser.DAT. Nothing appears to be stored in the .PDS directory, and -its purpose is currently unknown.

You can use the System Control Panel to copy a local profile onto -a samba server (see NT Help on profiles: it is also capable of firing -up the correct location in the System Control Panel for you). The -NT Help file also mentions that renaming NTuser.DAT to NTuser.MAN -turns a profile into a mandatory one.

Note: [lkcl 10aug97 - i notice that NT Workstation tells me that it is -downloading a profile from a slow link. whether this is actually the -case, or whether there is some configuration issue, as yet unknown, -that makes NT Workstation _think_ that the link is a slow one is a -matter to be resolved].

[lkcl 20aug97 - after samba digest correspondence, one user found, and -another confirmed, that profiles cannot be loaded from a samba server -unless "security = user" and "encrypt passwords = yes" (see the file -ENCRYPTION.txt) or "security = server" and "password server = ip.address. -of.yourNTserver" are used. Either of these options will allow the NT -workstation to access the samba server using LAN manager encrypted -passwords, without the user intervention normally required by NT -workstation for clear-text passwords].

[lkcl 25aug97 - more comments received about NT profiles: the case of -the profile _matters_. the file _must_ be called NTuser.DAT or, for -a mandatory profile, NTuser.MAN].

Windows NT Server

There is nothing to stop you specifying any path that you like for the -location of users' profiles. Therefore, you could specify that the -profile be stored on a samba server, or any other SMB server, as long as -that SMB server supports encrypted passwords.

Sharing Profiles between W95 and NT Workstation 4.0

Potentially outdated or incorrect material follows

I think this is all bogus, but have not deleted it. (Richard Sharpe)

The default logon path is \\%N\%U. NT Workstation will attempt to create -a directory "\\samba-server\username.PDS" if you specify the logon path -as "\\samba-server\username" with the NT User Manager. Therefore, you -will need to specify (for example) "\\samba-server\username\profile". -NT 4.0 will attempt to create "\\samba-server\username\profile.PDS", which -is more likely to succeed.

If you then want to share the same Start Menu / Desktop with W95, you will -need to specify "logon path = \\samba-server\username\profile" [lkcl 10aug97 -this has its drawbacks: i created a shortcut to telnet.exe, which attempts -to run from the c:\winnt\system32 directory. this directory is obviously -unlikely to exist on a Win95-only host].

If you have this set up correctly, you will find separate user.DAT and -NTuser.DAT files in the same profile directory.

Note: [lkcl 25aug97 - there are some issues to resolve with downloading of -NT profiles, probably to do with time/date stamps. i have found that -NTuser.DAT is never updated on the workstation after the first time that -it is copied to the local workstation profile directory. this is in -contrast to w95, where it _does_ transfer / update profiles correctly].

DOMAIN_CONTROL.txt : Windows NT Domain Control & Samba

Possibly Outdated Material

This appendix was originally authored by John H Terpstra of - the Samba Team and is included here for posterity. -

NOTE : -The term "Domain Controller" and those related to it refer to one specific -method of authentication that can underly an SMB domain. Domain Controllers -prior to Windows NT Server 3.1 were sold by various companies and based on -private extensions to the LAN Manager 2.1 protocol. Windows NT introduced -Microsoft-specific ways of distributing the user authentication database. -See DOMAIN.txt for examples of how Samba can participate in or create -SMB domains based on shared authentication database schemes other than the -Windows NT SAM.

Windows NT Server can be installed as either a plain file and print server -(WORKGROUP workstation or server) or as a server that participates in Domain -Control (DOMAIN member, Primary Domain controller or Backup Domain controller). -The same is true for OS/2 Warp Server, Digital Pathworks and other similar -products, all of which can participate in Domain Control along with Windows NT.

To many people these terms can be confusing, so let's try to clear the air.

Every Windows NT system (workstation or server) has a registry database. -The registry contains entries that describe the initialization information -for all services (the equivalent of Unix Daemons) that run within the Windows -NT environment. The registry also contains entries that tell application -software where to find dynamically loadable libraries that they depend upon. -In fact, the registry contains entries that describes everything that anything -may need to know to interact with the rest of the system.

The registry files can be located on any Windows NT machine by opening a -command prompt and typing:

C:\WINNT\> dir %SystemRoot%\System32\config

The environment variable %SystemRoot% value can be obtained by typing:

C:\WINNT>echo %SystemRoot%

The active parts of the registry that you may want to be familiar with are -the files called: default, system, software, sam and security.

In a domain environment, Microsoft Windows NT domain controllers participate -in replication of the SAM and SECURITY files so that all controllers within -the domain have an exactly identical copy of each.

The Microsoft Windows NT system is structured within a security model that -says that all applications and services must authenticate themselves before -they can obtain permission from the security manager to do what they set out -to do.

The Windows NT User database also resides within the registry. This part of -the registry contains the user's security identifier, home directory, group -memberships, desktop profile, and so on.

Every Windows NT system (workstation as well as server) will have its own -registry. Windows NT Servers that participate in Domain Security control -have a database that they share in common - thus they do NOT own an -independent full registry database of their own, as do Workstations and -plain Servers.

The User database is called the SAM (Security Access Manager) database and -is used for all user authentication as well as for authentication of inter- -process authentication (i.e. to ensure that the service action a user has -requested is permitted within the limits of that user's privileges).

The Samba team have produced a utility that can dump the Windows NT SAM into -smbpasswd format: see ENCRYPTION.txt for information on smbpasswd and -/pub/samba/pwdump on your nearest Samba mirror for the utility. This -facility is useful but cannot be easily used to implement SAM replication -to Samba systems.

Windows for Workgroups, Windows 95, and Windows NT Workstations and Servers -can participate in a Domain security system that is controlled by Windows NT -servers that have been correctly configured. Almost every domain will have -ONE Primary Domain Controller (PDC). It is desirable that each domain will -have at least one Backup Domain Controller (BDC).

The PDC and BDCs then participate in replication of the SAM database so that -each Domain Controlling participant will have an up to date SAM component -within its registry.

\ No newline at end of file diff --git a/docs/htmldocs/ads.html b/docs/htmldocs/ads.html new file mode 100644 index 0000000000..fc6b78b32c --- /dev/null +++ b/docs/htmldocs/ads.html @@ -0,0 +1,423 @@ + +Samba as a ADS domain member
SAMBA Project Documentation
PrevNext

Chapter 8. Samba as a ADS domain member

This is a VERY ROUGH guide to setting up the current (November 2001) +pre-alpha version of Samba 3.0 with kerberos authentication against a +Windows2000 KDC. The procedures listed here are likely to change as +the code develops.

Pieces you need before you begin: +

a Windows 2000 server.
samba 3.0 or higher.
the MIT kerberos development libraries (either install from the above sources or use a package). The heimdal libraries will not work.
the OpenLDAP development libraries.

8.1. Installing the required packages for Debian

On Debian you need to install the following packages: +

libkrb5-dev
krb5-user

8.2. Installing the required packages for RedHat

On RedHat this means you should have at least: +

krb5-workstation (for kinit)
krb5-libs (for linking with)
krb5-devel (because you are compiling from source)

in addition to the standard development environment.

Note that these are not standard on a RedHat install, and you may need +to get them off CD2.

8.3. Compile Samba

If your kerberos libraries are in a non-standard location then + remember to add the configure option --with-krb5=DIR.

After you run configure make sure that include/config.h contains + lines like this:

#define HAVE_KRB5 1
+#define HAVE_LDAP 1

If it doesn't then configure did not find your krb5 libraries or + your ldap libraries. Look in config.log to figure out why and fix + it.

Then compile and install Samba as usual. You must use at least the + following 3 options in smb.conf:

  realm = YOUR.KERBEROS.REALM
+  ads server = your.kerberos.server
+  security = ADS
+  encrypt passwords = yes

Strictly speaking, you can omit the realm name and you can use an IP + address for the ads server. In that case Samba will auto-detect these.

You do *not* need a smbpasswd file, although it won't do any harm + and if you have one then Samba will be able to fall back to normal + password security for older clients. I expect that the above + required options will change soon when we get better active + directory integration.

8.4. Setup your /etc/krb5.conf

The minimal configuration for krb5.conf is:

	[realms]
+    YOUR.KERBEROS.REALM = {
+	kdc = your.kerberos.server
+    }

Test your config by doing a "kinit USERNAME@REALM" and making sure that + your password is accepted by the Win2000 KDC.

NOTE: The realm must be uppercase.

You also must ensure that you can do a reverse DNS lookup on the IP +address of your KDC. Also, the name that this reverse lookup maps to +must either be the netbios name of the KDC (ie. the hostname with no +domain attached) or it can alternatively be the netbios name +followed by the realm.

The easiest way to ensure you get this right is to add a /etc/hosts +entry mapping the IP address of your KDC to its netbios name. If you +don't get this right then you will get a "local error" when you try +to join the realm.

If all you want is kerberos support in smbclient then you can skip +straight to step 5 now. Step 3 is only needed if you want kerberos +support in smbd.

8.5. Create the computer account

Do a "kinit" as a user that has authority to change arbitrary +passwords on the KDC ("Administrator" is a good choice). Then as a +user that has write permission on the Samba private directory +(usually root) run: +net ads join

8.5.1. Possible errors

"bash: kinit: command not found"

kinit is in the krb5-workstation RPM on RedHat systems, and is in /usr/kerberos/bin, so it won't be in the path until you log in again (or open a new terminal)

"ADS support not compiled in"

Samba must be reconfigured (remove config.cache) and recompiled (make clean all install) after the kerberos libs and headers are installed.

8.6. Test your server setup

On a Windows 2000 client try net use * \\server\share. You should +be logged in with kerberos without needing to know a password. If +this fails then run klist tickets. Did you get a ticket for the +server? Does it have an encoding type of DES-CBC-MD5 ?

8.7. Testing with smbclient

On your Samba server try to login to a Win2000 server or your Samba +server using smbclient and kerberos. Use smbclient as usual, but +specify the -k option to choose kerberos authentication.

8.8. Notes

You must change administrator password at least once after DC install, + to create the right encoding types

w2k doesn't seem to create the _kerberos._udp and _ldap._tcp in + their defaults DNS setup. Maybe fixed in service packs?

PrevHomeNext
How to Act as a Backup Domain Controller in a Purely Samba Controlled DomainUpSamba as a NT4 domain member
\ No newline at end of file diff --git a/docs/htmldocs/oplocks.html b/docs/htmldocs/oplocks.html new file mode 100644 index 0000000000..c926f32c14 --- /dev/null +++ b/docs/htmldocs/oplocks.html @@ -0,0 +1,208 @@ + +Oplocks
SAMBA Project Documentation
PrevNext

Chapter 3. Oplocks

3.1. What are oplocks?

When a client opens a file it can request an "oplock" or file +lease. This is (to simplify a bit) a guarentee that no one else +has the file open simultaneously. It allows the client to not +send any updates on the file to the server, thus reducing a +network file access to local access (once the file is in +client cache). An "oplock break" is when the server sends +a request to the client to flush all its changes back to +the server, so the file is in a consistent state for other +opens to succeed. If a client fails to respond to this +asynchronous request then the file can be corrupted. Hence +the "turn off oplocks" answer if people are having multi-user +file access problems.

Unless the kernel is "oplock aware" (SGI IRIX and Linux are +the only two UNIXes that are at the moment) then if a local +UNIX process accesses the file simultaneously then Samba +has no way of telling this is occuring, so the guarentee +to the client is broken. This can corrupt the file. Short +answer - it you have UNIX clients accessing the same file +as smbd locally or via NFS and you're not running Linux or +IRIX then turn off oplocks for that file or share.

"Share modes". These are modes of opening a file, that +guarentee an invarient - such as DENY_WRITE - which means +that if any other opens are requested with write access after +this current open has succeeded then they should be denied +with a "sharing violation" error message. Samba handles these +internally inside smbd. UNIX clients accessing the same file +ignore these invarients. Just proving that if you need simultaneous +file access from a Windows and UNIX client you *must* have an +application that is written to lock records correctly on both +sides. Few applications are written like this, and even fewer +are cross platform (UNIX and Windows) so in practice this isn't +much of a problem.

"Locking". This really means "byte range locking" - such as +lock 10 bytes at file offset 24 for write access. This is the +area in which well written UNIX and Windows apps will cooperate. +Windows locks (at least from NT or above) are 64-bit unsigned +offsets. UNIX locks are either 31 bit or 63 bit and are signed +(the top bit is used for the sign). Samba handles these by +first ensuring that all the Windows locks don't conflict (ie. +if other Windows clients have competing locks then just reject +immediately) - this allows us to support 64-bit Windows locks +on 32-bit filesystems. Secondly any locks that are valid are +then mapped onto UNIX fcntl byte range locks. These are the +locks that will be seen by UNIX processes. If there is a conflict +here the lock is rejected.

Note that if a client has an oplock then it "knows" that no +other client can have the file open so usually doesn't bother +to send to lock request to the server - this means once again +if you need to share files between UNIX and Windows processes +either use IRIX or Linux, or turn off oplocks for these +files/shares.

