DavidBannon La Trobe University

dbannon@samba.org

November 2000 It should be noted that 2.2.0 in its pre-release form still has a few problems, I'll try and keep this section current while things are still dynamic. At the time of this update (December 15, 2000) the current state of play is : Comments here about W2K joining the domain apply only to Samba 2.2 from the CVS after November 27th. The 'snapshot' release Samba2.2alpha1 does not work !!! See below on how to get a CVS tree. Known Bug !W2K machines will not successfully join a domain with a name that is made up from an even number of characters. Yep, thats right ! BIOTEST is OK as is MYDOMAI but MYDOMAIN will not work until this bug is fixed. Hmm.., we believe that this bug is fixed, but see below. Known Bug !After some bugs were fixed just before Christmas, W2K SP1 machines cannot join the domain. Expected to be fixed early in the new year. Whats that ? yeah, samba developers have a Christmas break too ! Know Bug !NTs (and possibly W2K ?) are not told the logged on user is a domain admin if the parameter "domain admin users = user" is used. The alternative, "domain admin group" does work. See the HowTo. Client Side creation of Machine accounts does work but is not complete. Firstly, the add user script runs as the user who's name was entered, not as root. Secondly, the machine name passed to the script (%U) has an underscore at the end, not a '$'. One alternative is to use %m and add the $. This method is documented in the HowTo. And thirdly, it does not work with NT4ws. A W2K machine can join the domain. See the HowTo which explains the process. The methods described are 'work arounds' and should be regarded as temporary. Although I (drb) have tested these procedures a number of people have had difficulty so there may be other issues at work. JFM is aware of these problems and will attend to them when he can. A Domain Admin account is required and at present it appears that only root is a suitable candidate. Much of the related code does work. For example, if an NT is removed from the domain and then rejoins, the Create a Computer Account in the Domain dialog will let you reset the smbpasswd. That is you don't need to do it from the unix box. However, at the present, you do need to have root as an administrator and use the root user name and password. Actually I'm not sure that last paragraph is correct .... Policies do work on a W2K machine. MS says that recent builds of W2K dont observe an NT policy but it appears it does in 'legacy' mode. Trust relationships PDC and BDC integration Windows NT ACLs (on the Samba shares) Offer a list of domain users to User Manager for Domains (or the Security Tab etc). CVS is a programme (publically available) that the Samba developers use to maintain the central source code. Non developers can get access to the source in a read only capacity. Many flavours of unix now arrive with cvs installed. Every NT, W2K or Samba machine that joins a Samba controlled domain must be known to the Samba PDC. There are two entries required, one in (typically) /etc/passwd and the other in (typically) /usr/local/samba/private/smbpasswd. Under some circumstances these entries are made manually, the HowTo discusses ways of creating them automatically. This was the only option until recently, now in version 2.2 better means are available. You might still need to do it manually for a couple of reasons. A machine account consists of two entries (assuming a standard install and /etc/passwd use), one in /etc/passwd and the other in /usr/local/samba/private/smbpasswd. The /etc/passwd entry will list the machine name with a $ appended, won't have a passwd, will have a null shell and no home directory. For example a machine called 'doppy' would have an /etc/passwd entry like this : doppy$:x:505:501:NTMachine:/dev/null:/bin/false On a linux system for example, you would typically add it like this : adduser -g machines -c NTMachine -d /dev/null -s /bin/false -n doppy$ Then you need to add that entry to smbpasswd, assuming you have a suitable path to the smbpasswd programme, do this : smbpasswd -a -m doppy$ The entry will be created with a well known password, so any machine that says its doppy could join the domain as long as it gets in first. So don't create the accounts any earlier than you need them. A 'machine name' in (typically) /etc/passwd consists of the machine name with a '$' appended. FreeBSD (and other BSD systems ?) won't create a user with a '$' in their name. The problem is only in the program used to make the entry, once made, it works perfectly. So create a user without the '$' and use vipw to edit the entry, adding the '$'. Or create the whole entry with vipw if you like, make sure you use a unique uid ! See the NTDom HowTo. There can be several reasons for this. Make sure that the time on the client and the PDC are synchronized. You can accomplish this by executing a net time \\server /set /yes replacing server with the name of your PDC (or another synchronized SMB server). See about Setting Time Make sure that the logon path is writeable by the user and