| 1 | <?xml version="1.0" encoding="iso-8859-1"?>
|
|---|
| 2 | <!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
|
|---|
| 3 | <chapter id="upgrading-to-3.0">
|
|---|
| 4 | <chapterinfo>
|
|---|
| 5 | &author.jelmer;
|
|---|
| 6 | &author.jht;
|
|---|
| 7 | &author.jerry;
|
|---|
| 8 | <pubdate>August 16, 2007</pubdate>
|
|---|
| 9 | </chapterinfo>
|
|---|
| 10 |
|
|---|
| 11 | <title>Updating and Upgrading Samba</title>
|
|---|
| 12 | <para>
|
|---|
| 13 | This chapter provides a detailed record of changes made during the 3.x series releases. At this time this
|
|---|
| 14 | series consists of the 3.0.x series that is under the GNU GPL version 2 license, and the Samba 3.2.x series
|
|---|
| 15 | that is being released under the terms of the GNU GPL version 3 license.
|
|---|
| 16 | </para>
|
|---|
| 17 |
|
|---|
| 18 | <sect1>
|
|---|
| 19 | <title>Key Update Requirements</title>
|
|---|
| 20 | <para>
|
|---|
| 21 | Samba is a fluid product in which there may be significant changes between releases. Some of these changes are
|
|---|
| 22 | brought about as a result of changes in the protocols that are used by Microsoft Windows network clients as a
|
|---|
| 23 | result of security or functionality updates through official Microsoft patches and updates. Samba must track
|
|---|
| 24 | such changes, particularly where they affect the internal operation of Samba itself.
|
|---|
| 25 | </para>
|
|---|
| 26 |
|
|---|
| 27 | <para>
|
|---|
| 28 | Please refer to any notes below that make explicit mention of the version of Samba you are using. In general,
|
|---|
| 29 | all changes that apply to a new release will apply to follow-on releases also. For example, changes to Samba
|
|---|
| 30 | 3.0.23 affect all releases up to an including 3.0.25 and later. Samba 3.2.x was originaly cut from Samba
|
|---|
| 31 | 3.0.25 before 3.2.0-specific changes were applied. Unless a 3.0.x series feature is specifically revoked, the
|
|---|
| 32 | behavior of the 3.2.x series can be expected to follow the earlier pattern.
|
|---|
| 33 | </para>
|
|---|
| 34 |
|
|---|
| 35 | <sect2>
|
|---|
| 36 | <title>Upgrading from Samba-3.0.x to Samba-3.2.0</title>
|
|---|
| 37 | <para>
|
|---|
| 38 | </para>
|
|---|
| 39 | </sect2>
|
|---|
| 40 |
|
|---|
| 41 | <sect2 id="oldupdatenotes">
|
|---|
| 42 | <title>Upgrading from Samba-2.x to Samba-3.0.25</title>
|
|---|
| 43 | <para>
|
|---|
| 44 | <indexterm><primary>Samba differences</primary></indexterm>
|
|---|
| 45 | <indexterm><primary>changed parameters</primary></indexterm>
|
|---|
| 46 | <indexterm><primary>simple guide</primary></indexterm>
|
|---|
| 47 | This chapter deals exclusively with the differences between Samba-3.0.25 and Samba-2.2.8a.
|
|---|
| 48 | It points out where configuration parameters have changed, and provides a simple guide for
|
|---|
| 49 | the move from 2.2.x to 3.0.25.
|
|---|
| 50 | </para>
|
|---|
| 51 | </sect2>
|
|---|
| 52 |
|
|---|
| 53 | <sect2>
|
|---|
| 54 | <title>Quick Migration Guide</title>
|
|---|
| 55 |
|
|---|
| 56 | <para>
|
|---|
| 57 | Samba-3.0.25 default behavior should be approximately the same as Samba-2.2.x.
|
|---|
| 58 | The default behavior when the new parameter <smbconfoption name="passdb backend"/>
|
|---|
| 59 | is not defined in the &smb.conf; file provides the same default behavior as Samba-2.2.x
|
|---|
| 60 | with <smbconfoption name="encrypt passwords">Yes</smbconfoption> and
|
|---|
| 61 | will use the <filename>smbpasswd</filename> database.
|
|---|
| 62 | </para>
|
|---|
| 63 |
|
|---|
| 64 | <para>
|
|---|
| 65 | <indexterm><primary>behavior approximately same</primary></indexterm>
|
|---|
| 66 | <indexterm><primary>differing protocol</primary></indexterm>
|
|---|
| 67 | So why say that <emphasis>behavior should be approximately the same as Samba-2.2.x</emphasis>? Because
|
|---|
| 68 | Samba-3.0.25 can negotiate new protocols, such as support for native Unicode, that may result in
|
|---|
| 69 | differing protocol code paths being taken. The new behavior under such circumstances is not
|
|---|
| 70 | exactly the same as the old one. The good news is that the domain and machine SIDs will be
|
|---|
| 71 | preserved across the upgrade.
|
|---|
| 72 | </para>
|
|---|
| 73 |
|
|---|
| 74 | <para>
|
|---|
| 75 | <indexterm><primary>LDAP backend</primary></indexterm>
|
|---|
| 76 | <indexterm><primary>database</primary></indexterm>
|
|---|
| 77 | <indexterm><primary>pdbedit</primary></indexterm>
|
|---|
| 78 | <indexterm><primary>Samba-3-compatible LDAP backend</primary></indexterm>
|
|---|
| 79 | If the Samba-2.2.x system is using an LDAP backend, and there is no time to update the LDAP
|
|---|
| 80 | database, then make sure that <smbconfoption name="passdb backend">ldapsam_compat</smbconfoption>
|
|---|
| 81 | is specified in the &smb.conf; file. For the rest, behavior should remain more or less the same.
|
|---|
| 82 | At a later date, when there is time to implement a new Samba-3-compatible LDAP backend, it is possible
|
|---|
| 83 | to migrate the old LDAP database to the new one through use of the <command>pdbedit</command>.
|
|---|
| 84 | See <link linkend="pdbeditthing">The <emphasis>pdbedit</emphasis> Command</link>.