PrevHomeNext
Improved browsing in sambaUpQuick Cross Subnet Browsing / Cross Workgroup Browsing guide
\ No newline at end of file diff --git a/docs/htmldocs/p1346.html b/docs/htmldocs/p1346.html new file mode 100644 index 0000000000..e558561800 --- /dev/null +++ b/docs/htmldocs/p1346.html @@ -0,0 +1,917 @@ + +Optional configuration
SAMBA Project Documentation
PrevNext

III. Optional configuration

Introduction

Samba has several features that you might want or might not want to use. The chapters in this +part each cover one specific feature.

Table of Contents
10. Integrating MS Windows networks with Samba
10.1. Agenda
10.2. Name Resolution in a pure Unix/Linux world
10.2.1. /etc/hosts
10.2.2. /etc/resolv.conf
10.2.3. /etc/host.conf
10.2.4. /etc/nsswitch.conf
10.3. Name resolution as used within MS Windows networking
10.3.1. The NetBIOS Name Cache
10.3.2. The LMHOSTS file
10.3.3. HOSTS file
10.3.4. DNS Lookup
10.3.5. WINS Lookup
10.4. How browsing functions and how to deploy stable and +dependable browsing using Samba
10.5. MS Windows security options and how to configure +Samba for seemless integration
10.5.1. Use MS Windows NT as an authentication server
10.5.2. Make Samba a member of an MS Windows NT security domain
10.5.3. Configure Samba as an authentication server
10.6. Conclusions
11. UNIX Permission Bits and Windows NT Access Control Lists
11.1. Viewing and changing UNIX permissions using the NT + security dialogs
11.2. How to view file security on a Samba share
11.3. Viewing file ownership
11.4. Viewing file or directory permissions
11.4.1. File Permissions
11.4.2. Directory Permissions
11.5. Modifying file or directory permissions
11.6. Interaction with the standard Samba create mask + parameters
11.7. Interaction with the standard Samba file attribute + mapping
12. Configuring PAM for distributed but centrally +managed authentication
12.1. Samba and PAM
12.2. Distributed Authentication
12.3. PAM Configuration in smb.conf
13. Hosting a Microsoft Distributed File System tree on Samba
13.1. Instructions
13.1.1. Notes
14. Printing Support
14.1. Introduction
14.2. Configuration
14.2.1. Creating [print$]
14.2.2. Setting Drivers for Existing Printers
14.2.3. Support a large number of printers
14.2.4. Adding New Printers via the Windows NT APW
14.2.5. Samba and Printer Ports
14.3. The Imprints Toolset
14.3.1. What is Imprints?
14.3.2. Creating Printer Driver Packages
14.3.3. The Imprints server
14.3.4. The Installation Client
14.4. Diagnosis
14.4.1. Introduction
14.4.2. Debugging printer problems
14.4.3. What printers do I have?
14.4.4. Setting up printcap and print servers
14.4.5. Job sent, no output
14.4.6. Job sent, strange output
14.4.7. Raw PostScript printed
14.4.8. Advanced Printing
14.4.9. Real debugging
15. Security levels
15.1. Introduction
15.2. More complete description of security levels
16. Unified Logons between Windows NT and UNIX using Winbind
16.1. Abstract
16.2. Introduction
16.3. What Winbind Provides
16.3.1. Target Uses
16.4. How Winbind Works
16.4.1. Microsoft Remote Procedure Calls
16.4.2. Name Service Switch
16.4.3. Pluggable Authentication Modules
16.4.4. User and Group ID Allocation
16.4.5. Result Caching
16.5. Installation and Configuration
16.5.1. Introduction
16.5.2. Requirements
16.5.3. Testing Things Out
16.6. Limitations
16.7. Conclusion
17. Passdb MySQL plugin
17.1. Building
17.2. Configuring
17.3. Using plaintext passwords or encrypted password
17.4. Getting non-column data from the table
18. Passdb XML plugin
18.1. Building
18.2. Usage
19. Storing Samba's User/Machine Account information in an LDAP Directory
19.1. Purpose
19.2. Introduction
19.3. Supported LDAP Servers
19.4. Schema and Relationship to the RFC 2307 posixAccount
19.5. Configuring Samba with LDAP
19.5.1. OpenLDAP configuration
19.5.2. Configuring Samba
19.6. Accounts and Groups management
19.7. Security and sambaAccount
19.8. LDAP specials attributes for sambaAccounts
19.9. Example LDIF Entries for a sambaAccount
19.10. Comments
20. HOWTO Access Samba source code via CVS
20.1. Introduction
20.2. CVS Access to samba.org
20.2.1. Access via CVSweb
20.2.2. Access via cvs
21. Group mapping HOWTO
22. Samba performance issues
22.1. Comparisons
22.2. Oplocks
22.2.1. Overview
22.2.2. Level2 Oplocks
22.2.3. Old 'fake oplocks' option - deprecated
22.3. Socket options
22.4. Read size
22.5. Max xmit
22.6. Locking
22.7. Share modes
22.8. Log level
22.9. Wide lines
22.10. Read raw
22.11. Write raw
22.12. Read prediction
22.13. Memory mapping
22.14. Slow Clients
22.15. Slow Logins
22.16. Client tuning
22.17. My Results
PrevHomeNext
Samba as a NT4 domain member Integrating MS Windows networks with Samba
\ No newline at end of file diff --git a/docs/htmldocs/p18.html b/docs/htmldocs/p18.html new file mode 100644 index 0000000000..a8f2a3c53c --- /dev/null +++ b/docs/htmldocs/p18.html @@ -0,0 +1,438 @@ + +General installation
SAMBA Project Documentation
PrevNext

I. General installation

Introduction

This part contains general info on how to install samba +and how to configure the parts of samba you will most likely need. +PLEASE read this.

Table of Contents
1. How to Install and Test SAMBA
1.1. Read the man pages
1.2. Building the Binaries
1.3. The all important step
1.4. Create the smb configuration file.
1.5. Test your config file with + testparm
1.6. Starting the smbd and nmbd
1.6.1. Starting from inetd.conf
1.6.2. Alternative: starting it as a daemon
1.7. Try listing the shares available on your + server
1.8. Try connecting with the unix client
1.9. Try connecting from a DOS, WfWg, Win9x, WinNT, + Win2k, OS/2, etc... client
1.10. What If Things Don't Work?
1.10.1. Diagnosing Problems
1.10.2. Scope IDs
1.10.3. Choosing the Protocol Level
1.10.4. Printing from UNIX to a Client PC
1.10.5. Locking
1.10.6. Mapping Usernames
2. Improved browsing in samba
2.1. Overview of browsing
2.2. Browsing support in samba
2.3. Problem resolution
2.4. Browsing across subnets
2.4.1. How does cross subnet browsing work ?
2.5. Setting up a WINS server
2.6. Setting up Browsing in a WORKGROUP
2.7. Setting up Browsing in a DOMAIN
2.8. Forcing samba to be the master
2.9. Making samba the domain master
2.10. Note about broadcast addresses
2.11. Multiple interfaces
3. Oplocks
3.1. What are oplocks?
4. Quick Cross Subnet Browsing / Cross Workgroup Browsing guide
4.1. Discussion
4.2. Use of the "Remote Announce" parameter
4.3. Use of the "Remote Browse Sync" parameter
4.4. Use of WINS
4.5. Do NOT use more than one (1) protocol on MS Windows machines
4.6. Name Resolution Order
5. LanMan and NT Password Encryption in Samba
5.1. Introduction
5.2. Important Notes About Security
5.2.1. Advantages of SMB Encryption
5.2.2. Advantages of non-encrypted passwords
5.3. The smbpasswd Command
PrevHomeNext
SAMBA Project Documentation How to Install and Test SAMBA
\ No newline at end of file diff --git a/docs/htmldocs/p3106.html b/docs/htmldocs/p3106.html new file mode 100644 index 0000000000..9967d8fb59 --- /dev/null +++ b/docs/htmldocs/p3106.html @@ -0,0 +1,391 @@ + +Appendixes
SAMBA Project Documentation
PrevNext

IV. Appendixes

Table of Contents
23. Portability
23.1. HPUX
23.2. SCO Unix
23.3. DNIX
23.4. RedHat Linux Rembrandt-II
24. Samba and other CIFS clients
24.1. Macintosh clients?
24.2. OS2 Client
24.2.1. How can I configure OS/2 Warp Connect or + OS/2 Warp 4 as a client for Samba?
24.2.2. How can I configure OS/2 Warp 3 (not Connect), + OS/2 1.2, 1.3 or 2.x for Samba?
24.2.3. Are there any other issues when OS/2 (any version) + is used as a client?
24.2.4. How do I get printer driver download working + for OS/2 clients?
24.3. Windows for Workgroups
24.3.1. Use latest TCP/IP stack from Microsoft
24.3.2. Delete .pwl files after password change
24.3.3. Configure WfW password handling
24.3.4. Case handling of passwords
24.4. Windows '95/'98
24.5. Windows 2000 Service Pack 2
25. Reporting Bugs
25.1. Introduction
25.2. General info
25.3. Debug levels
25.4. Internal errors
25.5. Attaching to a running process
25.6. Patches
26. Diagnosing your samba server
26.1. Introduction
26.2. Assumptions
26.3. Tests
26.3.1. Test 1
26.3.2. Test 2
26.3.3. Test 3
26.3.4. Test 4
26.3.5. Test 5
26.3.6. Test 6
26.3.7. Test 7
26.3.8. Test 8
26.3.9. Test 9
26.3.10. Test 10
26.3.11. Test 11
26.4. Still having troubles?
PrevHomeNext
Samba performance issues Portability
\ No newline at end of file diff --git a/docs/htmldocs/p544.html b/docs/htmldocs/p544.html new file mode 100644 index 0000000000..502d978b5f --- /dev/null +++ b/docs/htmldocs/p544.html @@ -0,0 +1,388 @@ + +Type of installation
SAMBA Project Documentation
PrevNext

II. Type of installation

Introduction

This part contains information on using samba in a (NT 4 or ADS) domain. +If you wish to run samba as a domain member or DC, read the appropriate chapter in +this part.

Table of Contents
6. How to Configure Samba as a NT4 Primary Domain Controller
6.1. Prerequisite Reading
6.2. Background
6.3. Configuring the Samba Domain Controller
6.4. Creating Machine Trust Accounts and Joining Clients to the +Domain
6.4.1. Manual Creation of Machine Trust Accounts
6.4.2. "On-the-Fly" Creation of Machine Trust Accounts
6.4.3. Joining the Client to the Domain
6.5. Common Problems and Errors
6.6. System Policies and Profiles
6.7. What other help can I get?
6.8. Domain Control for Windows 9x/ME
6.8.1. Configuration Instructions: Network Logons
6.8.2. Configuration Instructions: Setting up Roaming User Profiles
6.9. DOMAIN_CONTROL.txt : Windows NT Domain Control & Samba
7. How to Act as a Backup Domain Controller in a Purely Samba Controlled Domain
7.1. Prerequisite Reading
7.2. Background
7.3. What qualifies a Domain Controller on the network?
7.3.1. How does a Workstation find its domain controller?
7.3.2. When is the PDC needed?
7.4. Can Samba be a Backup Domain Controller?
7.5. How do I set up a Samba BDC?
7.5.1. How do I replicate the smbpasswd file?
8. Samba as a ADS domain member
8.1. Installing the required packages for Debian
8.2. Installing the required packages for RedHat
8.3. Compile Samba
8.4. Setup your /etc/krb5.conf
8.5. Create the computer account
8.5.1. Possible errors
8.6. Test your server setup
8.7. Testing with smbclient
8.8. Notes
9. Samba as a NT4 domain member
9.1. Joining an NT Domain with Samba 2.2
9.2. Samba and Windows 2000 Domains
9.3. Why is this better than security = server?
PrevHomeNext
LanMan and NT Password Encryption in Samba How to Configure Samba as a NT4 Primary Domain Controller
\ No newline at end of file diff --git a/docs/htmldocs/pdb-mysql.html b/docs/htmldocs/pdb-mysql.html new file mode 100644 index 0000000000..33ccd322a3 --- /dev/null +++ b/docs/htmldocs/pdb-mysql.html @@ -0,0 +1,286 @@ + +Passdb MySQL plugin
SAMBA Project Documentation
PrevNext

Chapter 17. Passdb MySQL plugin

17.1. Building

To build the plugin, run make bin/pdb_mysql.so +in the source/ directory of samba distribution.

Next, copy pdb_mysql.so to any location you want. I +strongly recommend installing it in $PREFIX/lib or /usr/lib/samba/

17.2. Configuring

This plugin lacks some good documentation, but here is some short info:

Add a the following to the passdb backend variable in your smb.conf: +

passdb backend = [other-plugins] plugin:/location/to/pdb_mysql.so:identifier [other-plugins]

The identifier can be any string you like, as long as it doesn't collide with +the identifiers of other plugins or other instances of pdb_mysql. If you +specify multiple pdb_mysql.so entries in 'passdb backend', you also need to +use different identifiers!