make sure that the connection to the logon path location is by the current user. Sometimes Windows client do not drop the connection immediately upon logoff. Some people have reported that the logon path location should also be browseable. I (GC) have yet to emperically verify this, but you can try. When a user logs onto the domain via a client machine, the PDC sends the client machine a list of things contained in the 'policy' (if it exists). This list may do things like suppress a splach screen, format the dates the way you like them or perhaps remove locally stored profiles. On a samba PDC this list is obtained from a file called ntconfig.pol and located in the [netlogon]share. The file is created with a policy editor and must be readable by anyone and writeable by only root. See below for how to get a suitable editor. There are two possible reasons for system policies not functioning correctly. Make sure that you have the following parameters set in smb.conf [netlogon] .... locking = no public = no browseable = yes .... A policy file must be in the [netlogon] share and must be readable by everyone and writeable by only root. The file must be created by an NTServer Policy Editor. Last time I (drb) looked in the source, it was looking for ntconfig.pol first then several other combinations of upper and lower case. People have reported success using NTconfig.pol, NTconfig.POL and ntconfig.pol. These are the case settings that I (GC) use with the filename ntconfig.pol case sensitive = no case preserve = yes default case = yes To create or edit ntconfig.pol you must use the NT Server Policy Editor, poledit.exe which is included with NT Server but not NT Workstation. There is a Policy Editor on a NTws but it is not suitable for creating Domain Policies. Further, although the Windows 95 Policy Editor can be installed on an NT Workstation/Server, it will not work with NT policies because the registry key that are set by the policy templates. However, the files from the NT Server will run happily enough on an NTws. You need poledit.exe, common.adm and winnt.adm. It is convenient to put the two *.adm files in c:\winnt\inf which is where the binary will look for them unless told otherwise. Note also that that directory is 'hidden'. The Windows NT policy editor is also included with the Service Pack 3 (and later) for Windows NT 4.0. Extract the files using servicepackname /x, ie thats Nt4sp6ai.exe /x for service pack 6a. The policy editor, poledt.exe and the associated template files (*.adm) should be extracted as well. It is also possible to downloaded the policy template files for Office97 and get a copy of the policy editor. Another possible location is with the Zero Administration Kit available for download from Microsoft. Install the group policy handler for Win9x to pick up group policies. Look on the Win98 CD in \tools\reskit\netadmin\poledit. Install group policies on a Win9x client by double-clicking grouppol.inf. Log off and on again a couple of times and see if Win98 picks up group policies. Unfortunately this needs to be done on every Win9x machine that uses group policies.... If group policies don't work one reports suggests getting the updated (read: working) grouppol.dll for Windows 9x. The group list is grabbed from /etc/group. NTws users can change their domain password by pressing Ctrl-Alt-Del and choosing 'Change Password'. By default however, this does not change the unix password (typically in /etc/passwd or /etc/shadow). In lots of situations thats OK, for example : The server is only accessible to the user via samba. Pam_smb or similar is installed so other applications still refer to the samba password. But sometimes you really do need to maintain two seperate password databases and there are good reasons to keep then in sync. Trying to explain to users that they need to change their passwords in two seperate places or use two seperate passwords is not fun. However do understand that setting up password sync is not without problems either. The chief difficulty is the interface between Samba and the passwd command, it can be a fiddle to set up and if the password the user has entered fails, the resulting errors are ambiguously reported and the user is confused. Further, you need to take steps to ensure that users only ever change their passwords via samba (or use smbpasswd), otherwise they will only be changing the unix password. There are a number of Windows or DOS based editors that will understand, and leave intact, the unix eof (as opposed to a DOS CL/LF). List members suggested : UltraEdit at www.ultraedit.com VI for windows at home.snafu.de/ramo/WinViEn.htm The author prefers PFE at www.lancs.ac.uk/people/cpaap/pfe/ but its no longer being developed... Since I don't need to buy an NT Server CD now, how do I get the 'User Manager for Domains', the 'Server Manager' ? Server Manager User Manager for Domains Event Viewer Click here to download the archived file ftp://ftp.microsoft.com/Softlib/MSLFILES/NEXUS.EXE The Windows NT 4.0 version of the 'User Manager for Domains' and 'Server Manager' are available from Microsoft