source: branches/samba-3.2.x/docs-xml/Samba3-ByExample/SBE-TheSmallOffice.xml@ 203

Last change on this file since 203 was 203, checked in by Herwig Bauernfeind, 16 years ago

Missing 3.2.2 client and HOWTO files
File size: 47.0 KB
Line 
1<?xml version="1.0" encoding="iso-8859-1"?>
2<!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
3<chapter id="small">
4 <title>Small Office Networking</title>
5
6 <para>
7 <link linkend="simple"/> focused on the basics of simple yet effective
8 network solutions. Network administrators who take pride in their work
9 (that's most of us, right?) take care to deliver what our users want,
10 but not too much more. If we make things too complex, we confound our users
11 and increase costs of network ownership. A professional network manager
12 avoids the temptation to put too much pizazz into the way that the network
13 operates. Some creativity is helpful, but keep it under control &smbmdash;
14 good advice that the following two scenarios illustrate.
15 </para>
16
17 <para>
18 <indexterm><primary>Netware</primary></indexterm>
19 In one case the network administrator of a mid-sized company spent three
20 months building a new network to replace an old Netware server. What he
21 delivered had all the bells and whistles he could muster. There were a
22 few teething problems during the changeover, nothing serious but a little
23 disruptive all the same. Users were exposed to many changes at once. The
24 network administrator was asked to resign two months after implementing
25 the new system because so many staff complained they had lost time and
26 were not happy with the new network. Everything was automated, and he
27 delivered more features than any advanced user could think of. He was
28 just too smart for his own good.
29 </para>
30
31 <para>
32 In the case of the other company, a new network manager was appointed
33 to oversee the replacement of a LanTastic network with an MS Windows
34 NT 4.0 network. He had the replacement installed and operational within
35 two weeks. Before installation and changeover, he called a meeting to
36 explain to all users what was going to happen, how it would affect them,
37 and that he would be available 24 hours a day to help them transition.
38 One week after conversion, he held another meeting asking for cooperation
39 in the introduction of a few new features that would help to make life
40 easier. Network users were thrilled with the help he provided. The network
41 he implemented was nowhere near as complex as in the first example, had fewer
42 features, and yet he had happy users. Months later he was still adding
43 new innovations. He always asked the users if a
44 particular feature was what they wanted. He asked his boss for a raise
45 and got it. He often told me, <quote>Always keep a few new tricks up your
46 sleeves for when you need them.</quote> Was he smart? You decide. Let's
47 get on with our next exercise.
48 </para>
49
50<sect1>
51 <title>Introduction</title>
52
53 <para>
54 Abmas Accounting has grown. Mr. Meany likes you and says he knew you
55 were the right person for the job. That's why he asked you to install the
56 new server. The past few months have been hard work. You advised Mr. Meany
57 that it is time for a change. Abmas now has 52 users, having acquired an
58 investment consulting business recently. The new users were added to the
59 network without any problems.
60 </para>
61
62 <para>
63 Some of the Windows clients are nearly past their use-by date. You found damaged and unusable software on
64 some of the workstations that came with the acquired business and found some machines in need of both
65 hardware and software maintenance.
66 </para>
67
68 <sect2>
69 <title>Assignment Tasks</title>
70
71 <para>
72 <indexterm><primary>Windows XP</primary></indexterm>
73 Mr. Meany is retiring in 12 months. Before he goes, he wants you to help ensure
74 that the business is running efficiently. Many of the new staff want notebook
75 computers. They visit customer business premises and need to use local network
76 facilities; these users are technically competent. The company uses a
77 business application that requires Windows XP Professional. In short, a complete
78 client upgrade is about to happen. Mr. Meany told you that he is working
79 on another business acquisition and that by the time he retires there will be
80 80 to 100 users.
81 </para>
82
83 <para>
84 Mr. Meany is not concerned about security. He wants to make it easier for
85 staff to do their work. He has hired you to help him appoint a full-time
86 network manager before he retires. Above all, he says he is investing in
87 the ability to grow. He is determined to live his lifelong dream and
88 hand the business over to a bright and capable executive who can make
89 things happen. This means your network design must cope well with
90 growth.
91 </para>
92
93 <para>
94 In a few months, Abmas will require an Internet connection for email and so
95 that staff can easily obtain software updates. Mr. Meany is warming up to
96 the installation of antivirus software but is not yet ready to approve
97 this expense. He told you to spend the money a virus scanner costs
98 on better quality notebook computers for mobile users.
99 </para>
100
101 <para>
102 One of Mr. Meany's golfing partners convinced him to buy new laser
103 printers, one black only, the other a color laser printer. Staff support
104 the need for a color printer so they can present more attractive proposals
105 and reports.
106 </para>
107
108 <para>
109 Mr. Meany also asked if it would be possible for one of the staff to manage
110 user accounts from the Windows desktop. That person will be responsible for
111 basic operations.
112 </para>
113
114 </sect2>
115</sect1>
116
117<sect1>
118 <title>Dissection and Discussion</title>
119
120 <para>
121 What are the key requirements in this business example? A quick review indicates
122 a need for
123 </para>
124
125 <itemizedlist>
126 <listitem><para>
127 Scalability, from 52 to over 100 users in 12 months
128 </para></listitem>
129
130 <listitem><para>
131 Mobile computing capability
132 <indexterm><primary>mobile computing</primary></indexterm>
133 </para></listitem>
134
135 <listitem><para>
136 Improved reliability and usability
137 </para></listitem>
138
139 <listitem><para>
140 Easier administration
141 </para></listitem>
142 </itemizedlist>
143
144 <para>
145 In this instance the installed Linux system is assumed to be a Red Hat Linux Fedora Core2 server
146 (as in <link linkend="AccountingOffice"/>).
147
148 </para>
149
150
151 <sect2>
152 <title>Technical Issues</title>
153
154 <para>
155 <indexterm><primary>smbpasswd</primary></indexterm>
156 <indexterm><primary>DHCP</primary></indexterm>
157 <indexterm><primary>DNS</primary></indexterm>
158 <indexterm><primary>WINS</primary></indexterm>
159 <indexterm><primary>Domain</primary></indexterm>
160 It is time to implement a domain security environment. You will use the <constant>
161 smbpasswd</constant> (default) backend. You should implement a DHCP server. There is no need to
162 run DNS at this time, but the system will use WINS. The domain name will be <constant>
163 BILLMORE</constant>. This time, the name of the server will be <constant>SLEETH</constant>.
164 </para>
165
166 <para>
167 All printers will be configured as DHCP clients. The DHCP server will assign
168 the printer a fixed IP address by way of its Ethernet interface (MAC) address.