|
|---|
| 85 | </para>
|
|---|
| 86 |
|
|---|
| 87 | </sect2>
|
|---|
| 88 | </sect1>
|
|---|
| 89 |
|
|---|
| 90 | <sect1>
|
|---|
| 91 | <title>New Features in Samba-3.x Series</title>
|
|---|
| 92 | <para>
|
|---|
| 93 | </para>
|
|---|
| 94 |
|
|---|
| 95 | <sect2>
|
|---|
| 96 | <title>New Features in Samba-3.2.x Series</title>
|
|---|
| 97 |
|
|---|
| 98 | <para>Samba is now distributed under the version 3
|
|---|
| 99 | of the new GNU General Public License.
|
|---|
| 100 | </para>
|
|---|
| 101 |
|
|---|
| 102 | <para>
|
|---|
| 103 | The major new features are:
|
|---|
| 104 | </para>
|
|---|
| 105 |
|
|---|
| 106 |
|
|---|
| 107 | <orderedlist numeration="arabic">
|
|---|
| 108 | <listitem><para>
|
|---|
| 109 | <indexterm><primary>File Service</primary></indexterm>
|
|---|
| 110 | <indexterm><primary>limit</primary></indexterm>
|
|---|
| 111 | Removal of the 1024 byte limit on pathnames and 256 byte limit on
|
|---|
| 112 | filename components to honor the MAX_PATH setting from the host OS.
|
|---|
| 113 | </para></listitem>
|
|---|
| 114 |
|
|---|
| 115 | <listitem><para>
|
|---|
| 116 | <indexterm><primary>Registory</primary></indexterm>
|
|---|
| 117 | <indexterm><primary>Configuration</primary></indexterm>
|
|---|
| 118 | Introduction of a registry based configuration system.
|
|---|
| 119 | </para></listitem>
|
|---|
| 120 |
|
|---|
| 121 | <listitem><para>
|
|---|
| 122 | <indexterm><primary>cluster</primary></indexterm>
|
|---|
| 123 | Experimental support for file serving clusters.
|
|---|
| 124 | </para></listitem>
|
|---|
| 125 |
|
|---|
| 126 | <listitem><para>
|
|---|
| 127 | <indexterm><primary>IPv6</primary></indexterm>
|
|---|
| 128 | Support for IPv6 in the server, and client tools and libraries.
|
|---|
| 129 | </para></listitem>
|
|---|
| 130 |
|
|---|
| 131 | <listitem><para>
|
|---|
| 132 | <indexterm><primary>alternate data streams</primary></indexterm>
|
|---|
| 133 | Support for storing alternate data streams in xattrs.
|
|---|
| 134 | </para></listitem>
|
|---|
| 135 |
|
|---|
| 136 | <listitem><para>
|
|---|
| 137 | <indexterm><primary>Encrypted SMB transport</primary></indexterm>
|
|---|
| 138 | Encrypted SMB transport in client tools and libraries, and server.
|
|---|
| 139 | </para></listitem>
|
|---|
| 140 |
|
|---|
| 141 | <listitem><para>
|
|---|
| 142 | <indexterm><primary>Windows Vista</primary></indexterm>
|
|---|
| 143 | Support for Vista clients authenticating via Kerberos.
|
|---|
| 144 | </para></listitem>
|
|---|
| 145 |
|
|---|
| 146 | <listitem><para>
|
|---|
| 147 | <indexterm><primary>Winbind</primary></indexterm>
|
|---|
| 148 | <indexterm><primary>forest</primary></indexterm>
|
|---|
| 149 | Full support for Windows 2003 cross-forest, transitive trusts
|
|---|
| 150 | and one-way domain trusts.
|
|---|
| 151 | </para></listitem>
|
|---|
| 152 |
|
|---|
| 153 | <listitem><para>
|
|---|
| 154 | <indexterm><primary>pam_winbind</primary></indexterm>
|
|---|
| 155 | Support for userPrincipalName logons via pam_winbind and NSS lookups.
|
|---|
| 156 | </para></listitem>
|
|---|
| 157 |
|
|---|
| 158 | <listitem><para>
|
|---|
| 159 | <indexterm><primary>LDAP</primary></indexterm>
|
|---|
| 160 | <indexterm><primary>Active Directory</primary></indexterm>
|
|---|
| 161 | <indexterm><primary>Signing</primary></indexterm>
|
|---|
| 162 | Support for Active Directory LDAP Signing policy.
|
|---|
| 163 | </para></listitem>
|
|---|
| 164 |
|
|---|
| 165 | <listitem><para>
|
|---|
| 166 | <indexterm><primary>Licence</primary></indexterm>
|
|---|
| 167 | <indexterm><primary>GPL</primary></indexterm>
|
|---|
| 168 | New LGPL Winbind client library (libwbclient.so).
|
|---|
| 169 | </para></listitem>
|
|---|
| 170 |
|
|---|
| 171 | <listitem><para>
|
|---|
| 172 | <indexterm><primary>domain</primary></indexterm>
|
|---|
| 173 | <indexterm><primary>domain trust</primary></indexterm>
|
|---|
| 174 | Support for establishing interdomain trust relationships with Windows 2008.
|
|---|
| 175 | </para></listitem>
|
|---|
| 176 |
|
|---|
| 177 | <listitem><para>
|
|---|
| 178 | <indexterm><primary>joining</primary></indexterm>
|
|---|
| 179 | New client and server support for remotely joining and unjoining Domains.
|
|---|
| 180 | </para></listitem>
|
|---|
| 181 |
|
|---|
| 182 |
|
|---|
| 183 | <listitem><para>
|
|---|
| 184 | <indexterm><primary>joining</primary></indexterm>
|
|---|
| 185 | Support for joining into Windows 2008 domains.
|
|---|
| 186 | </para></listitem>
|
|---|
| 187 |
|
|---|
| 188 | </orderedlist>
|
|---|
| 189 |
|
|---|
| 190 | <para>
|
|---|
| 191 | Plus lots of other improvements!