via ftp from ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE If it works OK when you log on as Domain Admin then the problem is that ordinary users don't have permission to change the time. (The system is running with their permission at logon time.) This is not a Samba problem, you will have the same problem where ever you connect. You can give 'everyone' permission to change the time from the User Manager. Anyone know what the registry settings are so this could be done with a Policy ? In a domain that has a number of servers you only need one password database. The machines that don't have their own ask the PDC to check for them. This will work fine for a domain controlled by either a Samba or NT machine. The following lines in smb.conf are typical, 'password server' points to the samba machine (or an NT) that has the password list : [global] ... security = domain workgroup = { Put your domain name here } password server = { Put the ip of the PDC here } encrypt passwords = yes ... The samba server in question will have to 'join the domain', that requires the domain controller to have a machine account for it. This is no different to the machine account requirements to allow a NTws to join the domain. For example, if we want a unix box called sleepy to ask the PDC called grumpy to do its authentication then grumpy will need an entry in its smbpasswd (assuming it's also samba) that starts with sleepy$. It would have to be created manually. If the domain is controlled by an NTServer then the "Server Manager for Domains" tool must be used to add 'sleepy' to the domain list. In either case we then join the domain. If the domain is called forest then on sleepy we would join the domain by typing : smbpasswd -j forest Note that the directory where the smbpasswd file would be located should exist as this is where smbd will generate the MACHINE.SID file. This might be /usr/local/samba/private/FOREST.SLEEPY.SID and it contains the trust account password for the domain member. The permissions are (and should remain) "rw------- Note the Samba Servers without the password list will most likely still need an account for each user, this means a line in its /etc/passwd. Because authentication is being handled at the domain level the /etc/passwd line does not need a password. If the shares being offered are not user specific, ie a common (read only ?) area or perhaps just printing then the user's /etc/passwd does not need a home directory. A typical line in /etc/passwd for a server that allows domain users to connect to the samba shares but does not offer a home share ('cos that's on the PDC) and does not allow logon to the unix prompt would be like this : jblow:x:542:100:Joe Blow:/dev/null:/bin/false One of the best diagnostic tools for debugging problems is Samba itself. You can use the -d option for both smbd and nmbd to specifiy what 'debug level' at which to run. See the man pages on smbd, nmbd and smb.conf for more information on debugging options. The debug level can range from 1 (the default) to around 100 but a debug level of about 20 will normally help you find any errors that samba is encountering. Another helpful method of debugging is to compile samba using the gcc -g flag. This will include debug information in the binaries and allow you to attch gdb to the running smbd / nmbd process. In order to attach gdb to an smbd process for an NT workstation, first get the workstation to make the connection. Pressing ctrl-alt-delete and going down to the domain box is sufficient (at least, on the first time you join the domain) to generate a 'LsaEnumTrustedDomains'. Thereafter, the workstation maintains an open connection, and therefore there will be an smbd process running (assuming that you haven't set a really short smbd idle timeout) So, in between pressing ctrl alt delete, and actually typing in your password, you can gdb attach and continue. Installing netmon on an NT workstation requires a couple of steps. The following are for installing Netmon V4.00.349, which comes with Microsoft Windows NT Server 4.0, on Microsoft Windows NT Workstation 4.0. The process should be similar for other version of Windows NT / Netmon. You will need both the Microsoft Windows NT Server 4.0 Install CD and the Workstation 4.0 Install CD. Initially you will need to install 'Network Monitor Tools and Agent' on the NT Server. To do this Goto Start - Settings - Control Panel - Network - Services - Add Select the 'Network Monitor Tools and Agent' and click on 'OK'. Click 'OK' on the Network Control Panel. Insert the Windows NT Server 4.0 install CD when prompted. At this point the Netmon files should exist in %SYSTEMROOT%\System32\netmon\*.*. Two subdirectories exist as well, parsers\ which contains the necessary DLL's for parsing the netmon packet dump, and captures\. In order to install the Netmon tools on an NT Workstation, you will first need to install the 'Network Monitor Agent' from the Workstation install CD. Goto Start - Settings - Control Panel - Network - Services - Add Select the 'Network Monitor Agent' and click on 'OK'. Click 'OK' on the Network Control Panel. Insert the Windows NT Workstation 4.0 install CD when prompted. Now copy the files from the NT Server in %SYSTEMROOT%\System32\netmon\*.