| [217] | 1 | <?xml version="1.0" encoding="iso-8859-1"?>
|
|---|
| 2 | <!DOCTYPE appendix PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
|
|---|
| 3 |
|
|---|
| 4 | <chapter id="appendix">
|
|---|
| 5 | <title>A Collection of Useful Tidbits</title>
|
|---|
| 6 |
|
|---|
| 7 | <para>
|
|---|
| 8 | <indexterm><primary>material</primary></indexterm>
|
|---|
| 9 | <indexterm><primary>domain</primary><secondary>joining</secondary></indexterm>
|
|---|
| 10 | Information presented here is considered to be either basic or well-known material that is informative
|
|---|
| 11 | yet helpful. Over the years, I have observed an interesting behavior. There is an expectation that
|
|---|
| 12 | the process for joining a Windows client to a Samba-controlled Windows domain may somehow involve steps
|
|---|
| 13 | different from doing so with Windows NT4 or a Windows ADS domain. Be assured that the steps are identical,
|
|---|
| 14 | as shown in the example given below.
|
|---|
| 15 | </para>
|
|---|
| 16 |
|
|---|
| 17 | <sect1 id="domjoin">
|
|---|
| 18 | <title>Joining a Domain: Windows 200x/XP Professional</title>
|
|---|
| 19 |
|
|---|
| 20 | <para>
|
|---|
| 21 | <indexterm><primary>joining a domain</primary></indexterm>
|
|---|
| 22 | Microsoft Windows NT/200x/XP Professional platforms can participate in Domain Security.
|
|---|
| 23 | This section steps through the process for making a Windows 200x/XP Professional machine a
|
|---|
| 24 | member of a Domain Security environment. It should be noted that this process is identical
|
|---|
| 25 | when joining a domain that is controlled by Windows NT4/200x as well as a Samba PDC.
|
|---|
| 26 | </para>
|
|---|
| 27 |
|
|---|
| 28 | <procedure>
|
|---|
| 29 | <title>Steps to Join a Domain</title>
|
|---|
| 30 |
|
|---|
| 31 | <step><para>
|
|---|
| 32 | Click <guimenu>Start</guimenu>.
|
|---|
| 33 | </para></step>
|
|---|
| 34 |
|
|---|
| 35 | <step><para>
|
|---|
| 36 | Right-click <guimenu>My Computer</guimenu>, and then select <guimenuitem>Properties</guimenuitem>.
|
|---|
| 37 | </para></step>
|
|---|
| 38 |
|
|---|
| 39 | <step><para>
|
|---|
| 40 | The opening panel is the same one that can be reached by clicking <guimenu>System</guimenu> on the Control Panel.
|
|---|
| 41 | See <link linkend="swxpp001"></link>.
|
|---|
| 42 | <figure id="swxpp001"><imagefile>wxpp001</imagefile><title>The General Panel.</title></figure>
|
|---|
| 43 | </para></step>
|
|---|
| 44 |
|
|---|
| 45 | <step><para>
|
|---|
| 46 | Click the <guimenu>Computer Name</guimenu> tab.
|
|---|
| 47 | This panel shows the <guimenuitem>Computer Description</guimenuitem>, the <guimenuitem>Full computer name</guimenuitem>,
|
|---|
| 48 | and the <guimenuitem>Workgroup</guimenuitem> or <guimenuitem>Domain name</guimenuitem>.
|
|---|
| 49 | </para>
|
|---|
| 50 |
|
|---|
| 51 | <para>
|
|---|
| 52 | Clicking the <guimenu>Network ID</guimenu> button launches the configuration wizard. Do not use this with
|
|---|
| 53 | Samba-3. If you wish to change the computer name, or join or leave the domain, click the <guimenu>Change</guimenu> button.
|
|---|
| 54 | See <link linkend="swxpp004"></link>.
|
|---|
| 55 | <figure id="swxpp004"><imagefile>wxpp004</imagefile><title>The Computer Name Panel.</title></figure>
|
|---|
| 56 | </para></step>
|
|---|
| 57 |
|
|---|
| 58 | <step><para>
|
|---|
| 59 | Click on <guimenu>Change</guimenu>. This panel shows that our example machine (TEMPTATION) is in a workgroup called WORKGROUP.
|
|---|
| 60 | We join the domain called MIDEARTH. See <link linkend="swxpp006"></link>.
|
|---|
| 61 | <figure id="swxpp006"><imagefile>wxpp006</imagefile><title>The Computer Name Changes Panel</title></figure>
|
|---|
| 62 | </para></step>
|
|---|
| 63 |
|
|---|
| 64 | <step><para>
|
|---|
| 65 | Enter the name <guimenu>MIDEARTH</guimenu> in the field below the Domain radio button.
|
|---|
| 66 | </para>
|
|---|
| 67 |
|
|---|
| 68 | <para>
|
|---|
| 69 | This panel shows that our example machine (TEMPTATION) is set to join the domain called MIDEARTH. See <link linkend="swxpp007"></link>.
|
|---|
| 70 | <figure id="swxpp007"><imagefile>wxpp007</imagefile><title>The Computer Name Changes Panel &smbmdash; Domain MIDEARTH</title></figure>
|
|---|
| 71 | </para></step>
|
|---|
| 72 |
|
|---|
| 73 | <step><para>
|
|---|
| 74 | Now click the <guimenu>OK</guimenu> button. A dialog box should appear to allow you to provide the credentials (username and password)
|
|---|
| 75 | of a domain administrative account that has the rights to add machines to the domain.
|
|---|
| 76 | </para>
|
|---|
| 77 |
|
|---|
| 78 | <para>
|
|---|
| 79 | Enter the name <quote>root</quote> and the root password from your Samba-3 server. See <link linkend="swxpp008"></link>.
|
|---|
| 80 | <figure id="swxpp008"><imagefile>wxpp008</imagefile><title>Computer Name Changes &smbmdash; User name and Password Panel</title></figure>
|
|---|
| 81 | </para></step>
|
|---|
| 82 |
|
|---|
| 83 | <step><para>
|
|---|
| 84 | Click <guimenu>OK</guimenu>.
|
|---|
| 85 | </para>
|
|---|
| 86 |
|
|---|
| 87 | <para>
|
|---|
| 88 | The <quote>Welcome to the MIDEARTH domain</quote> dialog box should appear. At this point, the machine must be rebooted.
|
|---|
| 89 | Joining the domain is now complete.
|
|---|
| 90 | </para></step>
|
|---|
| 91 |
|
|---|
| 92 | </procedure>
|
|---|
| 93 |
|
|---|
| 94 | <para>
|
|---|
| 95 | <indexterm><primary>Active Directory</primary></indexterm>
|
|---|
| 96 | <indexterm><primary>DNS</primary></indexterm>
|
|---|
| 97 | The screen capture shown in <link linkend="swxpp007"/> has a button labeled <guimenu>More...</guimenu>. This button opens a
|
|---|
| 98 | panel in which you can set (or change) the Primary DNS suffix of the computer. This is a parameter that mainly affects members
|
|---|
| 99 | of Microsoft Active Directory. Active Directory is heavily oriented around the DNS namespace.
|
|---|
| 100 | </para>
|
|---|
| 101 |
|
|---|
| 102 | <para>
|
|---|
| 103 | <indexterm><primary>Netlogon</primary></indexterm>
|
|---|
| 104 | <indexterm><primary>DNS</primary><secondary>dynamic</secondary></indexterm>
|
|---|
| 105 | Where NetBIOS technology uses WINS as well as UDP broadcast as key mechanisms for name resolution, Active Directory servers
|
|---|
| 106 | register their services with the Microsoft Dynamic DNS server. Windows clients must be able to query the correct DNS server
|
|---|
| 107 | to find the services (like which machines are domain controllers or which machines have the Netlogon service running).
|
|---|
| 108 | </para>
|
|---|
| 109 |
|
|---|
| 110 | <para>
|
|---|
| 111 | <indexterm><primary>DNS</primary><secondary>suffix</secondary></indexterm>
|
|---|
| 112 | The default setting of the Primary DNS suffix is the Active Directory domain name. When you change the Primary DNS suffix,
|
|---|
| 113 | this does not affect domain membership, but it can break network browsing and the ability to resolve your computer name to
|
|---|
| 114 | a valid IP address.
|
|---|
| 115 | </para>
|
|---|
| 116 |
|
|---|
| 117 | <para>
|
|---|
| 118 | The Primary DNS suffix parameter principally affects MS Windows clients that are members of an Active Directory domain.
|
|---|
| 119 | Where the client is a member of a Samba domain, it is preferable to leave this field blank.
|
|---|
| 120 | </para>
|
|---|
| 121 |
|
|---|
| 122 | <para>
|
|---|
| 123 | <indexterm><primary>Group Policy</primary></indexterm>
|
|---|
| 124 | According to Microsoft documentation, <quote>If this computer belongs to a group with <constant>Group Policy</constant>
|
|---|
| 125 | enabled on <command>Primary DNS suffice of this computer</command>, the string specified in the Group Policy is used
|
|---|
| 126 | as the primary DNS suffix and you might need to restart your computer to view the correct setting. The local setting is
|
|---|
| 127 | used only if Group Policy is disabled or unspecified.</quote>
|
|---|
| 128 | </para>
|
|---|
| 129 |
|
|---|
| 130 | </sect1>
|
|---|
| 131 |
|
|---|
| 132 | <sect1>
|
|---|
| 133 | <title>Samba System File Location</title>
|
|---|
| 134 |
|
|---|
| 135 | <para><indexterm>
|
|---|
| 136 | <primary>default installation</primary>
|
|---|
| 137 | </indexterm><indexterm>
|
|---|
| 138 | <primary>/usr/local/samba</primary>
|
|---|
| 139 | </indexterm><indexterm>
|
|---|
| 140 | <primary>/usr/local</primary>
|
|---|
| 141 | </indexterm>
|
|---|
| 142 | One of the frustrations expressed by subscribers to the Samba mailing lists revolves around the choice of where the default Samba Team
|
|---|
| 143 | build and installation process locates its Samba files. The location, chosen in the early 1990s, for the default installation is
|
|---|
| 144 | in the <filename>/usr/local/samba</filename> directory. This is a perfectly reasonable location, particularly given all the other
|
|---|
| 145 | Open Source software that installs into the <filename>/usr/local</filename> subdirectories.
|
|---|
| 146 | </para>
|
|---|
| 147 |
|
|---|
| 148 | <para>
|
|---|
| 149 | Several UNIX vendors, and Linux vendors in particular, elected to locate the Samba files in a location other than the Samba Team
|
|---|
| 150 | default.
|
|---|
| 151 | </para>
|
|---|
| 152 |
|
|---|
| 153 | <para><indexterm>
|
|---|
| 154 | <primary>Free Standards Group</primary>
|
|---|
| 155 | <see>FSG</see>
|
|---|
| 156 | </indexterm><indexterm>
|
|---|
| 157 | <primary>FSG</primary>
|
|---|
| 158 | </indexterm><indexterm>
|
|---|
| 159 | <primary>Linux Standards Base</primary>
|
|---|
| 160 | <see>LSB</see>
|
|---|
| 161 | </indexterm><indexterm>
|
|---|
| 162 | <primary>LSB</primary>
|
|---|
| 163 | </indexterm><indexterm>
|
|---|
| 164 | <primary>File Hierarchy System</primary>
|
|---|
| 165 | <see>FHS</see>
|
|---|
| 166 | </indexterm><indexterm>
|
|---|
| 167 | <primary>FHS</primary>
|
|---|
| 168 | </indexterm><indexterm>
|
|---|
| 169 | <primary>file locations</primary>
|
|---|
| 170 | </indexterm><indexterm>
|
|---|
| 171 | <primary>/etc/samba</primary>
|
|---|
| 172 | </indexterm><indexterm>
|
|---|
| 173 | <primary>/usr/sbin</primary>
|
|---|
| 174 | </indexterm><indexterm>
|
|---|
| 175 | <primary>/usr/bin</primary>
|
|---|
| 176 | </indexterm><indexterm>
|
|---|
| 177 | <primary>/usr/share</primary>
|
|---|
| 178 | </indexterm><indexterm>
|
|---|
| 179 | <primary>/usr/share/swat</primary>
|
|---|
| 180 | </indexterm><indexterm>
|
|---|
| 181 | <primary>/usr/lib/samba</primary>
|
|---|
| 182 | </indexterm><indexterm>
|
|---|
| 183 | <primary>/usr/share/samba/swat</primary>
|
|---|
| 184 | </indexterm><indexterm>
|
|---|
| 185 | <primary>SWAT</primary>
|
|---|
| 186 | </indexterm><indexterm>
|
|---|
| 187 | <primary>VFS modules</primary>
|
|---|
| 188 | </indexterm>
|
|---|
| 189 | Linux vendors, working in conjunction with the Free Standards Group (FSG), Linux Standards Base (LSB), and File Hierarchy
|
|---|
| 190 | System (FHS), have elected to locate the configuration files under the <filename>/etc/samba</filename> directory, common binary
|
|---|
| 191 | files (those used by users) in the <filename>/usr/bin</filename> directory, and the administrative files (daemons) in the
|
|---|
| 192 | <filename>/usr/sbin</filename> directory. Support files for the Samba Web Admin Tool (SWAT) are located under the
|
|---|
| 193 | <filename>/usr/share</filename> directory, either in <filename>/usr/share/samba/swat</filename> or in
|
|---|
| 194 | <filename>/usr/share/swat</filename>. There are additional support files for <command>smbd</command> in the
|
|---|
| 195 | <filename>/usr/lib/samba</filename> directory tree. The files located there include the dynamically loadable modules for the
|
|---|
| 196 | passdb backend as well as for the VFS modules.