|
|---|
| 192 | </para>
|
|---|
| 193 |
|
|---|
| 194 |
|
|---|
| 195 | </sect2>
|
|---|
| 196 |
|
|---|
| 197 | <sect2>
|
|---|
| 198 | <title>New Features in Samba-3.0.x</title>
|
|---|
| 199 |
|
|---|
| 200 | <para>
|
|---|
| 201 | The major new features are:
|
|---|
| 202 | </para>
|
|---|
| 203 |
|
|---|
| 204 | <orderedlist numeration="arabic">
|
|---|
| 205 | <listitem><para>
|
|---|
| 206 | <indexterm><primary>ADS</primary></indexterm>
|
|---|
| 207 | <indexterm><primary>LDAP/Kerberos</primary></indexterm>
|
|---|
| 208 | Active Directory support. This release is able to join an ADS realm
|
|---|
| 209 | as a member server and authenticate users using LDAP/Kerberos.
|
|---|
| 210 | </para></listitem>
|
|---|
| 211 |
|
|---|
| 212 | <listitem><para>
|
|---|
| 213 | <indexterm><primary>Unicode</primary></indexterm>
|
|---|
| 214 | <indexterm><primary>multibyte character sets</primary></indexterm>
|
|---|
| 215 | Unicode support. Samba will now negotiate Unicode on the wire, and
|
|---|
| 216 | internally there is a much better infrastructure for multibyte
|
|---|
| 217 | and Unicode character sets.
|
|---|
| 218 | </para></listitem>
|
|---|
| 219 |
|
|---|
| 220 | <listitem><para>
|
|---|
| 221 | <indexterm><primary>authentication system</primary></indexterm>
|
|---|
| 222 | New authentication system. The internal authentication system has
|
|---|
| 223 | been almost completely rewritten. Most of the changes are internal,
|
|---|
| 224 | but the new authoring system is also very configurable.
|
|---|
| 225 | </para></listitem>
|
|---|
| 226 |
|
|---|
| 227 | <listitem><para>
|
|---|
| 228 | <indexterm><primary>filename mangling</primary></indexterm>
|
|---|
| 229 | New filename mangling system. The filename mangling system has been
|
|---|
| 230 | completely rewritten. An internal database now stores mangling maps
|
|---|
| 231 | persistently.
|
|---|
| 232 | </para></listitem>
|
|---|
| 233 |
|
|---|
| 234 | <listitem><para>
|
|---|
| 235 | <indexterm><primary>net command</primary></indexterm>
|
|---|
| 236 | New <quote>net</quote> command. A new <quote>net</quote> command has been added. It is
|
|---|
| 237 | somewhat similar to the <quote>net</quote> command in Windows. Eventually, we
|
|---|
| 238 | plan to replace a bunch of other utilities (such as smbpasswd)
|
|---|
| 239 | with subcommands in <quote>net</quote>.
|
|---|
| 240 | </para></listitem>
|
|---|
| 241 |
|
|---|
| 242 | <listitem><para>
|
|---|
| 243 | <indexterm><primary>status32 codes</primary></indexterm>
|
|---|
| 244 | Samba now negotiates NT-style status32 codes on the wire. This
|
|---|
| 245 | considerably improves error handling.
|
|---|
| 246 | </para></listitem>
|
|---|
| 247 |
|
|---|
| 248 | <listitem><para>
|
|---|
| 249 | <indexterm><primary>printer attributes publishing</primary></indexterm>
|
|---|
| 250 | Better Windows 200x/XP printing support, including publishing
|
|---|
| 251 | printer attributes in Active Directory.
|
|---|
| 252 | </para></listitem>
|
|---|
| 253 |
|
|---|
| 254 | <listitem><para>
|
|---|
| 255 | <indexterm><primary>RPC modules</primary></indexterm>
|
|---|
| 256 | <indexterm><primary>passdb backends</primary></indexterm>
|
|---|
| 257 | <indexterm><primary>character sets</primary></indexterm>
|
|---|
| 258 | New loadable RPC modules for passdb backends and character sets.
|
|---|
| 259 | </para></listitem>
|
|---|
| 260 |
|
|---|
| 261 | <listitem><para>
|
|---|
| 262 | <indexterm><primary>dual-daemon winbindd</primary></indexterm>
|
|---|
| 263 | New default dual-daemon winbindd support for better performance.
|
|---|
| 264 | </para></listitem>
|
|---|
| 265 |
|
|---|
| 266 | <listitem><para>
|
|---|
| 267 | <indexterm><primary>migrating</primary></indexterm>
|
|---|
| 268 | <indexterm><primary>maintaining ids</primary></indexterm>
|
|---|
| 269 | <indexterm><primary>SID</primary></indexterm>
|
|---|
| 270 | Support for migrating from a Windows NT 4.0 domain to a Samba
|
|---|
| 271 | domain and maintaining user, group, and domain SIDs.
|
|---|
| 272 | </para></listitem>
|
|---|
| 273 |
|
|---|
| 274 | <listitem><para>
|
|---|
| 275 | <indexterm><primary>trust relationships</primary></indexterm>
|
|---|
| 276 | <indexterm><primary>domain controllers</primary></indexterm>
|
|---|
| 277 | Support for establishing trust relationships with Windows NT 4.0
|
|---|
| 278 | domain controllers.
|
|---|
| 279 | </para></listitem>
|
|---|
| 280 |
|
|---|
| 281 | <listitem><para>
|
|---|
| 282 | <indexterm><primary>Winbind architecture</primary></indexterm>
|
|---|
| 283 | <indexterm><primary>LDAP directory</primary></indexterm>
|
|---|
| 284 | <indexterm><primary>ID mapping</primary></indexterm>
|
|---|
| 285 | Initial support for a distributed Winbind architecture using
|
|---|
| 286 | an LDAP directory for storing SID to UID/GID mappings.
|
|---|
| 287 | </para></listitem>
|
|---|
| 288 |
|
|---|
| 289 | <listitem><para>
|
|---|
| 290 | Major updates to the Samba documentation tree.
|
|---|
| 291 | </para></listitem>
|
|---|
| 292 |
|
|---|
| 293 | <listitem><para>
|
|---|
| 294 | <indexterm><primary>SMB signing</primary></indexterm>
|
|---|
| 295 | <indexterm><primary>security settings</primary></indexterm>
|
|---|
| 296 | Full support for client and server SMB signing to ensure
|
|---|
| 297 | compatibility with default Windows 2003 security settings.
