| 1 | <?xml version="1.0" encoding="iso-8859-1"?>
|
|---|
| 2 | <!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
|
|---|
| 3 | <chapter id="install">
|
|---|
| 4 | <chapterinfo>
|
|---|
| 5 | &author.tridge;
|
|---|
| 6 | &author.jelmer;
|
|---|
| 7 | &author.jht;
|
|---|
| 8 | &author.kauer;
|
|---|
| 9 | &author.danshearer;
|
|---|
| 10 | <!-- Isn't some of this written by others as well? -->
|
|---|
| 11 |
|
|---|
| 12 | </chapterinfo>
|
|---|
| 13 |
|
|---|
| 14 | <title>How to Install and Test SAMBA</title>
|
|---|
| 15 |
|
|---|
| 16 | <sect1>
|
|---|
| 17 | <title>Obtaining and Installing Samba</title>
|
|---|
| 18 |
|
|---|
| 19 | <para>
|
|---|
| 20 | <indexterm><primary>packages</primary></indexterm>
|
|---|
| 21 | Binary packages of Samba are included in almost any Linux or UNIX distribution. There are also some
|
|---|
| 22 | packages available at <ulink url="http://samba.org/">the Samba home page</ulink>. Refer to the manual of your
|
|---|
| 23 | operating system for details on installing packages for your specific operating system.
|
|---|
| 24 | </para>
|
|---|
| 25 |
|
|---|
| 26 | <para>
|
|---|
| 27 | <indexterm><primary>compile</primary></indexterm>
|
|---|
| 28 | If you need to compile Samba from source, check <link linkend="compiling">How to Compile Samba</link>.
|
|---|
| 29 | </para>
|
|---|
| 30 |
|
|---|
| 31 | </sect1>
|
|---|
| 32 |
|
|---|
| 33 | <sect1>
|
|---|
| 34 | <title>Configuring Samba (smb.conf)</title>
|
|---|
| 35 |
|
|---|
| 36 | <para>
|
|---|
| 37 | <indexterm><primary>/etc/samba/smb.conf</primary></indexterm>
|
|---|
| 38 | <indexterm><primary>SWAT</primary></indexterm>
|
|---|
| 39 | Samba's configuration is stored in the &smb.conf; file, which usually resides in
|
|---|
| 40 | <filename>/etc/samba/smb.conf</filename> or <filename>/usr/local/samba/lib/smb.conf</filename>. You can either
|
|---|
| 41 | edit this file yourself or do it using one of the many graphical tools that are available, such as the
|
|---|
| 42 | Web-based interface SWAT, that is included with Samba.
|
|---|
| 43 | </para>
|
|---|
| 44 |
|
|---|
| 45 | <sect2>
|
|---|
| 46 | <title>Configuration File Syntax</title>
|
|---|
| 47 |
|
|---|
| 48 | <para>
|
|---|
| 49 | <indexterm><primary>section name</primary></indexterm>
|
|---|
| 50 | The &smb.conf; file uses the same syntax as the various old <filename>.ini</filename> files in Windows
|
|---|
| 51 | 3.1: Each file consists of various sections, which are started by putting the section name between brackets
|
|---|
| 52 | (<literal>[]</literal>) on a new line. Each contains zero or more key/value pairs separated by an equality
|
|---|
| 53 | sign (<literal>=</literal>). The file is just a plaintext file, so you can open and edit it with your favorite
|
|---|
| 54 | editing tool.
|
|---|
| 55 | </para>
|
|---|
| 56 |
|
|---|
| 57 | <para>
|
|---|
| 58 | <indexterm><primary>meta-service</primary></indexterm>
|
|---|
| 59 | <indexterm><primary>print</primary><secondary>queue</secondary></indexterm>
|
|---|
| 60 | <indexterm><primary>share</primary></indexterm>
|
|---|
| 61 | <indexterm><primary>spooler.</primary></indexterm>
|
|---|
| 62 | <indexterm><primary>print</primary><secondary>spooler</secondary></indexterm>
|
|---|
| 63 | <indexterm><primary>spool</primary><secondary>directory</secondary></indexterm>
|
|---|
| 64 | Each section in the &smb.conf; file represents either a share or a meta-service on the Samba server. The
|
|---|
| 65 | section <literal>[global]</literal> is special, since it contains settings that apply to the whole Samba
|
|---|
| 66 | server. Samba supports a number of meta-services, each of which serves its own purpose. For example, the
|
|---|
| 67 | <literal>[homes]</literal> share is a meta-service that causes Samba to provide a personal home share for
|
|---|
| 68 | each user. The <literal>[printers]</literal> share is a meta-service that establishes print queue support
|
|---|
| 69 | and that specifies the location of the intermediate spool directory into which print jobs are received
|
|---|
| 70 | from Windows clients prior to being dispatched to the UNIX/Linux print spooler.
|
|---|
| 71 | </para>
|
|---|
| 72 |
|
|---|
| 73 | <para>
|
|---|
| 74 | <indexterm><primary>printers</primary></indexterm>
|
|---|
| 75 | <indexterm><primary>meta-service</primary></indexterm>
|
|---|
| 76 | <indexterm><primary>printcap</primary></indexterm>
|
|---|
| 77 | <indexterm><primary>lpstat</primary></indexterm>
|
|---|
| 78 | <indexterm><primary>CUPS API</primary></indexterm>
|
|---|
| 79 | <indexterm><primary>browseable</primary></indexterm>
|
|---|
| 80 | The <literal>printers</literal> meta-service will cause every printer that is either specified in a
|
|---|
| 81 | <literal>printcap</literal> file, via the <command>lpstat</command>, or via the CUPS API, to be
|
|---|
| 82 | published as a shared print queue. The <literal>printers</literal> stanza in the &smb.conf; file can
|
|---|
| 83 | be set as not browseable. If it is set to be browseable, then it will be visible as if it is a share.