|
|---|
| 197 | </para>
|
|---|
| 198 |
|
|---|
| 199 | <para><indexterm>
|
|---|
| 200 | <primary>/var/lib/samba</primary>
|
|---|
| 201 | </indexterm><indexterm>
|
|---|
| 202 | <primary>/var/log/samba</primary>
|
|---|
| 203 | </indexterm><indexterm>
|
|---|
| 204 | <primary>run-time control files</primary>
|
|---|
| 205 | </indexterm>
|
|---|
| 206 | Samba creates runtime control files and generates log files. The runtime control files (tdb and dat files) are stored in
|
|---|
| 207 | the <filename>/var/lib/samba</filename> directory. Log files are created in <filename>/var/log/samba.</filename>
|
|---|
| 208 | </para>
|
|---|
| 209 |
|
|---|
| 210 | <para>
|
|---|
| 211 | When Samba is built and installed using the default Samba Team process, all files are located under the
|
|---|
| 212 | <filename>/usr/local/samba</filename> directory tree. This makes it simple to find the files that Samba owns.
|
|---|
| 213 | </para>
|
|---|
| 214 |
|
|---|
| 215 | <para><indexterm>
|
|---|
| 216 | <primary>smbd</primary>
|
|---|
| 217 | <secondary>location of files</secondary>
|
|---|
| 218 | </indexterm>
|
|---|
| 219 | One way to find the Samba files that are installed on your UNIX/Linux system is to search for the location
|
|---|
| 220 | of all files called <command>smbd</command>. Here is an example:
|
|---|
| 221 | <screen>
|
|---|
| 222 | &rootprompt; find / -name smbd -print
|
|---|
| 223 | </screen>
|
|---|
| 224 | You can find the location of the configuration files by running:
|
|---|
| 225 | <screen>
|
|---|
| 226 | &rootprompt; /path-to-binary-file/smbd -b | more
|
|---|
| 227 | ...
|
|---|
| 228 | Paths:
|
|---|
| 229 | SBINDIR: /usr/sbin
|
|---|
| 230 | BINDIR: /usr/bin
|
|---|
| 231 | SWATDIR: /usr/share/samba/swat
|
|---|
| 232 | CONFIGFILE: /etc/samba/smb.conf
|
|---|
| 233 | LOGFILEBASE: /var/log/samba
|
|---|
| 234 | LMHOSTSFILE: /etc/samba/lmhosts
|
|---|
| 235 | LIBDIR: /usr/lib/samba
|
|---|
| 236 | SHLIBEXT: so
|
|---|
| 237 | LOCKDIR: /var/lib/samba
|
|---|
| 238 | PIDDIR: /var/run/samba
|
|---|
| 239 | SMB_PASSWD_FILE: /etc/samba/smbpasswd
|
|---|
| 240 | PRIVATE_DIR: /etc/samba
|
|---|
| 241 | ...
|
|---|
| 242 | </screen>
|
|---|
| 243 | If you wish to locate the Samba version, just run:
|
|---|
| 244 | <screen>
|
|---|
| 245 | &rootprompt; /path-to-binary-file/smbd -V
|
|---|
| 246 | Version 3.0.20-SUSE
|
|---|
| 247 | </screen>
|
|---|
| 248 | </para>
|
|---|
| 249 |
|
|---|
| 250 | <para>
|
|---|
| 251 | Many people have been caught by installation of Samba using the default Samba Team process when it was already installed
|
|---|
| 252 | by the platform vendor's method. If your platform uses RPM format packages, you can check to see if Samba is installed by
|
|---|
| 253 | executing:<indexterm>
|
|---|
| 254 | <primary>rpm</primary>
|
|---|
| 255 | </indexterm>
|
|---|
| 256 | <screen>
|
|---|
| 257 | &rootprompt; rpm -qa | grep samba
|
|---|
| 258 | samba3-pdb-3.0.20-1
|
|---|
| 259 | samba3-vscan-0.3.6-0
|
|---|
| 260 | samba3-winbind-3.0.20-1
|
|---|
| 261 | samba3-3.0.20-1
|
|---|
| 262 | samba3-python-3.0.20-1
|
|---|
| 263 | samba3-utils-3.0.20-1
|
|---|
| 264 | samba3-doc-3.0.20-1
|
|---|
| 265 | samba3-client-3.0.20-1
|
|---|
| 266 | samba3-cifsmount-3.0.20-1
|
|---|
| 267 | </screen><indexterm>
|
|---|
| 268 | <primary>package names</primary>
|
|---|
| 269 | </indexterm>
|
|---|
| 270 | The package names, of course, vary according to how the vendor, or the binary package builder, prepared them.
|
|---|
| 271 | </para>
|
|---|
| 272 |
|
|---|
| 273 | </sect1>
|
|---|
| 274 |
|
|---|
| 275 | <sect1>
|
|---|
| 276 | <title>Starting Samba</title>
|
|---|
| 277 |
|
|---|
| 278 | <para><indexterm>
|
|---|
| 279 | <primary>daemon</primary>
|
|---|
| 280 | </indexterm>
|
|---|
| 281 | Samba essentially consists of two or three daemons. A daemon is a UNIX application that runs in the background and provides services.
|
|---|
| 282 | An example of a service is the Apache Web server for which the daemon is called <command>httpd</command>. In the case of Samba, there
|
|---|
| 283 | are three daemons, two of which are needed as a minimum.
|
|---|
| 284 | </para>
|
|---|
| 285 |
|
|---|
| 286 | <para>
|
|---|
| 287 | The Samba server is made up of the following daemons:
|
|---|
| 288 | </para>
|
|---|
| 289 |
|
|---|
| 290 | <example id="ch12SL">
|
|---|
| 291 | <title>A Useful Samba Control Script for SUSE Linux</title>
|
|---|
| 292 | <screen>
|
|---|
| 293 | #!/bin/bash
|
|---|
| 294 | #
|
|---|
| 295 | # Script to start/stop samba
|
|---|
| 296 | # Locate this in /sbin as a file called 'samba'
|
|---|
| 297 |
|
|---|
| 298 | RCD=/etc/rc.d
|
|---|
| 299 |
|
|---|
| 300 | if [ z$1 == 'z' ]; then
|
|---|
| 301 | echo $0 - No arguments given; must be start or stop.
|
|---|
| 302 | exit
|
|---|
| 303 | fi
|
|---|
| 304 |
|
|---|
| 305 | if [ $1 == 'start' ]; then
|
|---|
| 306 | ${RCD}/nmb start
|
|---|
| 307 | ${RCD}/smb start
|
|---|
| 308 | ${RCD}/winbind start
|
|---|
| 309 |
|
|---|
| 310 | fi
|
|---|
| 311 | if [ $1 == 'stop' ]; then
|
|---|
| 312 | ${RCD}/smb stop
|
|---|
| 313 | ${RCD}/winbind stop
|
|---|
| 314 | ${RCD}/nmb stop
|
|---|
| 315 | fi
|
|---|
| 316 | if [ $1 == 'restart' ]; then
|
|---|
| 317 | ${RCD}/smb stop
|
|---|
| 318 | ${RCD}/winbind stop
|
|---|
| 319 | ${RCD}/nmb stop
|
|---|
| 320 | sleep 5
|
|---|
| 321 | ${RCD}/nmb start
|
|---|
| 322 | ${RCD}/smb start
|
|---|
| 323 | ${RCD}/winbind start
|
|---|
| 324 | fi
|
|---|
| 325 | exit 0
|
|---|
| 326 | </screen>
|
|---|
| 327 | </example>
|
|---|
| 328 |
|
|---|
| 329 | <variablelist>
|
|---|
| 330 | <varlistentry><term>nmbd</term>
|
|---|
| 331 | <listitem><para>
|
|---|
| 332 | <indexterm><primary>smbd</primary></indexterm>
|
|---|
| 333 | <indexterm><primary>starting samba</primary><secondary>smbd</secondary></indexterm>
|
|---|
| 334 | This daemon handles all name registration and resolution requests. It is the primary vehicle involved
|
|---|
| 335 | in network browsing. It handles all UDP-based protocols. The <command>nmbd</command> daemon should
|
|---|
| 336 | be the first command started as part of the Samba startup process.
|
|---|
| 337 | </para></listitem>
|
|---|
| 338 | </varlistentry>
|
|---|
| 339 |
|
|---|
| 340 | <varlistentry><term>smbd</term>
|
|---|
| 341 | <listitem><para>
|
|---|
| 342 | <indexterm><primary>nmbd</primary></indexterm>
|
|---|
| 343 | <indexterm><primary>starting samba</primary><secondary>nmbd</secondary></indexterm>
|
|---|
| 344 | This daemon handles all TCP/IP-based connection services for file- and print-based operations. It also
|
|---|
| 345 | manages local authentication. It should be started immediately following the startup of <command>nmbd</command>.
|
|---|
| 346 | </para></listitem>
|
|---|
| 347 | </varlistentry>
|
|---|
| 348 |
|
|---|
| 349 | <varlistentry><term>winbindd</term>
|
|---|
| 350 | <listitem><para>
|
|---|
| 351 | <indexterm><primary>winbindd</primary></indexterm>
|
|---|
| 352 | <indexterm><primary>starting samba</primary><secondary>winbindd</secondary></indexterm>
|
|---|
| 353 | This daemon should be started when Samba is a member of a Windows NT4 or ADS domain. It is also needed when
|
|---|
| 354 | Samba has trust relationships with another domain. The <command>winbindd</command> daemon will check the
|
|---|
| 355 | &smb.conf; file for the presence of the <parameter>idmap uid</parameter> and <parameter>idmap gid</parameter>
|
|---|
| 356 | parameters. If they are not found, <command>winbindd</command> bails out and refuses to start.
|
|---|
| 357 | </para></listitem>
|
|---|
| 358 | </varlistentry>
|
|---|
| 359 | </variablelist>
|
|---|
| 360 |
|
|---|
| 361 | <para>
|
|---|
| 362 | When Samba has been packaged by an operating system vendor, the startup process is typically a custom feature of its
|
|---|
| 363 | integration into the platform as a whole. Please refer to your operating system platform administration manuals for
|
|---|
| 364 | specific information pertaining to correct management of Samba startup.
|
|---|
| 365 | </para>
|
|---|
| 366 |
|
|---|
| 367 | <example id="ch12RHscript">
|
|---|
| 368 | <title>A Sample Samba Control Script for Red Hat Linux</title>
|
|---|
| 369 | <screen>
|
|---|
| 370 | #!/bin/sh
|
|---|
| 371 | #
|
|---|
| 372 | # chkconfig: 345 81 35
|
|---|
| 373 | # description: Starts and stops the Samba smbd and nmbd daemons \
|
|---|
| 374 | # used to provide SMB network services.
|
|---|
| 375 |
|
|---|
| 376 | # Source function library.
|
|---|
| 377 | . /etc/rc.d/init.d/functions
|
|---|
| 378 | # Source networking configuration.
|
|---|
| 379 | . /etc/sysconfig/network
|
|---|
| 380 | # Check that networking is up.
|
|---|
| 381 | [ ${NETWORKING} = "no" ] && exit 0
|
|---|
| 382 | CONFIG=/etc/samba/smb.conf
|
|---|
| 383 | # Check that smb.conf exists.
|
|---|
| 384 | [ -f $CONFIG ] || exit 0
|
|---|
| 385 |
|
|---|
| 386 | # See how we were called.
|
|---|
| 387 | case "$1" in
|
|---|
| 388 | start)
|
|---|
| 389 | echo -n "Starting SMB services: "
|
|---|
| 390 | daemon smbd -D; daemon nmbd -D; echo;
|
|---|
| 391 | touch /var/lock/subsys/smb
|
|---|
| 392 | ;;
|
|---|
| 393 | stop)
|
|---|
| 394 | echo -n "Shutting down SMB services: "
|
|---|
| 395 | smbdpids=`ps guax | grep smbd | grep -v grep | awk '{print $2}'`
|
|---|
| 396 | for pid in $smbdpids; do
|
|---|
| 397 | kill -TERM $pid
|
|---|
| 398 | done
|
|---|
| 399 | killproc nmbd -TERM; rm -f /var/lock/subsys/smb
|
|---|
| 400 | echo ""
|
|---|
| 401 | ;;
|
|---|
| 402 | status)
|
|---|
| 403 | status smbd; status nmbd;
|
|---|
| 404 | ;;
|
|---|
| 405 | restart)
|
|---|
| 406 | echo -n "Restarting SMB services: "
|
|---|
| 407 | $0 stop; $0 start;
|
|---|
| 408 | echo "done."