* to %SYSTEMROOT%\System32\netmon\*.* on the Workstation and set permissions as you deem appropriate for your site. You will need administrative rights on the NT box to run netmon. To install Netmon on a Windows 9x box install the network monitor agent from the Windows 9x CD (\admin\nettools\netmon). There is a readme file located with the netmon driver files on the CD if you need information on how to do this. Copy the files from a working Netmon installation. There are many sources of information available in the form of mailing lists, RFC's and documentation. The docs that come with the samba distribution contain very good explanations of general SMB topics such as browsing. Home of Samba site http://samba.org. We have a mirror near you ! The Development document on the Samba mirrors might mention your problem. If so, it might mean that the developers are working on it. Ignacio Coupeau has a very comprehesive look at LDAP with Samba at http://www.unav.es/cti/ldap-smb-howto.html Be a little carefull however, I suspect that it does not specificly address samba 2.2.x. The HEAD pre-2.1 may possibly be the best stream to look at. Lars Kneschke's site covers Samba-TNG at http://www.kneschke.de/projekte/samba_tng, but again, a lot of it does not apply to the main stream Samba. See how Scott Merrill simulates a BDC behaviour at http://www.skippy.net/linux/smb-howto.html. Although 2.0.7 has almost had its day as a PDC, I (drb) will keep the 2.0.7 PDC pages at http://bioserve.latrobe.edu.au/samba going for a while yet. Misc links to CIFS information http://samba.org/cifs/ NT Domains for Unix http://mailhost.cb1.com/~lkcl/ntdom/ FTP site for older SMB specs: ftp://ftp.microsoft.com/developr/drg/CIFS/ CIFS/E Browser Protocol draft-leach-cifs-browser-spec-00.txt CIFS Remote Administration Protocol draft-leach-cifs-rap-spec-00.txt CIFS Logon and Pass Through Authentication draft-leach-cifs-logon-spec-00.txt A Common Internet File System (CIFS/1.0) Protocol draft-leach-cifs-v1-spec-01.txt CIFS Printing Specification draft-leach-cifs-print-spec-00.txt RFC1001 (March '87) Protocol standard for a NetBIOS service on a TCP/UDP transport: Concepts and methods. http://ds.internic.net/rfc/rfc1001.txt RFC1002 (March '87) Protocol standard for a NetBIOS service on a TCP/UDP transport: Detailed specifications. http://ds.internic.net/rfc/rfc1002.txt Microsoft's main CIFS page: http://www.microsoft.com/workshop/networking/cifs/ There are a number of Samba related mailing lists. Go to http://samba.org, click on your nearest mirror and then click on Support and then click on Samba related mailing lists. For questions relating to Samba TNG go to http://www.samba-tng.org/ It has been requested that you don't post questions about Samba-TNG to the main stream Samba lists. Always remember that the developers are volunteers, they are not paid and they never guarantee to produce a particular feature at a particular time. Any time lines are 'best guess' and nothing more. Always mention what version of samba you are using and what operating system its running under. You should probably list the relevant sections of your smb.conf file, at least the options in [global] that affect PDC support. In addition to the version, if you obtained Samba via CVS mention the date when you last checked it out. Try and make your question clear and brief, lots of long, convoluted questions get deleted before they are completely read ! Don't post html encoded messages (if you can select colour or font size its html). If you run one of those niffy 'I'm on holidays' things when you are away, make sure its configured to not answer mailing lists. Don't cross post. Work out which is the best list to post to and see what happens, ie don't post to both samba-ntdom and samba-technical. Many people active on the lists subscribe to more than one list and get annoyed to see the same message two or more times. Often someone will see a message and thinking it would be better dealt with on another, will forward it on for you. You might include partial log files written at a debug level set to as much as 20. Please don't send the entire log but enough to give the context of the error messages. (Possibly) If you have a complete netmon trace ( from the opening of the pipe to the error ) you can send the *.CAP file as well. Please think carefully before attaching a document to an email. Consider pasting the relevant parts into the body of the message. The samba mailing lists go to a huge number of people, do they all need a copy of your smb.conf in their attach directory ? To have your name removed from a samba mailing list, go to the same place you went to to get on it. Go to http://samba.org, click on your nearest mirror and then click on Support and then click on Samba related mailing lists. Or perhaps see here Please don't post messages to the list asking to be removed, you will just be refered to the above address (unless that process failed in some way...)