|
|---|
| 84 | That makes no sense given that this meta-service is responsible only for making UNIX system printers
|
|---|
| 85 | available as Windows print queues. If a <literal>comment</literal> parameter is specified, the value
|
|---|
| 86 | of it will be displayed as part of the printer name in Windows Explorer browse lists.
|
|---|
| 87 | </para>
|
|---|
| 88 |
|
|---|
| 89 | <para>
|
|---|
| 90 | <indexterm><primary>stanza</primary></indexterm>
|
|---|
| 91 | Each section of the &smb.conf; file that specifies a share, or a meta-service, is called a stanza.
|
|---|
| 92 | The <literal>global</literal> stanza specifies settings that affect all the other stanzas in the
|
|---|
| 93 | &smb.conf; file. Configuration parameters are documented in the &smb.conf; man page. Some parameters
|
|---|
| 94 | can be used only in the <literal>global</literal> stanza, some only in share or meta-service stanzas,
|
|---|
| 95 | and some can be used globally or just within a share or meta-service stanza.
|
|---|
| 96 | </para>
|
|---|
| 97 |
|
|---|
| 98 | <para>
|
|---|
| 99 | <indexterm><primary>minimal</primary><secondary>configuration</secondary></indexterm>
|
|---|
| 100 | <link linkend="smbconfminimal">A minimal smb.conf</link> contains a very minimal &smb.conf;.
|
|---|
| 101 | <indexterm><primary>minimal configuration</primary></indexterm>
|
|---|
| 102 | </para>
|
|---|
| 103 |
|
|---|
| 104 | <example id="smbconfminimal">
|
|---|
| 105 | <title>A minimal smb.conf</title>
|
|---|
| 106 | <smbconfblock>
|
|---|
| 107 |
|
|---|
| 108 | <smbconfsection name="[global]"/>
|
|---|
| 109 | <smbconfoption name="workgroup">WKG</smbconfoption>
|
|---|
| 110 | <smbconfoption name="netbios name">MYNAME</smbconfoption>
|
|---|
| 111 | <smbconfsection name="[share1]"/>
|
|---|
| 112 | <smbconfoption name="path">/tmp</smbconfoption>
|
|---|
| 113 |
|
|---|
| 114 | <smbconfsection name="[share2]"/>
|
|---|
| 115 | <smbconfoption name="path">/my_shared_folder</smbconfoption>
|
|---|
| 116 | <smbconfoption name="comment">Some random files</smbconfoption>
|
|---|
| 117 | </smbconfblock>
|
|---|
| 118 | </example>
|
|---|
| 119 |
|
|---|
| 120 | </sect2>
|
|---|
| 121 |
|
|---|
| 122 | <sect2 id="tdbdocs">
|
|---|
| 123 | <title>TDB Database File Information</title>
|
|---|
| 124 |
|
|---|
| 125 | <para>
|
|---|
| 126 | This section contains brief descriptions of the databases that are used by Samba-3.
|
|---|
| 127 | </para>
|
|---|
| 128 |
|
|---|
| 129 | <para>
|
|---|
| 130 | <indexterm><primary>tdb file locations</primary></indexterm>
|
|---|
| 131 | The directory in which Samba stores the tdb files is determined by compile-time directives. Samba-3 stores
|
|---|
| 132 | tdb files in two locations. The best way to determine these locations is to execute the following
|
|---|
| 133 | command:
|
|---|
| 134 | <screen>
|
|---|
| 135 | &rootprompt; smbd -b | grep PRIVATE_DIR
|
|---|
| 136 | PRIVATE_DIR: /etc/samba/private
|
|---|
| 137 | </screen>
|
|---|
| 138 | This means that the confidential tdb files are stored in the <filename>/etc/samba/private</filename>
|
|---|
| 139 | directory. Samba-3 also uses a number of tdb files that contain more mundane data. The location of
|
|---|
| 140 | these files can be found by executing:
|
|---|
| 141 | <screen>
|
|---|
| 142 | &rootprompt; smbd -b | grep LOCKDIR
|
|---|
| 143 | LOCKDIR: /var/lib/samba
|
|---|
| 144 | </screen>
|
|---|
| 145 | Therefore the remaining control files will, in the example shown, be stored in the
|
|---|
| 146 | <filename>/var/lib/samba</filename> directory.
|
|---|
| 147 | </para>
|
|---|
| 148 |
|
|---|
| 149 | <para>
|
|---|
| 150 | <indexterm><primary>tdb file descriptions</primary></indexterm>
|
|---|
| 151 | The persistent tdb files are described in <link linkend="tdbpermfiledesc">the Persistent TDB File
|
|---|
| 152 | Descriptions table</link>. All persistent tdb files should be regularly backed up. Use the
|
|---|
| 153 | <command>tdbbackup</command> utility to backup the tdb files. All persistent tdb files must be
|
|---|
| 154 | preserved during machine migrations, updates and upgrades.
|
|---|
| 155 | </para>
|
|---|
| 156 |
|
|---|
| 157 | <para>
|
|---|
| 158 | The temporary tdb files do not need to be backed up, nor do they need to be preseved across machine
|
|---|
| 159 | migrations, updates or upgrades. The temporary tdb files are described in <link linkend="tdbtempfiledesc">
|
|---|
| 160 | the Temporary TDB File Descriptions</link>.