|
|---|
| 298 | </para></listitem>
|
|---|
| 299 | </orderedlist>
|
|---|
| 300 |
|
|---|
| 301 | <para>
|
|---|
| 302 | Plus lots of other improvements!
|
|---|
| 303 | </para>
|
|---|
| 304 |
|
|---|
| 305 |
|
|---|
| 306 | <sect3>
|
|---|
| 307 | <title>Configuration Parameter Changes</title>
|
|---|
| 308 |
|
|---|
| 309 | <para>
|
|---|
| 310 | This section contains a brief listing of changes to &smb.conf; options since the Samba-2.2.x series up to and
|
|---|
| 311 | including Samba-3.0.25.
|
|---|
| 312 | </para>
|
|---|
| 313 |
|
|---|
| 314 | <para>
|
|---|
| 315 | Please refer to the smb.conf(5) man page for complete descriptions of new or modified
|
|---|
| 316 | parameters.
|
|---|
| 317 | </para>
|
|---|
| 318 |
|
|---|
| 319 | <para>
|
|---|
| 320 | Whenever a Samba update or upgrade is performed it is highly recommended to read the file called
|
|---|
| 321 | <emphasis>WHATSNEW.txt</emphasis> that is part of the Samba distribution tarball. This file may also
|
|---|
| 322 | be obtain on-line from the Samba <ulink url="http://www.samba.org/samba/">web site</ulink>, in
|
|---|
| 323 | the right column, under Current Stable Release, by clicking on <emphasis>Release Notes</emphasis>.
|
|---|
| 324 | </para>
|
|---|
| 325 |
|
|---|
| 326 | </sect3>
|
|---|
| 327 |
|
|---|
| 328 | <sect3>
|
|---|
| 329 | <title>Removed Parameters</title>
|
|---|
| 330 |
|
|---|
| 331 | <indexterm><primary>deleted parameters</primary></indexterm>
|
|---|
| 332 | <para>
|
|---|
| 333 | In alphabetical order, these are the parameters eliminated from Samba-2.2.x through 3.0.25.
|
|---|
| 334 | </para>
|
|---|
| 335 |
|
|---|
| 336 | <itemizedlist>
|
|---|
| 337 | <listitem><para>admin log</para></listitem>
|
|---|
| 338 | <listitem><para>alternate permissions</para></listitem>
|
|---|
| 339 | <listitem><para>character set</para></listitem>
|
|---|
| 340 | <listitem><para>client codepage</para></listitem>
|
|---|
| 341 | <listitem><para>code page directory</para></listitem>
|
|---|
| 342 | <listitem><para>coding system</para></listitem>
|
|---|
| 343 | <listitem><para>domain admin group</para></listitem>
|
|---|
| 344 | <listitem><para>domain guest group</para></listitem>
|
|---|
| 345 | <listitem><para>enable rid algorithm</para></listitem>
|
|---|
| 346 | <listitem><para>enable svcctl</para></listitem>
|
|---|
| 347 | <listitem><para>force unknown acl user</para></listitem>
|
|---|
| 348 | <listitem><para>hosts equiv</para></listitem>
|
|---|
| 349 | <listitem><para>ldap filter</para></listitem>
|
|---|
| 350 | <listitem><para>min password length</para></listitem>
|
|---|
| 351 | <listitem><para>nt smb support</para></listitem>
|
|---|
| 352 | <listitem><para>post script</para></listitem>
|
|---|
| 353 | <listitem><para>printer admin</para></listitem>
|
|---|
| 354 | <listitem><para>printer driver</para></listitem>
|
|---|
| 355 | <listitem><para>printer driver file</para></listitem>
|
|---|
| 356 | <listitem><para>printer driver location</para></listitem>
|
|---|
| 357 | <listitem><para>read size</para></listitem>
|
|---|
| 358 | <listitem><para>source environment</para></listitem>
|
|---|
| 359 | <listitem><para>status </para></listitem>
|
|---|
| 360 | <listitem><para>strip dot </para></listitem>
|
|---|
| 361 | <listitem><para>total print jobs</para></listitem>
|
|---|
| 362 | <listitem><para>unicode</para></listitem>
|
|---|
| 363 | <listitem><para>use rhosts</para></listitem>
|
|---|
| 364 | <listitem><para>valid chars</para></listitem>
|
|---|
| 365 | <listitem><para>vfs options</para></listitem>
|
|---|
| 366 | <listitem><para>winbind enable local accounts</para></listitem>
|
|---|
| 367 | <listitem><para>winbind max idle children</para></listitem>
|
|---|
| 368 | <listitem><para>wins partners</para></listitem>
|
|---|
| 369 | </itemizedlist>
|
|---|
| 370 |
|
|---|
| 371 | </sect3>
|
|---|
| 372 |
|
|---|
| 373 | <sect3>
|
|---|
| 374 | <title>New Parameters</title>
|
|---|
| 375 |
|
|---|
| 376 | <para>The following new parameters have been released up to and including Samba 3.0.25 (grouped by function:)</para>
|
|---|
| 377 |
|
|---|
| 378 | <para>Remote Management</para>
|
|---|
| 379 |
|
|---|
| 380 | <indexterm><primary>new parameters</primary></indexterm>
|
|---|
| 381 |
|
|---|
| 382 | <itemizedlist>
|
|---|
| 383 | <listitem><para>abort shutdown script</para></listitem>
|
|---|
| 384 | <listitem><para>shutdown script</para></listitem>
|
|---|
| 385 | </itemizedlist>
|
|---|
| 386 |
|
|---|
| 387 | <para>User and Group Account Management</para>
|
|---|
| 388 |
|
|---|
| 389 | <itemizedlist>
|
|---|
| 390 | <listitem><para>add group script</para></listitem>
|
|---|
| 391 | <listitem><para>add machine script</para></listitem>
|
|---|
| 392 | <listitem><para>add user to group script</para></listitem>
|
|---|
| 393 | <listitem><para>algorithmic rid base</para></listitem>
|
|---|
| 394 | <listitem><para>delete group script</para></listitem>
|
|---|
| 395 | <listitem><para>delete user from group script</para></listitem>
|
|---|
| 396 | <listitem><para>passdb backend</para></listitem>
|
|---|