Additional options can be given thru the smb.conf file in the [global] section.

identifier:mysql host                     - host name, defaults to 'localhost'
+identifier:mysql password
+identifier:mysql user                     - defaults to 'samba'
+identifier:mysql database                 - defaults to 'samba'
+identifier:mysql port                     - defaults to 3306
+identifier:table                          - Name of the table containing users

Names of the columns in this table(I've added column types those columns should have first):

identifier:logon time column             - int(9)
+identifier:logoff time column            - int(9)
+identifier:kickoff time column           - int(9)
+identifier:pass last set time column     - int(9)
+identifier:pass can change time column   - int(9)
+identifier:pass must change time column  - int(9)
+identifier:username column               - varchar(255) - unix username
+identifier:domain column                 - varchar(255) - NT domain user is part of
+identifier:nt username column            - varchar(255) - NT username
+identifier:fullname column            - varchar(255) - Full name of user
+identifier:home dir column               - varchar(255) - Unix homedir path
+identifier:dir drive column              - varchar(2) - Directory drive path (eg: 'H:')
+identifier:logon script column           - varchar(255) - Batch file to run on client side when logging on
+identifier:profile path column           - varchar(255) - Path of profile
+identifier:acct desc column              - varchar(255) - Some ASCII NT user data
+identifier:workstations column           - varchar(255) - Workstations user can logon to (or NULL for all)
+identifier:unknown string column         - varchar(255) - unknown string
+identifier:munged dial column            - varchar(255) - ?
+identifier:uid column                    - int(9) - Unix user ID (uid)
+identifier:gid column                    - int(9) - Unix user group (gid)
+identifier:user sid column               - varchar(255) - NT user SID
+identifier:group sid column              - varchar(255) - NT group ID
+identifier:lanman pass column            - varchar(255) - encrypted lanman password
+identifier:nt pass column                - varchar(255) - encrypted nt passwd
+identifier:plaintext pass column         - varchar(255) - plaintext password
+identifier:acct control column           - int(9) - nt user data
+identifier:unknown 3 column              - int(9) - unknown
+identifier:logon divs column             - int(9) - ?
+identifier:hours len column              - int(9) - ?
+identifier:unknown 5 column              - int(9) - unknown
+identifier:unknown 6 column              - int(9) - unknown

Eventually, you can put a colon (:) after the name of each column, which +should specify the column to update when updating the table. You can also +specify nothing behind the colon - then the data from the field will not be +updated.

17.3. Using plaintext passwords or encrypted password

I strongly discourage the use of plaintext passwords, however, you can use them:

If you would like to use plaintext passwords, set 'identifier:lanman pass column' and 'identifier:nt pass column' to 'NULL' (without the quotes) and 'identifier:plaintext pass column' to the name of the column containing the plaintext passwords.

If you use encrypted passwords, set the 'identifier:plaintext pass column' to 'NULL' (without the quotes). This is the default.

17.4. Getting non-column data from the table

It is possible to have not all data in the database and making some 'constant'.

For example, you can set 'identifier:fullname column' to : +CONCAT(First_name,' ',Sur_name)

Or, set 'identifier:workstations column' to : +NULL

See the MySQL documentation for more language constructs.

PrevHomeNext
Unified Logons between Windows NT and UNIX using WinbindUpPassdb XML plugin
\ No newline at end of file diff --git a/docs/htmldocs/pdb-xml.html b/docs/htmldocs/pdb-xml.html new file mode 100644 index 0000000000..75abfc5a81 --- /dev/null +++ b/docs/htmldocs/pdb-xml.html @@ -0,0 +1,189 @@ + +Passdb XML plugin
SAMBA Project Documentation
PrevNext

Chapter 18. Passdb XML plugin

18.1. Building

This module requires libxml2 to be installed.

To build pdb_xml, run: make bin/pdb_xml.so in +the directory source/.

18.2. Usage

The usage of pdb_xml is pretty straightforward. To export data, use: + +pdbedit -e plugin:/usr/lib/samba/pdb_xml.so:filename + +(where filename is the name of the file to put the data in)

To import data, use: +pdbedit -i plugin:/usr/lib/samba/pdb_xml.so:filename -e current-pdb + +Where filename is the name to read the data from and current-pdb to put it in.

PrevHomeNext
Passdb MySQL pluginUpStoring Samba's User/Machine Account information in an LDAP Directory
\ No newline at end of file diff --git a/docs/htmldocs/printingdebug.html b/docs/htmldocs/printingdebug.html deleted file mode 100644 index 0b99407257..0000000000 --- a/docs/htmldocs/printingdebug.html +++ /dev/null @@ -1,522 +0,0 @@ - -Debugging Printing Problems
SAMBA Project Documentation
PrevNext

Chapter 15. Debugging Printing Problems

15.1. Introduction

This is a short description of how to debug printing problems with -Samba. This describes how to debug problems with printing from a SMB -client to a Samba server, not the other way around. For the reverse -see the examples/printing directory.

Ok, so you want to print to a Samba server from your PC. The first -thing you need to understand is that Samba does not actually do any -printing itself, it just acts as a middleman between your PC client -and your Unix printing subsystem. Samba receives the file from the PC -then passes the file to a external "print command". What print command -you use is up to you.

The whole things is controlled using options in smb.conf. The most -relevant options (which you should look up in the smb.conf man page) -are:

      [global]
-        print command     - send a file to a spooler
-        lpq command       - get spool queue status
-        lprm command      - remove a job
-      [printers]
-        path = /var/spool/lpd/samba

The following are nice to know about:

        queuepause command   - stop a printer or print queue
-        queueresume command  - start a printer or print queue

Example:

        print command = /usr/bin/lpr -r -P%p %s
-        lpq command   = /usr/bin/lpq    -P%p %s
-        lprm command  = /usr/bin/lprm   -P%p %j
-        queuepause command = /usr/sbin/lpc -P%p stop
-        queuepause command = /usr/sbin/lpc -P%p start

Samba should set reasonable defaults for these depending on your -system type, but it isn't clairvoyant. It is not uncommon that you -have to tweak these for local conditions. The commands should -always have fully specified pathnames, as the smdb may not have -the correct PATH values.

When you send a job to Samba to be printed, it will make a temporary -copy of it in the directory specified in the [printers] section. -and it should be periodically cleaned out. The lpr -r option -requests that the temporary copy be removed after printing; If -printing fails then you might find leftover files in this directory, -and it should be periodically cleaned out. Samba used the lpq -command to determine the "job number" assigned to your print job -by the spooler.

The %>letter< are "macros" that get dynamically replaced with appropriate -values when they are used. The %s gets replaced with the name of the spool -file that Samba creates and the %p gets replaced with the name of the -printer. The %j gets replaced with the "job number" which comes from -the lpq output.

15.2. Debugging printer problems

One way to debug printing problems is to start by replacing these -command with shell scripts that record the arguments and the contents -of the print file. A simple example of this kind of things might -be:

	print command = /tmp/saveprint %p %s
-
-    #!/bin/saveprint
-    # we make sure that we are the right user
-    /usr/bin/id -p >/tmp/tmp.print
-    # we run the command and save the error messages
-    # replace the command with the one appropriate for your system
-    /usr/bin/lpr -r -P$1 $2 2>>&/tmp/tmp.print

Then you print a file and try removing it. You may find that the -print queue needs to be stopped in order to see the queue status -and remove the job:


h4: {42} % echo hi >/tmp/hi
-h4: {43} % smbclient //localhost/lw4
-added interface ip=10.0.0.4 bcast=10.0.0.255 nmask=255.255.255.0
-Password: 
-Domain=[ASTART] OS=[Unix] Server=[Samba 2.0.7]
-smb: \> print /tmp/hi
-putting file /tmp/hi as hi-17534 (0.0 kb/s) (average 0.0 kb/s)
-smb: \> queue
-1049     3            hi-17534
-smb: \> cancel 1049
-Error cancelling job 1049 : code 0
-smb: \> cancel 1049
-Job 1049 cancelled
-smb: \> queue
-smb: \> exit

The 'code 0' indicates that the job was removed. The comment -by the smbclient is a bit misleading on this. -You can observe the command output and then and look at the -/tmp/tmp.print file to see what the results are. You can quickly -find out if the problem is with your printing system. Often people -have problems with their /etc/printcap file or permissions on -various print queues.

15.3. What printers do I have?

You can use the 'testprns' program to check to see if the printer -name you are using is recognized by Samba. For example, you can -use:

    testprns printer /etc/printcap

Samba can get its printcap information from a file or from a program. -You can try the following to see the format of the extracted -information:

    testprns -a printer /etc/printcap
-
-    testprns -a printer '|/bin/cat printcap'

15.4. Setting up printcap and print servers

You may need to set up some printcaps for your Samba system to use. -It is strongly recommended that you use the facilities provided by -the print spooler to set up queues and printcap information.

Samba requires either a printcap or program to deliver printcap -information. This printcap information has the format:

  name|alias1|alias2...:option=value:...

For almost all printing systems, the printer 'name' must be composed -only of alphanumeric or underscore '_' characters. Some systems also -allow hyphens ('-') as well. An alias is an alternative name for the -printer, and an alias with a space in it is used as a 'comment' -about the printer. The printcap format optionally uses a \ at the end of lines -to extend the printcap to multiple lines.

Here are some examples of printcap files:

  1. pr just printer name

  2. pr|alias printer name and alias

  3. pr|My Printer printer name, alias used as comment

  4. pr:sh:\ Same as pr:sh:cm= testing - :cm= \ - testing

  5. pr:sh Same as pr:sh:cm= testing - :cm= testing

Samba reads the printcap information when first started. If you make -changes in the printcap information, then you must do the following:

  1. make sure that the print spooler is aware of these changes. -The LPRng system uses the 'lpc reread' command to do this.

  2. make sure that the spool queues, etc., exist and have the -correct permissions. The LPRng system uses the 'checkpc -f' -command to do this.

  3. You now should send a SIGHUP signal to the smbd server to have -it reread the printcap information.

15.5. Job sent, no output

This is the most frustrating part of printing. You may have sent the -job, verified that the job was forwarded, set up a wrapper around -the command to send the file, but there was no output from the printer.

First, check to make sure that the job REALLY is getting to the -right print queue. If you are using a BSD or LPRng print spooler, -you can temporarily stop the printing of jobs. Jobs can still be -submitted, but they will not be printed. Use:

  lpc -Pprinter stop

Now submit a print job and then use 'lpq -Pprinter' to see if the -job is in the print queue. If it is not in the print queue then -you will have to find out why it is not being accepted for printing.

Next, you may want to check to see what the format of the job really -was. With the assistance of the system administrator you can view -the submitted jobs files. You may be surprised to find that these -are not in what you would expect to call a printable format. -You can use the UNIX 'file' utitily to determine what the job -format actually is:

    cd /var/spool/lpd/printer   # spool directory of print jobs
-    ls                          # find job files
-    file dfA001myhost

You should make sure that your printer supports this format OR that -your system administrator has installed a 'print filter' that will -convert the file to a format appropriate for your printer.

15.6. Job sent, strange output

Once you have the job printing, you can then start worrying about -making it print nicely.

The most common problem is extra pages of output: banner pages -OR blank pages at the end.

If you are getting banner pages, check and make sure that the -printcap option or printer option is configured for no banners. -If you have a printcap, this is the :sh (suppress header or banner -page) option. You should have the following in your printer.

   printer: ... :sh

If you have this option and are still getting banner pages, there -is a strong chance that your printer is generating them for you -automatically. You should make sure that banner printing is disabled -for the printer. This usually requires using the printer setup software -or procedures supplied by the printer manufacturer.

If you get an extra page of output, this could be due to problems -with your job format, or if you are generating PostScript jobs, -incorrect setting on your printer driver on the MicroSoft client. -For example, under Win95 there is a option:

  Printers|Printer Name|(Right Click)Properties|Postscript|Advanced|

that allows you to choose if a Ctrl-D is appended to all jobs. -This is a very bad thing to do, as most spooling systems will -automatically add a ^D to the end of the job if it is detected as -PostScript. The multiple ^D may cause an additional page of output.

15.7. Raw PostScript printed

This is a problem that is usually caused by either the print spooling -system putting information at the start of the print job that makes -the printer think the job is a text file, or your printer simply -does not support PostScript. You may need to enable 'Automatic -Format Detection' on your printer.

15.8. Advanced Printing

Note that you can do some pretty magic things by using your -imagination with the "print command" option and some shell scripts. -Doing print accounting is easy by passing the %U option to a print -command shell script. You could even make the print command detect -the type of output and its size and send it to an appropriate -printer.

15.9. Real debugging

If the above debug tips don't help, then maybe you need to bring in -the bug guns, system tracing. See Tracing.txt in this directory.

PrevHomeNext
Printing SupportUpSecurity levels
\ No newline at end of file diff --git a/docs/htmldocs/pwencrypt.html b/docs/htmldocs/pwencrypt.html new file mode 100644 index 0000000000..81c709a4ff --- /dev/null +++ b/docs/htmldocs/pwencrypt.html @@ -0,0 +1,445 @@ + +LanMan and NT Password Encryption in Samba
SAMBA Project Documentation
PrevNext

Chapter 5. LanMan and NT Password Encryption in Samba

5.1. Introduction

Newer windows clients send encrypted passwords over + the wire, instead of plain text passwords. The newest clients + will only send encrypted passwords and refuse to send plain text + passwords, unless their registry is tweaked.