|
|---|
| 409 | ;;
|
|---|
| 410 | *)
|
|---|
| 411 | echo "Usage: smb {start|stop|restart|status}"
|
|---|
| 412 | exit 1
|
|---|
| 413 | esac
|
|---|
| 414 | </screen>
|
|---|
| 415 | </example>
|
|---|
| 416 |
|
|---|
| 417 | <para><indexterm>
|
|---|
| 418 | <primary>samba control script</primary>
|
|---|
| 419 | </indexterm>
|
|---|
| 420 | SUSE Linux implements individual control over each Samba daemon. A Samba control script that can be conveniently
|
|---|
| 421 | executed from the command line is shown in <link linkend="ch12SL"/>. This can be located in the directory
|
|---|
| 422 | <filename>/sbin</filename> in a file called <filename>samba</filename>. This type of control script should be
|
|---|
| 423 | owned by user root and group root, and set so that only root can execute it.
|
|---|
| 424 | </para>
|
|---|
| 425 |
|
|---|
| 426 | <para><indexterm>
|
|---|
| 427 | <primary>startup script</primary>
|
|---|
| 428 | </indexterm>
|
|---|
| 429 | A sample startup script for a Red Hat Linux system is shown in <link linkend="ch12RHscript"/>.
|
|---|
| 430 | This file could be located in the directory <filename>/etc/rc.d</filename> and can be called
|
|---|
| 431 | <filename>samba</filename>. A similar startup script is required to control <command>winbind</command>.
|
|---|
| 432 | If you want to find more information regarding startup scripts please refer to the packaging section of
|
|---|
| 433 | the Samba source code distribution tarball. The packaging files for each platform include a
|
|---|
| 434 | startup control file.
|
|---|
| 435 | </para>
|
|---|
| 436 |
|
|---|
| 437 | </sect1>
|
|---|
| 438 |
|
|---|
| 439 | <sect1>
|
|---|
| 440 | <title>DNS Configuration Files</title>
|
|---|
| 441 |
|
|---|
| 442 | <para>
|
|---|
| 443 | The following files are common to all DNS server configurations. Rather than repeat them multiple times, they
|
|---|
| 444 | are presented here for general reference.
|
|---|
| 445 | </para>
|
|---|
| 446 |
|
|---|
| 447 | <sect2>
|
|---|
| 448 | <title>The Forward Zone File for the Loopback Adaptor</title>
|
|---|
| 449 |
|
|---|
| 450 | <para>
|
|---|
| 451 | The forward zone file for the loopback address never changes. An example file is shown
|
|---|
| 452 | in <link linkend="loopback"/>. All traffic destined for an IP address that is hosted on a
|
|---|
| 453 | physical interface on the machine itself is routed to the loopback adaptor. This is
|
|---|
| 454 | a fundamental design feature of the TCP/IP protocol implementation. The loopback adaptor
|
|---|
| 455 | is called <constant>localhost</constant>.
|
|---|
| 456 | </para>
|
|---|
| 457 |
|
|---|
| 458 | <example id="loopback">
|
|---|
| 459 | <title>DNS Localhost Forward Zone File: <filename>/var/lib/named/localhost.zone</filename></title>
|
|---|
| 460 | <screen>
|
|---|
| 461 | $TTL 1W
|
|---|
| 462 | @ IN SOA @ root (
|
|---|
| 463 | 42 ; serial
|
|---|
| 464 | 2D ; refresh
|
|---|
| 465 | 4H ; retry
|
|---|
| 466 | 6W ; expiry
|
|---|
| 467 | 1W ) ; minimum
|
|---|
| 468 |
|
|---|
| 469 | IN NS @
|
|---|
| 470 | IN A 127.0.0.1
|
|---|
| 471 | </screen>
|
|---|
| 472 | </example>
|
|---|
| 473 |
|
|---|
| 474 | </sect2>
|
|---|
| 475 |
|
|---|
| 476 | <sect2>
|
|---|
| 477 | <title>The Reverse Zone File for the Loopback Adaptor</title>
|
|---|
| 478 |
|
|---|
| 479 | <para>
|
|---|
| 480 | The reverse zone file for the loopback address as shown in <link linkend="dnsloopy"/>
|
|---|
| 481 | is necessary so that references to the address <constant>127.0.0.1</constant> can be
|
|---|
| 482 | resolved to the correct name of the interface.
|
|---|
| 483 | </para>
|
|---|
| 484 |
|
|---|
| 485 | <example id="dnsloopy">
|
|---|
| 486 | <title>DNS Localhost Reverse Zone File: <filename>/var/lib/named/127.0.0.zone</filename></title>
|
|---|
| 487 | <screen>
|
|---|
| 488 | $TTL 1W
|
|---|
| 489 | @ IN SOA localhost. root.localhost. (
|
|---|
| 490 | 42 ; serial
|
|---|
| 491 | 2D ; refresh
|
|---|
| 492 | 4H ; retry
|
|---|
| 493 | 6W ; expiry
|
|---|
| 494 | 1W ) ; minimum
|
|---|
| 495 |
|
|---|
| 496 | IN NS localhost.
|
|---|
| 497 | 1 IN PTR localhost.
|
|---|
| 498 | </screen>
|
|---|
| 499 | </example>
|
|---|
| 500 |
|
|---|
| 501 | <example id="roothint">
|
|---|
| 502 | <title>DNS Root Name Server Hint File: <filename>/var/lib/named/root.hint</filename></title>
|
|---|
| 503 | <screen>
|
|---|
| 504 | ; This file is made available by InterNIC under anonymous FTP as
|
|---|
| 505 | ; file /domain/named.root
|
|---|
| 506 | ; on server FTP.INTERNIC.NET
|
|---|
| 507 | ; last update: Nov 5, 2002. Related version of root zone: 2002110501
|
|---|
| 508 | ; formerly NS.INTERNIC.NET
|
|---|
| 509 | . 3600000 IN NS A.ROOT-SERVERS.NET.
|
|---|
| 510 | A.ROOT-SERVERS.NET. 3600000 A 198.41.0.4
|
|---|
| 511 | ; formerly NS1.ISI.EDU
|
|---|
| 512 | . 3600000 NS B.ROOT-SERVERS.NET.
|
|---|
| 513 | B.ROOT-SERVERS.NET. 3600000 A 128.9.0.107
|
|---|
| 514 | ; formerly C.PSI.NET
|
|---|
| 515 | . 3600000 NS C.ROOT-SERVERS.NET.
|
|---|
| 516 | C.ROOT-SERVERS.NET. 3600000 A 192.33.4.12
|
|---|
| 517 | ; formerly TERP.UMD.EDU
|
|---|
| 518 | . 3600000 NS D.ROOT-SERVERS.NET.
|
|---|
| 519 | D.ROOT-SERVERS.NET. 3600000 A 128.8.10.90
|
|---|
| 520 | ; formerly NS.NASA.GOV
|
|---|
| 521 | . 3600000 NS E.ROOT-SERVERS.NET.
|
|---|
| 522 | E.ROOT-SERVERS.NET. 3600000 A 192.203.230.10
|
|---|
| 523 | ; formerly NS.ISC.ORG
|
|---|
| 524 | . 3600000 NS F.ROOT-SERVERS.NET.
|
|---|
| 525 | F.ROOT-SERVERS.NET. 3600000 A 192.5.5.241
|
|---|
| 526 | ; formerly NS.NIC.DDN.MIL
|
|---|
| 527 | . 3600000 NS G.ROOT-SERVERS.NET.
|
|---|
| 528 | G.ROOT-SERVERS.NET. 3600000 A 192.112.36.4
|
|---|
| 529 | ; formerly AOS.ARL.ARMY.MIL
|
|---|
| 530 | . 3600000 NS H.ROOT-SERVERS.NET.
|
|---|
| 531 | H.ROOT-SERVERS.NET. 3600000 A 128.63.2.53
|
|---|
| 532 | ; formerly NIC.NORDU.NET
|
|---|
| 533 | . 3600000 NS I.ROOT-SERVERS.NET.
|
|---|
| 534 | I.ROOT-SERVERS.NET. 3600000 A 192.36.148.17
|
|---|
| 535 | ; operated by VeriSign, Inc.
|
|---|
| 536 | . 3600000 NS J.ROOT-SERVERS.NET.
|
|---|
| 537 | J.ROOT-SERVERS.NET. 3600000 A 192.58.128.30
|
|---|
| 538 | ; housed in LINX, operated by RIPE NCC
|
|---|
| 539 | . 3600000 NS K.ROOT-SERVERS.NET.
|
|---|
| 540 | K.ROOT-SERVERS.NET. 3600000 A 193.0.14.129
|
|---|
| 541 | ; operated by IANA
|
|---|
| 542 | . 3600000 NS L.ROOT-SERVERS.NET.
|
|---|
| 543 | L.ROOT-SERVERS.NET. 3600000 A 198.32.64.12
|
|---|
| 544 | ; housed in Japan, operated by WIDE
|
|---|
| 545 | . 3600000 NS M.ROOT-SERVERS.NET.
|
|---|
| 546 | M.ROOT-SERVERS.NET. 3600000 A 202.12.27.33
|
|---|
| 547 | ; End of File
|
|---|
| 548 | </screen>
|
|---|
| 549 | </example>
|
|---|
| 550 | </sect2>
|
|---|
| 551 |
|
|---|
| 552 | <sect2>
|
|---|
| 553 | <title>DNS Root Server Hint File</title>
|
|---|
| 554 |
|
|---|
| 555 | <para>
|
|---|
| 556 | The content of the root hints file as shown in <link linkend="roothint"/> changes slowly over time.
|
|---|
| 557 | Periodically this file should be updated from the source shown. Because
|
|---|
| 558 | of its size, this file is located at the end of this chapter.
|
|---|
| 559 | </para>
|
|---|
| 560 |
|
|---|
| 561 | </sect2>
|
|---|
| 562 |
|
|---|
| 563 | </sect1>
|
|---|
| 564 |
|
|---|
| 565 | <sect1 id="altldapcfg">
|
|---|
| 566 | <title>Alternative LDAP Database Initialization</title>
|
|---|
| 567 |
|
|---|
| 568 | <para><indexterm>
|
|---|
| 569 | <primary>LDAP</primary>
|
|---|
| 570 | <secondary>database</secondary>
|
|---|
| 571 | </indexterm><indexterm>
|
|---|
| 572 | <primary>LDAP</primary>
|
|---|
| 573 | <secondary>initial configuration</secondary>
|
|---|
| 574 | </indexterm>
|
|---|
| 575 | The following procedure may be used as an alternative means of configuring
|
|---|
| 576 | the initial LDAP database. Many administrators prefer to have greater control
|
|---|
| 577 | over how system files get configured.
|
|---|
| 578 | </para>
|
|---|
| 579 |
|
|---|
| 580 | <sect2>
|
|---|
| 581 | <title>Initialization of the LDAP Database</title>
|
|---|
| 582 |
|
|---|
| 583 | <para><indexterm>
|
|---|
| 584 | <primary>LDIF</primary>
|
|---|
| 585 | </indexterm><indexterm>
|
|---|
| 586 | <primary>Domain Groups</primary>
|
|---|
| 587 | <secondary>well-known</secondary>
|
|---|
| 588 | </indexterm><indexterm>
|
|---|
| 589 | <primary>SID</primary>
|
|---|
| 590 | </indexterm>
|
|---|
| 591 | The first step to get the LDAP server ready for action is to create the LDIF file from
|
|---|
| 592 | which the LDAP database will be preloaded. This is necessary to create the containers
|
|---|
| 593 | into which the user, group, and other accounts are written. It is also necessary to
|
|---|
| 594 | preload the well-known Windows NT Domain Groups, as they must have the correct SID so
|
|---|
| 595 | that they can be recognized as special NT Groups by the MS Windows clients.
|
|---|
| 596 | </para>
|
|---|
| 597 |
|
|---|
| 598 | <procedure id="ldapinit">
|
|---|
| 599 | <title>LDAP Directory Pre-Load Steps</title>
|
|---|
| 600 |
|
|---|
| 601 | <step><para>
|
|---|
| 602 | Create a directory in which to store the files you use to generate
|
|---|
| 603 | the LDAP LDIF file for your system. Execute the following:
|
|---|
| 604 | <screen>
|
|---|
| 605 | &rootprompt; mkdir /etc/openldap/SambaInit
|
|---|
| 606 | &rootprompt; chown root:root /etc/openldap/SambaInit
|
|---|
| 607 | &rootprompt; chmod 700 /etc/openldap/SambaInit
|
|---|
| 608 | </screen>
|
|---|
| 609 | </para></step>
|
|---|
| 610 |
|
|---|
| 611 | <step><para>
|
|---|
| 612 | Install the files shown in <link linkend="sbehap-ldapreconfa"/>, <link linkend="sbehap-ldapreconfb"/>,
|
|---|
| 613 | and <link linkend="sbehap-ldapreconfc"/> into the directory
|
|---|
| 614 | <filename>/etc/openldap/SambaInit/SMBLDAP-ldif-preconfig.sh.</filename> These three files are,
|
|---|
| 615 | respectively, parts A, B, and C of the <filename>SMBLDAP-ldif-preconfig.sh</filename> file.