| 397 | <listitem><para>rename user script</para></listitem>
|
|---|
| 398 | <listitem><para>set primary group script</para></listitem>
|
|---|
| 399 | <listitem><para>username map script</para></listitem>
|
|---|
| 400 | </itemizedlist>
|
|---|
| 401 |
|
|---|
| 402 | <para>Authentication</para>
|
|---|
| 403 |
|
|---|
| 404 | <itemizedlist>
|
|---|
| 405 | <listitem><para>auth methods</para></listitem>
|
|---|
| 406 | <listitem><para>ldap password sync</para></listitem>
|
|---|
| 407 | <listitem><para>passdb expand explicit</para></listitem>
|
|---|
| 408 | <listitem><para>realm</para></listitem>
|
|---|
| 409 | </itemizedlist>
|
|---|
| 410 |
|
|---|
| 411 | <para>Protocol Options</para>
|
|---|
| 412 |
|
|---|
| 413 | <itemizedlist>
|
|---|
| 414 | <listitem><para>add port command</para></listitem>
|
|---|
| 415 | <listitem><para>afs token lifetime</para></listitem>
|
|---|
| 416 | <listitem><para>client lanman auth</para></listitem>
|
|---|
| 417 | <listitem><para>client NTLMv2 auth</para></listitem>
|
|---|
| 418 | <listitem><para>client schannel</para></listitem>
|
|---|
| 419 | <listitem><para>client signing</para></listitem>
|
|---|
| 420 | <listitem><para>client use spnego</para></listitem>
|
|---|
| 421 | <listitem><para>defer sharing violations</para></listitem>
|
|---|
| 422 | <listitem><para>disable netbios</para></listitem>
|
|---|
| 423 | <listitem><para>dmapi support</para></listitem>
|
|---|
| 424 | <listitem><para>enable privileges</para></listitem>
|
|---|
| 425 | <listitem><para>use kerberos keytab</para></listitem>
|
|---|
| 426 | <listitem><para>log nt token command</para></listitem>
|
|---|
| 427 | <listitem><para>ntlm auth</para></listitem>
|
|---|
| 428 | <listitem><para>paranoid server security </para></listitem>
|
|---|
| 429 | <listitem><para>sendfile</para></listitem>
|
|---|
| 430 | <listitem><para>server schannel</para></listitem>
|
|---|
| 431 | <listitem><para>server signing</para></listitem>
|
|---|
| 432 | <listitem><para>smb ports</para></listitem>
|
|---|
| 433 | <listitem><para>svcctl list</para></listitem>
|
|---|
| 434 | <listitem><para>use spnego</para></listitem>
|
|---|
| 435 | </itemizedlist>
|
|---|
| 436 |
|
|---|
| 437 | <para>File Service</para>
|
|---|
| 438 |
|
|---|
| 439 | <itemizedlist>
|
|---|
| 440 | <listitem><para>allocation roundup size</para></listitem>
|
|---|
| 441 | <listitem><para>acl check permissions</para></listitem>
|
|---|
| 442 | <listitem><para>acl group control</para></listitem>
|
|---|
| 443 | <listitem><para>acl map full control</para></listitem>
|
|---|
| 444 | <listitem><para>aio read size</para></listitem>
|
|---|
| 445 | <listitem><para>aio write size</para></listitem>
|
|---|
| 446 | <listitem><para>dfree cache time</para></listitem>
|
|---|
| 447 | <listitem><para>dfree command</para></listitem>
|
|---|
| 448 | <listitem><para>ea support</para></listitem>
|
|---|
| 449 | <listitem><para>enable asu support</para></listitem>
|
|---|
| 450 | <listitem><para>fam change notify</para></listitem>
|
|---|
| 451 | <listitem><para>force unknown acl user</para></listitem>
|
|---|
| 452 | <listitem><para>get quota command</para></listitem>
|
|---|
| 453 | <listitem><para>hide special files</para></listitem>
|
|---|
| 454 | <listitem><para>hide unwriteable files</para></listitem>
|
|---|
| 455 | <listitem><para>inherit owner</para></listitem>
|
|---|
| 456 | <listitem><para>hostname lookups</para></listitem>
|
|---|
| 457 | <listitem><para>kernel change notify</para></listitem>
|
|---|
| 458 | <listitem><para>mangle prefix</para></listitem>
|
|---|
| 459 | <listitem><para>map acl inherit</para></listitem>
|
|---|
| 460 | <listitem><para>map read only</para></listitem>
|
|---|
| 461 | <listitem><para>max stat cache size</para></listitem>
|
|---|
| 462 | <listitem><para>msdfs proxy</para></listitem>
|
|---|
| 463 | <listitem><para>open files database hash size</para></listitem>
|
|---|
| 464 | <listitem><para>set quota command</para></listitem>
|
|---|
| 465 | <listitem><para>store dos attributes</para></listitem>
|
|---|
| 466 | <listitem><para>use sendfile</para></listitem>
|
|---|
| 467 | <listitem><para>usershare allow guests</para></listitem>
|
|---|
| 468 | <listitem><para>usershare max shares</para></listitem>
|
|---|
| 469 | <listitem><para>usershare owner only</para></listitem>
|
|---|
| 470 | <listitem><para>usershare path</para></listitem>
|
|---|
| 471 | <listitem><para>usershare prefix allow list</para></listitem>
|
|---|
| 472 | <listitem><para>usershare prefix deny list</para></listitem>
|
|---|
| 473 | <listitem><para>usershare template share</para></listitem>
|
|---|
| 474 | <listitem><para>vfs objects</para></listitem>
|
|---|
| 475 | </itemizedlist>
|
|---|
| 476 |
|
|---|
| 477 | <para>Printing</para>
|
|---|
| 478 |
|
|---|
| 479 | <itemizedlist>
|
|---|
| 480 | <listitem><para>cups options</para></listitem>
|
|---|
| 481 | <listitem><para>cups server</para></listitem>
|
|---|
| 482 | <listitem><para>force printername</para></listitem>
|
|---|
| 483 | <listitem><para>iprint server</para></listitem>
|
|---|