|
|---|
| 161 | </para>
|
|---|
| 162 |
|
|---|
| 163 | <table frame='all' id="tdbpermfiledesc"><title>Persistent TDB File Descriptions</title>
|
|---|
| 164 | <tgroup cols='2'>
|
|---|
| 165 | <colspec align="left"/>
|
|---|
| 166 | <colspec align="justify" colwidth="1*"/>
|
|---|
| 167 | <colspec align="left"/>
|
|---|
| 168 | <thead>
|
|---|
| 169 | <row>
|
|---|
| 170 | <entry align="left">Name</entry>
|
|---|
| 171 | <entry align="justify">Description</entry>
|
|---|
| 172 | </row>
|
|---|
| 173 | </thead>
|
|---|
| 174 | <tbody>
|
|---|
| 175 | <row>
|
|---|
| 176 | <entry>account_policy</entry>
|
|---|
| 177 | <entry><para>Samba/NT account policy settings, includes password expiration settings.</para></entry>
|
|---|
| 178 | </row>
|
|---|
| 179 | <row>
|
|---|
| 180 | <entry>group_mapping</entry>
|
|---|
| 181 | <entry><para>Mapping table from Windows groups/SID to UNIX groups.</para></entry>
|
|---|
| 182 | </row>
|
|---|
| 183 | <row>
|
|---|
| 184 | <entry>ntdrivers</entry>
|
|---|
| 185 | <entry><para>Stores per-printer installed driver information.</para></entry>
|
|---|
| 186 | </row>
|
|---|
| 187 | <row>
|
|---|
| 188 | <entry>ntforms</entry>
|
|---|
| 189 | <entry><para>Stores per-printer installed forms information.</para></entry>
|
|---|
| 190 | </row>
|
|---|
| 191 | <row>
|
|---|
| 192 | <entry>ntprinters</entry>
|
|---|
| 193 | <entry><para>Stores the per-printer devmode configuration settings.</para></entry>
|
|---|
| 194 | </row>
|
|---|
| 195 | <row>
|
|---|
| 196 | <entry>passdb</entry>
|
|---|
| 197 | <entry><para>
|
|---|
| 198 | Exists only when the tdbsam passwd backend is used. This file stores the
|
|---|
| 199 | SambaSAMAccount information. Note: This file requires that user POSIX account information is
|
|---|
| 200 | availble from either the /etc/passwd file, or from an alternative system source.
|
|---|
| 201 | </para></entry>
|
|---|
| 202 | </row>
|
|---|
| 203 | <row>
|
|---|
| 204 | <entry>registry</entry>
|
|---|
| 205 | <entry><para>
|
|---|
| 206 | Read-only Samba database of a Windows registry skeleton that provides support for exporting
|
|---|
| 207 | various database tables via the winreg RPCs.
|
|---|
| 208 | </para></entry>
|
|---|
| 209 | </row>
|
|---|
| 210 | <row>
|
|---|
| 211 | <entry>secrets</entry>
|
|---|
| 212 | <entry><para>
|
|---|
| 213 | This file stores the Workgroup/Domain/Machine SID, the LDAP directory update password, and
|
|---|
| 214 | a further collection of critical environmental data that is necessary for Samba to operate
|
|---|
| 215 | correctly. This file contains very sensitive information that must be protected. It is stored
|
|---|
| 216 | in the PRIVATE_DIR directory.
|
|---|
| 217 | </para></entry>
|
|---|
| 218 | </row>
|
|---|
| 219 | <row>
|
|---|
| 220 | <entry>share_info</entry>
|
|---|
| 221 | <entry><para>Stores per-share ACL information.</para></entry>
|
|---|
| 222 | </row>
|
|---|
| 223 | <row>
|
|---|
| 224 | <entry>winbindd_idmap</entry>
|
|---|
| 225 | <entry><para>Winbindd's local IDMAP database.</para></entry>
|
|---|
| 226 | </row>
|
|---|
| 227 | </tbody>
|
|---|
| 228 | </tgroup>
|
|---|
| 229 | </table>
|
|---|
| 230 |
|
|---|
| 231 | <table frame='all' id="tdbtempfiledesc"><title>Temporary TDB File Descriptions</title>
|
|---|
| 232 | <tgroup cols='3'>
|
|---|
| 233 | <colspec align="left"/>
|
|---|
| 234 | <colspec align="justify" colwidth="1*"/>
|
|---|
| 235 | <colspec align="left"/>
|
|---|
| 236 | <thead>
|
|---|
| 237 | <row>
|
|---|
| 238 | <entry align="left">Name</entry>
|
|---|
| 239 | <entry align="justify">Description</entry>
|
|---|
| 240 | <entry align="center">Backup</entry>
|
|---|
| 241 | </row>
|
|---|
| 242 | </thead>
|
|---|
| 243 | <tbody>
|
|---|
| 244 | <row>
|
|---|
| 245 | <entry>brlock</entry>
|
|---|
| 246 | <entry><para>Byte-range locking information.</para></entry>
|
|---|
| 247 | <entry>No</entry>
|
|---|
| 248 | </row>
|
|---|
| 249 | <row>
|
|---|
| 250 | <entry>connections</entry>
|
|---|
| 251 | <entry><para>A temporary cache for current connection information used to enforce max connections.</para></entry>
|
|---|
| 252 | <entry>no</entry>
|
|---|
| 253 | </row>
|
|---|
| 254 | <row>
|
|---|
| 255 | <entry>eventlog/*tdb</entry>
|
|---|
| 256 | <entry><para>Records of eventlog entries. In most circumstances this is just a cache of system logs.</para></entry>
|
|---|
| 257 | <entry>no</entry>
|
|---|
| 258 | </row>
|
|---|
| 259 | <row>
|
|---|
| 260 | <entry>gencache</entry>
|
|---|