These passwords can't be converted to unix style encrypted + passwords. Because of that you can't use the standard unix + user database, and you have to store the Lanman and NT hashes + somewhere else. For more information, see the documentation + about the passdb backend = parameter. +

5.2. Important Notes About Security

The unix and SMB password encryption techniques seem similar + on the surface. This similarity is, however, only skin deep. The unix + scheme typically sends clear text passwords over the network when + logging in. This is bad. The SMB encryption scheme never sends the + cleartext password over the network but it does store the 16 byte + hashed values on disk. This is also bad. Why? Because the 16 byte hashed + values are a "password equivalent". You cannot derive the user's + password from them, but they could potentially be used in a modified + client to gain access to a server. This would require considerable + technical knowledge on behalf of the attacker but is perfectly possible. + You should thus treat the smbpasswd file as though it contained the + cleartext passwords of all your users. Its contents must be kept + secret, and the file should be protected accordingly.

Ideally we would like a password scheme which neither requires + plain text passwords on the net or on disk. Unfortunately this + is not available as Samba is stuck with being compatible with + other SMB systems (WinNT, WfWg, Win95 etc).

Note that Windows NT 4.0 Service pack 3 changed the + default for permissible authentication so that plaintext + passwords are never sent over the wire. + The solution to this is either to switch to encrypted passwords + with Samba or edit the Windows NT registry to re-enable plaintext + passwords. See the document WinNT.txt for details on how to do + this.

Other Microsoft operating systems which also exhibit + this behavior includes

  • MS DOS Network client 3.0 with + the basic network redirector installed

  • Windows 95 with the network redirector + update installed

  • Windows 98 [se]

  • Windows 2000

Note :All current release of + Microsoft SMB/CIFS clients support authentication via the + SMB Challenge/Response mechanism described here. Enabling + clear text authentication does not disable the ability + of the client to participate in encrypted authentication.

5.2.1. Advantages of SMB Encryption

  • plain text passwords are not passed across + the network. Someone using a network sniffer cannot just + record passwords going to the SMB server.

  • WinNT doesn't like talking to a server + that isn't using SMB encrypted passwords. It will refuse + to browse the server if the server is also in user level + security mode. It will insist on prompting the user for the + password on each connection, which is very annoying. The + only things you can do to stop this is to use SMB encryption. +

5.2.2. Advantages of non-encrypted passwords

  • plain text passwords are not kept + on disk.

  • uses same password file as other unix + services such as login and ftp

  • you are probably already using other + services (such as telnet and ftp) which send plain text + passwords over the net, so sending them for SMB isn't + such a big deal.

5.3. The smbpasswd Command

The smbpasswd command maintains the two 32 byte password fields + in the smbpasswd file. If you wish to make it similar to the unix + passwd or yppasswd programs, + install it in /usr/local/samba/bin/ (or your + main Samba binary directory).

smbpasswd now works in a client-server mode + where it contacts the local smbd to change the user's password on its + behalf. This has enormous benefits - as follows.

smbpasswd now has the capability + to change passwords on Windows NT servers (this only works when + the request is sent to the NT Primary Domain Controller if you + are changing an NT Domain user's password).

To run smbpasswd as a normal user just type :

$ smbpasswd

Old SMB password: <type old value here - + or hit return if there was no old password>

New SMB Password: <type new value> +

Repeat New SMB Password: <re-type new value +

If the old value does not match the current value stored for + that user, or the two new values do not match each other, then the + password will not be changed.

If invoked by an ordinary user it will only allow the user + to change his or her own Samba password.

If run by the root user smbpasswd may take an optional + argument, specifying the user name whose SMB password you wish to + change. Note that when run as root smbpasswd does not prompt for + or check the old password value, thus allowing root to set passwords + for users who have forgotten their passwords.

smbpasswd is designed to work in the same way + and be familiar to UNIX users who use the passwd or + yppasswd commands.

For more details on using smbpasswd refer + to the man page which will always be the definitive reference.

PrevHomeNext
Quick Cross Subnet Browsing / Cross Workgroup Browsing guideUpType of installation
\ No newline at end of file diff --git a/docs/htmldocs/samba-howto-collection.html b/docs/htmldocs/samba-howto-collection.html new file mode 100644 index 0000000000..0c5e284757 --- /dev/null +++ b/docs/htmldocs/samba-howto-collection.html @@ -0,0 +1,1117 @@ + +SAMBA Project Documentation

SAMBA Project Documentation

SAMBA Team

Abstract

Last Update : Thu Aug 15 12:48:45 CDT 2002

This book is a collection of HOWTOs added to Samba documentation over the years. +I try to ensure that all are current, but sometimes the is a larger job +than one person can maintain. The most recent version of this document +can be found at http://www.samba.org/ +on the "Documentation" page. Please send updates to jerry@samba.org.

This documentation is distributed under the GNU General Public License (GPL) +version 2. A copy of the license is included with the Samba source +distribution. A copy can be found on-line at http://www.fsf.org/licenses/gpl.txt

Cheers, jerry

Table of Contents
I. General installation
1. How to Install and Test SAMBA
1.1. Read the man pages
1.2. Building the Binaries
1.3. The all important step
1.4. Create the smb configuration file.
1.5. Test your config file with + testparm
1.6. Starting the smbd and nmbd
1.7. Try listing the shares available on your + server
1.8. Try connecting with the unix client
1.9. Try connecting from a DOS, WfWg, Win9x, WinNT, + Win2k, OS/2, etc... client
1.10. What If Things Don't Work?
2. Improved browsing in samba
2.1. Overview of browsing
2.2. Browsing support in samba
2.3. Problem resolution
2.4. Browsing across subnets
2.5. Setting up a WINS server
2.6. Setting up Browsing in a WORKGROUP
2.7. Setting up Browsing in a DOMAIN
2.8. Forcing samba to be the master
2.9. Making samba the domain master
2.10. Note about broadcast addresses
2.11. Multiple interfaces
3. Oplocks
3.1. What are oplocks?
4. Quick Cross Subnet Browsing / Cross Workgroup Browsing guide
4.1. Discussion
4.2. Use of the "Remote Announce" parameter
4.3. Use of the "Remote Browse Sync" parameter
4.4. Use of WINS
4.5. Do NOT use more than one (1) protocol on MS Windows machines
4.6. Name Resolution Order
5. LanMan and NT Password Encryption in Samba
5.1. Introduction
5.2. Important Notes About Security
5.3. The smbpasswd Command
II. Type of installation
6. How to Configure Samba as a NT4 Primary Domain Controller
6.1. Prerequisite Reading
6.2. Background
6.3. Configuring the Samba Domain Controller
6.4. Creating Machine Trust Accounts and Joining Clients to the +Domain
6.5. Common Problems and Errors
6.6. System Policies and Profiles
6.7. What other help can I get?
6.8. Domain Control for Windows 9x/ME
6.9. DOMAIN_CONTROL.txt : Windows NT Domain Control & Samba
7. How to Act as a Backup Domain Controller in a Purely Samba Controlled Domain
7.1. Prerequisite Reading
7.2. Background
7.3. What qualifies a Domain Controller on the network?
7.4. Can Samba be a Backup Domain Controller?
7.5. How do I set up a Samba BDC?
8. Samba as a ADS domain member
8.1. Installing the required packages for Debian
8.2. Installing the required packages for RedHat
8.3. Compile Samba
8.4. Setup your /etc/krb5.conf
8.5. Create the computer account
8.6. Test your server setup
8.7. Testing with smbclient
8.8. Notes
9. Samba as a NT4 domain member
9.1. Joining an NT Domain with Samba 2.2
9.2. Samba and Windows 2000 Domains
9.3. Why is this better than security = server?
III. Optional configuration
10. Integrating MS Windows networks with Samba
10.1. Agenda
10.2. Name Resolution in a pure Unix/Linux world
10.3. Name resolution as used within MS Windows networking
10.4. How browsing functions and how to deploy stable and +dependable browsing using Samba
10.5. MS Windows security options and how to configure +Samba for seemless integration
10.6. Conclusions
11. UNIX Permission Bits and Windows NT Access Control Lists
11.1. Viewing and changing UNIX permissions using the NT + security dialogs
11.2. How to view file security on a Samba share
11.3. Viewing file ownership
11.4. Viewing file or directory permissions
11.5. Modifying file or directory permissions
11.6. Interaction with the standard Samba create mask + parameters
11.7. Interaction with the standard Samba file attribute + mapping
12. Configuring PAM for distributed but centrally +managed authentication
12.1. Samba and PAM
12.2. Distributed Authentication
12.3. PAM Configuration in smb.conf
13. Hosting a Microsoft Distributed File System tree on Samba
13.1. Instructions
14. Printing Support
14.1. Introduction
14.2. Configuration
14.3. The Imprints Toolset
14.4. Diagnosis
15. Security levels
15.1. Introduction
15.2. More complete description of security levels
16. Unified Logons between Windows NT and UNIX using Winbind
16.1. Abstract
16.2. Introduction
16.3. What Winbind Provides
16.4. How Winbind Works
16.5. Installation and Configuration
16.6. Limitations
16.7. Conclusion
17. Passdb MySQL plugin
17.1. Building
17.2. Configuring
17.3. Using plaintext passwords or encrypted password
17.4. Getting non-column data from the table
18. Passdb XML plugin
18.1. Building
18.2. Usage
19. Storing Samba's User/Machine Account information in an LDAP Directory
19.1. Purpose
19.2. Introduction
19.3. Supported LDAP Servers
19.4. Schema and Relationship to the RFC 2307 posixAccount
19.5. Configuring Samba with LDAP
19.6. Accounts and Groups management
19.7. Security and sambaAccount
19.8. LDAP specials attributes for sambaAccounts
19.9. Example LDIF Entries for a sambaAccount
19.10. Comments
20. HOWTO Access Samba source code via CVS
20.1. Introduction
20.2. CVS Access to samba.org
21. Group mapping HOWTO
22. Samba performance issues
22.1. Comparisons
22.2. Oplocks
22.3. Socket options
22.4. Read size
22.5. Max xmit
22.6. Locking
22.7. Share modes
22.8. Log level
22.9. Wide lines
22.10. Read raw
22.11. Write raw
22.12. Read prediction
22.13. Memory mapping
22.14. Slow Clients
22.15. Slow Logins
22.16. Client tuning
22.17. My Results
IV. Appendixes
23. Portability
23.1. HPUX
23.2. SCO Unix
23.3. DNIX
23.4. RedHat Linux Rembrandt-II
24. Samba and other CIFS clients
24.1. Macintosh clients?
24.2. OS2 Client
24.3. Windows for Workgroups
24.4. Windows '95/'98
24.5. Windows 2000 Service Pack 2
25. Reporting Bugs
25.1. Introduction
25.2. General info
25.3. Debug levels
25.4. Internal errors
25.5. Attaching to a running process
25.6. Patches
26. Diagnosing your samba server
26.1. Introduction
26.2. Assumptions
26.3. Tests
26.4. Still having troubles?
  Next
  General installation
\ No newline at end of file diff --git a/docs/htmldocs/samba-pdc.html b/docs/htmldocs/samba-pdc.html new file mode 100644 index 0000000000..ebf6e85674 --- /dev/null +++ b/docs/htmldocs/samba-pdc.html @@ -0,0 +1,2649 @@ + +How to Configure Samba as a NT4 Primary Domain Controller
SAMBA Project Documentation
PrevNext

Chapter 6. How to Configure Samba as a NT4 Primary Domain Controller

6.1. Prerequisite Reading

Before you continue reading in this chapter, please make sure +that you are comfortable with configuring basic files services +in smb.conf and how to enable and administer password +encryption in Samba. Theses two topics are covered in the +smb.conf(5) +manpage and the Encryption chapter +of this HOWTO Collection.

6.2. Background

Author's Note: This document is a combination +of David Bannon's "Samba 2.2 PDC HOWTO" and "Samba NT Domain FAQ". +Both documents are superseded by this one.

Versions of Samba prior to release 2.2 had marginal capabilities to act +as a Windows NT 4.0 Primary Domain Controller + +(PDC). With Samba 2.2.0, we are proud to announce official support for +Windows NT 4.0-style domain logons from Windows NT 4.0 and Windows +2000 clients. This article outlines the steps +necessary for configuring Samba as a PDC. It is necessary to have a +working Samba server prior to implementing the PDC functionality. If +you have not followed the steps outlined in UNIX_INSTALL.html, please make sure +that your server is configured correctly before proceeding. Another +good resource in the smb.conf(5) man +page. The following functionality should work in 2.2:

  • domain logons for Windows NT 4.0/2000 clients. +

  • placing a Windows 9x client in user level security +

  • retrieving a list of users and groups from a Samba PDC to + Windows 9x/NT/2000 clients +

  • roving (roaming) user profiles +

  • Windows NT 4.0-style system policies +

The following pieces of functionality are not included in the 2.2 release:

  • Windows NT 4 domain trusts +

  • SAM replication with Windows NT 4.0 Domain Controllers + (i.e. a Samba PDC and a Windows NT BDC or vice versa) +

  • Adding users via the User Manager for Domains +

  • Acting as a Windows 2000 Domain Controller (i.e. Kerberos and + Active Directory) +

Please note that Windows 9x clients are not true members of a domain +for reasons outlined in this article. Therefore the protocol for +support Windows 9x-style domain logons is completely different +from NT4 domain logons and has been officially supported for some +time.