| 484 | <listitem><para>max reported print jobs</para></listitem>
|
|---|
| 485 | <listitem><para>printcap cache time</para></listitem>
|
|---|
| 486 | </itemizedlist>
|
|---|
| 487 |
|
|---|
| 488 |
|
|---|
| 489 | <para>Unicode and Character Sets</para>
|
|---|
| 490 |
|
|---|
| 491 | <itemizedlist>
|
|---|
| 492 | <listitem><para>display charset</para></listitem>
|
|---|
| 493 | <listitem><para>dos charset</para></listitem>
|
|---|
| 494 | <listitem><para>UNIX charset</para></listitem>
|
|---|
| 495 | </itemizedlist>
|
|---|
| 496 |
|
|---|
| 497 | <para>SID to UID/GID Mappings</para>
|
|---|
| 498 |
|
|---|
| 499 | <itemizedlist>
|
|---|
| 500 | <listitem><para>idmap backend</para></listitem>
|
|---|
| 501 | <listitem><para>idmap gid</para></listitem>
|
|---|
| 502 | <listitem><para>idmap uid</para></listitem>
|
|---|
| 503 | <listitem><para>username map script</para></listitem>
|
|---|
| 504 | <listitem><para>winbind nss info</para></listitem>
|
|---|
| 505 | <listitem><para>winbind offline logon</para></listitem>
|
|---|
| 506 | <listitem><para>winbind refresh tickets</para></listitem>
|
|---|
| 507 | <listitem><para>winbind trusted domains only</para></listitem>
|
|---|
| 508 | <listitem><para>template primary group</para></listitem>
|
|---|
| 509 | </itemizedlist>
|
|---|
| 510 |
|
|---|
| 511 | <para>LDAP</para>
|
|---|
| 512 |
|
|---|
| 513 | <itemizedlist>
|
|---|
| 514 | <listitem><para>ldap delete dn</para></listitem>
|
|---|
| 515 | <listitem><para>ldap group suffix</para></listitem>
|
|---|
| 516 | <listitem><para>ldap idmap suffix</para></listitem>
|
|---|
| 517 | <listitem><para>ldap machine suffix</para></listitem>
|
|---|
| 518 | <listitem><para>ldap passwd sync</para></listitem>
|
|---|
| 519 | <listitem><para>ldap replication sleep</para></listitem>
|
|---|
| 520 | <listitem><para>ldap timeout</para></listitem>
|
|---|
| 521 | <listitem><para>ldap user suffix</para></listitem>
|
|---|
| 522 | </itemizedlist>
|
|---|
| 523 |
|
|---|
| 524 | <para>General Configuration</para>
|
|---|
| 525 |
|
|---|
| 526 | <itemizedlist>
|
|---|
| 527 | <listitem><para>eventlog list</para></listitem>
|
|---|
| 528 | <listitem><para>preload modules</para></listitem>
|
|---|
| 529 | <listitem><para>reset on zero vc</para></listitem>
|
|---|
| 530 | <listitem><para>privatedir</para></listitem>
|
|---|
| 531 | </itemizedlist>
|
|---|
| 532 |
|
|---|
| 533 | </sect3>
|
|---|
| 534 |
|
|---|
| 535 | <sect3>
|
|---|
| 536 | <title>Modified Parameters (Changes in Behavior)</title>
|
|---|
| 537 |
|
|---|
| 538 | <itemizedlist>
|
|---|
| 539 | <listitem><para>acl group control (new default is No, deprecated parameter)</para></listitem>
|
|---|
| 540 | <listitem><para>change notify timeout (scope changed)</para></listitem>
|
|---|
| 541 | <listitem><para>dos filemode (disabled by default)</para></listitem>
|
|---|
| 542 | <listitem><para>dos filetimes (enabled by default)</para></listitem>
|
|---|
| 543 | <listitem><para>enable asu support (disabled by default)</para></listitem>
|
|---|
| 544 | <listitem><para>enable privileges (enabled by default)</para></listitem>
|
|---|
| 545 | <listitem><para>encrypt passwords (enabled by default) </para></listitem>
|
|---|
| 546 | <listitem><para>host msdfs (enabled by default)</para></listitem>
|
|---|
| 547 | <listitem><para>mangling method (set to hash2 by default) </para></listitem>
|
|---|
| 548 | <listitem><para>map to guest</para></listitem>
|
|---|
| 549 | <listitem><para>only user (deprecated)</para></listitem>
|
|---|
| 550 | <listitem><para>passwd chat</para></listitem>
|
|---|
| 551 | <listitem><para>passwd program</para></listitem>
|
|---|
| 552 | <listitem><para>password server</para></listitem>
|
|---|
| 553 | <listitem><para>restrict anonymous (integer value)</para></listitem>
|
|---|
| 554 | <listitem><para>security (new ads value)</para></listitem>
|
|---|
| 555 | <listitem><para>strict locking (auto by default)</para></listitem>
|
|---|
| 556 | <listitem><para>winbind cache time (increased to 5 minutes)</para></listitem>
|
|---|
| 557 | <listitem><para>winbind enum groups (disabled by default)</para></listitem>
|
|---|
| 558 | <listitem><para>winbind enum users (disabled by default)</para></listitem>
|
|---|
| 559 | <listitem><para>winbind nested groups (enabled by default)</para></listitem>
|
|---|
| 560 | <listitem><para>winbind uid (deprecated in favor of idmap uid)</para></listitem>
|
|---|
| 561 | <listitem><para>winbind gid (deprecated in favor of idmap gid)</para></listitem>
|
|---|
| 562 | <listitem><para>winbindd nss info</para></listitem>
|
|---|
| 563 | <listitem><para>write cache (deprecated)</para></listitem>
|
|---|
| 564 | </itemizedlist>
|
|---|
| 565 |
|
|---|
| 566 | </sect3>
|
|---|
| 567 |
|
|---|
| 568 | </sect2>
|
|---|
| 569 |
|
|---|
| 570 | <sect2>
|
|---|
| 571 | <title>New Functionality</title>
|
|---|
| 572 |
|
|---|
| 573 | <para>
|
|---|
| 574 | <indexterm><primary>major changes</primary></indexterm>
|
|---|
| 575 | The major changes in behavior since that Samba-2.2.x series are documented in this section.