| 261 | <entry><para>Generic caching database for dead WINS servers and trusted domain data.</para></entry>
|
|---|
| 262 | <entry>no</entry>
|
|---|
| 263 | </row>
|
|---|
| 264 | <row>
|
|---|
| 265 | <entry>login_cache</entry>
|
|---|
| 266 | <entry><para>A temporary cache for login information, in particular bad password attempts.</para></entry>
|
|---|
| 267 | <entry>no</entry>
|
|---|
| 268 | </row>
|
|---|
| 269 | <row>
|
|---|
| 270 | <entry>messages</entry>
|
|---|
| 271 | <entry><para>Temporary storage of messages being processed by smbd.</para></entry>
|
|---|
| 272 | <entry>no</entry>
|
|---|
| 273 | </row>
|
|---|
| 274 | <row>
|
|---|
| 275 | <entry>netsamlogon_cache</entry>
|
|---|
| 276 | <entry><para>Caches user net_info_3 structure data from net_samlogon requests (as a domain member).</para></entry>
|
|---|
| 277 | <entry>no</entry>
|
|---|
| 278 | </row>
|
|---|
| 279 | <row>
|
|---|
| 280 | <entry>perfmon/*.tdb</entry>
|
|---|
| 281 | <entry><para>Performance counter information.</para></entry>
|
|---|
| 282 | <entry>no</entry>
|
|---|
| 283 | </row>
|
|---|
| 284 | <row>
|
|---|
| 285 | <entry>printing/*.tdb</entry>
|
|---|
| 286 | <entry><para>Cached output from lpq command created on a per-print-service basis.</para></entry>
|
|---|
| 287 | <entry>no</entry>
|
|---|
| 288 | </row>
|
|---|
| 289 | <row>
|
|---|
| 290 | <entry>schannel_store</entry>
|
|---|
| 291 | <entry><para>
|
|---|
| 292 | A confidential file, stored in the PRIVATE_DIR, containing crytographic connection
|
|---|
| 293 | information so that clients that have temporarily disconnected can reconnect without
|
|---|
| 294 | needing to renegotiate the connection setup process.
|
|---|
| 295 | </para></entry>
|
|---|
| 296 | <entry>no</entry>
|
|---|
| 297 | </row>
|
|---|
| 298 | <row>
|
|---|
| 299 | <entry>sessionid</entry>
|
|---|
| 300 | <entry><para>Temporary cache for miscellaneous session information and for utmp handling.</para></entry>
|
|---|
| 301 | <entry>no</entry>
|
|---|
| 302 | </row>
|
|---|
| 303 | <row>
|
|---|
| 304 | <entry>unexpected</entry>
|
|---|
| 305 | <entry><para>Stores packets received for which no process is actively listening.</para></entry>
|
|---|
| 306 | <entry>no</entry>
|
|---|
| 307 | </row>
|
|---|
| 308 | <row>
|
|---|
| 309 | <entry>winbindd_cache</entry>
|
|---|
| 310 | <entry><para>Cache of Identity information received from an NT4 domain or from ADS. Includes user
|
|---|
| 311 | lists, etc.</para></entry>
|
|---|
| 312 | <entry>yes</entry>
|
|---|
| 313 | </row>
|
|---|
| 314 | </tbody>
|
|---|
| 315 | </tgroup>
|
|---|
| 316 | </table>
|
|---|
| 317 |
|
|---|
| 318 | </sect2>
|
|---|
| 319 |
|
|---|
| 320 | <sect2>
|
|---|
| 321 | <title>Starting Samba</title>
|
|---|
| 322 |
|
|---|
| 323 | <para>
|
|---|
| 324 | <indexterm><primary>daemon</primary></indexterm>
|
|---|
| 325 | Samba essentially consists of two or three daemons. A daemon is a UNIX application that runs in the background and provides services.
|
|---|
| 326 | An example of a service is the Apache Web server for which the daemon is called <command>httpd</command>. In the case of Samba there
|
|---|
| 327 | are three daemons, two of which are needed as a minimum.
|
|---|
| 328 | </para>
|
|---|
| 329 |
|
|---|
| 330 | <para>
|
|---|
| 331 | The Samba server is made up of the following daemons:
|
|---|
| 332 | </para>
|
|---|
| 333 |
|
|---|
| 334 | <variablelist>
|
|---|
| 335 | <varlistentry><term>nmbd</term>
|
|---|
| 336 | <listitem><para>
|
|---|
| 337 | <indexterm><primary>nmbd</primary></indexterm>
|
|---|
| 338 | <indexterm><primary>starting samba</primary><secondary>nmbd</secondary></indexterm>
|
|---|
| 339 | This daemon handles all name registration and resolution requests. It is the primary vehicle involved
|
|---|
| 340 | in network browsing. It handles all UDP-based protocols. The <command>nmbd</command> daemon should
|
|---|
| 341 | be the first command started as part of the Samba startup process.
|
|---|
| 342 | </para></listitem>
|
|---|
| 343 | </varlistentry>
|
|---|
| 344 |
|
|---|
| 345 | <varlistentry><term>smbd</term>
|
|---|
| 346 | <listitem><para>
|
|---|
| 347 | <indexterm><primary>smbd</primary></indexterm>
|
|---|
| 348 | <indexterm><primary>starting samba</primary><secondary>smbd</secondary></indexterm>
|
|---|
| 349 | This daemon handles all TCP/IP-based connection services for file- and print-based operations. It also
|
|---|
| 350 | manages local authentication. It should be started immediately following the startup of <command>nmbd</command>.