169 See <link linkend="dhcp01"/>.
170 </para>
171
172 <note><para>
173 The &smb.conf; file you are creating in this exercise can be used with equal effectiveness
174 with Samba-2.2.x series releases. This is deliberate so that in the next chapter it is
175 possible to start with the installation that you have created here, migrate it
176 to a Samba-3 configuration, and then secure the system further. Configurations following
177 this one utilize features that may not be supported in Samba-2.2.x releases.
178 However, you should note that the examples in each chapter start with the assumption
179 that a fresh new installation is being effected.
180 </para></note>
181
182 <para>
183 Later on, when the Internet connection is implemented, you will add DNS as well as
184 other enhancements. It is important that you plan accordingly.
185 </para>
186
187 <para>
188 <indexterm><primary>Ethernet switch</primary></indexterm>
189 You have split the network into two separate areas. Each has its own Ethernet switch.
190 There are 20 users on the accounting network and 32 users on the financial services
191 network. The server has two network interfaces, one serving each network. The
192 network printers will be located in a central area. You plan to install the new
193 printers and keep the old printer in use also.
194 </para>
195
196 <para>
197 You will provide separate file storage areas for each business entity. The old system
198 will go away, accounting files will be handled under a single directory, and files will
199 be stored under customer name, not under a personal work area. Staff will be made
200 responsible for file location, so the old share point must be maintained.
201 </para>
202
203 <para>
204 Given that DNS will not be used, you will configure WINS name resolution for UNIX
205 hostname name resolution.
206 </para>
207
208 <para>
209 <indexterm><primary>Domain</primary><secondary>groups</secondary></indexterm>
210 <indexterm><primary>UNIX</primary><secondary>groups</secondary></indexterm>
211 It is necessary to map Windows Domain Groups to UNIX groups. It is
212 advisable to also map Windows Local Groups to UNIX groups. Additionally, the two
213 key staff groups in the firm are accounting staff and financial services staff.
214 For these, it is necessary to create UNIX groups as well as Windows Domain Groups.
215 </para>
216
217 <para>
218 In the sample &smb.conf; file, you have configured Samba to call the UNIX
219 <command>groupadd</command> to add group entries. This utility does not permit
220 the addition of group names that contain uppercase characters or spaces. This
221 is considered a bug. The <command>groupadd</command> is part of the
222 <command>shadow-utils</command> open source software package. A later release
223 of this package may have been patched to resolve this bug. If your operating
224 platform has this bug, it means that attempts to add a Windows Domain Group that
225 has either a space or uppercase characters in it will fail. See
226 <emphasis>TOSHARG2</emphasis>, Chapter 11, Section 11.3.1, Example 11.1, for
227 more information.
228 </para>
229
230 <para>
231 <indexterm><primary>CUPS</primary></indexterm>
232 Vendor-supplied printer drivers will be installed on each client. The CUPS print
233 spooler on the UNIX host will be operated in <constant>raw</constant> mode.
234 </para>
235
236 </sect2>
237
238 <sect2>
239 <title>Political Issues</title>
240
241 <para>
242 Mr. Meany is an old-school manager. He sets the rules and wants to see compliance.
243 He is willing to spend money on things he believes are of value. You need more
244 time to convince him of real priorities.
245 </para>
246
247 <para>
248 Go ahead, buy better notebooks. Wouldn't it be neat if they happened to be
249 supplied with antivirus software? Above all, demonstrate good purchase value and remember
250 to make your users happy.
251 </para>
252
253 </sect2>
254
255</sect1>
256
257<sect1>
258 <title>Implementation</title>
259
260 <para>
261 <indexterm><primary>migration</primary></indexterm>
262 In this example, the assumption is made that this server is being configured from a clean start.
263 The alternate approach could be to demonstrate the migration of the system that is documented
264 in <link linkend="AcctgNet"/> to meet the new requirements. The decision to treat this case, as with
265 future examples, as a new installation is based on the premise that you can determine
266 the migration steps from the information provided in <link linkend="ntmigration"/>.
267 Additionally, a fresh installation makes the example easier to follow.
268 </para>
269
270 <para>
271 <indexterm><primary>group membership</primary></indexterm>
272 Each user will be given a home directory on the UNIX system, which will be available as a private
273 share. Two additional shares will be created, one for the accounting department and the other for
274 the financial services department. Network users will be given access to these shares by way
275 of group membership.
276 </para>
277
278 <para>
279 <indexterm><primary>UNIX</primary><secondary>groups</secondary></indexterm>
280 UNIX group membership is the primary mechanism by which Windows Domain users will be granted
281 rights and privileges within the Windows environment.
282 </para>
283
284 <para>
285 <indexterm><primary>sticky bit</primary></indexterm>
286 The user <command>alanm</command> will be made the owner of all files. This will be preserved
287 by setting the sticky bit (set UID/GID) on the top-level directories.
288 </para>
289
290 <figure id="acct2net">
291 <title>Abmas Accounting &smbmdash; 52-User Network Topology</title>
292 <imagefile scale="100">acct2net</imagefile>
293 </figure>
294
295 <procedure>
296 <title>Server Installation Steps</title>
297
298 <step><para>
299 Using UNIX/Linux system tools, name the server <constant>sleeth</constant>.
300 </para></step>
301
302 <step><para>
303 <indexterm><primary>/etc/hosts</primary></indexterm>
304 Place an entry for the machine <constant>sleeth</constant> in the <filename>/etc/hosts</filename>.
305 The printers are network attached, so there should be entries for the
306 network printers also. An example <filename>/etc/hosts</filename> file is shown here:
307<screen>
308192.168.1.1 sleeth sleeth1
309192.168.2.1 sleeth2
310192.168.1.10 hplj6
311192.168.1.11 hplj4
312192.168.2.10 qms
313</screen>
314 </para></step>
315
316 <step><para>
317 Install the Samba-3 binary RPM from the Samba-Team FTP site.
318 </para></step>
319
320 <step><para>
321 Install the ISC DHCP server using the UNIX/Linux system tools available to you.
322 </para></step>
323
324 <step><para>
325 <indexterm><primary>/etc/rc.d/rc.local</primary></indexterm>
326 <indexterm><primary>IP forwarding</primary></indexterm>
327 <indexterm><primary>router</primary></indexterm>
328 <indexterm><primary>/proc/sys/net/ipv4/ip_forward</primary></indexterm>
329 Because Samba will be operating over two network interfaces and clients on each side
330 may want to be able to reach clients on the other side, it is imperative that IP forwarding
331 is enabled. Use the system tool of your choice to enable IP forwarding. In the
332 absence of such a tool on the Linux system, add to the <filename>/etc/rc.d/rc.local</filename>
333 file an entry as follows:
334<screen>
335echo 1 > /proc/sys/net/ipv4/ip_forward
336</screen>
337 This causes the Linux kernel to forward IP packets so that it acts as a router.
338 </para></step>
339
340 <step><para>
341 Install the &smb.conf; file as shown in <link linkend="acct2conf"/> and
342 <link linkend="acct3conf"/>. Combine these two examples to form a single
343 <filename>/etc/samba/smb.conf</filename> file.
344 </para></step>
345
346 <step><para>
347 <indexterm><primary>smbpasswd</primary></indexterm>
348 Add the user <command>root</command> to the Samba password backend:
349<screen>
350&rootprompt; smbpasswd -a root
351New SMB password: XXXXXXX
352Retype new SMB password: XXXXXXX
353&rootprompt;
354</screen>
355 <indexterm><primary>administrator</primary></indexterm>
356 This is the Windows Domain Administrator password. Never delete this account from
357 the password backend after Windows Domain Groups have been initialized. If you delete
358 this account, your system is crippled. You cannot restore this account,
359 and your Samba server can no longer be administered.
360 </para></step>
361
362 <step><para>
363 <indexterm><primary>username map</primary></indexterm>
364 Create the username map file to permit the <constant>root</constant> account to be called
365 <constant>Administrator</constant> from the Windows network environment. To do this, create
366 the file <filename>/etc/samba/smbusers</filename> with the following contents:
367<screen>
368####
369# User mapping file
370####
371# File Format
372# -----------
373# Unix_ID = Windows_ID
374#
375# Examples:
376# root = Administrator
377# janes = "Jane Smith"
378# jimbo = Jim Bones
379#
380# Note: If the name contains a space it must be double quoted.
381# In the example above the name 'jimbo' will be mapped to Windows
382# user names 'Jim' and 'Bones' because the space was not quoted.
383#######################################################################
384root = Administrator
385####
386# End of File
387####
388</screen>
389 </para></step>
390
391 <step><para>
392 <indexterm><primary>initGrps.sh</primary></indexterm>
393 Create and map Windows Domain Groups to UNIX groups. A sample script is provided in
394 <link linkend="initGrps"/>. Create a file containing this script. We called ours
395 <filename>/etc/samba/initGrps.sh</filename>. Set this file so it can be executed,
396 and then execute the script. Sample output should be as follows:
397
398<example id="initGrps">
399<title>Script to Map Windows NT Groups to UNIX Groups</title>
400<indexterm><primary>initGrps.sh</primary></indexterm>
401<screen>
402#!/bin/bash
403#
404# initGrps.sh
405#
406
407# Create UNIX groups
408groupadd acctsdep
409groupadd finsrvcs
410
411# Map Windows Domain Groups to UNIX groups
412net groupmap add ntgroup="Domain Admins" unixgroup=root type=d
413net groupmap add ntgroup="Domain Users" unixgroup=users type=d
414net groupmap add ntgroup="Domain Guests" unixgroup=nobody type=d
415
416# Add Functional Domain Groups
417net groupmap add ntgroup="Accounts Dept" unixgroup=acctsdep type=d
418net groupmap add ntgroup="Financial Services" unixgroup=finsrvcs type=d
419</screen>
420</example>
421
422<screen>
423&rootprompt; chmod 755 initGrps.sh
424&rootprompt; cd /etc/samba
425&rootprompt; ./initGrps.sh
426Updated mapping entry for Domain Admins
427Updated mapping entry for Domain Users
428Updated mapping entry for Domain Guests
429No rid or sid specified, choosing algorithmic mapping
430Successfully added group Accounts Dept to the mapping db
431No rid or sid specified, choosing algorithmic mapping
432Successfully added group Domain Guests to the mapping db
433
434&rootprompt; cd /etc/samba
435&rootprompt; net groupmap list | sort
436Account Operators (S-1-5-32-548) -> -1
437Accounts Dept (S-1-5-21-194350-25496802-3394589-2003) -> acctsdep
438Administrators (S-1-5-32-544) -> -1
439Backup Operators (S-1-5-32-551) -> -1
440Domain Admins (S-1-5-21-194350-25496802-3394589-512) -> root
441Domain Guests (S-1-5-21-194350-25496802-3394589-514) -> nobody
442Domain Users (S-1-5-21-194350-25496802-3394589-513) -> users
443Financial Services (S-1-5-21-194350-25496802-3394589-2005) -> finsrvcs
444Guests (S-1-5-32-546) -> -1
445Power Users (S-1-5-32-547) -> -1
446Print Operators (S-1-5-32-550) -> -1
447Replicators (S-1-5-32-552) -> -1
448System Operators (S-1-5-32-549) -> -1
449Users (S-1-5-32-545) -> -1
450</screen>
451 </para></step>
452
453 <step><para>
454 <indexterm><primary>/etc/passwd</primary></indexterm>
455 <indexterm><primary>password</primary><secondary>backend</secondary></indexterm>
456 <indexterm><primary>smbpasswd</primary></indexterm>
457 For each user who needs to be given a Windows Domain account, make an entry in the
458 <filename>/etc/passwd</filename> file as well as in the Samba password backend.
459 Use the system tool of your choice to create the UNIX system accounts, and use the Samba
460 <command>smbpasswd</command> program to create the Domain user accounts.
461 </para>
462
463 <para>
464 <indexterm><primary>useradd</primary></indexterm>
465 <indexterm><primary>adduser</primary></indexterm>
466 <indexterm><primary>user</primary><secondary>management</secondary></indexterm>
467 There are a number of tools for user management under UNIX, such as
468 <command>useradd</command> and <command>adduser</command>, as well as a plethora of custom
469 tools. With the tool of your choice, create a home directory for each user.