|
|---|
| 616 | </para></step>
|
|---|
| 617 |
|
|---|
| 618 | <step><para>
|
|---|
| 619 | Install the files shown in <link linkend="sbehap-ldifpata"/> and <link linkend="sbehap-ldifpatb"/> into the directory
|
|---|
| 620 | <filename>/etc/openldap/SambaInit/.</filename> These two files are
|
|---|
| 621 | parts A and B, respectively, of the <filename>init-ldif.pat</filename> file.
|
|---|
| 622 | </para></step>
|
|---|
| 623 |
|
|---|
| 624 | <step><para>
|
|---|
| 625 | Change to the <filename>/etc/openldap/SambaInit</filename> directory. Execute the following:
|
|---|
| 626 | <screen>
|
|---|
| 627 | &rootprompt; sh SMBLDAP-ldif-preconfig.sh
|
|---|
| 628 |
|
|---|
| 629 | How do you wish to refer to your organization?
|
|---|
| 630 | Suggestions:
|
|---|
| 631 | Black Tire Company, Inc.
|
|---|
| 632 | Cat With Hat Ltd.
|
|---|
| 633 | How would you like your organization name to appear?
|
|---|
| 634 | Your organization name is: My Organization
|
|---|
| 635 | Enter a new name is this is not what you want, press Enter to Continue.
|
|---|
| 636 | Name [My Organization]: Abmas Inc.
|
|---|
| 637 |
|
|---|
| 638 | Samba Config File Location [/etc/samba/smb.conf]:
|
|---|
| 639 | Enter a new full path or press Enter to continue.
|
|---|
| 640 | Samba Config File Location [/etc/samba/smb.conf]:
|
|---|
| 641 | Domain Name: MEGANET2
|
|---|
| 642 | Domain SID: S-1-5-21-3504140859-1010554828-2431957765
|
|---|
| 643 |
|
|---|
| 644 | The name of your Internet domain is now needed in a special format
|
|---|
| 645 | as follows, if your domain name is mydomain.org, what we need is
|
|---|
| 646 | the information in the form of:
|
|---|
| 647 | Domain ID: mydomain
|
|---|
| 648 | Top level: org
|
|---|
| 649 | If your fully qualified hostname is: snoopy.bazaar.garagesale.net
|
|---|
| 650 | where "snoopy" is the name of the machine,
|
|---|
| 651 | Then the information needed is:
|
|---|
| 652 | Domain ID: garagesale
|
|---|
| 653 | Top Level: net
|
|---|
| 654 |
|
|---|
| 655 | Found the following domain name: abmas.biz
|
|---|
| 656 | I think the bit we are looking for might be: abmas
|
|---|
| 657 | Enter the domain name or press Enter to continue:
|
|---|
| 658 |
|
|---|
| 659 | The top level organization name I will use is: biz
|
|---|
| 660 | Enter the top level org name or press Enter to continue:
|
|---|
| 661 | &rootprompt;
|
|---|
| 662 | </screen>
|
|---|
| 663 | This creates a file called <filename>MEGANET2.ldif</filename>.
|
|---|
| 664 | </para></step>
|
|---|
| 665 |
|
|---|
| 666 | <step><para>
|
|---|
| 667 | It is now time to preload the LDAP database with the following
|
|---|
| 668 | command:
|
|---|
| 669 | <screen>
|
|---|
| 670 | &rootprompt; slapadd -v -l MEGANET2.ldif
|
|---|
| 671 | added: "dc=abmas,dc=biz" (00000001)
|
|---|
| 672 | added: "cn=Manager,dc=abmas,dc=biz" (00000002)
|
|---|
| 673 | added: "ou=People,dc=abmas,dc=biz" (00000003)
|
|---|
| 674 | added: "ou=Computers,dc=abmas,dc=biz" (00000004)
|
|---|
| 675 | added: "ou=Groups,dc=abmas,dc=biz" (00000005)
|
|---|
| 676 | added: "ou=Domains,dc=abmas,dc=biz" (00000006)
|
|---|
| 677 | added: "sambaDomainName=MEGANET2,ou=Domains,dc=abmas,dc=biz" (00000007)
|
|---|
| 678 | added: "cn=domadmins,ou=Groups,dc=abmas,dc=biz" (00000008)
|
|---|
| 679 | added: "cn=domguests,ou=Groups,dc=abmas,dc=biz" (00000009)
|
|---|
| 680 | added: "cn=domusers,ou=Groups,dc=abmas,dc=biz" (0000000a)
|
|---|
| 681 | </screen>
|
|---|
| 682 | You should verify that the account information was correctly loaded by executing:
|
|---|
| 683 | <screen>
|
|---|
| 684 | &rootprompt; slapcat
|
|---|
| 685 | dn: dc=abmas,dc=biz
|
|---|
| 686 | objectClass: dcObject
|
|---|
| 687 | objectClass: organization
|
|---|
| 688 | dc: abmas
|
|---|
| 689 | o: Abmas Inc.
|
|---|
| 690 | description: Posix and Samba LDAP Identity Database
|
|---|
| 691 | structuralObjectClass: organization
|
|---|
| 692 | entryUUID: af552f8e-c4a1-1027-9002-9421e01bf474
|
|---|
| 693 | creatorsName: cn=manager,dc=abmas,dc=biz
|
|---|
| 694 | modifiersName: cn=manager,dc=abmas,dc=biz
|
|---|
| 695 | createTimestamp: 20031217055747Z
|
|---|
| 696 | modifyTimestamp: 20031217055747Z
|
|---|
| 697 | entryCSN: 2003121705:57:47Z#0x0001#0#0000
|
|---|
| 698 | ...
|
|---|
| 699 |
|
|---|
| 700 | dn: cn=domusers,ou=Groups,dc=abmas,dc=biz
|
|---|
| 701 | objectClass: posixGroup
|
|---|
| 702 | objectClass: sambaGroupMapping
|
|---|
| 703 | gidNumber: 513
|
|---|
| 704 | cn: domusers
|
|---|
| 705 | sambaSID: S-1-5-21-3504140859-1010554828-2431957765-513
|
|---|
| 706 | sambaGroupType: 2
|
|---|
| 707 | displayName: Domain Users
|
|---|
| 708 | description: Domain Users
|
|---|
| 709 | structuralObjectClass: posixGroup
|
|---|
| 710 | entryUUID: af7e98ba-c4a1-1027-900b-9421e01bf474
|
|---|
| 711 | creatorsName: cn=manager,dc=abmas,dc=biz
|
|---|
| 712 | modifiersName: cn=manager,dc=abmas,dc=biz
|
|---|
| 713 | createTimestamp: 20031217055747Z
|
|---|
| 714 | modifyTimestamp: 20031217055747Z
|
|---|
| 715 | entryCSN: 2003121705:57:47Z#0x000a#0#0000
|
|---|
| 716 | </screen>
|
|---|
| 717 | </para></step>
|
|---|
| 718 |
|
|---|
| 719 | <step><para>
|
|---|
| 720 | Your LDAP database is ready for testing. You can now start the LDAP server
|
|---|
| 721 | using the system tool for your Linux operating system. For SUSE Linux, you can
|
|---|
| 722 | do this as follows:
|
|---|
| 723 | <screen>
|
|---|
| 724 | &rootprompt; rcldap start
|
|---|
| 725 | </screen>
|
|---|
| 726 | </para></step>
|
|---|
| 727 |
|
|---|
| 728 | <step><para>
|
|---|
| 729 | It is now a good idea to validate that the LDAP server is running correctly.
|
|---|
| 730 | Execute the following:
|
|---|
| 731 | <screen>
|
|---|
| 732 | &rootprompt; ldapsearch -x -b "dc=abmas,dc=biz" "(ObjectClass=*)"
|
|---|
| 733 | # extended LDIF
|
|---|
| 734 | #
|
|---|
| 735 | # LDAPv3
|
|---|
| 736 | # base <dc=abmas,dc=biz> with scope sub
|
|---|
| 737 | # filter: (ObjectClass=*)
|
|---|
| 738 | # requesting: ALL
|
|---|
| 739 | #
|
|---|
| 740 |
|
|---|
| 741 | # abmas.biz
|
|---|
| 742 | dn: dc=abmas,dc=biz
|
|---|
| 743 | objectClass: dcObject
|
|---|
| 744 | objectClass: organization
|
|---|
| 745 | dc: abmas
|
|---|
| 746 | o: Abmas Inc.
|
|---|
| 747 | description: Posix and Samba LDAP Identity Database
|
|---|
| 748 | ...
|
|---|
| 749 | # domusers, Groups, abmas.biz
|
|---|
| 750 | dn: cn=domusers,ou=Groups,dc=abmas,dc=biz
|
|---|
| 751 | objectClass: posixGroup
|
|---|
| 752 | objectClass: sambaGroupMapping
|
|---|
| 753 | gidNumber: 513
|
|---|
| 754 | cn: domusers
|
|---|
| 755 | sambaSID: S-1-5-21-3504140859-1010554828-2431957765-513
|
|---|
| 756 | sambaGroupType: 2
|
|---|
| 757 | displayName: Domain Users
|
|---|
| 758 | description: Domain Users
|
|---|
| 759 |
|
|---|
| 760 | # search result
|
|---|
| 761 | search: 2
|
|---|
| 762 | result: 0 Success
|
|---|
| 763 |
|
|---|
| 764 | # numResponses: 11
|
|---|
| 765 | # numEntries: 10
|
|---|
| 766 | </screen>
|
|---|
| 767 | Your LDAP server is ready for creation of additional accounts.
|
|---|
| 768 | </para></step>
|
|---|
| 769 | </procedure>
|
|---|
| 770 |
|
|---|
| 771 | </sect2>
|
|---|
| 772 |
|
|---|
| 773 | <example id="sbehap-ldapreconfa">
|
|---|
| 774 | <title>LDAP Pre-configuration Script: <filename>SMBLDAP-ldif-preconfig.sh</filename> &smbmdash; Part A</title>
|
|---|
| 775 | <screen>
|
|---|
| 776 | #!/bin/bash
|
|---|
| 777 | #
|
|---|
| 778 | # This script prepares the ldif LDAP load file only
|
|---|
| 779 | #
|
|---|
| 780 |
|
|---|
| 781 | # Pattern File Name
|
|---|
| 782 | file=init-ldif.pat
|
|---|
| 783 |
|
|---|
| 784 | # The name of my organization
|
|---|
| 785 | ORGNAME="My Organization"
|
|---|
| 786 |
|
|---|
| 787 | # My Internet domain. ie: if my domain is: buckets.org, INETDOMAIN="buckets"
|
|---|
| 788 | INETDOMAIN="my-domain"
|
|---|
| 789 |
|
|---|
| 790 | # In the above case, md domain is: buckets.org, TLDORG="org"
|
|---|
| 791 | TLDORG="org"
|
|---|
| 792 |
|
|---|
| 793 | # This is the Samba Domain/Workgroup Name
|
|---|
| 794 | DOMNAME="MYWORKGROUP"
|
|---|
| 795 |
|
|---|
| 796 | #
|
|---|
| 797 | # Here We Go ...
|
|---|
| 798 | #
|
|---|
| 799 |
|
|---|
| 800 | cat <<EOF
|
|---|
| 801 |
|
|---|
| 802 | How do you wish to refer to your organization?
|
|---|
| 803 |
|
|---|
| 804 | Suggestions:
|
|---|
| 805 | Black Tire Company, Inc.
|
|---|
| 806 | Cat With Hat Ltd.
|
|---|
| 807 |
|
|---|
| 808 | How would you like your organization name to appear?
|
|---|
| 809 |
|
|---|
| 810 | EOF
|
|---|
| 811 |
|
|---|
| 812 | echo "Your organization name is: $ORGNAME"
|
|---|
| 813 | echo
|
|---|
| 814 | echo "Enter a new name or, press Enter to Continue."