Implementing a Samba PDC can basically be divided into 2 broad +steps.

  1. Configuring the Samba PDC +

  2. Creating machine trust accounts and joining clients + to the domain +

There are other minor details such as user profiles, system +policies, etc... However, these are not necessarily specific +to a Samba PDC as much as they are related to Windows NT networking +concepts. They will be mentioned only briefly here.

6.3. Configuring the Samba Domain Controller

The first step in creating a working Samba PDC is to +understand the parameters necessary in smb.conf. I will not +attempt to re-explain the parameters here as they are more that +adequately covered in the smb.conf +man page. For convenience, the parameters have been +linked with the actual smb.conf description.

Here is an example smb.conf for acting as a PDC:

[global]
+    ; Basic server settings
+    netbios name = POGO
+    workgroup = NARNIA
+
+    ; we should act as the domain and local master browser
+    os level = 64
+    preferred master = yes
+    domain master = yes
+    local master = yes
+    
+    ; security settings (must user security = user)
+    security = user
+    
+    ; encrypted passwords are a requirement for a PDC
+    encrypt passwords = yes
+    
+    ; support domain logons
+    domain logons = yes
+    
+    ; where to store user profiles?
+    logon path = \\%N\profiles\%u
+    
+    ; where is a user's home directory and where should it
+    ; be mounted at?
+    logon drive = H:
+    logon home = \\homeserver\%u
+    
+    ; specify a generic logon script for all users
+    ; this is a relative **DOS** path to the [netlogon] share
+    logon script = logon.cmd
+
+; necessary share for domain controller
+[netlogon]
+    path = /usr/local/samba/lib/netlogon
+    read only = yes
+    write list = ntadmin
+    
+; share for storing user profiles
+[profiles]
+    path = /export/smb/ntprofile
+    read only = no
+    create mask = 0600
+    directory mask = 0700

There are a couple of points to emphasize in the above configuration.

  • Encrypted passwords must be enabled. For more details on how + to do this, refer to ENCRYPTION.html. +

  • The server must support domain logons and a + [netlogon] share +

  • The server must be the domain master browser in order for Windows + client to locate the server as a DC. Please refer to the various + Network Browsing documentation included with this distribution for + details. +

As Samba 2.2 does not offer a complete implementation of group mapping +between Windows NT groups and Unix groups (this is really quite +complicated to explain in a short space), you should refer to the +domain admin +group smb.conf parameter for information of creating "Domain +Admins" style accounts.

6.4. Creating Machine Trust Accounts and Joining Clients to the +Domain

A machine trust account is a Samba account that is used to +authenticate a client machine (rather than a user) to the Samba +server. In Windows terminology, this is known as a "Computer +Account."

The password of a machine trust account acts as the shared secret for +secure communication with the Domain Controller. This is a security +feature to prevent an unauthorized machine with the same NetBIOS name +from joining the domain and gaining access to domain user/group +accounts. Windows NT and 2000 clients use machine trust accounts, but +Windows 9x clients do not. Hence, a Windows 9x client is never a true +member of a domain because it does not possess a machine trust +account, and thus has no shared secret with the domain controller.

A Windows PDC stores each machine trust account in the Windows +Registry. A Samba PDC, however, stores each machine trust account +in two parts, as follows: + +

  • A Samba account, stored in the same location as user + LanMan and NT password hashes (currently + smbpasswd). The Samba account + possesses and uses only the NT password hash.

  • A corresponding Unix account, typically stored in + /etc/passwd. (Future releases will alleviate the need to + create /etc/passwd entries.)

There are two ways to create machine trust accounts:

  • Manual creation. Both the Samba and corresponding + Unix account are created by hand.

  • "On-the-fly" creation. The Samba machine trust + account is automatically created by Samba at the time the client + is joined to the domain. (For security, this is the + recommended method.) The corresponding Unix account may be + created automatically or manually.

6.4.1. Manual Creation of Machine Trust Accounts

The first step in manually creating a machine trust account is to +manually create the corresponding Unix account in +/etc/passwd. This can be done using +vipw or other 'add user' command that is normally +used to create new Unix accounts. The following is an example for a +Linux based Samba server:

root# /usr/sbin/useradd -g 100 -d /dev/null -c "machine +nickname" -s /bin/false machine_name$

root# passwd -l machine_name$

On *BSD systems, this can be done using the 'chpass' utility:

root# chpass -a "machine_name$:*:101:100::0:0:Workstation machine_name:/dev/null:/sbin/nologin"

The /etc/passwd entry will list the machine name +with a "$" appended, won't have a password, will have a null shell and no +home directory. For example a machine named 'doppy' would have an +/etc/passwd entry like this:

doppy$:x:505:501:machine_nickname:/dev/null:/bin/false

Above, machine_nickname can be any +descriptive name for the client, i.e., BasementComputer. +machine_name absolutely must be the NetBIOS +name of the client to be joined to the domain. The "$" must be +appended to the NetBIOS name of the client or Samba will not recognize +this as a machine trust account.

Now that the corresponding Unix account has been created, the next step is to create +the Samba account for the client containing the well-known initial +machine trust account password. This can be done using the smbpasswd(8) command +as shown here:

root# smbpasswd -a -m machine_name

where machine_name is the machine's NetBIOS +name. The RID of the new machine account is generated from the UID of +the corresponding Unix account.

Join the client to the domain immediately
 

Manually creating a machine trust account using this method is the + equivalent of creating a machine trust account on a Windows NT PDC using + the "Server Manager". From the time at which the account is created + to the time which the client joins the domain and changes the password, + your domain is vulnerable to an intruder joining your domain using a + a machine with the same NetBIOS name. A PDC inherently trusts + members of the domain and will serve out a large degree of user + information to such clients. You have been warned! +

6.4.2. "On-the-Fly" Creation of Machine Trust Accounts

The second (and recommended) way of creating machine trust accounts is +simply to allow the Samba server to create them as needed when the client +is joined to the domain.

Since each Samba machine trust account requires a corresponding +Unix account, a method for automatically creating the +Unix account is usually supplied; this requires configuration of the +add user script +option in smb.conf. This +method is not required, however; corresponding Unix accounts may also +be created manually.

Below is an example for a RedHat 6.2 Linux system.

[global]
+   # <...remainder of parameters...>
+   add user script = /usr/sbin/useradd -d /dev/null -g 100 -s /bin/false -M %u

6.4.3. Joining the Client to the Domain

The procedure for joining a client to the domain varies with the +version of Windows.

  • Windows 2000

    When the user elects to join the client to a domain, Windows prompts for + an account and password that is privileged to join the domain. A + Samba administrative account (i.e., a Samba account that has root + privileges on the Samba server) must be entered here; the + operation will fail if an ordinary user account is given. + The password for this account should be + set to a different password than the associated + /etc/passwd entry, for security + reasons.

    The session key of the Samba administrative account acts as an + encryption key for setting the password of the machine trust + account. The machine trust account will be created on-the-fly, or + updated if it already exists.

  • Windows NT

    If the machine trust account was created manually, on the + Identification Changes menu enter the domain name, but do not + check the box "Create a Computer Account in the Domain." In this case, + the existing machine trust account is used to join the machine to + the domain.

    If the machine trust account is to be created + on-the-fly, on the Identification Changes menu enter the domain + name, and check the box "Create a Computer Account in the Domain." In + this case, joining the domain proceeds as above for Windows 2000 + (i.e., you must supply a Samba administrative account when + prompted).

6.5. Common Problems and Errors

  • I cannot include a '$' in a machine name. +

    A 'machine name' in (typically) /etc/passwd + of the machine name with a '$' appended. FreeBSD (and other BSD + systems?) won't create a user with a '$' in their name. +

    The problem is only in the program used to make the entry, once + made, it works perfectly. So create a user without the '$' and + use vipw to edit the entry, adding the '$'. Or create + the whole entry with vipw if you like, make sure you use a + unique User ID ! +

  • I get told "You already have a connection to the Domain...." + or "Cannot join domain, the credentials supplied conflict with an + existing set.." when creating a machine trust account. +

    This happens if you try to create a machine trust account from the + machine itself and already have a connection (e.g. mapped drive) + to a share (or IPC$) on the Samba PDC. The following command + will remove all network drive connections: +

    C:\WINNT\> net use * /d +

    Further, if the machine is a already a 'member of a workgroup' that + is the same name as the domain you are joining (bad idea) you will + get this message. Change the workgroup name to something else, it + does not matter what, reboot, and try again. +

  • The system can not log you on (C000019B).... +

    I joined the domain successfully but after upgrading + to a newer version of the Samba code I get the message, "The system + can not log you on (C000019B), Please try a gain or consult your + system administrator" when attempting to logon. +

    This occurs when the domain SID stored in + private/WORKGROUP.SID is + changed. For example, you remove the file and smbd automatically + creates a new one. Or you are swapping back and forth between + versions 2.0.7, TNG and the HEAD branch code (not recommended). The + only way to correct the problem is to restore the original domain + SID or remove the domain client from the domain and rejoin. +

  • The machine trust account for this computer either does not + exist or is not accessible. +

    When I try to join the domain I get the message "The machine account + for this computer either does not exist or is not accessible". What's + wrong? +

    This problem is caused by the PDC not having a suitable machine trust account. + If you are using the add user script method to create + accounts then this would indicate that it has not worked. Ensure the domain + admin user system is working. +

    Alternatively if you are creating account entries manually then they + have not been created correctly. Make sure that you have the entry + correct for the machine trust account in smbpasswd file on the Samba PDC. + If you added the account using an editor rather than using the smbpasswd + utility, make sure that the account name is the machine NetBIOS name + with a '$' appended to it ( i.e. computer_name$ ). There must be an entry + in both /etc/passwd and the smbpasswd file. Some people have reported + that inconsistent subnet masks between the Samba server and the NT + client have caused this problem. Make sure that these are consistent + for both client and server. +

  • When I attempt to login to a Samba Domain from a NT4/W2K workstation, + I get a message about my account being disabled. +

    This problem is caused by a PAM related bug in Samba 2.2.0. This bug is + fixed in 2.2.1. Other symptoms could be unaccessible shares on + NT/W2K member servers in the domain or the following error in your smbd.log: + passdb/pampass.c:pam_account(268) PAM: UNKNOWN ERROR for User: %user% +

    At first be ensure to enable the useraccounts with smbpasswd -e + %user%, this is normally done, when you create an account. +

    In order to work around this problem in 2.2.0, configure the + account control flag in + /etc/pam.d/samba file as follows: + 

    	account required        pam_permit.so
+

    If you want to remain backward compatibility to samba 2.0.x use + pam_permit.so, it's also possible to use + pam_pwdb.so. There are some bugs if you try to + use pam_unix.so, if you need this, be ensure to use + the most recent version of this file. +

6.6. System Policies and Profiles

Much of the information necessary to implement System Policies and +Roving User Profiles in a Samba domain is the same as that for +implementing these same items in a Windows NT 4.0 domain. +You should read the white paper Implementing +Profiles and Policies in Windows NT 4.0 available from Microsoft.

Here are some additional details:

  • What about Windows NT Policy Editor? +

    To create or edit ntconfig.pol you must use + the NT Server Policy Editor, poledit.exe which + is included with NT Server but not NT Workstation. + There is a Policy Editor on a NTws + but it is not suitable for creating Domain Policies. + Further, although the Windows 95 + Policy Editor can be installed on an NT Workstation/Server, it will not + work with NT policies because the registry key that are set by the policy templates. + However, the files from the NT Server will run happily enough on an NTws. + You need poledit.exe, common.adm and winnt.adm. It is convenient + to put the two *.adm files in c:\winnt\inf which is where + the binary will look for them unless told otherwise. Note also that that + directory is 'hidden'. +

    The Windows NT policy editor is also included with the Service Pack 3 (and + later) for Windows NT 4.0. Extract the files using servicepackname /x, + i.e. that's Nt4sp6ai.exe /x for service pack 6a. The policy editor, + poledit.exe and the associated template files (*.adm) should + be extracted as well. It is also possible to downloaded the policy template + files for Office97 and get a copy of the policy editor. Another possible + location is with the Zero Administration Kit available for download from Microsoft. +

  • Can Win95 do Policies? +

    Install the group policy handler for Win9x to pick up group + policies. Look on the Win98 CD in \tools\reskit\netadmin\poledit. + Install group policies on a Win9x client by double-clicking + grouppol.inf. Log off and on again a couple of + times and see if Win98 picks up group policies. Unfortunately this needs + to be done on every Win9x machine that uses group policies.... +

    If group policies don't work one reports suggests getting the updated + (read: working) grouppol.dll for Windows 9x. The group list is grabbed + from /etc/group. +

  • How do I get 'User Manager' and 'Server Manager' +

    Since I don't need to buy an NT Server CD now, how do I get + the 'User Manager for Domains', the 'Server Manager'? +

    Microsoft distributes a version of these tools called nexus for + installation on Windows 95 systems. The tools set includes +

    • Server Manager

    • User Manager for Domains

    • Event Viewer

    Click here to download the archived file ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE +

    The Windows NT 4.0 version of the 'User Manager for + Domains' and 'Server Manager' are available from Microsoft via ftp + from ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE +

6.7. What other help can I get?

There are many sources of information available in the form +of mailing lists, RFC's and documentation. The docs that come +with the samba distribution contain very good explanations of +general SMB topics such as browsing.