470 </para></step>
471
472 <step><para>
473 Using the preferred tool for your UNIX system, add each user to the UNIX groups created
474 previously, as necessary. File system access control will be based on UNIX group membership.
475 </para></step>
476
477 <step><para>
478 Create the directory mount point for the disk subsystem that is mounted to provide
479 data storage for company files. In this case the mount point is indicated in the &smb.conf;
480 file is <filename>/data</filename>. Format the file system as required, mount the formatted
481 file system partition using <command>mount</command>,
482 and make the appropriate changes in <filename>/etc/fstab</filename>.
483 </para></step>
484
485 <step><para>
486 Create the top-level file storage directories are follows:
487<screen>
488&rootprompt; mkdir -p /data/{accounts,finsvcs}
489&rootprompt; chown -R root:root /data
490&rootprompt; chown -R alanm:accounts /data/accounts
491&rootprompt; chown -R alanm:finsvcs /data/finsvcs
492&rootprompt; chmod -R ug+rwx,o+rx-w /data
493</screen>
494 Each department is responsible for creating its own directory structure within its
495 share. The directory root of the <command>accounts</command> share is <filename>/data/accounts</filename>.
496 The directory root of the <command>finsvcs</command> share is <filename>/data/finsvcs</filename>.
497 </para></step>
498
499 <step><para>
500 Configure the printers with the IP addresses as shown in <link linkend="acct2net"/>.
501 Follow the instructions in the manufacturers' manuals to permit printing to port 9100.
502 This allows the CUPS spooler to print using raw mode protocols.
503 <indexterm><primary>CUPS</primary></indexterm>
504 <indexterm><primary>raw printing</primary></indexterm>
505 </para></step>
506
507 <step><para>
508 <indexterm><primary>CUPS</primary><secondary>queue</secondary></indexterm>
509 <indexterm><primary>lpadmin</primary></indexterm>
510 Configure the CUPS Print Queues as follows:
511<screen>
512&rootprompt; lpadmin -p hplj4 -v socket://192.168.1.11:9100 -E
513&rootprompt; lpadmin -p hplj6 -v socket://192.168.1.10:9100 -E
514&rootprompt; lpadmin -p qms -v socket://192.168.2.10:9100 -E
515</screen>
516 <indexterm><primary>print filter</primary></indexterm>
517 This creates the necessary print queues with no assigned print filter.
518 </para></step>
519
520 <step><para>
521 <indexterm><primary>mime type</primary></indexterm>
522 <indexterm><primary>/etc/mime.convs</primary></indexterm>
523 <indexterm><primary>application/octet-stream</primary></indexterm>
524 Edit the file <filename>/etc/cups/mime.convs</filename> to uncomment the line:
525<screen>
526application/octet-stream application/vnd.cups-raw 0 -
527</screen>
528 </para></step>
529
530 <step><para>
531 <indexterm><primary>/etc/mime.types</primary></indexterm>
532 Edit the file <filename>/etc/cups/mime.types</filename> to uncomment the line:
533<screen>
534application/octet-stream
535</screen>
536 </para></step>
537
538 <step><para>
539 <indexterm><primary>DHCP Server</primary></indexterm>
540 Using your favorite system editor, create an <filename>/etc/dhcpd.conf</filename> with the
541 contents as shown in <link linkend="dhcp01"/>.
542<example id="dhcp01">
543<title>Abmas Accounting DHCP Server Configuration File &smbmdash; <filename>/etc/dhcpd.conf</filename></title>
544<indexterm><primary>/etc/dhcpd.conf</primary></indexterm>
545<screen>
546default-lease-time 86400;
547max-lease-time 172800;
548default-lease-time 86400;
549
550option ntp-servers 192.168.1.1;
551option domain-name "abmas.biz";
552option domain-name-servers 192.168.1.1, 192.168.2.1;
553option netbios-name-servers 192.168.1.1, 192.168.2.1;
554option netbios-node-type 8;
555### NOTE ###
556# netbios-node-type=8 means set clients to Hybrid Mode
557# so they will use Unicast communication with the WINS
558# server and thus reduce the level of UDP broadcast
559# traffic by up to 90%.
560############
561
562subnet 192.168.1.0 netmask 255.255.255.0 {
563 range dynamic-bootp 192.168.1.128 192.168.1.254;
564 option subnet-mask 255.255.255.0;
565 option routers 192.168.1.1;
566 allow unknown-clients;
567 host hplj4 {
568 hardware ethernet 08:00:46:7a:35:e4;
569 fixed-address 192.168.1.10;
570 }
571 host hplj6 {
572 hardware ethernet 00:03:47:cb:81:e0;
573 fixed-address 192.168.1.11;
574 }
575 }
576subnet 192.168.2.0 netmask 255.255.255.0 {
577 range dynamic-bootp 192.168.2.128 192.168.2.254;
578 option subnet-mask 255.255.255.0;
579 option routers 192.168.2.1;
580 allow unknown-clients;
581 host qms {
582 hardware ethernet 01:04:31:db:e1:c0;
583 fixed-address 192.168.1.10;