|
|---|
| 351 | </para></listitem>
|
|---|
| 352 | </varlistentry>
|
|---|
| 353 |
|
|---|
| 354 | <varlistentry><term>winbindd</term>
|
|---|
| 355 | <listitem><para>
|
|---|
| 356 | <indexterm><primary>winbindd</primary></indexterm>
|
|---|
| 357 | <indexterm><primary>starting samba</primary><secondary>winbindd</secondary></indexterm>
|
|---|
| 358 | This daemon should be started when Samba is a member of a Windows NT4 or ADS domain. It is also needed when
|
|---|
| 359 | Samba has trust relationships with another domain. The <command>winbindd</command> daemon will check the
|
|---|
| 360 | &smb.conf; file for the presence of the <parameter>idmap uid</parameter> and <parameter>idmap gid</parameter>
|
|---|
| 361 | parameters. If they are are found, <command>winbindd</command> will use the values specified for
|
|---|
| 362 | for UID and GID allocation. If these parameters are not specified, <command>winbindd</command>
|
|---|
| 363 | will start but it will not be able to allocate UIDs or GIDs.
|
|---|
| 364 | </para></listitem>
|
|---|
| 365 | </varlistentry>
|
|---|
| 366 | </variablelist>
|
|---|
| 367 |
|
|---|
| 368 | <para>
|
|---|
| 369 | <indexterm><primary>startup</primary><secondary>process</secondary></indexterm>
|
|---|
| 370 | When Samba has been packaged by an operating system vendor, the startup process is typically a custom feature of its
|
|---|
| 371 | integration into the platform as a whole. Please refer to your operating system platform administration manuals for
|
|---|
| 372 | specific information pertaining to correct management of Samba startup.
|
|---|
| 373 | </para>
|
|---|
| 374 |
|
|---|
| 375 | </sect2>
|
|---|
| 376 |
|
|---|
| 377 | <sect2>
|
|---|
| 378 | <title>Example Configuration</title>
|
|---|
| 379 |
|
|---|
| 380 | <para>
|
|---|
| 381 | <indexterm><primary>examples</primary></indexterm>
|
|---|
| 382 | <indexterm><primary>source code</primary></indexterm>
|
|---|
| 383 | <indexterm><primary>distribution</primary></indexterm>
|
|---|
| 384 | <indexterm><primary>tarball</primary></indexterm>
|
|---|
| 385 | <indexterm><primary>package</primary></indexterm>
|
|---|
| 386 | There are sample configuration files in the examples subdirectory in the source code distribution tarball
|
|---|
| 387 | package. It is suggested you read them carefully so you can see how the options go together in practice. See
|
|---|
| 388 | the man page for all the options. It might be worthwhile to start out with the
|
|---|
| 389 | <filename>smb.conf.default</filename> configuration file and adapt it to your needs. It contains plenty of comments.
|
|---|
| 390 | </para>
|
|---|
| 391 |
|
|---|
| 392 | <para>
|
|---|
| 393 | <indexterm><primary>simplest</primary><secondary>configuration</secondary></indexterm>
|
|---|
| 394 | The simplest useful configuration file would contain something like that shown in
|
|---|
| 395 | <link linkend="simple-example">Another simple smb.conf File</link>.
|
|---|
| 396 | <indexterm><primary>simple configuration</primary></indexterm>
|
|---|
| 397 | </para>
|
|---|
| 398 |
|
|---|
| 399 | <example id="simple-example">
|
|---|
| 400 | <title>Another simple smb.conf File</title>
|
|---|
| 401 | <smbconfblock>
|
|---|
| 402 | <smbconfsection name="[global]"/>
|
|---|
| 403 | <smbconfoption name="workgroup">&example.workgroup;</smbconfoption>
|
|---|
| 404 |
|
|---|
| 405 | <smbconfsection name="[homes]"/>
|
|---|
| 406 | <smbconfoption name="guest ok">no</smbconfoption>
|
|---|
| 407 | <smbconfoption name="read only">no</smbconfoption>
|
|---|
| 408 | </smbconfblock>
|
|---|
| 409 | </example>
|
|---|
| 410 |
|
|---|
| 411 | <para>
|
|---|
| 412 | <indexterm><primary>connections</primary></indexterm>
|
|---|
| 413 | <indexterm><primary>account</primary></indexterm>
|
|---|
| 414 | <indexterm><primary>login name</primary></indexterm>
|
|---|
| 415 | <indexterm><primary>service name</primary></indexterm>
|
|---|
| 416 | This will allow connections by anyone with an account on the server, using either
|
|---|
| 417 | their login name or <smbconfsection name="homes"/> as the service name.
|
|---|
| 418 | (Note: The workgroup that Samba should appear in must also be set. The default
|
|---|
| 419 | workgroup name is WORKGROUP.)
|
|---|
| 420 | </para>
|
|---|
| 421 |
|
|---|
| 422 | <para>
|
|---|
| 423 | <indexterm><primary>smbd</primary></indexterm>
|
|---|
| 424 | Make sure you put the &smb.conf; file in the correct place. Note, the correct location of this file
|
|---|
| 425 | depends on how the binary files were built. You can discover the correct location by executing from
|
|---|
| 426 | the directory that contains the <command>smbd</command> command file:
|
|---|
| 427 | <screen>
|
|---|
| 428 | &rootprompt; smbd -b | grep smb.conf
|
|---|
| 429 | </screen>
|
|---|
| 430 | </para>
|
|---|
| 431 |
|
|---|
| 432 | <para>
|
|---|
| 433 | <indexterm><primary>security</primary><secondary>settings</secondary></indexterm>
|
|---|
| 434 | For more information about security settings for the <smbconfsection name="[homes]"/> share, please refer to
|
|---|
| 435 | <link linkend="securing-samba">Securing Samba</link>.