  • What are some diagnostics tools I can use to debug the domain logon + process and where can I find them? +

    One of the best diagnostic tools for debugging problems is Samba itself. + You can use the -d option for both smbd and nmbd to specify what + 'debug level' at which to run. See the man pages on smbd, nmbd and + smb.conf for more information on debugging options. The debug + level can range from 1 (the default) to 10 (100 for debugging passwords). +

    Another helpful method of debugging is to compile samba using the + gcc -g flag. This will include debug + information in the binaries and allow you to attach gdb to the + running smbd / nmbd process. In order to attach gdb to an smbd + process for an NT workstation, first get the workstation to make the + connection. Pressing ctrl-alt-delete and going down to the domain box + is sufficient (at least, on the first time you join the domain) to + generate a 'LsaEnumTrustedDomains'. Thereafter, the workstation + maintains an open connection, and therefore there will be an smbd + process running (assuming that you haven't set a really short smbd + idle timeout) So, in between pressing ctrl alt delete, and actually + typing in your password, you can gdb attach and continue. +

    Some useful samba commands worth investigating: +

    • testparam | more

    • smbclient -L //{netbios name of server}

    An SMB enabled version of tcpdump is available from + http://www.tcpdup.org/. + Ethereal, another good packet sniffer for Unix and Win32 + hosts, can be downloaded from http://www.ethereal.com. +

    For tracing things on the Microsoft Windows NT, Network Monitor + (aka. netmon) is available on the Microsoft Developer Network CD's, + the Windows NT Server install CD and the SMS CD's. The version of + netmon that ships with SMS allows for dumping packets between any two + computers (i.e. placing the network interface in promiscuous mode). + The version on the NT Server install CD will only allow monitoring + of network traffic directed to the local NT box and broadcasts on the + local subnet. Be aware that Ethereal can read and write netmon + formatted files. +

  • How do I install 'Network Monitor' on an NT Workstation + or a Windows 9x box? +

    Installing netmon on an NT workstation requires a couple + of steps. The following are for installing Netmon V4.00.349, which comes + with Microsoft Windows NT Server 4.0, on Microsoft Windows NT + Workstation 4.0. The process should be similar for other version of + Windows NT / Netmon. You will need both the Microsoft Windows + NT Server 4.0 Install CD and the Workstation 4.0 Install CD. +

    Initially you will need to install 'Network Monitor Tools and Agent' + on the NT Server. To do this +

    • Goto Start - Settings - Control Panel - + Network - Services - Add

    • Select the 'Network Monitor Tools and Agent' and + click on 'OK'.

    • Click 'OK' on the Network Control Panel. +

    • Insert the Windows NT Server 4.0 install CD + when prompted.

    At this point the Netmon files should exist in + %SYSTEMROOT%\System32\netmon\*.*. + Two subdirectories exist as well, parsers\ + which contains the necessary DLL's for parsing the netmon packet + dump, and captures\. +

    In order to install the Netmon tools on an NT Workstation, you will + first need to install the 'Network Monitor Agent' from the Workstation + install CD. +

    • Goto Start - Settings - Control Panel - + Network - Services - Add

    • Select the 'Network Monitor Agent' and click + on 'OK'.

    • Click 'OK' on the Network Control Panel. +

    • Insert the Windows NT Workstation 4.0 install + CD when prompted.

    Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.* + to %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set + permissions as you deem appropriate for your site. You will need + administrative rights on the NT box to run netmon. +

    To install Netmon on a Windows 9x box install the network monitor agent + from the Windows 9x CD (\admin\nettools\netmon). There is a readme + file located with the netmon driver files on the CD if you need + information on how to do this. Copy the files from a working + Netmon installation. +

  • The following is a list if helpful URLs and other links: +

  • How do I get help from the mailing lists? +

    There are a number of Samba related mailing lists. Go to http://samba.org, click on your nearest mirror + and then click on Support and then click on Samba related mailing lists. +

    For questions relating to Samba TNG go to + http://www.samba-tng.org/ + It has been requested that you don't post questions about Samba-TNG to the + main stream Samba lists.

    If you post a message to one of the lists please observe the following guide lines : +

    • Always remember that the developers are volunteers, they are + not paid and they never guarantee to produce a particular feature at + a particular time. Any time lines are 'best guess' and nothing more. +

    • Always mention what version of samba you are using and what + operating system its running under. You should probably list the + relevant sections of your smb.conf file, at least the options + in [global] that affect PDC support.

    • In addition to the version, if you obtained Samba via + CVS mention the date when you last checked it out.

    • Try and make your question clear and brief, lots of long, + convoluted questions get deleted before they are completely read ! + Don't post html encoded messages (if you can select colour or font + size its html).

    • If you run one of those nifty 'I'm on holidays' things when + you are away, make sure its configured to not answer mailing lists. +

    • Don't cross post. Work out which is the best list to post to + and see what happens, i.e. don't post to both samba-ntdom and samba-technical. + Many people active on the lists subscribe to more + than one list and get annoyed to see the same message two or more times. + Often someone will see a message and thinking it would be better dealt + with on another, will forward it on for you.

    • You might include partial + log files written at a debug level set to as much as 20. + Please don't send the entire log but enough to give the context of the + error messages.

    • (Possibly) If you have a complete netmon trace ( from the opening of + the pipe to the error ) you can send the *.CAP file as well.

    • Please think carefully before attaching a document to an email. + Consider pasting the relevant parts into the body of the message. The samba + mailing lists go to a huge number of people, do they all need a copy of your + smb.conf in their attach directory?

  • How do I get off the mailing lists? +

    To have your name removed from a samba mailing list, go to the + same place you went to to get on it. Go to http://lists.samba.org, + click on your nearest mirror and then click on Support and + then click on Samba related mailing lists. Or perhaps see + here +

    Please don't post messages to the list asking to be removed, you will just + be referred to the above address (unless that process failed in some way...) +

6.8. Domain Control for Windows 9x/ME

The following section contains much of the original +DOMAIN.txt file previously included with Samba. Much of +the material is based on what went into the book Special +Edition, Using Samba, by Richard Sharpe.

A domain and a workgroup are exactly the same thing in terms of network +browsing. The difference is that a distributable authentication +database is associated with a domain, for secure login access to a +network. Also, different access rights can be granted to users if they +successfully authenticate against a domain logon server (NT server and +other systems based on NT server support this, as does at least Samba TNG now).

The SMB client logging on to a domain has an expectation that every other +server in the domain should accept the same authentication information. +Network browsing functionality of domains and workgroups is +identical and is explained in BROWSING.txt. It should be noted, that browsing +is totally orthogonal to logon support.

Issues related to the single-logon network model are discussed in this +section. Samba supports domain logons, network logon scripts, and user +profiles for MS Windows for workgroups and MS Windows 9X/ME clients +which will be the focus of this section.

When an SMB client in a domain wishes to logon it broadcast requests for a +logon server. The first one to reply gets the job, and validates its +password using whatever mechanism the Samba administrator has installed. +It is possible (but very stupid) to create a domain where the user +database is not shared between servers, i.e. they are effectively workgroup +servers advertising themselves as participating in a domain. This +demonstrates how authentication is quite different from but closely +involved with domains.

Using these features you can make your clients verify their logon via +the Samba server; make clients run a batch file when they logon to +the network and download their preferences, desktop and start menu.

Before launching into the configuration instructions, it is +worthwhile lookingat how a Windows 9x/ME client performs a logon:

  1. The client broadcasts (to the IP broadcast address of the subnet it is in) + a NetLogon request. This is sent to the NetBIOS name DOMAIN<1c> at the + NetBIOS layer. The client chooses the first response it receives, which + contains the NetBIOS name of the logon server to use in the format of + \\SERVER. +

  2. The client then connects to that server, logs on (does an SMBsessetupX) and + then connects to the IPC$ share (using an SMBtconX). +

  3. The client then does a NetWkstaUserLogon request, which retrieves the name + of the user's logon script. +

  4. The client then connects to the NetLogon share and searches for this + and if it is found and can be read, is retrieved and executed by the client. + After this, the client disconnects from the NetLogon share. +

  5. The client then sends a NetUserGetInfo request to the server, to retrieve + the user's home share, which is used to search for profiles. Since the + response to the NetUserGetInfo request does not contain much more + the user's home share, profiles for Win9X clients MUST reside in the user + home directory. +

  6. The client then connects to the user's home share and searches for the + user's profile. As it turns out, you can specify the user's home share as + a sharename and path. For example, \\server\fred\.profile. + If the profiles are found, they are implemented. +

  7. The client then disconnects from the user's home share, and reconnects to + the NetLogon share and looks for CONFIG.POL, the policies file. If this is + found, it is read and implemented. +

6.8.1. Configuration Instructions: Network Logons

The main difference between a PDC and a Windows 9x logon +server configuration is that

  • Password encryption is not required for a Windows 9x logon server.

  • Windows 9x/ME clients do not possess machine trust accounts.

Therefore, a Samba PDC will also act as a Windows 9x logon +server.

security mode and master browsers
 

There are a few comments to make in order to tie up some +loose ends. There has been much debate over the issue of whether +or not it is ok to configure Samba as a Domain Controller in security +modes other than USER. The only security mode +which will not work due to technical reasons is SHARE +mode security. DOMAIN and SERVER +mode security is really just a variation on SMB user level security.

Actually, this issue is also closely tied to the debate on whether +or not Samba must be the domain master browser for its workgroup +when operating as a DC. While it may technically be possible +to configure a server as such (after all, browsing and domain logons +are two distinctly different functions), it is not a good idea to +so. You should remember that the DC must register the DOMAIN#1b NetBIOS +name. This is the name used by Windows clients to locate the DC. +Windows clients do not distinguish between the DC and the DMB. +For this reason, it is very wise to configure the Samba DC as the DMB.

Now back to the issue of configuring a Samba DC to use a mode other +than "security = user". If a Samba host is configured to use +another SMB server or DC in order to validate user connection +requests, then it is a fact that some other machine on the network +(the "password server") knows more about user than the Samba host. +99% of the time, this other host is a domain controller. Now +in order to operate in domain mode security, the "workgroup" parameter +must be set to the name of the Windows NT domain (which already +has a domain controller, right?)

Therefore configuring a Samba box as a DC for a domain that +already by definition has a PDC is asking for trouble. +Therefore, you should always configure the Samba DC to be the DMB +for its domain.

6.8.2. Configuration Instructions: Setting up Roaming User Profiles

NOTE! Roaming profiles support is different +for Win9X and WinNT.

Before discussing how to configure roaming profiles, it is useful to see how +Win9X and WinNT clients implement these features.

Win9X clients send a NetUserGetInfo request to the server to get the user's +profiles location. However, the response does not have room for a separate +profiles location field, only the user's home share. This means that Win9X +profiles are restricted to being in the user's home directory.

WinNT clients send a NetSAMLogon RPC request, which contains many fields, +including a separate field for the location of the user's profiles. +This means that support for profiles is different for Win9X and WinNT.

6.8.2.1. Windows NT Configuration

To support WinNT clients, in the [global] section of smb.conf set the +following (for example):

logon path = \\profileserver\profileshare\profilepath\%U\moreprofilepath

The default for this option is \\%N\%U\profile, namely +\\sambaserver\username\profile. The \\N%\%U service is created +automatically by the [homes] service. +If you are using a samba server for the profiles, you _must_ make the +share specified in the logon path browseable.

[lkcl 26aug96 - we have discovered a problem where Windows clients can +maintain a connection to the [homes] share in between logins. The +[homes] share must NOT therefore be used in a profile path.]

6.8.2.2. Windows 9X Configuration

To support Win9X clients, you must use the "logon home" parameter. Samba has +now been fixed so that "net use/home" now works as well, and it, too, relies +on the "logon home" parameter.

By using the logon home parameter, you are restricted to putting Win9X +profiles in the user's home directory. But wait! There is a trick you +can use. If you set the following in the [global] section of your +smb.conf file:

logon home = \\%L\%U\.profiles

then your Win9X clients will dutifully put their clients in a subdirectory +of your home directory called .profiles (thus making them hidden).

Not only that, but 'net use/home' will also work, because of a feature in +Win9X. It removes any directory stuff off the end of the home directory area +and only uses the server and share portion. That is, it looks like you +specified \\%L\%U for "logon home".

6.8.2.3. Win9X and WinNT Configuration

You can support profiles for both Win9X and WinNT clients by setting both the +"logon home" and "logon path" parameters. For example:

logon home = \\%L\%U\.profiles
+logon path = \\%L\profiles\%U

I have not checked what 'net use /home' does on NT when "logon home" is +set as above.