|
|---|
| 576 | Please refer to the <filename>WHATSNEW.txt</filename> file that ships with every release of
|
|---|
| 577 | Samba to obtain detailed information regarding the changes that have been made during the
|
|---|
| 578 | life of the current Samba release.
|
|---|
| 579 | </para>
|
|---|
| 580 |
|
|---|
| 581 | <sect3>
|
|---|
| 582 | <title>TDB Data Files</title>
|
|---|
| 583 |
|
|---|
| 584 | <indexterm><primary>tdb data files</primary></indexterm>
|
|---|
| 585 | <para>
|
|---|
| 586 | Refer to <link linkend="install">Installation, Chapter 1</link>, <link linkend="tdbdocs">Chapter 1</link>
|
|---|
| 587 | for information pertaining to the Samba-3 data files, their location and the information that must be
|
|---|
| 588 | preserved across server migrations, updates and upgrades.
|
|---|
| 589 | </para>
|
|---|
| 590 |
|
|---|
| 591 | <para>
|
|---|
| 592 | <indexterm><primary>tdb file backup</primary></indexterm>
|
|---|
| 593 | Please remember to back up your existing ${lock directory}/*tdb before upgrading to Samba-3. If necessary,
|
|---|
| 594 | Samba will upgrade databases as they are opened. Downgrading from Samba-3 to 2.2, or reversion to an earlier
|
|---|
| 595 | version of Samba-3 from a later release, is an unsupported path.
|
|---|
| 596 | </para>
|
|---|
| 597 |
|
|---|
| 598 | <para>
|
|---|
| 599 | <indexterm><primary>tdb file descriptions</primary></indexterm>
|
|---|
| 600 | The old Samba-2.2.x tdb files are described in <link linkend="oldtdbfiledesc">the next table</link>.
|
|---|
| 601 | </para>
|
|---|
| 602 |
|
|---|
| 603 |
|
|---|
| 604 | <table frame='all' id="oldtdbfiledesc"><title>Samba-2.2.x TDB File Descriptions</title>
|
|---|
| 605 | <tgroup cols='3'>
|
|---|
| 606 | <colspec align="left"/>
|
|---|
| 607 | <colspec align="justify" colwidth="1*"/>
|
|---|
| 608 | <colspec align="left"/>
|
|---|
| 609 | <thead>
|
|---|
| 610 | <row>
|
|---|
| 611 | <entry align="left">Name</entry>
|
|---|
| 612 | <entry align="justify">Description</entry>
|
|---|
| 613 | <entry align="center">Backup?</entry>
|
|---|
| 614 | </row>
|
|---|
| 615 | </thead>
|
|---|
| 616 | <tbody>
|
|---|
| 617 | <row>
|
|---|
| 618 | <entry>account_policy</entry>
|
|---|
| 619 | <entry>User policy settings</entry>
|
|---|
| 620 | <entry>yes</entry>
|
|---|
| 621 | </row>
|
|---|
| 622 | <row>
|
|---|
| 623 | <entry>brlock</entry>
|
|---|
| 624 | <entry>Byte-range file locking information.</entry>
|
|---|
| 625 | <entry>no</entry>
|
|---|
| 626 | </row>
|
|---|
| 627 | <row>
|
|---|
| 628 | <entry>connections</entry>
|
|---|
| 629 | <entry><para>Client connection information</para></entry>
|
|---|
| 630 | <entry>no</entry>
|
|---|
| 631 | </row>
|
|---|
| 632 | <row>
|
|---|
| 633 | <entry>locking</entry>
|
|---|
| 634 | <entry>Temporary file locking data.</entry>
|
|---|
| 635 | <entry>no</entry>
|
|---|
| 636 | </row>
|
|---|
| 637 | <row>
|
|---|
| 638 | <entry>messages</entry>
|
|---|
| 639 | <entry><para>Temporary storage of messages being processed by smbd.</para></entry>
|
|---|
| 640 | <entry>no</entry>
|
|---|
| 641 | </row>
|
|---|
| 642 | <row>
|
|---|
| 643 | <entry>ntdrivers</entry>
|
|---|
| 644 | <entry><para>Stores per-printer driver information.</para></entry>
|
|---|
| 645 | <entry>yes</entry>
|
|---|
| 646 | </row>
|
|---|
| 647 | <row>
|
|---|
| 648 | <entry>ntforms</entry>
|
|---|
| 649 | <entry><para>Stores per-printer forms information.</para></entry>
|
|---|
| 650 | <entry>yes</entry>
|
|---|
| 651 | </row>
|
|---|
| 652 | <row>
|
|---|
| 653 | <entry>ntprinters</entry>
|
|---|
| 654 | <entry><para>Stores the per-printer devmode configuration settings.</para></entry>
|
|---|
| 655 | <entry>yes</entry>
|
|---|
| 656 | </row>
|
|---|
| 657 | <row>
|
|---|
| 658 | <entry>printing/*.tdb</entry>
|
|---|
| 659 | <entry><para>Cached output from lpq command created on a per-print-service basis.</para></entry>
|
|---|
| 660 | <entry>no</entry>
|
|---|
| 661 | </row>
|
|---|
| 662 | <row>
|
|---|
| 663 |
|
|---|
| 664 | <entry>registry</entry>
|
|---|
| 665 | <entry><para>Read-only Samba registry skeleton that provides support for
|
|---|
| 666 | exporting various database tables via the winreg RPCs.</para></entry>
|
|---|
| 667 | <entry>no</entry>
|
|---|
| 668 | </row>
|
|---|
| 669 | <row>
|
|---|
| 670 | <entry>sessionid</entry>
|
|---|
| 671 | <entry><para>Temporary cache for miscellaneous session information.</para></entry>
|
|---|
| 672 | <entry>no</entry>
|
|---|
| 673 | </row>
|
|---|
| 674 | <row>
|
|---|
| 675 | <entry>share_info</entry>
|
|---|
| 676 | <entry>Share ACL settings.</entry>
|
|---|
| 677 | <entry>yes</entry>
|
|---|
| 678 | </row>
|
|---|
| 679 | <row>
|
|---|
| 680 |
|
|---|
| 681 | <entry>unexpected</entry>
|
|---|
| 682 | <entry><para>Packets received for which no process was listening.</para></entry>
|
|---|
| 683 | <entry>no</entry>
|
|---|
| 684 | </row>
|
|---|
| 685 | <row>
|
|---|
| 686 | <entry>winbindd_cache</entry>
|
|---|
| 687 | <entry><para>Cache of identity information received from an NT4 or an ADS domain.</para></entry>
|
|---|
| 688 | <entry>yes</entry>
|
|---|
| 689 | </row>
|
|---|
| 690 | <row>
|
|---|
| 691 | <entry>winbindd_idmap</entry>
|
|---|
| 692 | <entry><para>New ID map table from SIDS to UNIX UIDs/GIDs.</para></entry>
|
|---|
| 693 | <entry>yes</entry>
|
|---|
| 694 | </row>
|
|---|
| 695 | </tbody>
|
|---|
| 696 | </tgroup>
|
|---|
| 697 | </table>
|
|---|
| 698 |
|
|---|
| 699 | </sect3>
|
|---|
| 700 |
|
|---|
| 701 | <sect3>
|
|---|
| 702 | <title>Changes in Behavior</title>
|
|---|
| 703 |
|
|---|
| 704 | <para>
|
|---|
| 705 | The following issues are known changes in behavior between Samba-2.2 and
|
|---|
| 706 | Samba-3 that may affect certain installations of Samba.