584 }
585 }
586subnet 127.0.0.0 netmask 255.0.0.0 {
587 }
588</screen>
589</example>
590 </para></step>
591
592
593 <step><para>
594 Use the standard system tool to start Samba and CUPS and configure them to start
595 automatically at every system reboot. For example,
596 </para>
597
598 <para>
599 <indexterm><primary>chkconfig</primary></indexterm>
600 <indexterm><primary>starting dhcpd</primary></indexterm>
601 <indexterm><primary>starting samba</primary></indexterm>
602 <indexterm><primary>starting CUPS</primary></indexterm>
603 <indexterm><primary>chkconfig</primary></indexterm>
604<screen>
605&rootprompt; chkconfig dhcp on
606&rootprompt; chkconfig smb on
607&rootprompt; chkconfig cups on
608&rootprompt; /etc/rc.d/init.d/dhcp restart
609&rootprompt; /etc/rc.d/init.d/smb restart
610&rootprompt; /etc/rc.d/init.d/cups restart
611</screen>
612 </para></step>
613
614 <step><para>
615 <indexterm><primary>name service switch</primary></indexterm>
616 <indexterm><primary>NSS</primary><see>same service switch</see></indexterm>
617 <indexterm><primary>DNS</primary></indexterm>
618 <indexterm><primary>DNS server</primary></indexterm>
619 <indexterm><primary>WINS</primary></indexterm>
620 <indexterm><primary>/etc/nsswitch.conf</primary></indexterm>
621 Configure the name service switch (NSS) to handle WINS-based name resolution.
622 Since this system does not use a DNS server, it is safe to remove this option from
623 the NSS configuration. Edit the <filename>/etc/nsswitch.conf</filename> file so that
624 the <constant>hosts:</constant> entry looks like this:
625<screen>
626hosts: files wins
627</screen>
628 </para></step>
629
630 </procedure>
631
632<example id="acct2conf">
633<title>Accounting Office Network &smb.conf; File &smbmdash; [globals] Section</title>
634<smbconfblock>
635<smbconfcomment>Global parameters</smbconfcomment>
636<smbconfsection name="[global]"/>
637<smbconfoption name="workgroup">BILLMORE</smbconfoption>
638<smbconfoption name="passwd chat">*New*Password* %n\n*Re-enter*new*password* %n\n *Password*changed*</smbconfoption>
639<smbconfoption name="username map">/etc/samba/smbusers</smbconfoption>
640<smbconfoption name="syslog">0</smbconfoption>
641<smbconfoption name="name resolve order">wins bcast hosts</smbconfoption>
642<smbconfoption name="printcap name">CUPS</smbconfoption>
643<smbconfoption name="show add printer wizard">No</smbconfoption>
644<smbconfoption name="add user script">/usr/sbin/useradd -m -G users '%u'</smbconfoption>
645<smbconfoption name="delete user script">/usr/sbin/userdel -r '%u'</smbconfoption>
646<smbconfoption name="add group script">/usr/sbin/groupadd '%g'</smbconfoption>
647<smbconfoption name="delete group script">/usr/sbin/groupdel '%g'</smbconfoption>
648<smbconfoption name="add user to group script">/usr/sbin/usermod -A '%g' '%u'</smbconfoption>
649<smbconfoption name="add machine script">/usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'</smbconfoption>
650<smbconfoption name="logon script">scripts\login.bat</smbconfoption>
651<smbconfoption name="logon path"> </smbconfoption>
652<smbconfoption name="logon drive">X:</smbconfoption>
653<smbconfoption name="domain logons">Yes</smbconfoption>
654<smbconfoption name="preferred master">Yes</smbconfoption>
655<smbconfoption name="wins support">Yes</smbconfoption>
656<smbconfoption name="printing">CUPS</smbconfoption>
657</smbconfblock>
658</example>
659
660<example id="acct3conf">
661<title>Accounting Office Network &smb.conf; File &smbmdash; Services and Shares Section</title>
662<smbconfblock>
663<smbconfsection name="[homes]"/>
664<smbconfoption name="comment">Home Directories</smbconfoption>
665<smbconfoption name="valid users">%S</smbconfoption>
666<smbconfoption name="read only">No</smbconfoption>
667<smbconfoption name="browseable">No</smbconfoption>
668
669<smbconfsection name="[printers]"/>
670<smbconfoption name="comment">SMB Print Spool</smbconfoption>
671<smbconfoption name="path">/var/spool/samba</smbconfoption>
672<smbconfoption name="printable">Yes</smbconfoption>
673<smbconfoption name="guest ok">Yes</smbconfoption>
674<smbconfoption name="use client driver">Yes</smbconfoption>
675<smbconfoption name="browseable">No</smbconfoption>
676
677<smbconfsection name="[netlogon]"/>
678<smbconfoption name="comment">Network Logon Service</smbconfoption>
679<smbconfoption name="path">/data/%U</smbconfoption>
680<smbconfoption name="valid users">%S</smbconfoption>
681<smbconfoption name="read only">No</smbconfoption>
682
683<smbconfsection name="[accounts]"/>
684<smbconfoption name="comment">Accounting Files</smbconfoption>
685<smbconfoption name="path">/data/accounts</smbconfoption>
686<smbconfoption name="valid users">%G</smbconfoption>
687<smbconfoption name="read only">No</smbconfoption>
688
689<smbconfsection name="[finsvcs]"/>
690<smbconfoption name="comment">Financial Service Files</smbconfoption>
691<smbconfoption name="path">/data/finsvcs</smbconfoption>
692<smbconfoption name="valid users">%G</smbconfoption>
693<smbconfoption name="read only">No</smbconfoption>
694</smbconfblock>
695</example>
696
697 <sect2>
698 <title>Validation</title>
699
700 <para>
701 Does everything function as it ought? That is the key question at this point.
702 Here are some simple steps to validate your Samba server configuration.
703 </para>
704
705 <procedure>
706 <title>Validation Steps</title>
707
708 <step><para>
709 <indexterm><primary>testparm</primary></indexterm>
710 If your &smb.conf; file has bogus options or parameters, this may cause Samba
711 to refuse to start. The first step should always be to validate the contents
712 of this file by running:
713<screen>
714&rootprompt; testparm -s
715Load smb config files from smb.conf
716Processing section "[homes]"
717Processing section "[printers]"
718Processing section "[netlogon]"
719Processing section "[accounts]"
720Processing section "[service]"
721Loaded services file OK.
722# Global parameters
723[global]
724 workgroup = BILLMORE
725 passwd chat = *New*Password* \
726 %n\n *Re-enter*new*password* %n\n *Password*changed*
727 username map = /etc/samba/smbusers
728 syslog = 0
729 name resolve order = wins bcast hosts
730 printcap name = CUPS
731 show add printer wizard = No
732 add user script = /usr/sbin/useradd -m -G users '%u'
733 delete user script = /usr/sbin/userdel -r '%u'
734 add group script = /usr/sbin/groupadd '%g'
735 delete group script = /usr/sbin/groupdel '%g'
736 add user to group script = /usr/sbin/usermod -A '%g' '%u'
737 add machine script = /usr/sbin/useradd
738 -s /bin/false -d /var/lib/nobody '%u'
739 logon script = scripts\logon.bat
740 logon path =
741 logon drive = X:
742 domain logons = Yes
743 preferred master = Yes
744 wins support = Yes
745...