|
|---|
| 815 | echo
|
|---|
| 816 | </screen>
|
|---|
| 817 | </example>
|
|---|
| 818 |
|
|---|
| 819 | <example id="sbehap-ldapreconfb">
|
|---|
| 820 | <title>LDAP Pre-configuration Script: <filename>SMBLDAP-ldif-preconfig.sh</filename> &smbmdash; Part B</title>
|
|---|
| 821 | <screen>
|
|---|
| 822 | echo -e -n "Name [$ORGNAME]: "
|
|---|
| 823 | read name
|
|---|
| 824 |
|
|---|
| 825 | if [ ! -z "$name" ]; then
|
|---|
| 826 | ORGNAME=${name}
|
|---|
| 827 | fi
|
|---|
| 828 | echo
|
|---|
| 829 | sed "s/ORGNAME/${ORGNAME}/g" < $file > $file.tmp1
|
|---|
| 830 |
|
|---|
| 831 | # Try to find smb.conf
|
|---|
| 832 |
|
|---|
| 833 | if [ -e /usr/local/samba/lib/smb.conf ]; then
|
|---|
| 834 | CONF=/usr/local/samba/lib/smb.conf
|
|---|
| 835 | elif [ -e /etc/samba/smb.conf ]; then
|
|---|
| 836 | CONF=/etc/samba/smb.conf
|
|---|
| 837 | fi
|
|---|
| 838 |
|
|---|
| 839 | echo "Samba Config File Location [$CONF]: "
|
|---|
| 840 | echo
|
|---|
| 841 | echo "Enter a new full path or press Enter to continue."
|
|---|
| 842 | echo
|
|---|
| 843 | echo -n "Samba Config File Location [$CONF]: "
|
|---|
| 844 | read name
|
|---|
| 845 | if [ ! -z "$name" ]; then
|
|---|
| 846 | CONF=$name
|
|---|
| 847 | fi
|
|---|
| 848 | echo
|
|---|
| 849 |
|
|---|
| 850 | # Find the name of our Domain/Workgroup
|
|---|
| 851 | DOMNAME=`grep -i workgroup ${CONF} | sed "s/ //g" | cut -f2 -d=`
|
|---|
| 852 | echo Domain Name: $DOMNAME
|
|---|
| 853 | echo
|
|---|
| 854 |
|
|---|
| 855 | sed "s/DOMNAME/${DOMNAME}/g" < $file.tmp1 > $file.tmp2
|
|---|
| 856 |
|
|---|
| 857 | DOMSID=`net getlocalsid ${DOMNAME} | cut -f2 -d: | sed "s/ //g"`
|
|---|
| 858 | echo Domain SID: $DOMSID
|
|---|
| 859 |
|
|---|
| 860 | sed "s/DOMSID/${DOMSID}/g" < $file.tmp2 > $file.tmp1
|
|---|
| 861 | </screen>
|
|---|
| 862 | </example>
|
|---|
| 863 |
|
|---|
| 864 | <example id="sbehap-ldapreconfc">
|
|---|
| 865 | <title>LDAP Pre-configuration Script: <filename>SMBLDAP-ldif-preconfig.sh</filename> &smbmdash; Part C</title>
|
|---|
| 866 | <screen>
|
|---|
| 867 | cat <<EOL
|
|---|
| 868 | The name of your Internet domain is now needed in a special format
|
|---|
| 869 | as follows, if your domain name is mydomain.org, what we need is
|
|---|
| 870 | the information in the form of:
|
|---|
| 871 | Domain ID: mydomain
|
|---|
| 872 | Top level: org
|
|---|
| 873 |
|
|---|
| 874 | If your fully qualified hostname is: snoopy.bazaar.garagesale.net
|
|---|
| 875 | where "snoopy" is the name of the machine,
|
|---|
| 876 | Then the information needed is:
|
|---|
| 877 | Domain ID: garagesale
|
|---|
| 878 | Top Level: net
|
|---|
| 879 |
|
|---|
| 880 | EOL
|
|---|
| 881 | INETDOMAIN=`hostname -d | cut -f1 -d.`
|
|---|
| 882 | echo Found the following domain name: `hostname -d`
|
|---|
| 883 | echo "I think the bit we are looking for might be: $INETDOMAIN"
|
|---|
| 884 | echo
|
|---|
| 885 | echo -n "Enter the domain name or press Enter to continue: "
|
|---|
| 886 | read domnam
|
|---|
| 887 | if [ ! -z $domnam ]; then
|
|---|
| 888 | INETDOMAIN=$domnam
|
|---|
| 889 | fi
|
|---|
| 890 | echo
|
|---|
| 891 | sed "s/INETDOMAIN/${INETDOMAIN}/g" < $file.tmp1 > $file.tmp2
|
|---|
| 892 | TLDORG=`hostname -d | sed "s/${INETDOMAIN}.//g"`
|
|---|
| 893 | echo "The top level organization name I will use is: ${TLDORG}"
|
|---|
| 894 | echo
|
|---|
| 895 | echo -n "Enter the top level org name or press Enter to continue: "
|
|---|
| 896 | read domnam
|
|---|
| 897 | if [ ! -z $domnam ]; then
|
|---|
| 898 | TLDORG=$domnam
|
|---|
| 899 | fi
|
|---|
| 900 | sed "s/TLDORG/${TLDORG}/g" < $file.tmp2 > $DOMNAME.ldif
|
|---|
| 901 | rm $file.tmp*
|
|---|
| 902 | exit 0
|
|---|
| 903 | </screen>
|
|---|
| 904 | </example>
|
|---|
| 905 |
|
|---|
| 906 | <example id="sbehap-ldifpata">
|
|---|
| 907 | <title>LDIF Pattern File Used to Pre-configure LDAP &smbmdash; Part A</title>
|
|---|
| 908 | <screen>
|
|---|
| 909 | dn: dc=INETDOMAIN,dc=TLDORG
|
|---|
| 910 | objectClass: dcObject
|
|---|
| 911 | objectClass: organization
|
|---|
| 912 | dc: INETDOMAIN
|
|---|
| 913 | o: ORGNAME
|
|---|
| 914 | description: Posix and Samba LDAP Identity Database
|
|---|
| 915 |
|
|---|
| 916 | dn: cn=Manager,dc=INETDOMAIN,dc=TLDORG
|
|---|
| 917 | objectClass: organizationalRole
|
|---|
| 918 | cn: Manager
|
|---|
| 919 | description: Directory Manager
|
|---|
| 920 |
|
|---|
| 921 | dn: ou=People,dc=INETDOMAIN,dc=TLDORG
|
|---|
| 922 | objectClass: top
|
|---|
| 923 | objectClass: organizationalUnit
|
|---|
| 924 | ou: People
|
|---|
| 925 |
|
|---|
| 926 | dn: ou=Computers,dc=INETDOMAIN,dc=TLDORG
|
|---|
| 927 | objectClass: top
|
|---|
| 928 | objectClass: organizationalUnit
|
|---|
| 929 | ou: Computers
|
|---|
| 930 |
|
|---|
| 931 | dn: ou=Groups,dc=INETDOMAIN,dc=TLDORG
|
|---|
| 932 | objectClass: top
|
|---|
| 933 | objectClass: organizationalUnit
|
|---|
| 934 | ou: Groups
|
|---|
| 935 |
|
|---|
| 936 | dn: ou=Idmap,dc=INETDOMAIN,dc=TLDORG
|
|---|
| 937 | objectClass: top
|
|---|
| 938 | objectClass: organizationalUnit
|
|---|
| 939 | ou: Idmap
|
|---|
| 940 |
|
|---|
| 941 | dn: ou=Domains,dc=INETDOMAIN,dc=TLDORG
|
|---|
| 942 | objectClass: top
|
|---|
| 943 | objectClass: organizationalUnit
|
|---|
| 944 | ou: Domains
|
|---|
| 945 |
|
|---|
| 946 | dn: sambaDomainName=DOMNAME,ou=Domains,dc=INETDOMAIN,dc=TLDORG
|
|---|
| 947 | objectClass: sambaDomain
|
|---|
| 948 | sambaDomainName: DOMNAME
|
|---|
| 949 | sambaSID: DOMSID
|
|---|
| 950 | sambaAlgorithmicRidBase: 1000
|
|---|
| 951 | structuralObjectClass: sambaDomain
|
|---|
| 952 | </screen>
|
|---|
| 953 | </example>
|
|---|
| 954 |
|
|---|
| 955 | <example id="sbehap-ldifpatb">
|
|---|
| 956 | <title>LDIF Pattern File Used to Pre-configure LDAP &smbmdash; Part B</title>
|
|---|
| 957 | <screen>
|
|---|
| 958 | dn: cn=domadmins,ou=Groups,dc=INETDOMAIN,dc=TLDORG
|
|---|
| 959 | objectClass: posixGroup
|
|---|
| 960 | objectClass: sambaGroupMapping
|
|---|
| 961 | gidNumber: 512
|
|---|
| 962 | cn: domadmins
|
|---|
| 963 | sambaSID: DOMSID-512
|
|---|
| 964 | sambaGroupType: 2
|
|---|
| 965 | displayName: Domain Admins
|
|---|
| 966 | description: Domain Administrators
|
|---|
| 967 |
|
|---|
| 968 | dn: cn=domguests,ou=Groups,dc=INETDOMAIN,dc=TLDORG
|
|---|
| 969 | objectClass: posixGroup
|
|---|
| 970 | objectClass: sambaGroupMapping
|
|---|
| 971 | gidNumber: 514
|
|---|
| 972 | cn: domguests
|
|---|
| 973 | sambaSID: DOMSID-514
|
|---|
| 974 | sambaGroupType: 2
|
|---|
| 975 | displayName: Domain Guests
|
|---|
| 976 | description: Domain Guests Users
|
|---|
| 977 |
|
|---|
| 978 | dn: cn=domusers,ou=Groups,dc=INETDOMAIN,dc=TLDORG
|
|---|
| 979 | objectClass: posixGroup
|
|---|
| 980 | objectClass: sambaGroupMapping
|
|---|
| 981 | gidNumber: 513
|
|---|
| 982 | cn: domusers
|
|---|
| 983 | sambaSID: DOMSID-513
|
|---|
| 984 | sambaGroupType: 2
|
|---|
| 985 | displayName: Domain Users
|
|---|
| 986 | description: Domain Users
|
|---|
| 987 | </screen>
|
|---|
| 988 | </example>
|
|---|
| 989 |
|
|---|
| 990 | </sect1>
|
|---|
| 991 |
|
|---|
| 992 | <sect1>
|
|---|
| 993 | <title>The LDAP Account Manager</title>
|
|---|
| 994 |
|
|---|
| 995 | <para>
|
|---|
| 996 | <indexterm><primary>LAM</primary></indexterm>
|
|---|
| 997 | <indexterm><primary>LDAP Account Manager</primary><see>LAM</see></indexterm>
|
|---|
| 998 | <indexterm><primary>PHP</primary></indexterm>
|
|---|
| 999 | <indexterm><primary>unencrypted</primary></indexterm>
|
|---|
| 1000 | <indexterm><primary>SSL</primary></indexterm>
|
|---|
| 1001 | <indexterm><primary>Posix</primary></indexterm>
|
|---|
| 1002 | <indexterm><primary>accounts</primary><secondary>manage</secondary></indexterm>
|
|---|
| 1003 | The LDAP Account Manager (LAM) is an application suite that has been written in PHP.
|
|---|
| 1004 | LAM can be used with any Web server that has PHP4 support. It connects to the LDAP
|
|---|
| 1005 | server either using unencrypted connections or via SSL/TLS. LAM can be used to manage
|
|---|
| 1006 | Posix accounts as well as SambaSAMAccounts for users, groups, and Windows machines
|
|---|
| 1007 | (hosts).
|
|---|
| 1008 | </para>
|
|---|
| 1009 |
|
|---|
| 1010 | <para>
|
|---|
| 1011 | LAM is available from the <ulink url="http://sourceforge.net/projects/lam/">LAM</ulink>
|
|---|
| 1012 | home page and from its mirror sites. LAM has been released under the GNU GPL version 2.
|
|---|
| 1013 | The current version of LAM is 0.4.9. Release of version 0.5 is expected in the third quarter
|
|---|
| 1014 | of 2005.