6.8.2.4. Windows 9X Profile Setup

When a user first logs in on Windows 9X, the file user.DAT is created, +as are folders "Start Menu", "Desktop", "Programs" and "Nethood". +These directories and their contents will be merged with the local +versions stored in c:\windows\profiles\username on subsequent logins, +taking the most recent from each. You will need to use the [global] +options "preserve case = yes", "short preserve case = yes" and +"case sensitive = no" in order to maintain capital letters in shortcuts +in any of the profile folders.

The user.DAT file contains all the user's preferences. If you wish to +enforce a set of preferences, rename their user.DAT file to user.MAN, +and deny them write access to this file.

  1. On the Windows 95 machine, go to Control Panel | Passwords and + select the User Profiles tab. Select the required level of + roaming preferences. Press OK, but do _not_ allow the computer + to reboot. +

  2. On the Windows 95 machine, go to Control Panel | Network | + Client for Microsoft Networks | Preferences. Select 'Log on to + NT Domain'. Then, ensure that the Primary Logon is 'Client for + Microsoft Networks'. Press OK, and this time allow the computer + to reboot. +

Under Windows 95, Profiles are downloaded from the Primary Logon. +If you have the Primary Logon as 'Client for Novell Networks', then +the profiles and logon script will be downloaded from your Novell +Server. If you have the Primary Logon as 'Windows Logon', then the +profiles will be loaded from the local machine - a bit against the +concept of roaming profiles, if you ask me.

You will now find that the Microsoft Networks Login box contains +[user, password, domain] instead of just [user, password]. Type in +the samba server's domain name (or any other domain known to exist, +but bear in mind that the user will be authenticated against this +domain and profiles downloaded from it, if that domain logon server +supports it), user name and user's password.

Once the user has been successfully validated, the Windows 95 machine +will inform you that 'The user has not logged on before' and asks you +if you wish to save the user's preferences? Select 'yes'.

Once the Windows 95 client comes up with the desktop, you should be able +to examine the contents of the directory specified in the "logon path" +on the samba server and verify that the "Desktop", "Start Menu", +"Programs" and "Nethood" folders have been created.

These folders will be cached locally on the client, and updated when +the user logs off (if you haven't made them read-only by then :-). +You will find that if the user creates further folders or short-cuts, +that the client will merge the profile contents downloaded with the +contents of the profile directory already on the local client, taking +the newest folders and short-cuts from each set.

If you have made the folders / files read-only on the samba server, +then you will get errors from the w95 machine on logon and logout, as +it attempts to merge the local and the remote profile. Basically, if +you have any errors reported by the w95 machine, check the Unix file +permissions and ownership rights on the profile directory contents, +on the samba server.

If you have problems creating user profiles, you can reset the user's +local desktop cache, as shown below. When this user then next logs in, +they will be told that they are logging in "for the first time".

  1. instead of logging in under the [user, password, domain] dialog, + press escape. +

  2. run the regedit.exe program, and look in: +

    HKEY_LOCAL_MACHINE\Windows\CurrentVersion\ProfileList +

    you will find an entry, for each user, of ProfilePath. Note the + contents of this key (likely to be c:\windows\profiles\username), + then delete the key ProfilePath for the required user. +

    [Exit the registry editor]. +

  3. WARNING - before deleting the contents of the + directory listed in + the ProfilePath (this is likely to be c:\windows\profiles\username), + ask them if they have any important files stored on their desktop + or in their start menu. delete the contents of the directory + ProfilePath (making a backup if any of the files are needed). +

    This will have the effect of removing the local (read-only hidden + system file) user.DAT in their profile directory, as well as the + local "desktop", "nethood", "start menu" and "programs" folders. +

  4. search for the user's .PWL password-caching file in the c:\windows + directory, and delete it. +

  5. log off the windows 95 client. +

  6. check the contents of the profile path (see "logon path" described + above), and delete the user.DAT or user.MAN file for the user, + making a backup if required. +

If all else fails, increase samba's debug log levels to between 3 and 10, +and / or run a packet trace program such as tcpdump or netmon.exe, and +look for any error reports.

If you have access to an NT server, then first set up roaming profiles +and / or netlogons on the NT server. Make a packet trace, or examine +the example packet traces provided with NT server, and see what the +differences are with the equivalent samba trace.

6.8.2.5. Windows NT Workstation 4.0

When a user first logs in to a Windows NT Workstation, the profile +NTuser.DAT is created. The profile location can be now specified +through the "logon path" parameter.

[lkcl 10aug97 - i tried setting the path to +\\samba-server\homes\profile, and discovered that this fails because +a background process maintains the connection to the [homes] share +which does _not_ close down in between user logins. you have to +have \\samba-server\%L\profile, where user is the username created +from the [homes] share].

There is a parameter that is now available for use with NT Profiles: +"logon drive". This should be set to "h:" or any other drive, and +should be used in conjunction with the new "logon home" parameter.

The entry for the NT 4.0 profile is a _directory_ not a file. The NT +help on profiles mentions that a directory is also created with a .PDS +extension. The user, while logging in, must have write permission to +create the full profile path (and the folder with the .PDS extension) +[lkcl 10aug97 - i found that the creation of the .PDS directory failed, +and had to create these manually for each user, with a shell script. +also, i presume, but have not tested, that the full profile path must +be browseable just as it is for w95, due to the manner in which they +attempt to create the full profile path: test existence of each path +component; create path component].

In the profile directory, NT creates more folders than 95. It creates +"Application Data" and others, as well as "Desktop", "Nethood", +"Start Menu" and "Programs". The profile itself is stored in a file +NTuser.DAT. Nothing appears to be stored in the .PDS directory, and +its purpose is currently unknown.

You can use the System Control Panel to copy a local profile onto +a samba server (see NT Help on profiles: it is also capable of firing +up the correct location in the System Control Panel for you). The +NT Help file also mentions that renaming NTuser.DAT to NTuser.MAN +turns a profile into a mandatory one.

[lkcl 10aug97 - i notice that NT Workstation tells me that it is +downloading a profile from a slow link. whether this is actually the +case, or whether there is some configuration issue, as yet unknown, +that makes NT Workstation _think_ that the link is a slow one is a +matter to be resolved].

[lkcl 20aug97 - after samba digest correspondence, one user found, and +another confirmed, that profiles cannot be loaded from a samba server +unless "security = user" and "encrypt passwords = yes" (see the file +ENCRYPTION.txt) or "security = server" and "password server = ip.address. +of.yourNTserver" are used. Either of these options will allow the NT +workstation to access the samba server using LAN manager encrypted +passwords, without the user intervention normally required by NT +workstation for clear-text passwords].

[lkcl 25aug97 - more comments received about NT profiles: the case of +the profile _matters_. the file _must_ be called NTuser.DAT or, for +a mandatory profile, NTuser.MAN].

6.8.2.6. Windows NT Server

There is nothing to stop you specifying any path that you like for the +location of users' profiles. Therefore, you could specify that the +profile be stored on a samba server, or any other SMB server, as long as +that SMB server supports encrypted passwords.

6.8.2.7. Sharing Profiles between W95 and NT Workstation 4.0

Potentially outdated or incorrect material follows
 

I think this is all bogus, but have not deleted it. (Richard Sharpe)

The default logon path is \\%N\%U. NT Workstation will attempt to create +a directory "\\samba-server\username.PDS" if you specify the logon path +as "\\samba-server\username" with the NT User Manager. Therefore, you +will need to specify (for example) "\\samba-server\username\profile". +NT 4.0 will attempt to create "\\samba-server\username\profile.PDS", which +is more likely to succeed.

If you then want to share the same Start Menu / Desktop with W95, you will +need to specify "logon path = \\samba-server\username\profile" [lkcl 10aug97 +this has its drawbacks: i created a shortcut to telnet.exe, which attempts +to run from the c:\winnt\system32 directory. this directory is obviously +unlikely to exist on a Win95-only host].

If you have this set up correctly, you will find separate user.DAT and +NTuser.DAT files in the same profile directory.

[lkcl 25aug97 - there are some issues to resolve with downloading of +NT profiles, probably to do with time/date stamps. i have found that +NTuser.DAT is never updated on the workstation after the first time that +it is copied to the local workstation profile directory. this is in +contrast to w95, where it _does_ transfer / update profiles correctly].

6.9. DOMAIN_CONTROL.txt : Windows NT Domain Control & Samba

Possibly Outdated Material
 

This appendix was originally authored by John H Terpstra of + the Samba Team and is included here for posterity. +

NOTE : +The term "Domain Controller" and those related to it refer to one specific +method of authentication that can underly an SMB domain. Domain Controllers +prior to Windows NT Server 3.1 were sold by various companies and based on +private extensions to the LAN Manager 2.1 protocol. Windows NT introduced +Microsoft-specific ways of distributing the user authentication database. +See DOMAIN.txt for examples of how Samba can participate in or create +SMB domains based on shared authentication database schemes other than the +Windows NT SAM.

Windows NT Server can be installed as either a plain file and print server +(WORKGROUP workstation or server) or as a server that participates in Domain +Control (DOMAIN member, Primary Domain controller or Backup Domain controller). +The same is true for OS/2 Warp Server, Digital Pathworks and other similar +products, all of which can participate in Domain Control along with Windows NT.

To many people these terms can be confusing, so let's try to clear the air.

Every Windows NT system (workstation or server) has a registry database. +The registry contains entries that describe the initialization information +for all services (the equivalent of Unix Daemons) that run within the Windows +NT environment. The registry also contains entries that tell application +software where to find dynamically loadable libraries that they depend upon. +In fact, the registry contains entries that describes everything that anything +may need to know to interact with the rest of the system.

The registry files can be located on any Windows NT machine by opening a +command prompt and typing:

C:\WINNT\> dir %SystemRoot%\System32\config

The environment variable %SystemRoot% value can be obtained by typing:

C:\WINNT>echo %SystemRoot%

The active parts of the registry that you may want to be familiar with are +the files called: default, system, software, sam and security.

In a domain environment, Microsoft Windows NT domain controllers participate +in replication of the SAM and SECURITY files so that all controllers within +the domain have an exactly identical copy of each.

The Microsoft Windows NT system is structured within a security model that +says that all applications and services must authenticate themselves before +they can obtain permission from the security manager to do what they set out +to do.

The Windows NT User database also resides within the registry. This part of +the registry contains the user's security identifier, home directory, group +memberships, desktop profile, and so on.

Every Windows NT system (workstation as well as server) will have its own +registry. Windows NT Servers that participate in Domain Security control +have a database that they share in common - thus they do NOT own an +independent full registry database of their own, as do Workstations and +plain Servers.

The User database is called the SAM (Security Access Manager) database and +is used for all user authentication as well as for authentication of inter- +process authentication (i.e. to ensure that the service action a user has +requested is permitted within the limits of that user's privileges).

The Samba team have produced a utility that can dump the Windows NT SAM into +smbpasswd format: see ENCRYPTION.txt for information on smbpasswd and +/pub/samba/pwdump on your nearest Samba mirror for the utility. This +facility is useful but cannot be easily used to implement SAM replication +to Samba systems.

Windows for Workgroups, Windows 95, and Windows NT Workstations and Servers +can participate in a Domain security system that is controlled by Windows NT +servers that have been correctly configured. Almost every domain will have +ONE Primary Domain Controller (PDC). It is desirable that each domain will +have at least one Backup Domain Controller (BDC).

The PDC and BDCs then participate in replication of the SAM database so that +each Domain Controlling participant will have an up to date SAM component +within its registry.

PrevHomeNext
Type of installationUpHow to Act as a Backup Domain Controller in a Purely Samba Controlled Domain
\ No newline at end of file diff --git a/docs/htmldocs/vfstest.1.html b/docs/htmldocs/vfstest.1.html new file mode 100644 index 0000000000..3db7ff3d97 --- /dev/null +++ b/docs/htmldocs/vfstest.1.html @@ -0,0 +1,496 @@ + +vfstest

vfstest

Name

vfstest -- tool for testing samba VFS modules

Synopsis

vfstest [-d debuglevel] [-c command] [-l logfile] [-h]

DESCRIPTION

This tool is part of the Samba suite.

vfstest is a small command line + utility that has the ability to test dso samba VFS modules. It gives the + user the ability to call the various VFS functions manually and + supports cascaded VFS modules. +

OPTIONS

-c|--command=command

Execute the specified (colon-seperated) commands. + See below for the commands that are available. +

-d|--debug=debuglevel

debuglevel is an integer +from 0 to 10. The default value if this parameter is +not specified is zero.

The higher this value, the more detail will be +logged to the log files about the activities of the +server. At level 0, only critical errors and serious +warnings will be logged. Level 1 is a reasonable level for +day to day running - it generates a small amount of +information about operations carried out.

Levels above 1 will generate considerable +amounts of log data, and should only be used when +investigating a problem. Levels above 3 are designed for +use only by developers and generate HUGE amounts of log +data, most of which is extremely cryptic.

Note that specifying this parameter here will +override the log +level parameter in the smb.conf(5) file.