|
|---|
| 436 | </para>
|
|---|
| 437 |
|
|---|
| 438 | <sect3>
|
|---|
| 439 | <title>Test Your Config File with <command>testparm</command></title>
|
|---|
| 440 |
|
|---|
| 441 | <para>
|
|---|
| 442 | <indexterm><primary>validate</primary></indexterm>
|
|---|
| 443 | <indexterm><primary>testparm</primary></indexterm>
|
|---|
| 444 | <indexterm><primary>misconfigurations</primary></indexterm>
|
|---|
| 445 | It's important to validate the contents of the &smb.conf; file using the &testparm; program.
|
|---|
| 446 | If testparm runs correctly, it will list the loaded services. If not, it will give an error message.
|
|---|
| 447 | Make sure it runs correctly and that the services look reasonable before proceeding. Enter the command:
|
|---|
| 448 | <screen>
|
|---|
| 449 | &rootprompt; testparm /etc/samba/smb.conf
|
|---|
| 450 | </screen>
|
|---|
| 451 | Testparm will parse your configuration file and report any unknown parameters or incorrect syntax.
|
|---|
| 452 | It also performs a check for common misconfigurations and will issue a warning if one is found.
|
|---|
| 453 | </para>
|
|---|
| 454 |
|
|---|
| 455 | <para>
|
|---|
| 456 | Always run testparm again whenever the &smb.conf; file is changed!
|
|---|
| 457 | </para>
|
|---|
| 458 |
|
|---|
| 459 | <para>
|
|---|
| 460 | <indexterm><primary>smbd</primary></indexterm>
|
|---|
| 461 | <indexterm><primary>nmbd</primary></indexterm>
|
|---|
| 462 | <indexterm><primary>winbindd</primary></indexterm>
|
|---|
| 463 | <indexterm><primary>configuration</primary><secondary>documentation</secondary></indexterm>
|
|---|
| 464 | The &smb.conf; file is constantly checked by the Samba daemons <command>smbd</command> and every instance of
|
|---|
| 465 | itself that it spawns, <command>nmbd</command> and <command>winbindd</command>. It is good practice to
|
|---|
| 466 | keep this file as small as possible. Many administrators prefer to document Samba configuration settings
|
|---|
| 467 | and thus the need to keep this file small goes against good documentation wisdom. One solution that may
|
|---|
| 468 | be adopted is to do all documentation and configuration in a file that has another name, such as
|
|---|
| 469 | <filename>smb.conf.master</filename>. The <command>testparm</command> utility can be used to generate a
|
|---|
| 470 | fully optimized &smb.conf; file from this master configuration and documentation file as shown here:
|
|---|
| 471 | <screen>
|
|---|
| 472 | &rootprompt; testparm -s smb.conf.master > smb.conf
|
|---|
| 473 | </screen>
|
|---|
| 474 | This administrative method makes it possible to maintain detailed configuration change records while at
|
|---|
| 475 | the same time keeping the working &smb.conf; file size to the minimum necessary.
|
|---|
| 476 | </para>
|
|---|
| 477 |
|
|---|
| 478 | </sect3>
|
|---|
| 479 | </sect2>
|
|---|
| 480 |
|
|---|
| 481 | <sect2>
|
|---|
| 482 | <title>SWAT</title>
|
|---|
| 483 |
|
|---|
| 484 | <para>
|
|---|
| 485 | <indexterm><primary>swat</primary></indexterm>
|
|---|
| 486 | SWAT is a Web-based interface that can be used to facilitate the configuration of Samba. SWAT might not
|
|---|
| 487 | be available in the Samba package that shipped with your platform, but in a separate package. If you need to build SWAT please read the SWAT man page regarding compilation, installation, and
|
|---|
| 488 | configuration of SWAT from the source code.
|
|---|
| 489 | </para>
|
|---|
| 490 |
|
|---|
| 491 | <para>
|
|---|
| 492 | To launch SWAT, just run your favorite Web browser and point it to
|
|---|
| 493 | <ulink url="http://localhost:901/" noescape="1">http://localhost:901/</ulink>.
|
|---|
| 494 | Replace <replaceable>localhost</replaceable> with the name of the computer on which
|
|---|
| 495 | Samba is running if that is a different computer than your browser.
|
|---|
| 496 | </para>
|
|---|
| 497 |
|
|---|
| 498 | <para>
|
|---|
| 499 | SWAT can be used from a browser on any IP-connected machine, but be aware that connecting from a remote
|
|---|
| 500 | machine leaves your connection open to password sniffing because passwords will be sent over the wire in the clear.
|
|---|
| 501 | </para>
|
|---|
| 502 |
|
|---|
| 503 | <para>
|
|---|
| 504 | Please note that re-writing the configuration file using SWAT will
|
|---|
| 505 | remove all comments!
|
|---|
| 506 | More information about SWAT can be found in <link linkend="SWAT">The Samba Web Administration Tool</link>.