|
|---|
| 1015 | </para>
|
|---|
| 1016 |
|
|---|
| 1017 | <para>
|
|---|
| 1018 | <indexterm><primary>PHP4</primary></indexterm>
|
|---|
| 1019 | <indexterm><primary>OpenLDAP</primary></indexterm>
|
|---|
| 1020 | <indexterm><primary>Perl</primary></indexterm>
|
|---|
| 1021 | Requirements:
|
|---|
| 1022 | </para>
|
|---|
| 1023 |
|
|---|
| 1024 | <itemizedlist>
|
|---|
| 1025 | <listitem><para>A web server that will work with PHP4.</para></listitem>
|
|---|
| 1026 | <listitem><para>PHP4 (available from the <ulink url="http://www.php.net/">PHP</ulink> home page.)</para></listitem>
|
|---|
| 1027 | <listitem><para>OpenLDAP 2.0 or later.</para></listitem>
|
|---|
| 1028 | <listitem><para>A Web browser that supports CSS.</para></listitem>
|
|---|
| 1029 | <listitem><para>Perl.</para></listitem>
|
|---|
| 1030 | <listitem><para>The gettext package.</para></listitem>
|
|---|
| 1031 | <listitem><para>mcrypt + mhash (optional).</para></listitem>
|
|---|
| 1032 | <listitem><para>It is also a good idea to install SSL support.</para></listitem>
|
|---|
| 1033 | </itemizedlist>
|
|---|
| 1034 |
|
|---|
| 1035 | <para>
|
|---|
| 1036 | LAM is a useful tool that provides a simple Web-based device that can be used to
|
|---|
| 1037 | manage the contents of the LDAP directory to:
|
|---|
| 1038 | <indexterm><primary>organizational units</primary></indexterm>
|
|---|
| 1039 | <indexterm><primary>operating profiles</primary></indexterm>
|
|---|
| 1040 | <indexterm><primary>account policies</primary></indexterm>
|
|---|
| 1041 | </para>
|
|---|
| 1042 |
|
|---|
| 1043 | <itemizedlist>
|
|---|
| 1044 | <listitem><para>Display user/group/host and Domain entries.</para></listitem>
|
|---|
| 1045 | <listitem><para>Manage entries (Add/Delete/Edit).</para></listitem>
|
|---|
| 1046 | <listitem><para>Filter and sort entries.</para></listitem>
|
|---|
| 1047 | <listitem><para>Store and use multiple operating profiles.</para></listitem>
|
|---|
| 1048 | <listitem><para>Edit organizational units (OUs).</para></listitem>
|
|---|
| 1049 | <listitem><para>Upload accounts from a file.</para></listitem>
|
|---|
| 1050 | <listitem><para>Is compatible with Samba-2.2.x and Samba-3.</para></listitem>
|
|---|
| 1051 | </itemizedlist>
|
|---|
| 1052 |
|
|---|
| 1053 | <para>
|
|---|
| 1054 | When correctly configured, LAM allows convenient management of UNIX (Posix) and Samba
|
|---|
| 1055 | user, group, and windows domain member machine accounts.
|
|---|
| 1056 | </para>
|
|---|
| 1057 |
|
|---|
| 1058 | <para>
|
|---|
| 1059 | <indexterm><primary>default password</primary></indexterm>
|
|---|
| 1060 | <indexterm><primary>secure connections</primary></indexterm>
|
|---|
| 1061 | <indexterm><primary>LAM</primary></indexterm>
|
|---|
| 1062 | <indexterm><primary>SSL</primary></indexterm>
|
|---|
| 1063 | The default password is <quote>lam.</quote> It is highly recommended that you use only
|
|---|
| 1064 | an SSL connection to your Web server for all remote operations involving LAM. If you
|
|---|
| 1065 | want secure connections, you must configure your Apache Web server to permit connections
|
|---|
| 1066 | to LAM using only SSL.
|
|---|
| 1067 | </para>
|
|---|
| 1068 |
|
|---|
| 1069 | <procedure id="sbehap-laminst">
|
|---|
| 1070 | <title>Apache Configuration Steps for LAM</title>
|
|---|
| 1071 |
|
|---|
| 1072 | <step><para>
|
|---|
| 1073 | Extract the LAM package by untarring it as shown here:
|
|---|
| 1074 | <screen>
|
|---|
| 1075 | &rootprompt; tar xzf ldap-account-manager_0.4.9.tar.gz
|
|---|
| 1076 | </screen>
|
|---|
| 1077 | Alternatively, install the LAM DEB for your system using the following command:
|
|---|
| 1078 | <screen>
|
|---|
| 1079 | &rootprompt; dpkg -i ldap-account-manager_0.4.9.all.deb
|
|---|
| 1080 | </screen>
|
|---|
| 1081 | </para></step>
|
|---|
| 1082 |
|
|---|
| 1083 | <step><para>
|
|---|
| 1084 | Copy the extracted files to the document root directory of your Web server.
|
|---|
| 1085 | For example, on SUSE Linux Enterprise Server 9, copy to the
|
|---|
| 1086 | <filename>/srv/www/htdocs</filename> directory.
|
|---|
| 1087 | </para></step>
|
|---|
| 1088 |
|
|---|
| 1089 | <step><para>
|
|---|
| 1090 | <indexterm><primary>file permissions</primary></indexterm>
|
|---|
| 1091 | Set file permissions using the following commands:
|
|---|
| 1092 | <screen>
|
|---|
| 1093 | &rootprompt; chown -R wwwrun:www /srv/www/htdocs/lam
|
|---|
| 1094 | &rootprompt; chmod 755 /srv/www/htdocs/lam/sess
|
|---|
| 1095 | &rootprompt; chmod 755 /srv/www/htdocs/lam/tmp
|
|---|
| 1096 | &rootprompt; chmod 755 /srv/www/htdocs/lam/config
|
|---|
| 1097 | &rootprompt; chmod 755 /srv/www/htdocs/lam/lib/*pl
|
|---|
| 1098 | </screen>
|
|---|
| 1099 | </para></step>
|
|---|
| 1100 |
|
|---|
| 1101 | <step><para>
|
|---|
| 1102 | <indexterm><primary>LAM</primary><secondary>configuration file</secondary></indexterm>
|
|---|
| 1103 | Using your favorite editor create the following <filename>config.cfg</filename>
|
|---|
| 1104 | LAM configuration file:
|
|---|
| 1105 | <screen>
|
|---|
| 1106 | &rootprompt; cd /srv/www/htdocs/lam/config
|
|---|
| 1107 | &rootprompt; cp config.cfg_sample config.cfg
|
|---|
| 1108 | &rootprompt; vi config.cfg
|
|---|
| 1109 | </screen>
|
|---|
| 1110 | <indexterm><primary>LAM</primary><secondary>profile</secondary></indexterm>
|
|---|
| 1111 | <indexterm><primary>LAM</primary><secondary>wizard</secondary></indexterm>
|
|---|
| 1112 | An example file is shown in <link linkend="lamcfg"/>.
|
|---|
| 1113 | This is the minimum configuration that must be completed. The LAM profile
|
|---|
| 1114 | file can be created using a convenient wizard that is part of the LAM
|
|---|
| 1115 | configuration suite.
|
|---|
| 1116 | </para></step>
|
|---|
| 1117 |
|
|---|
| 1118 | <step><para>
|
|---|
| 1119 | Start your Web server then, using your Web browser, connect to
|
|---|
| 1120 | <ulink url="http://localhost/lam">LAM</ulink> URL. Click on the
|
|---|
| 1121 | the <parameter>Configuration Login</parameter> link then click on the
|
|---|
| 1122 | Configuration Wizard link to begin creation of the default profile so that
|
|---|
| 1123 | LAM can connect to your LDAP server. Alternately, copy the
|
|---|
| 1124 | <filename>lam.conf_sample</filename> file to a file called
|
|---|
| 1125 | <filename>lam.conf</filename> then, using your favorite editor,
|
|---|
| 1126 | change the settings to match local site needs.
|
|---|
| 1127 | </para></step>
|
|---|
| 1128 | </procedure>
|
|---|
| 1129 |
|
|---|
| 1130 | <para>
|
|---|
| 1131 | <indexterm><primary>pitfalls</primary></indexterm>
|
|---|
| 1132 | An example of a working file is shown here in <link linkend="lamconf"/>.
|
|---|
| 1133 | This file has been stripped of comments to keep the size small. The comments
|
|---|
| 1134 | and help information provided in the profile file that the wizard creates
|
|---|
| 1135 | is very useful and will help many administrators to avoid pitfalls.
|
|---|
| 1136 | Your configuration file obviously reflects the configuration options that
|
|---|
| 1137 | are preferred at your site.
|
|---|
| 1138 | </para>
|
|---|
| 1139 |
|
|---|
| 1140 | <para>
|
|---|
| 1141 | <indexterm><primary>LAM</primary><secondary>login screen</secondary></indexterm>
|
|---|
| 1142 | It is important that your LDAP server is running at the time that LAM is
|
|---|
| 1143 | being configured. This permits you to validate correct operation.
|
|---|
| 1144 | An example of the LAM login screen is provided in <link linkend="lam-login"/>.
|
|---|
| 1145 | </para>
|
|---|
| 1146 |
|
|---|
| 1147 | <figure id="lam-login">
|
|---|
| 1148 | <title>The LDAP Account Manager Login Screen</title>
|
|---|
| 1149 | <imagefile scale="50">lam-login</imagefile>
|
|---|
| 1150 | </figure>
|
|---|
| 1151 |
|
|---|
| 1152 | <para>
|
|---|
| 1153 | <indexterm><primary>LAM</primary><secondary>configuration editor</secondary></indexterm>
|
|---|
| 1154 | The LAM configuration editor has a number of options that must be managed correctly.
|
|---|
| 1155 | An example of use of the LAM configuration editor is shown in <link linkend="lam-config"/>.
|
|---|
| 1156 | It is important that you correctly set the minimum and maximum UID/GID values that are
|
|---|
| 1157 | permitted for use at your site. The default values may not be compatible with a need to
|
|---|
| 1158 | modify initial default account values for well-known Windows network users and groups.
|
|---|
| 1159 | The best work-around is to temporarily set the minimum values to zero (0) to permit
|
|---|
| 1160 | the initial settings to be made. Do not forget to reset these to sensible values before
|
|---|
| 1161 | using LAM to add additional users and groups.
|
|---|
| 1162 | </para>
|
|---|
| 1163 |
|
|---|
| 1164 | <figure id="lam-config">
|
|---|
| 1165 | <title>The LDAP Account Manager Configuration Screen</title>
|
|---|
| 1166 | <imagefile scale="50">lam-config</imagefile>
|
|---|
| 1167 | </figure>
|
|---|
| 1168 |
|
|---|
| 1169 | <para>
|
|---|
| 1170 | <indexterm><primary>PDF</primary></indexterm>
|
|---|
| 1171 | LAM has some nice, but unusual features. For example, one unexpected feature in most application
|
|---|
| 1172 | screens permits the generation of a PDF file that lists configuration information. This is a well
|
|---|
| 1173 | thought out facility. This option has been edited out of the following screen shots to conserve
|
|---|
| 1174 | space.
|
|---|
| 1175 | </para>
|
|---|
| 1176 |
|
|---|
| 1177 | <para>
|
|---|
| 1178 | <indexterm><primary>LAM</primary><secondary>opening screen</secondary></indexterm>
|
|---|
| 1179 | When you log onto LAM the opening screen drops you right into the user manager as shown in
|
|---|
| 1180 | <link linkend="lam-user"/>. This is a logical action as it permits the most-needed facility
|
|---|
| 1181 | to be used immediately. The editing of an existing user, as with the addition of a new user,
|
|---|
| 1182 | is easy to follow and very clear in both layout and intent. It is a simple matter to edit
|
|---|
| 1183 | generic settings, UNIX specific parameters, and then Samba account requirements. Each step
|
|---|
| 1184 | involves clicking a button that intuitively drives you through the process. When you have
|
|---|
| 1185 | finished editing simply press the <guimenu>Final</guimenu> button.
|
|---|
| 1186 | </para>
|
|---|
| 1187 |
|
|---|
| 1188 | <figure id="lam-user">
|
|---|
| 1189 | <title>The LDAP Account Manager User Edit Screen</title>
|
|---|
| 1190 | <imagefile scale="50">lam-users</imagefile>
|
|---|
| 1191 | </figure>
|
|---|
| 1192 |
|
|---|
| 1193 | <para>
|
|---|
| 1194 | The edit screen for groups is shown in <link linkend="lam-group"/>. As with the edit screen
|
|---|
| 1195 | for user accounts, group accounts may be rapidly dealt with. <link linkend="lam-group-mem"/>
|
|---|
| 1196 | shows a sub-screen from the group editor that permits users to be assigned secondary group
|
|---|
| 1197 | memberships.
|
|---|
| 1198 | </para>
|
|---|
| 1199 |
|
|---|
| 1200 | <figure id="lam-group">
|
|---|
| 1201 | <title>The LDAP Account Manager Group Edit Screen</title>
|
|---|
| 1202 | <imagefile scale="50">lam-groups</imagefile>
|
|---|
| 1203 | </figure>
|
|---|
| 1204 |
|
|---|
| 1205 | <figure id="lam-group-mem">
|
|---|
| 1206 | <title>The LDAP Account Manager Group Membership Edit Screen</title>
|
|---|
| 1207 | <imagefile scale="50">lam-group-members</imagefile>
|
|---|
| 1208 | </figure>
|
|---|
| 1209 |
|
|---|
| 1210 | <para>
|
|---|
| 1211 | <indexterm><primary>smbldap-tools</primary></indexterm><indexterm><primary>scripts</primary></indexterm>
|
|---|
| 1212 | The final screen presented here is one that you should not normally need to use. Host accounts will
|
|---|
| 1213 | be automatically managed using the smbldap-tools scripts. This means that the screen <link linkend="lam-host"/>
|
|---|
| 1214 | will, in most cases, not be used.