-h|--help

Print a summary of command line options.

-l|--logfile=logbasename

File name for log/debug files. The extension + '.client' will be appended. The log file is never removed + by the client. +

COMMANDS

VFS COMMANDS

GENERAL COMMANDS

VERSION

This man page is correct for version 3.0 of the Samba + suite.

AUTHOR

The original Samba software and related utilities + were created by Andrew Tridgell. Samba is now developed + by the Samba Team as an Open Source project similar + to the way the Linux kernel is developed.

The vfstest man page was written by Jelmer Vernooij.

\ No newline at end of file diff --git a/docs/htmldocs/wfw_slip.htm b/docs/htmldocs/wfw_slip.htm deleted file mode 100644 index 5b4a0a5e53..0000000000 --- a/docs/htmldocs/wfw_slip.htm +++ /dev/null @@ -1,175 +0,0 @@ - - -Peter Karrer Announces SLIP for WFW - - -

Winserve

-
-

Peter Karrer Announces SLIP for WFW

-[NEW 03-22-95) -
-Hello, -

-I've discovered a way to run WfW's TCP/IP-32 over a SLIP packet driver. This -allows WfW users to do Windows networking over dialup lines just like it is -possible with NT and the Windows 95 beta! -

-For instance, you can mount Microsoft's FTP server as a network drive in File -Manager or connect to an MS Mail post office over the Internet. Of course, -the usual Internet stuff works as well. Another interesting site is -WINSERVE.001; check out www.winserve.com. -

-This method should work with any class 1 (Ethernet II) packet driver. However, -I'm not in a position to try anything else than SLIPPER/CSLIPPER. -
-

Files you need:

-WFWT32.EXE: ftp://ftp.microsoft.com/bussys/msclient/wfw/wfwt32.exe -

- Microsoft's free TCP/IP for WfW. It's a self-extracting archive which - should be executed in an empty directory. -

-SLIPPER.EXE: ftp://biocserver.bioc.cwru.edu/pub/dos/slipper/slippr15.zip -

- Peter Tattam's SLIP packet driver. CSLIPPER.EXE is a variant which supports - VJ header compression. -

-PDETHER.EXE: ftp://sjf-lwp.idz.sjf.novell.com/odi/pdether/pde105.zip -

- Don Provan's ODI-over-Packet Driver shim. This *must* be version 1.05 (or - above). -

-LSL.COM: -

- Novell's LAN Support Layer. If you're an owner of Windows 3.10, you'll - have it on one of your install disks. Use "expand a:lsl.co_ lsl.com" to - expand it. Microsoft has stopped bundling LSL.COM with WfW 3.11, though. - The newest version of LSL.COM can be downloaded as part of - ftp://ftp.novell.com/pub/netware/nwos/dosclnt12/vlms/vlmup2.exe. - However, it's not clear if this one may be legally used outside Netware - environments. -

-NET.CFG: -

- A configuration file for LSL and PDETHER. It should contain the following - text: -

-

-Link Support
-        Buffers 8 1600
-Link Driver PDETHER
-        Int 60
-        Frame Ethernet_II
-        Protocol IP   800  Ethernet_II
-        Protocol ARP  806  Ethernet_II
-        Protocol RARP 8035 Ethernet_II
-
-

-DISCOMX.COM: -

- A little hack of mine to disable the COM port used by the SLIP packet driver. - Usage is e.g. "discomx 2" to disable COM2. This should be run before - starting WfW, otherwise you'll get "device conflict" messages. Here it is: -

-begin 644 discomx.com
-F,=N)V8H.@`"P(+^!`/.N3XH="=MT!DN`XP/1XS')!R:)CP`$S2``
-`
-end
-
- (Save this text to disk as filename, then run "uudecode filename". - uudecode can be found, for instance, at - ftp://ftp.switch.ch/mirror/simtel/msdos/starter/uudecode.com ) -

-LMHOSTS: -

- An optional file which should be stored in your Windows subdirectory. It is - used to map NetBIOS computer names to IP addresses. Example: -

-

-198.105.232.1   ftp             #PRE  # ftp.microsoft.com
-204.118.34.11   winserve.001    #PRE  # Winserve
-
-
-

How to install it:

-

-

-
-

How it works:

-

-Microsoft's TCP/IP-32 requires an NDIS3 interface. NDIS is Microsoft's way -to interface with a network. -

-WfW also contains an NDIS3-over-ODI "shim", whose real mode component is -ODIHLP.EXE. ODI is Novell's way to interface with a network. -

-SLIPPER is a Packet Driver (PD) for use over serial lines. PDs are everybody -else's way to interface with a network. SLIPPER's "ether" option makes it -look like an Ethernet PD to applications using it. -

-A "shim" is a program which simulates a network application programming -interface on top of another. -

-There is no NDIS SLIP driver which would work with WfW. -

-There is no NDIS-over-PD shim. -

-However, there's an ODI-over-PD shim (PDETHER) and an NDIS-over-ODI shim -(ODIHLP etc.) -

-OK, so let's do NDIS-over-ODI-over-PD! -

-This should have worked all the time; however, a non-feature in PDETHER -versions < 1.05 has prevented the method from functioning until now. -

-Questions, suggestions etc. please to -

-

-Peter Karrer		pkarrer@ife.ee.ethz.ch
-
- - - diff --git a/docs/manpages/net.8 b/docs/manpages/net.8 index 7a6a5c18c6..bf2b13997c 100644 --- a/docs/manpages/net.8 +++ b/docs/manpages/net.8 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "NET" "8" "03 October 2002" "" "" +.TH "NET" "8" "05 November 2002" "" "" .SH NAME net \- Tool for administration of Samba and remote CIFS servers. .SH SYNOPSIS diff --git a/docs/manpages/smbcacls.1 b/docs/manpages/smbcacls.1 index fccb6ec887..47be19d3d9 100644 --- a/docs/manpages/smbcacls.1 +++ b/docs/manpages/smbcacls.1 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "SMBCACLS" "1" "01 October 2002" "" "" +.TH "SMBCACLS" "1" "05 November 2002" "" "" .SH NAME smbcacls \- Set or get ACLs on an NT file or directory names .SH SYNOPSIS diff --git a/docs/manpages/smbcontrol.1 b/docs/manpages/smbcontrol.1 index b60841dc94..f78c4b96d4 100644 --- a/docs/manpages/smbcontrol.1 +++ b/docs/manpages/smbcontrol.1 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "SMBCONTROL" "1" "01 October 2002" "" "" +.TH "SMBCONTROL" "1" "05 November 2002" "" "" .SH NAME smbcontrol \- send messages to smbd, nmbd or winbindd processes .SH SYNOPSIS diff --git a/docs/manpages/smbd.8 b/docs/manpages/smbd.8 index 7e1b35d5aa..5d1f6bc46e 100644 --- a/docs/manpages/smbd.8 +++ b/docs/manpages/smbd.8 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "SMBD" "8" "01 October 2002" "" "" +.TH "SMBD" "8" "05 November 2002" "" "" .SH NAME smbd \- server to provide SMB/CIFS services to clients .SH SYNOPSIS diff --git a/docs/manpages/smbgroupedit.8 b/docs/manpages/smbgroupedit.8 index 3ee7980e5d..0aebf3276e 100644 --- a/docs/manpages/smbgroupedit.8 +++ b/docs/manpages/smbgroupedit.8 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "SMBGROUPEDIT" "8" "01 October 2002" "" "" +.TH "SMBGROUPEDIT" "8" "05 November 2002" "" "" .SH NAME smbgroupedit \- Query/set/change UNIX - Windows NT group mapping .SH SYNOPSIS diff --git a/docs/manpages/smbmnt.8 b/docs/manpages/smbmnt.8 index b316268b0c..6f7d79ea5d 100644 --- a/docs/manpages/smbmnt.8 +++ b/docs/manpages/smbmnt.8 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "SMBMNT" "8" "01 October 2002" "" "" +.TH "SMBMNT" "8" "05 November 2002" "" "" .SH NAME smbmnt \- helper utility for mounting SMB filesystems .SH SYNOPSIS diff --git a/docs/manpages/smbmount.8 b/docs/manpages/smbmount.8 index ac67d0ee60..525a10be7f 100644 --- a/docs/manpages/smbmount.8 +++ b/docs/manpages/smbmount.8 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "SMBMOUNT" "8" "01 October 2002" "" "" +.TH "SMBMOUNT" "8" "05 November 2002" "" "" .SH NAME smbmount \- mount an smbfs filesystem .SH SYNOPSIS diff --git a/docs/manpages/smbpasswd.8 b/docs/manpages/smbpasswd.8 index ee097cf6f1..e0fe91afe1 100644 --- a/docs/manpages/smbpasswd.8 +++ b/docs/manpages/smbpasswd.8 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "SMBPASSWD" "8" "01 October 2002" "" "" +.TH "SMBPASSWD" "8" "05 November 2002" "" "" .SH NAME smbpasswd \- change a user's SMB password .SH SYNOPSIS diff --git a/docs/manpages/smbsh.1 b/docs/manpages/smbsh.1 index b2eec12c81..6aa70c470c 100644 --- a/docs/manpages/smbsh.1 +++ b/docs/manpages/smbsh.1 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "SMBSH" "1" "01 October 2002" "" "" +.TH "SMBSH" "1" "05 November 2002" "" "" .SH NAME smbsh \- Allows access to Windows NT filesystem using UNIX commands .SH SYNOPSIS diff --git a/docs/manpages/smbspool.8 b/docs/manpages/smbspool.8 index e9496e7a74..708b68b4d4 100644 --- a/docs/manpages/smbspool.8 +++ b/docs/manpages/smbspool.8 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "SMBSPOOL" "8" "01 October 2002" "" "" +.TH "SMBSPOOL" "8" "05 November 2002" "" "" .SH NAME smbspool \- send a print file to an SMB printer .SH SYNOPSIS diff --git a/docs/manpages/smbstatus.1 b/docs/manpages/smbstatus.1 index fc452ae731..0d2833025f 100644 --- a/docs/manpages/smbstatus.1 +++ b/docs/manpages/smbstatus.1 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "SMBSTATUS" "1" "01 October 2002" "" "" +.TH "SMBSTATUS" "1" "05 November 2002" "" "" .SH NAME smbstatus \- report on current Samba connections .SH SYNOPSIS diff --git a/docs/manpages/smbtar.1 b/docs/manpages/smbtar.1 index bee874dcba..93077fc16d 100644 --- a/docs/manpages/smbtar.1 +++ b/docs/manpages/smbtar.1 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "SMBTAR" "1" "01 October 2002" "" "" +.TH "SMBTAR" "1" "05 November 2002" "" "" .SH NAME smbtar \- shell script for backing up SMB/CIFS shares directly to UNIX tape drives .SH SYNOPSIS diff --git a/docs/manpages/smbumount.8 b/docs/manpages/smbumount.8 index da16cc5288..013e5dd79e 100644 --- a/docs/manpages/smbumount.8 +++ b/docs/manpages/smbumount.8 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "SMBUMOUNT" "8" "01 October 2002" "" "" +.TH "SMBUMOUNT" "8" "05 November 2002" "" "" .SH NAME smbumount \- smbfs umount for normal users .SH SYNOPSIS diff --git a/docs/manpages/swat.8 b/docs/manpages/swat.8 index c097dd499b..7ec1892131 100644 --- a/docs/manpages/swat.8 +++ b/docs/manpages/swat.8 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "SWAT" "8" "01 October 2002" "" "" +.TH "SWAT" "8" "05 November 2002" "" "" .SH NAME swat \- Samba Web Administration Tool .SH SYNOPSIS diff --git a/docs/manpages/testparm.1 b/docs/manpages/testparm.1 index a53e066acf..a519fd6930 100644 --- a/docs/manpages/testparm.1 +++ b/docs/manpages/testparm.1 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "TESTPARM" "1" "01 October 2002" "" "" +.TH "TESTPARM" "1" "05 November 2002" "" "" .SH NAME testparm \- check an smb.conf configuration file for internal correctness .SH SYNOPSIS diff --git a/docs/manpages/testprns.1 b/docs/manpages/testprns.1 index 5d5cb97f31..dc44a7d1bf 100644 --- a/docs/manpages/testprns.1 +++ b/docs/manpages/testprns.1 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "TESTPRNS" "1" "01 October 2002" "" "" +.TH "TESTPRNS" "1" "05 November 2002" "" "" .SH NAME testprns \- check printer name for validity with smbd .SH SYNOPSIS diff --git a/docs/manpages/winbindd.8 b/docs/manpages/winbindd.8 index 21c5cc0635..6ac186cbab 100644 --- a/docs/manpages/winbindd.8 +++ b/docs/manpages/winbindd.8 @@ -3,7 +3,7 @@ .\" .\" Please send any bug reports, improvements, comments, patches, .\" etc. to Steve Cheng . -.TH "WINBINDD" "8" "18 oktober 2002" "" "" +.TH "WINBINDD" "8" "05 November 2002" "" "" .SH NAME winbindd \- Name Service Switch daemon for resolving names from NT servers .SH SYNOPSIS -- cgit