746### Remainder cut to save space ###
747</screen>
748 The inclusion of an invalid parameter (say one called dogbert) would generate an
749 error as follows:
750<screen>
751Unknown parameter encountered: "dogbert"
752Ignoring unknown parameter "dogbert"
753</screen>
754 Clear away all errors before proceeding, and start or restart samba as necessary.
755 </para></step>
756
757 <step><para>
758 <indexterm><primary>check samba daemons</primary></indexterm>
759 <indexterm><primary>nmbd</primary></indexterm>
760 <indexterm><primary>smbd</primary></indexterm>
761 <indexterm><primary>winbindd</primary></indexterm>
762 Check that the Samba server is running:
763<screen>
764&rootprompt; ps ax | grep mbd
76514244 ? S 0:00 /usr/sbin/nmbd -D
76614245 ? S 0:00 /usr/sbin/nmbd -D
76714290 ? S 0:00 /usr/sbin/smbd -D
768
769$rootprompt; ps ax | grep winbind
77014293 ? S 0:00 /usr/sbin/winbindd -B
77114295 ? S 0:00 /usr/sbin/winbindd -B
772</screen>
773 The <command>winbindd</command> daemon is running in split mode (normal), so there are also
774 two instances of it. For more information regarding <command>winbindd</command>, see
775 <emphasis>TOSHARG2</emphasis>, Chapter 23, Section 23.3. The single instance of
776 <command>smbd</command> is normal.
777 </para></step>
778
779 <step><para>
780 <indexterm><primary>anonymous connection</primary></indexterm>
781 Check that an anonymous connection can be made to the Samba server:
782<screen>
783&rootprompt; smbclient -L localhost -U%
784
785 Sharename Type Comment
786 --------- ---- -------
787 netlogon Disk Network Logon Service
788 accounts Disk Accounting Files
789 finsvcs Disk Financial Service Files
790 IPC$ IPC IPC Service (Samba3)
791 ADMIN$ IPC IPC Service (Samba3)
792 hplj4 Printer Hewlett-Packard LaserJet 4
793 hplj6 Printer Hewlett-Packard LaserJet 6
794 qms Printer QMS Magicolor Laser Printer XXXX
795
796 Server Comment
797 --------- -------
798 SLEETH Samba 3.0.20
799
800 Workgroup Master
801 --------- -------
802 BILLMORE SLEETH
803</screen>
804 This demonstrates that an anonymous listing of shares can be obtained. This is the equivalent
805 of browsing the server from a Windows client to obtain a list of shares on the server.
806 The <constant>-U%</constant> argument means to send a <constant>NULL</constant> username and
807 a <constant>NULL</constant> password.
808 </para></step>
809
810 <step><para>
811 <indexterm><primary>dhcp client validation</primary></indexterm>
812 <indexterm><primary>printer validation</primary></indexterm>
813 <indexterm><primary>/etc/dhcpd.conf</primary></indexterm>
814 Verify that the printers have the IP addresses assigned in the DHCP server configuration file.
815 The easiest way to do this is to ping the printer name. Immediately after the ping response
816 has been received, execute <command>arp -a</command> to find the MAC address of the printer
817 that has responded. Now you can compare the IP address and the MAC address of the printer
818 with the configuration information in the <filename>/etc/dhcpd.conf</filename> file. They
819 should, of course, match. For example,
820<screen>
821&rootprompt; ping hplj4
822PING hplj4 (192.168.1.11) 56(84) bytes of data.
82364 bytes from hplj4 (192.168.1.11): icmp_seq=1 ttl=64 time=0.113 ms
824
825&rootprompt; arp -a
826hplj4 (192.168.1.11) at 08:00:46:7A:35:E4 [ether] on eth0
827</screen>
828 The MAC address <constant>08:00:46:7A:35:E4</constant> matches that specified for the
829 IP address from which the printer has responded and the entry for it in the
830 <filename>/etc/dhcpd.conf</filename> file.
831 </para></step>
832
833 <step><para>
834 <indexterm><primary>authenticated connection</primary></indexterm>
835 Make an authenticated connection to the server using the <command>smbclient</command> tool:
836<screen>
837&rootprompt; smbclient //sleeth/accounts -U alanm
838Password: XXXXXXX
839smb: \&gt; dir
840 . D 0 Sun Nov 9 01:28:34 2003
841 .. D 0 Sat Aug 16 17:24:26 2003
842 .mc DH 0 Sat Nov 8 21:57:38 2003
843 .qt DH 0 Fri Sep 5 00:48:25 2003
844 SMB D 0 Sun Oct 19 23:04:30 2003
845 Documents D 0 Sat Nov 1 00:31:51 2003
846 xpsp1a_en_x86.exe 131170400 Sun Nov 2 01:25:44 2003
847
848 65387 blocks of size 65536. 28590 blocks available
849smb: \> q
850</screen>
851 </para></step>
852
853 </procedure>
854
855 </sect2>
856
857
858 <procedure>
859 <title>Windows XP Professional Client Configuration</title>
860
861 <step><para>
862 Configure clients to the network settings shown in <link linkend="acct2net"/>.
863 All clients use DHCP for TCP/IP protocol stack configuration.
864 <indexterm><primary>WINS</primary></indexterm>
865 <indexterm><primary>DHCP</primary></indexterm>
866 DHCP configures all Windows clients to use the WINS Server address <constant>192.168.1.1</constant>.
867 </para></step>
868
869 <step><para>
870 Join the Windows Domain called <constant>BILLMORE</constant>. Use the Domain Administrator
871 username <constant>root</constant> and the SMB password you assigned to this account.
872 A detailed step-by-step procedure for joining a Windows 200x/XP Professional client to
873 a Windows Domain is given in <link linkend="appendix"/>, <link linkend="domjoin"/>.
874 Reboot the machine as prompted and then log on using a Domain User account.
875 </para></step>
876
877 <step><para>
878 Verify on each client that the machine called <constant>SLEETH</constant>
879 is visible in <guimenu>My Network Places</guimenu>, that it is
880 possible to connect to it and see the shares <guimenuitem>accounts</guimenuitem>
881 and <guimenuitem>finsvcs</guimenuitem>,
882 and that it is possible to open that share to reveal its contents.
883 </para></step>
884
885 <step><para>
886 Instruct all users to log onto the workstation using their assigned username and password.
887 </para></step>
888
889 <step><para>
890 Install a printer on each using the following steps:
891 </para>
892
893 <procedure>
894 <step><para>
895 Click <menuchoice>
896 <guimenu>Start</guimenu>
897 <guimenuitem>Settings</guimenuitem>
898 <guimenuitem>Printers</guimenuitem>
899 <guiicon>Add Printer</guiicon>
900 <guibutton>Next</guibutton>
901 </menuchoice>. Do not click <guimenuitem>Network printer</guimenuitem>.