|
|---|
| 1215 | </para>
|
|---|
| 1216 |
|
|---|
| 1217 | <figure id="lam-host">
|
|---|
| 1218 | <title>The LDAP Account Manager Host Edit Screen</title>
|
|---|
| 1219 | <imagefile scale="50">lam-hosts</imagefile>
|
|---|
| 1220 | </figure>
|
|---|
| 1221 |
|
|---|
| 1222 | <para>
|
|---|
| 1223 | One aspect of LAM that may annoy some users is the way it forces certain conventions on
|
|---|
| 1224 | the administrator. For example, LAM does not permit the creation of Windows user and group
|
|---|
| 1225 | accounts that contain spaces even though the underlying UNIX/Linux
|
|---|
| 1226 | operating system may exhibit no problems with them. Given the propensity for using upper-case
|
|---|
| 1227 | characters and spaces (particularly in the default Windows account names) this may cause
|
|---|
| 1228 | some annoyance. For the rest, LAM is a very useful administrative tool.
|
|---|
| 1229 | </para>
|
|---|
| 1230 |
|
|---|
| 1231 | <para>
|
|---|
| 1232 | The next major release, LAM 0.5, will have fewer restrictions and support the latest Samba features
|
|---|
| 1233 | (e.g., logon hours). The new plugin-based architecture also allows management of much more different
|
|---|
| 1234 | account types like plain UNIX accounts. The upload can now handle groups and hosts, too. Another
|
|---|
| 1235 | important point is the tree view which allows browsing and editing LDAP objects directly.
|
|---|
| 1236 | </para>
|
|---|
| 1237 |
|
|---|
| 1238 | <example id="lamcfg">
|
|---|
| 1239 | <title>Example LAM Configuration File &smbmdash; <filename>config.cfg</filename></title>
|
|---|
| 1240 | <screen>
|
|---|
| 1241 | # password to add/delete/rename configuration profiles
|
|---|
| 1242 | password: not24get
|
|---|
| 1243 |
|
|---|
| 1244 | # default profile, without ".conf"
|
|---|
| 1245 | default: lam
|
|---|
| 1246 | </screen>
|
|---|
| 1247 | </example>
|
|---|
| 1248 |
|
|---|
| 1249 | <example id="lamconf">
|
|---|
| 1250 | <title>LAM Profile Control File &smbmdash; <filename>lam.conf</filename></title>
|
|---|
| 1251 | <screen>
|
|---|
| 1252 | ServerURL: ldap://massive.abmas.org:389
|
|---|
| 1253 | Admins: cn=Manager,dc=abmas,dc=biz
|
|---|
| 1254 | Passwd: not24get
|
|---|
| 1255 | usersuffix: ou=People,dc=abmas,dc=biz
|
|---|
| 1256 | groupsuffix: ou=Groups,dc=abmas,dc=biz
|
|---|
| 1257 | hostsuffix: ou=Computers,dc=abmas,dc=biz
|
|---|
| 1258 | domainsuffix: ou=Domains,dc=abmas,dc=biz
|
|---|
| 1259 | MinUID: 0
|
|---|
| 1260 | MaxUID: 65535
|
|---|
| 1261 | MinGID: 0
|
|---|
| 1262 | MaxGID: 65535
|
|---|
| 1263 | MinMachine: 20000
|
|---|
| 1264 | MaxMachine: 25000
|
|---|
| 1265 | userlistAttributes: #uid;#givenName;#sn;#uidNumber;#gidNumber
|
|---|
| 1266 | grouplistAttributes: #cn;#gidNumber;#memberUID;#description
|
|---|
| 1267 | hostlistAttributes: #cn;#description;#uidNumber;#gidNumber
|
|---|
| 1268 | maxlistentries: 30
|
|---|
| 1269 | defaultLanguage: en_GB:ISO-8859-1:English (Great Britain)
|
|---|
| 1270 | scriptPath:
|
|---|
| 1271 | scriptServer:
|
|---|
| 1272 | samba3: yes
|
|---|
| 1273 | cachetimeout: 5
|
|---|
| 1274 | pwdhash: SSHA
|
|---|
| 1275 | </screen>
|
|---|
| 1276 | </example>
|
|---|
| 1277 |
|
|---|
| 1278 | </sect1>
|
|---|
| 1279 |
|
|---|
| 1280 | <sect1>
|
|---|
| 1281 | <title>IDEALX Management Console</title>
|
|---|
| 1282 |
|
|---|
| 1283 | <para>
|
|---|
| 1284 | IMC (the IDEALX Mamagement Console) is a tool that can be used as the basis for a comprehensive
|
|---|
| 1285 | web-based management interface for UNIX and Linux systems.
|
|---|
| 1286 | </para>
|
|---|
| 1287 |
|
|---|
| 1288 | <para>
|
|---|
| 1289 | The Samba toolset is the first console developped for IMC. It offers a simple and ergonomic
|
|---|
| 1290 | interface for managing a Samba domain controler. The goal is to give Linux administrators who
|
|---|
| 1291 | need to manage production Samba servers an effective, intuitive and consistent management
|
|---|
| 1292 | experience. An IMC screenshot of the user management tool is shown in <link linkend="imcidealx"/>.
|
|---|
| 1293 | </para>
|
|---|
| 1294 |
|
|---|
| 1295 | <figure id="imcidealx">
|
|---|
| 1296 | <title>The IMC Samba User Account Screen</title>
|
|---|
| 1297 | <imagefile scale="40">imc-usermanager2</imagefile>
|
|---|
| 1298 | </figure>
|
|---|
| 1299 |
|
|---|
| 1300 | <para>
|
|---|
| 1301 | IMC is built on a set of Perl modules. Most modules are standard CPAN modules. Some are bundled with IMC,
|
|---|
| 1302 | but will soon to be hosted on the CPAN independently, like Struts4P, a port of Struts to the Perl language.
|
|---|
| 1303 | </para>
|
|---|
| 1304 |
|
|---|
| 1305 | <para>
|
|---|
| 1306 | For further information regarding IMC refer to the web <ulink url="http://imc.sourceforge.net/">site.</ulink>
|
|---|
| 1307 | Prebuilt RPM packages are also <ulink url="http://imc.sourceforge.net/download.html">available.</ulink>
|
|---|
| 1308 | </para>
|
|---|
| 1309 |
|
|---|
| 1310 | </sect1>
|
|---|
| 1311 |
|
|---|
| 1312 | <sect1 id="ch12-SUIDSGID">
|
|---|
| 1313 | <title>Effect of Setting File and Directory SUID/SGID Permissions Explained</title>
|
|---|
| 1314 |
|
|---|
| 1315 | <indexterm><primary>SUID</primary></indexterm>
|
|---|
| 1316 | <indexterm><primary>SGID</primary></indexterm>
|
|---|
| 1317 | <para>
|
|---|
| 1318 | The setting of the SUID/SGID bits on the file or directory permissions flag has particular
|
|---|
| 1319 | consequences. If the file is executable and the SUID bit is set, it executes with the privilege
|
|---|
| 1320 | of (with the UID of) the owner of the file. For example, if you are logged onto a system as
|
|---|
| 1321 | a normal user (let's say as the user <constant>bobj</constant>), and you execute a file that is owned
|
|---|
| 1322 | by the user <constant>root</constant> (uid = 0), and the file has the SUID bit set, then the file is
|
|---|
| 1323 | executed as if you had logged in as the user <constant>root</constant> and then executed the file.
|
|---|
| 1324 | The SUID bit effectively gives you (as <constant>bobj</constant>) administrative privilege for the
|
|---|
| 1325 | use of that executable file.
|
|---|
| 1326 | </para>
|
|---|
| 1327 |
|
|---|
| 1328 | <para>
|
|---|
| 1329 | The setting of the SGID bit does precisely the same as the effect of the SUID bit, except that it
|
|---|
| 1330 | applies the privilege to the UNIX group setting. In other words, the file executes with the force
|
|---|
| 1331 | of capability of the group.
|
|---|
| 1332 | </para>
|
|---|
| 1333 |
|
|---|
| 1334 | <para>
|
|---|
| 1335 | When the SUID/SGID permissions are set on a directory, all files that are created within that directory
|
|---|
| 1336 | are automatically given the ownership of the SUID user and the SGID group, as per the ownership
|
|---|
| 1337 | of the directory in which the file is created. This means that the system level <command>create()</command>
|
|---|
| 1338 | function executes with the SUID user and/or SGID group of the directory in which the file is
|
|---|
| 1339 | created.
|
|---|
| 1340 | </para>
|
|---|
| 1341 |
|
|---|
| 1342 | <para>
|
|---|
| 1343 | If you want to obtain the SUID behavior, simply execute the following command:
|
|---|
| 1344 | <screen>
|
|---|
| 1345 | &rootprompt; chmod u+s file-or-directory
|
|---|
| 1346 | </screen>
|
|---|
| 1347 | To set the SGID properties on a file or a directory, execute this command:
|
|---|
| 1348 | <screen>
|
|---|
| 1349 | &rootprompt; chmod g+s file-or-directory
|
|---|
| 1350 | </screen>
|
|---|
| 1351 | And to set both SUID and SGID properties, execute the following:
|
|---|
| 1352 | <screen>
|
|---|
| 1353 | &rootprompt; chmod ug+s file-or-directory
|
|---|
| 1354 | </screen>
|
|---|
| 1355 | </para>
|
|---|
| 1356 |
|
|---|
| 1357 | <para>
|
|---|
| 1358 | Let's consider the example of a directory <filename>/data/accounts</filename>. The permissions on this
|
|---|
| 1359 | directory before setting both SUID and SGID on this directory are:
|
|---|
| 1360 | <screen>
|
|---|
| 1361 | &rootprompt; ls -al /data/accounts
|
|---|
| 1362 | total 1
|
|---|
| 1363 | drwxr-xr-x 10 root root 232 Dec 18 17:08 .
|
|---|
| 1364 | drwxr-xr-x 21 root root 600 Dec 17 23:15 ..
|
|---|
| 1365 | drwxrwxrwx 2 bobj Domain Users 48 Dec 18 17:08 accounts/
|
|---|
| 1366 | drwx------ 2 root root 48 Jan 26 2002 lost+found
|
|---|
| 1367 | </screen>
|
|---|
| 1368 | In this example, if the user <constant>maryv</constant> creates a file, it is owned by her.
|
|---|
| 1369 | If <constant>maryv</constant> has the primary group of <constant>Accounts</constant>, the file is
|
|---|
| 1370 | owned by the group <constant>Accounts</constant>, as shown in this listing:
|
|---|
| 1371 | <screen>
|
|---|
| 1372 | &rootprompt; ls -al /data/accounts/maryvfile.txt
|
|---|
| 1373 | drw-rw-r-- 2 maryv Accounts 12346 Dec 18 17:53
|
|---|
| 1374 | </screen>
|
|---|
| 1375 | </para>
|
|---|
| 1376 |
|
|---|
| 1377 | <para>
|
|---|
| 1378 | Now you set the SUID and SGID and check the result as follows:
|
|---|
| 1379 | <screen>
|
|---|
| 1380 | &rootprompt; chmod ug+s /data/accounts
|
|---|
| 1381 | &rootprompt; ls -al /data/accounts
|
|---|
| 1382 | total 1
|
|---|
| 1383 | drwxr-xr-x 10 root root 232 Dec 18 17:08 .
|
|---|
| 1384 | drwxr-xr-x 21 root root 600 Dec 17 23:15 ..
|
|---|
| 1385 | drwsrwsr-x 2 bobj Domain Users 48 Dec 18 17:08 accounts
|
|---|
| 1386 | drwx------ 2 root root 48 Jan 26 2002 lost+found
|
|---|
| 1387 | </screen>
|
|---|
| 1388 | If <constant>maryv</constant> creates a file in this directory after this change has been made, the
|
|---|
| 1389 | file is owned by the user <constant>bobj</constant>, and the group is set to the group
|
|---|
| 1390 | <constant>Domain Users</constant>, as shown here:
|
|---|
| 1391 | <screen>
|
|---|
| 1392 | &rootprompt; chmod ug+s /data/accounts
|
|---|
| 1393 | &rootprompt; ls -al /data/accounts/maryvfile.txt
|
|---|
| 1394 | total 1
|
|---|
| 1395 | drw-rw-r-- 2 bobj Domain Users 12346 Dec 18 18:11 maryvfile.txt
|
|---|
| 1396 | </screen>
|
|---|
| 1397 | </para>
|
|---|
| 1398 |
|
|---|
| 1399 | </sect1>
|
|---|
| 1400 |
|
|---|
| 1401 | <sect1 id="ch12dblck">
|
|---|
| 1402 | <title>Shared Data Integrity</title>
|
|---|
| 1403 |
|
|---|
| 1404 | <para><indexterm>
|
|---|
| 1405 | <primary>data integrity</primary>
|
|---|
| 1406 | </indexterm><indexterm>
|
|---|
| 1407 | <primary>multi-user</primary>
|
|---|
| 1408 | <secondary>data access</secondary>
|
|---|
| 1409 | </indexterm>
|
|---|
| 1410 | The integrity of shared data is often viewed as a particularly emotional issue, especially where
|
|---|
| 1411 | there are concurrent problems with multiuser data access. Contrary to the assertions of some who have
|
|---|
| 1412 | experienced problems in either area, the cause has nothing to do with the phases of the moons of Jupiter.