|
|---|
| 507 | </para>
|
|---|
| 508 |
|
|---|
| 509 | </sect2>
|
|---|
| 510 |
|
|---|
| 511 | </sect1>
|
|---|
| 512 |
|
|---|
| 513 | <sect1>
|
|---|
| 514 | <title>List Shares Available on the Server</title>
|
|---|
| 515 |
|
|---|
| 516 | <para>
|
|---|
| 517 | To list shares that are available from the configured Samba server, execute the
|
|---|
| 518 | following command:
|
|---|
| 519 | </para>
|
|---|
| 520 |
|
|---|
| 521 | <para><screen>
|
|---|
| 522 | &prompt;<userinput>smbclient -L <replaceable>yourhostname</replaceable></userinput>
|
|---|
| 523 | </screen></para>
|
|---|
| 524 |
|
|---|
| 525 | <para>
|
|---|
| 526 | You should see a list of shares available on your server. If you do not, then
|
|---|
| 527 | something is incorrectly configured. This method can also be used to see what shares
|
|---|
| 528 | are available on other SMB servers, such as Windows 2000.
|
|---|
| 529 | </para>
|
|---|
| 530 |
|
|---|
| 531 | <para>
|
|---|
| 532 | If you choose user-level security, you may find that Samba requests a password
|
|---|
| 533 | before it will list the shares. See the <command>smbclient</command> man page for details.
|
|---|
| 534 | You can force it to list the shares without a password by adding the option
|
|---|
| 535 | <option>-N</option> to the command line.
|
|---|
| 536 | </para>
|
|---|
| 537 | </sect1>
|
|---|
| 538 |
|
|---|
| 539 | <sect1>
|
|---|
| 540 | <title>Connect with a UNIX Client</title>
|
|---|
| 541 |
|
|---|
| 542 | <para>
|
|---|
| 543 | Enter the following command:
|
|---|
| 544 | <screen>
|
|---|
| 545 | &prompt;<userinput>smbclient <replaceable> //yourhostname/aservice</replaceable></userinput>
|
|---|
| 546 | </screen></para>
|
|---|
| 547 |
|
|---|
| 548 | <para>Typically <replaceable>yourhostname</replaceable> is the name of the host on which &smbd;
|
|---|
| 549 | has been installed. The <replaceable>aservice</replaceable> is any service that has been defined in the &smb.conf;
|
|---|
| 550 | file. Try your username if you just have a <smbconfsection name="[homes]"/> section in the &smb.conf; file.</para>
|
|---|
| 551 |
|
|---|
| 552 | <para>Example: If the UNIX host is called <replaceable>bambi</replaceable> and a valid login name
|
|---|
| 553 | is <replaceable>fred</replaceable>, you would type:</para>
|
|---|
| 554 |
|
|---|
| 555 | <para><screen>
|
|---|
| 556 | &prompt;<userinput>smbclient //<replaceable>bambi</replaceable>/<replaceable>fred</replaceable></userinput>
|
|---|
| 557 | </screen></para>
|
|---|
| 558 | </sect1>
|
|---|
| 559 |
|
|---|
| 560 | <sect1>
|
|---|
| 561 | <title>Connect from a Remote SMB Client</title>
|
|---|
| 562 |
|
|---|
| 563 | <para>
|
|---|
| 564 | Now that Samba is working correctly locally, you can try to access it from other clients. Within a few
|
|---|
| 565 | minutes, the Samba host should be listed in the Network Neighborhood on all Windows clients of its subnet.
|
|---|
| 566 | Try browsing the server from another client or "mounting" it.
|
|---|
| 567 | </para>
|
|---|
| 568 |
|
|---|
| 569 | <para>
|
|---|
| 570 | Mounting disks from a DOS, Windows, or OS/2 client can be done by running a command such as:
|
|---|
| 571 | <screen>
|
|---|
| 572 | &dosprompt;<userinput>net use m: \\servername\service</userinput>
|
|---|
| 573 | </screen>
|
|---|
| 574 | Where the drive letter m: is any available drive letter. It is important to double-check that the
|
|---|
| 575 | service (share) name that you used does actually exist.
|
|---|
| 576 | </para>
|
|---|
| 577 |
|
|---|
| 578 | <para>
|
|---|
| 579 | Try printing, for example,
|
|---|
| 580 | <screen>
|
|---|
| 581 | &dosprompt;<userinput>net use lpt1: \\servername\spoolservice</userinput>
|
|---|
| 582 | </screen>
|
|---|
| 583 | The <literal>spoolservice</literal> is the name of the printer (actually the print queue) on the target
|
|---|
| 584 | server. This will permit all print jobs that are captured by the lpt1: port on the Windows client to
|
|---|
| 585 | be sent to the printer that owns the spoolservice that has been specified.
|
|---|
| 586 | </para>
|
|---|
| 587 |
|
|---|
| 588 | <para>
|
|---|
| 589 | <screen>&dosprompt;<userinput>print filename</userinput>
|
|---|
| 590 | </screen></para>
|
|---|
| 591 |
|
|---|
| 592 | <sect2>
|
|---|
| 593 | <title>What If Things Don't Work?</title>
|
|---|
| 594 |
|
|---|
| 595 | <para>
|
|---|
| 596 | You might want to read <link linkend="diagnosis">The Samba Checklist</link>. If you are still
|
|---|
| 597 | stuck, refer to <link linkend="problems">Analyzing and Solving Samba Problems</link>. Samba has
|
|---|
| 598 | been successfully installed at thousands of sites worldwide. It is unlikely that your particular problem is
|
|---|
| 599 | unique, so it might be productive to perform an Internet search to see if someone else has encountered your
|
|---|
| 600 | problem and has found a way to overcome it.
|
|---|
| 601 | </para>
|
|---|
| 602 |
|
|---|
| 603 | <para>
|
|---|
| 604 | If you are new to Samba, and particularly if you are new to Windows networking, or to UNIX/Linux,
|
|---|
| 605 | the book <quote>Samba-3 by Example</quote> will help you to create a validated network environment.