902 Ensure that <guimenuitem>Local printer</guimenuitem> is selected.
903 </para></step>
904
905 <step><para>
906 Click <guibutton>Next</guibutton>. In the
907 <guimenuitem>Manufacturer:</guimenuitem> panel, select <constant>HP</constant>.
908 In the <guimenuitem>Printers:</guimenuitem> panel, select the printer called
909 <constant>HP LaserJet 4</constant>. Click <guibutton>Next</guibutton>.
910 </para></step>
911
912 <step><para>
913 In the <guimenuitem>Available ports:</guimenuitem> panel, select
914 <constant>FILE:</constant>. Accept the default printer name by clicking
915 <guibutton>Next</guibutton>. When asked, <quote>Would you like to print a
916 test page?</quote>, click <guimenuitem>No</guimenuitem>. Click
917 <guibutton>Finish</guibutton>.
918 </para></step>
919
920 <step><para>
921 You may be prompted for the name of a file to print to. If so, close the
922 dialog panel. Right-click <menuchoice>
923 <guiicon>HP LaserJet 4</guiicon>
924 <guimenuitem>Properties</guimenuitem>
925 <guisubmenu>Details (Tab)</guisubmenu>
926 <guimenuitem>Add Port</guimenuitem>
927 </menuchoice>.
928 </para></step>
929
930 <step><para>
931 In the <guimenuitem>Network</guimenuitem> panel, enter the name of
932 the print queue on the Samba server as follows: <constant>\\SERVER\hplj4</constant>.
933 Click <menuchoice>
934 <guibutton>OK</guibutton>
935 <guibutton>OK</guibutton>
936 </menuchoice> to complete the installation.
937 </para></step>
938
939 <step><para>
940 Repeat the printer installation steps above for the HP LaserJet 6 printer
941 as well as for the QMS Magicolor XXXX laser printer.
942 </para></step>
943 </procedure>
944 </step>
945 </procedure>
946
947 <sect2>
948 <title>Notebook Computers: A Special Case</title>
949
950 <para>
951 As a network administrator, you already know how to create local machine accounts for Windows 200x/XP
952 Professional systems. This is the preferred solution to provide continuity of work for notebook users
953 so that absence from the office network environment does not become a barrier to productivity.
954 </para>
955
956 <para>
957 By creating a local machine account that has the same username and password as you create for that
958 user in the Windows Domain environment, the user can log onto the machine locally and still
959 transparently access network resources as if logged onto the domain itself. There are some trade-offs
960 that mean that as the network is more tightly secured, it becomes necessary to modify Windows client
961 configuration somewhat.
962 </para>
963
964 </sect2>
965
966 <sect2>
967 <title>Key Points Learned</title>
968
969 <para>
970 In this network design and implementation exercise, you created a Windows NT4-style Domain
971 Controller using Samba-3.0.20. Following these guidelines, you experienced
972 and implemented several important aspects of Windows networking. In the next chapter,
973 you build on the experience. These are the highlights from this chapter:
974 </para>
975
976 <itemizedlist>
977 <listitem><para>
978 <indexterm><primary>DHCP</primary></indexterm>
979 You implemented a DHCP server, and Microsoft Windows clients were able to obtain all necessary
980 network configuration settings from this server.
981 </para></listitem>
982
983 <listitem><para>
984 <indexterm><primary>Domain Controller</primary></indexterm>
985 You created a Windows Domain Controller. You were able to use the network logon service
986 and successfully joined Windows 200x/XP Professional clients to the Domain.
987 </para></listitem>
988
989 <listitem><para>
990 <indexterm><primary>CUPS</primary></indexterm>
991 You created raw print queues in the CUPS printing system. You maintained a simple
992 printing system so that all users can share centrally managed printers. You installed
993 native printer drivers on the Windows clients.
994 </para></listitem>
995
996 <listitem><para>
997 You experienced the benefits of centrally managed user accounts on the server.
998 </para></listitem>
999
1000 <listitem><para>
1001 You offered Mobile notebook users a solution that allows them to continue to work
1002 while away from the office and not connected to the corporate network.
1003 </para></listitem>
1004 </itemizedlist>
1005
1006 </sect2>
1007
1008</sect1>
1009
1010<sect1>
1011 <title>Questions and Answers</title>
1012
1013 <para>
1014 Your new Domain Controller is ready to serve you. What does it mean? Here are some questions and answers that
1015 may help.
1016 </para>
1017
1018 <qandaset>
1019 <qandaentry>
1020 <question>
1021
1022 <para>
1023 What is the key benefit of using DHCP to configure Windows client TCP/IP stacks?
1024 </para>
1025
1026 </question>
1027 <answer>
1028
1029 <para>
1030 First and foremost, portability. It means that notebook users can move between
1031 the Abmas office and client offices (so long as they, too, use DHCP) without having to manually
1032 reconfigure their machines. It also means that when they work from their home environments
1033 either using DHCP assigned addressing or when using dial-up networking, settings such as
1034 default routes and DNS server addresses that apply only to the Abmas office environment do
1035 not interfere with remote operations. This is an extremely important feature of DHCP.
1036 </para>
1037
1038 </answer>
1039 </qandaentry>
1040
1041 <qandaentry>
1042 <question>
1043
1044 <para>
1045 Are there any DHCP server configuration parameters in the <filename>/etc/dhcpd.conf</filename>
1046 that should be noted in particular?
1047 </para>
1048
1049 </question>
1050 <answer>
1051
1052 <para>
1053 Yes. The configuration you created automatically provides each client with the IP address
1054 of your WINS server. It also configures the client to preferentially register NetBIOS names
1055 with the WINS server, and then instructs the client to first query the WINS server when a
1056 NetBIOS machine name needs to be resolved to an IP Address. This configuration
1057 results in far lower UDP broadcast traffic than would be the case if WINS was not used.
1058 </para>
1059
1060 </answer>
1061 </qandaentry>
1062
1063 <qandaentry>
1064 <question>
1065
1066 <para>
1067 Is it possible to create a Windows Domain account that is specifically called <constant>Administrator</constant>?
1068 </para>
1069
1070 </question>
1071 <answer>
1072
1073 <para>
1074 You can surely create a Windows Domain account called <constant>Administrator</constant>. It is also
1075 possible to map that account so that it has the effective UNIX UID of 0. This way it isn't
1076 necessary to use the <parameter>username map</parameter> facility to map this account to the UNIX
1077 account called <constant>root</constant>.