|
|---|
| 1413 | </para>
|
|---|
| 1414 |
|
|---|
| 1415 | <para>
|
|---|
| 1416 | The solution to concurrent multiuser data access problems must consider three separate areas
|
|---|
| 1417 | from which the problem may stem:<indexterm>
|
|---|
| 1418 | <primary>locking</primary>
|
|---|
| 1419 | <secondary>Application level</secondary>
|
|---|
| 1420 | </indexterm><indexterm>
|
|---|
| 1421 | <primary>locking</primary>
|
|---|
| 1422 | <secondary>Client side</secondary>
|
|---|
| 1423 | </indexterm><indexterm>
|
|---|
| 1424 | <primary>locking</primary>
|
|---|
| 1425 | <secondary>Server side</secondary>
|
|---|
| 1426 | </indexterm>
|
|---|
| 1427 | </para>
|
|---|
| 1428 |
|
|---|
| 1429 | <itemizedlist>
|
|---|
| 1430 | <listitem><para>application-level locking controls</para></listitem>
|
|---|
| 1431 | <listitem><para>client-side locking controls</para></listitem>
|
|---|
| 1432 | <listitem><para>server-side locking controls</para></listitem>
|
|---|
| 1433 | </itemizedlist>
|
|---|
| 1434 |
|
|---|
| 1435 | <para><indexterm>
|
|---|
| 1436 | <primary>database applications</primary>
|
|---|
| 1437 | </indexterm><indexterm>
|
|---|
| 1438 | <primary>Microsoft Access</primary>
|
|---|
| 1439 | </indexterm>
|
|---|
| 1440 | Many database applications use some form of application-level access control. An example of one
|
|---|
| 1441 | well-known application that uses application-level locking is Microsoft Access. Detailed guidance
|
|---|
| 1442 | is provided here because this is the most common application for which problems have been reported.
|
|---|
| 1443 | </para>
|
|---|
| 1444 |
|
|---|
| 1445 | <para><indexterm>
|
|---|
| 1446 | <primary>Microsoft Excel</primary>
|
|---|
| 1447 | </indexterm><indexterm>
|
|---|
| 1448 | <primary>Act!</primary>
|
|---|
| 1449 | </indexterm>
|
|---|
| 1450 | Common applications that are affected by client- and server-side locking controls include MS
|
|---|
| 1451 | Excel and Act!. Important locking guidance is provided here.
|
|---|
| 1452 | </para>
|
|---|
| 1453 |
|
|---|
| 1454 |
|
|---|
| 1455 | <sect2>
|
|---|
| 1456 | <title>Microsoft Access</title>
|
|---|
| 1457 |
|
|---|
| 1458 | <para>
|
|---|
| 1459 | The best advice that can be given is to carefully read the Microsoft knowledgebase articles that
|
|---|
| 1460 | cover this area. Examples of relevant documents include:
|
|---|
| 1461 | </para>
|
|---|
| 1462 |
|
|---|
| 1463 | <itemizedlist>
|
|---|
| 1464 | <listitem><para>http://support.microsoft.com/default.aspx?scid=kb;en-us;208778</para></listitem>
|
|---|
| 1465 | <listitem><para>http://support.microsoft.com/default.aspx?scid=kb;en-us;299373</para></listitem>
|
|---|
| 1466 | </itemizedlist>
|
|---|
| 1467 |
|
|---|
| 1468 |
|
|---|
| 1469 | <para><indexterm>
|
|---|
| 1470 | <primary>multi-user</primary>
|
|---|
| 1471 | <secondary>access</secondary>
|
|---|
| 1472 | </indexterm><indexterm>
|
|---|
| 1473 | <primary>exclusive open</primary>
|
|---|
| 1474 | </indexterm>
|
|---|
| 1475 | Make sure that your MS Access database file is configured for multiuser access (not set for
|
|---|
| 1476 | exclusive open). Open MS Access on each client workstation, then set the following: <menuchoice>
|
|---|
| 1477 | <guimenu>(Menu bar) Tools</guimenu><guimenu>Options</guimenu><guimenu>[tab] General</guimenu>
|
|---|
| 1478 | </menuchoice>. Set network path to Default database folder: <filename>\\server\share\folder</filename>.
|
|---|
| 1479 | </para>
|
|---|
| 1480 |
|
|---|
| 1481 | <para>
|
|---|
| 1482 | You can configure MS Access file sharing behavior as follows: click <guimenu>[tab] Advanced</guimenu>.
|
|---|
| 1483 | Set:<indexterm>
|
|---|
| 1484 | <primary>record locking</primary>
|
|---|
| 1485 | </indexterm>
|
|---|
| 1486 | </para>
|
|---|
| 1487 |
|
|---|
| 1488 | <itemizedlist>
|
|---|
| 1489 | <listitem><para>Default open mode: Shared</para></listitem>
|
|---|
| 1490 | <listitem><para>Default Record Locking: Edited Record</para></listitem>
|
|---|
| 1491 | <listitem><para>Open databases using record_level locking</para></listitem>
|
|---|
| 1492 | </itemizedlist>
|
|---|
| 1493 |
|
|---|
| 1494 | <para><indexterm>
|
|---|
| 1495 | <primary>MS Access</primary>
|
|---|
| 1496 | <secondary>validate</secondary>
|
|---|
| 1497 | </indexterm>
|
|---|
| 1498 | You must now commit the changes so that they will take effect. To do so, click
|
|---|
| 1499 | <guimenu>Apply</guimenu><guimenu>Ok</guimenu>. At this point, you should exit MS Access, restart
|
|---|
| 1500 | it, and then validate that these settings have not changed.
|
|---|
| 1501 | </para>
|
|---|
| 1502 |
|
|---|
| 1503 | </sect2>
|
|---|
| 1504 |
|
|---|
| 1505 | <sect2>
|
|---|
| 1506 | <title>Act! Database Sharing</title>
|
|---|
| 1507 |
|
|---|
| 1508 | <para><indexterm>
|
|---|
| 1509 | <primary>ACT! database</primary>
|
|---|
| 1510 | </indexterm><indexterm>
|
|---|
| 1511 | <primary>data corruption</primary>
|
|---|
| 1512 | </indexterm>
|
|---|
| 1513 | Where the server sharing the ACT! database(s) is running Samba,or Windows NT, 200x, or XP, you
|
|---|
| 1514 | must disable opportunistic locking on the server and all workstations. Failure to do so
|
|---|
| 1515 | results in data corruption. This information is available from the Act! Web site
|
|---|
| 1516 | knowledgebase articles
|
|---|
| 1517 | <ulink url="http://itdomino.saleslogix.com/act.nsf/docid/1998223162925">1998223162925</ulink>
|
|---|
| 1518 | as well as from article
|
|---|
| 1519 | <ulink url="http://itdomino.saleslogix.com/act.nsf/docid/200110485036">200110485036</ulink>.
|
|---|
| 1520 | </para>
|
|---|
| 1521 |
|
|---|
| 1522 | <para><indexterm>
|
|---|
| 1523 | <primary>opportunistic locking</primary>
|
|---|
| 1524 | </indexterm><indexterm>
|
|---|
| 1525 | <primary>Act!Diag</primary>
|
|---|
| 1526 | </indexterm>
|
|---|
| 1527 | These documents clearly state that opportunistic locking must be disabled on both
|
|---|
| 1528 | the server (Samba in the case we are interested in here), as well as on every workstation
|
|---|
| 1529 | from which the centrally shared Act! database will be accessed. Act! provides
|
|---|
| 1530 | a tool called <command>Act!Diag</command> that may be used to disable all workstation
|
|---|
| 1531 | registry settings that may otherwise interfere with the operation of Act!
|
|---|
| 1532 | Registered Act! users may download this utility from the Act! Web
|
|---|
| 1533 | <ulink url="http://www.act.com/support/updates/index.cfm">site.</ulink>
|
|---|
| 1534 | </para>
|
|---|
| 1535 |
|
|---|
| 1536 | </sect2>
|
|---|
| 1537 |
|
|---|
| 1538 | <sect2>
|
|---|
| 1539 | <title>Opportunistic Locking Controls</title>
|
|---|
| 1540 |
|
|---|
| 1541 | <para><indexterm>
|
|---|
| 1542 | <primary>file caching</primary>
|
|---|
| 1543 | </indexterm>
|
|---|
| 1544 | Third-party Windows applications may not be compatible with the use of opportunistic file
|
|---|
| 1545 | and record locking. For applications that are known not to be compatible,<footnote>Refer to
|
|---|
| 1546 | the application manufacturer's installation guidelines and knowledge base for specific
|
|---|
| 1547 | information regarding compatibility. It is often safe to assume that if the software
|
|---|
| 1548 | manufacturer does not specifically mention incompatibilities with opportunistic file
|
|---|
| 1549 | and record locking, or with Windows client file caching, the application is probably
|
|---|
| 1550 | compatible with Windows (as well as Samba) default settings.</footnote> oplock
|
|---|
| 1551 | support may need to be disabled both on the Samba server and on the Windows workstations.
|
|---|
| 1552 | </para>
|
|---|
| 1553 |
|
|---|
| 1554 | <para><indexterm>
|
|---|
| 1555 | <primary>cache</primary>
|
|---|
| 1556 | </indexterm><indexterm>
|
|---|
| 1557 | <primary>write lock</primary>
|
|---|
| 1558 | </indexterm><indexterm>
|
|---|
| 1559 | <primary>flush</primary>
|
|---|
| 1560 | <secondary>cache memory</secondary>
|
|---|
| 1561 | </indexterm>
|
|---|
| 1562 | Oplocks enable a Windows client to cache parts of a file that are being
|
|---|
| 1563 | edited. Another windows client may then request to open the file with the
|
|---|
| 1564 | ability to write to it. The server will then ask the original workstation
|
|---|
| 1565 | that had the file open with a write lock to release its lock. Before
|
|---|
| 1566 | doing so, that workstation must flush the file from cache memory to the
|
|---|
| 1567 | disk or network drive.
|
|---|
| 1568 | </para>
|
|---|
| 1569 |
|
|---|
| 1570 | <para><indexterm>
|
|---|
| 1571 | <primary>Oplocks</primary>
|
|---|
| 1572 | <secondary>disabled</secondary>
|
|---|
| 1573 | </indexterm>
|
|---|
| 1574 | Disabling of Oplocks usage may require server and client changes.
|
|---|
| 1575 | Oplocks may be disabled by file, by file pattern, on the share, or on the
|
|---|
| 1576 | Samba server.
|
|---|
| 1577 | </para>
|
|---|
| 1578 |
|
|---|
| 1579 | <para>
|
|---|
| 1580 | The following are examples showing how Oplock support may be managed using
|
|---|
| 1581 | Samba &smb.conf; file settings:
|
|---|
| 1582 | <screen>
|
|---|
| 1583 | By file: veto oplock files = myfile.mdb
|
|---|
| 1584 |
|
|---|
| 1585 | By Pattern: veto oplock files = /*.mdb/
|
|---|
| 1586 |
|
|---|
| 1587 | On the Share: oplocks = No
|
|---|
| 1588 | level2 oplocks = No
|
|---|
| 1589 |
|
|---|
| 1590 | On the server:
|
|---|
| 1591 | (in [global]) oplocks = No
|
|---|
| 1592 | level2 oplocks = No
|
|---|
| 1593 | </screen>
|
|---|
| 1594 | </para>
|
|---|
| 1595 |
|
|---|
| 1596 | <para>
|
|---|
| 1597 | The following registry entries on Microsoft Windows XP Professional, 2000 Professional, and Windows NT4
|
|---|
| 1598 | workstation clients must be configured as shown here:
|
|---|
| 1599 | <screen>
|
|---|
| 1600 | REGEDIT4
|
|---|
| 1601 |
|
|---|
| 1602 | [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
|
|---|
| 1603 | Services\LanmanServer\Parameters]
|
|---|
| 1604 | "EnableOplocks"=dword:00000000
|
|---|
| 1605 |
|
|---|
| 1606 | [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
|
|---|
| 1607 | Services\LanmanWorkstation\Parameters]
|
|---|
| 1608 | "UseOpportunisticLocking"=dword:00000000
|
|---|
| 1609 | </screen>
|
|---|
| 1610 | </para>
|
|---|
| 1611 |
|
|---|
| 1612 | <para>
|
|---|
| 1613 | Comprehensive coverage of file and record-locking controls is provided in TOSHARG2, Chapter 13.
|
|---|
| 1614 | The information in that chapter was obtained from a wide variety of sources.
|
|---|
| 1615 | </para>
|
|---|
| 1616 |
|
|---|
| 1617 | </sect2>
|
|---|
| 1618 |
|
|---|
| 1619 | </sect1>
|
|---|
| 1620 |
|
|---|
| 1621 | </chapter>
|
|---|
| 1622 |
|
|---|