|
|---|
| 606 | Simply choose from the first five chapters the network design that most closely matches site needs,
|
|---|
| 607 | then follow the simple step-by-step procedure to deploy it. Later, when you have a working network
|
|---|
| 608 | you may well want to refer back to this book for further insight into opportunities for improvement.
|
|---|
| 609 | </para>
|
|---|
| 610 |
|
|---|
| 611 | </sect2>
|
|---|
| 612 |
|
|---|
| 613 | <sect2>
|
|---|
| 614 | <title>Still Stuck?</title>
|
|---|
| 615 |
|
|---|
| 616 | <para>
|
|---|
| 617 | The best advice under the stress of abject frustration is to cool down! That may be challenging
|
|---|
| 618 | of itself, but while you are angry or annoyed your ability to seek out a solution is somewhat
|
|---|
| 619 | undermined. A cool head clears the way to finding the answer you are looking for. Just remember,
|
|---|
| 620 | every problem has a solution &smbmdash; there is a good chance that someone else has found it
|
|---|
| 621 | even though you can't right now. That will change with time, patience and learning.
|
|---|
| 622 | </para>
|
|---|
| 623 |
|
|---|
| 624 | <para>
|
|---|
| 625 | Now that you have cooled down a bit, please refer to <link linkend="diagnosis">the Samba Checklist</link>
|
|---|
| 626 | for a process that can be followed to identify the cause of your problem.
|
|---|
| 627 | </para>
|
|---|
| 628 |
|
|---|
| 629 | </sect2>
|
|---|
| 630 |
|
|---|
| 631 | </sect1>
|
|---|
| 632 |
|
|---|
| 633 | <sect1>
|
|---|
| 634 | <title>Common Errors</title>
|
|---|
| 635 |
|
|---|
| 636 | <para>
|
|---|
| 637 | The following questions and issues are raised repeatedly on the Samba mailing list.
|
|---|
| 638 | </para>
|
|---|
| 639 |
|
|---|
| 640 | <sect2>
|
|---|
| 641 | <title>Large Number of smbd Processes</title>
|
|---|
| 642 |
|
|---|
| 643 | <para>
|
|---|
| 644 | Samba consists of three core programs: &nmbd;, &smbd;, and &winbindd;. &nmbd; is the name server message daemon,
|
|---|
| 645 | &smbd; is the server message daemon, and &winbindd; is the daemon that handles communication with domain controllers.
|
|---|
| 646 | </para>
|
|---|
| 647 |
|
|---|
| 648 | <para>
|
|---|
| 649 | If Samba is <emphasis>not</emphasis> running as a WINS server, then there will be one single instance of
|
|---|
| 650 | &nmbd; running on your system. If it is running as a WINS server, then there will be
|
|---|
| 651 | two instances &smbmdash; one to handle the WINS requests.
|
|---|
| 652 | </para>
|
|---|
| 653 |
|
|---|
| 654 | <para>
|
|---|
| 655 | &smbd; handles all connection requests. It spawns a new process for each client
|
|---|
| 656 | connection made. That is why you may see so many of them, one per client connection.
|
|---|
| 657 | </para>
|
|---|
| 658 |
|
|---|
| 659 | <para>
|
|---|
| 660 | &winbindd; will run as one or two daemons, depending on whether or not it is being
|
|---|
| 661 | run in <emphasis>split mode</emphasis> (in which case there will be two instances).
|
|---|
| 662 | </para>
|
|---|
| 663 |
|
|---|
| 664 | </sect2>
|
|---|
| 665 |
|
|---|
| 666 | <sect2>
|
|---|
| 667 | <title>Error Message: open_oplock_ipc</title>
|
|---|
| 668 |
|
|---|
| 669 | <para>
|
|---|
| 670 | An error message is observed in the log files when &smbd; is started: <quote>open_oplock_ipc: Failed to
|
|---|
| 671 | get local UDP socket for address 100007f. Error was Cannot assign requested.</quote>
|
|---|
| 672 | </para>
|
|---|
| 673 |
|
|---|
| 674 | <para>
|
|---|
| 675 | Your loopback device isn't working correctly. Make sure it is configured correctly. The loopback
|
|---|
| 676 | device is an internal (virtual) network device with the IP address <emphasis>127.0.0.1</emphasis>.
|
|---|
| 677 | Read your OS documentation for details on how to configure the loopback on your system.
|
|---|
| 678 | </para>
|
|---|
| 679 |
|
|---|
| 680 | </sect2>
|
|---|
| 681 |
|
|---|
| 682 | <sect2>
|
|---|
| 683 | <title><quote><errorname>The network name cannot be found</errorname></quote></title>
|
|---|
| 684 |
|
|---|
| 685 | <para>
|
|---|
| 686 | This error can be caused by one of these misconfigurations:
|
|---|
| 687 | </para>
|
|---|
| 688 |
|
|---|
| 689 | <itemizedlist>
|
|---|
| 690 | <listitem><para>You specified a nonexisting path
|
|---|
| 691 | for the share in &smb.conf;.</para></listitem>
|
|---|
| 692 |
|
|---|
| 693 | <listitem><para>The user you are trying to access the share with does not
|
|---|
| 694 | have sufficient permissions to access the path for
|
|---|
| 695 | the share. Both read (r) and access (x) should be possible.</para></listitem>
|
|---|
| 696 |
|
|---|
| 697 | <listitem><para>The share you are trying to access does not exist.</para></listitem>
|
|---|
| 698 | </itemizedlist>
|
|---|
| 699 |
|
|---|
| 700 | </sect2>
|
|---|
| 701 | </sect1>
|
|---|
| 702 |
|
|---|
| 703 | </chapter>
|
|---|