1078 </para>
1079
1080 </answer>
1081 </qandaentry>
1082
1083 <qandaentry>
1084 <question>
1085
1086 <para>
1087 Why is it necessary to give the Windows Domain <constant>Administrator</constant> a UNIX UID of 0?
1088 </para>
1089
1090 </question>
1091 <answer>
1092
1093 <para>
1094 The Windows Domain <constant>Administrator</constant> account is the most privileged account that
1095 exists on the Windows platform. This user can change any setting, add, delete, or modify user
1096 accounts, and completely reconfigure the system. The equivalent to this account in the UNIX
1097 environment is the <constant>root</constant> account. If you want to permit the Windows Domain
1098 Administrator to manage accounts as well as permissions, privileges, and security
1099 settings within the Domain and on the Samba server, equivalent rights must be assigned. This is
1100 achieved with the <constant>root</constant> UID equal to 0.
1101 </para>
1102
1103 </answer>
1104 </qandaentry>
1105
1106 <qandaentry>
1107 <question>
1108
1109 <para>
1110 One of my junior staff needs the ability to add machines to the Domain, but I do not want to give him
1111 <constant>root</constant> access. How can we do this?
1112 </para>
1113
1114 </question>
1115 <answer>
1116
1117 <para>
1118 Users who are members of the <constant>Domain Admins</constant> group can add machines to the
1119 Domain. This group is mapped to the UNIX group account called <constant>root</constant>
1120 (or the equivalent <constant>wheel</constant> on some UNIX systems) that has a GID of 0.
1121 This must be the primary GID of the account of the user who is a member of the Windows <constant>
1122 Domain Admins</constant> account.
1123 </para>
1124
1125 </answer>
1126 </qandaentry>
1127
1128 <qandaentry>
1129 <question>
1130
1131 <para>
1132 Why must I map Windows Domain Groups to UNIX groups?
1133 </para>
1134
1135 </question>
1136 <answer>
1137
1138 <para>
1139 Samba-3 does not permit a Domain Group to become visible to Domain network clients unless the account
1140 has a UNIX group account equivalent. The Domain groups that should be given UNIX equivalents are
1141 <guimenu>Domain Guests</guimenu>, <guimenu>Domain Users</guimenu>, and <guimenu>Domain Admins</guimenu>.
1142 </para>
1143
1144 </answer>
1145 </qandaentry>
1146
1147 <qandaentry>
1148 <question>
1149
1150 <para>
1151 I deleted my <constant>root</constant> account and now I cannot add it back! What can I do?
1152 </para>
1153
1154 </question>
1155 <answer>
1156
1157 <para>
1158 This is a nasty problem. Fortunately, there is a solution.
1159 </para>
1160
1161 <procedure>
1162 <step><para>
1163 Back up your existing configuration files in case you need to restore them.
1164 </para></step>
1165
1166 <step><para>
1167 Rename the <filename>group_mapping.tdb</filename> file.
1168 </para></step>
1169
1170 <step><para>
1171 Use the <command>smbpasswd</command> to add the root account.
1172 </para></step>
1173
1174 <step><para>
1175 Restore the <filename>group_mapping.tdb</filename> file.
1176 </para></step>
1177 </procedure>
1178
1179 </answer>
1180 </qandaentry>
1181
1182 <qandaentry>
1183 <question>
1184
1185 <para>
1186 When I run <command>net groupmap list</command>, it reports a group called <guimenu>Administrators</guimenu>
1187 as well as <guimenu>Domain Admins</guimenu>. What is the difference between them?
1188 </para>
1189
1190 </question>
1191 <answer>
1192
1193 <para>
1194 The group called <guimenu>Administrators</guimenu> is representative of the same account that would be
1195 present as the Local Group account on a Domain Member server or workstation. Samba uses only Domain
1196 Groups at this time. A Workstation or Server Local Group has no meaning in a Samba context. This
1197 may change at some later date. These accounts are provided only so that security objects are correctly shown.
1198 </para>
1199
1200 </answer>
1201 </qandaentry>
1202
1203 <qandaentry>
1204 <question>
1205
1206 <para>
1207 What is the effect of changing the name of a Samba server or of changing the Domain name?
1208 </para>
1209
1210 </question>
1211 <answer>
1212
1213 <para>
1214 If you elect to change the name of the Samba server, on restarting <command>smbd</command>,
1215 Windows security identifiers are changed. In the case of a standalone server or a Domain Member server,
1216 the machine SID is changed. This may break Domain membership. In the case of a change of the Domain name
1217 (Workgroup name), the Domain SID is changed. This affects all Domain memberships.
1218 </para>
1219
1220 <para>
1221 If it becomes necessary to change either the server name or the Domain name, be sure to back up the respective
1222 SID before the change is made. You can back up the SID using the <command>net getlocalsid</command> (Samba-3)
1223 or the <command>smbpasswd</command> (Samba-2.2.x). To change the SID, you use the same tool. Be sure
1224 to check the man page for this command for detailed instructions regarding the steps involved.
1225 </para>
1226
1227 </answer>
1228 </qandaentry>
1229
1230 <qandaentry>
1231 <question>
1232
1233 <para>
1234 How can I manage user accounts from my Windows XP Professional workstation?
1235 </para>
1236
1237 </question>
1238 <answer>
1239
1240 <para>
1241 Samba-3 implements a Windows NT4-style security domain architecture. This type of Domain cannot
1242 be managed using tools present on a Windows XP Professional installation. You may download from the
1243 Microsoft Web site the SRVTOOLS.EXE package. Extract it into the directory from which you wish to use
1244 it. This package extracts the tools: <command>User Manager for Domains</command>, <command>Server Manager</command>, and <command>Event
1245 Viewer</command>. You may use the <guimenu>User Manager for Domains</guimenu> to manage your Samba-3
1246 Domain user and group accounts. Of course, you do need to be logged on as the <constant>Administrator</constant>
1247 for the Samba-3 Domain. It may help to log on as the <constant>root</constant> account.
1248 </para>
1249
1250 </answer>
1251 </qandaentry>
1252
1253 </qandaset>
1254
1255</sect1>
1256
1257</chapter>
1258
Note: See TracBrowser for help on using the repository browser.