|
|---|
| 707 | </para>
|
|---|
| 708 |
|
|---|
| 709 | <orderedlist>
|
|---|
| 710 | <listitem><para>
|
|---|
| 711 | <indexterm><primary>Windows domain</primary></indexterm>
|
|---|
| 712 | <indexterm><primary>getpwnam() call</primary></indexterm>
|
|---|
| 713 | <indexterm><primary>NT_STATUS_LOGON_FAILURE</primary></indexterm>
|
|---|
| 714 | When operating as a member of a Windows domain, Samba-2.2 would map any users authenticated by the remote DC
|
|---|
| 715 | to the <quote>guest account</quote> if a UID could not be obtained via the getpwnam() call. Samba-3 rejects
|
|---|
| 716 | the connection with the error message <quote>NT_STATUS_LOGON_FAILURE.</quote> There is no current workaround
|
|---|
| 717 | to re-establish the Samba-2.2 behavior.
|
|---|
| 718 | </para></listitem>
|
|---|
| 719 |
|
|---|
| 720 | <listitem><para>
|
|---|
| 721 | <indexterm><primary>add user script</primary></indexterm>
|
|---|
| 722 | <indexterm><primary>add machine script</primary></indexterm>
|
|---|
| 723 | When adding machines to a Samba-2.2 controlled domain, the
|
|---|
| 724 | <quote>add user script</quote> was used to create the UNIX identity of the
|
|---|
| 725 | machine trust account. Samba-3 introduces a new <quote>add machine
|
|---|
| 726 | script</quote> that must be specified for this purpose. Samba-3 will
|
|---|
| 727 | not fall back to using the <quote>add user script</quote> in the absence of
|
|---|
| 728 | an <quote>add machine script</quote>.
|
|---|
| 729 | </para></listitem>
|
|---|
| 730 | </orderedlist>
|
|---|
| 731 |
|
|---|
| 732 | </sect3>
|
|---|
| 733 |
|
|---|
| 734 | <sect3>
|
|---|
| 735 | <title>Passdb Backends and Authentication</title>
|
|---|
| 736 |
|
|---|
| 737 | <para>
|
|---|
| 738 | There have been a few new changes that Samba administrators should be
|
|---|
| 739 | aware of when moving to Samba-3.
|
|---|
| 740 | </para>
|
|---|
| 741 |
|
|---|
| 742 | <orderedlist>
|
|---|
| 743 | <listitem><para>
|
|---|
| 744 | <indexterm><primary>encrypted passwords</primary></indexterm>
|
|---|
| 745 | Encrypted passwords have been enabled by default in order to
|
|---|
| 746 | interoperate better with out-of-the-box Windows client
|
|---|
| 747 | installations. This does mean that either (a) a Samba account
|
|---|
| 748 | must be created for each user, or (b) <quote>encrypt passwords = no</quote>
|
|---|
| 749 | must be explicitly defined in &smb.conf;.
|
|---|
| 750 | </para></listitem>
|
|---|
| 751 |
|
|---|
| 752 | <listitem><para>
|
|---|
| 753 | <indexterm><primary>ADS</primary></indexterm>
|
|---|
| 754 | <indexterm><primary>Kerberos</primary></indexterm>
|
|---|
| 755 | <indexterm><primary>LDAP</primary></indexterm>
|
|---|
| 756 | Inclusion of new <smbconfoption name="security">ads</smbconfoption> option for integration
|
|---|
| 757 | with an Active Directory domain using the native Windows Kerberos 5 and LDAP protocols.
|
|---|
| 758 | </para></listitem>
|
|---|
| 759 | </orderedlist>
|
|---|
| 760 |
|
|---|
| 761 | <para>
|
|---|
| 762 | <indexterm><primary>account storage backends</primary></indexterm>
|
|---|
| 763 | Samba-3 also includes the possibility of setting up chains of authentication methods (<smbconfoption
|
|---|
| 764 | name="auth methods"/>) and account storage backends (<smbconfoption name="passdb backend"/>). Please refer to
|
|---|
| 765 | the &smb.conf; man page and <link linkend="passdb">Account Information Databases</link>, for
|
|---|
| 766 | details. While both parameters assume sane default values, it is likely that you will need to understand what
|
|---|
| 767 | the values actually mean in order to ensure Samba operates correctly.
|
|---|
| 768 | </para>
|
|---|
| 769 |
|
|---|
| 770 | <para>
|
|---|
| 771 | <indexterm><primary>pdbedit</primary></indexterm>
|
|---|
| 772 | <indexterm><primary>smbpasswd</primary></indexterm>
|
|---|
| 773 | <indexterm><primary>net tool</primary></indexterm>
|
|---|
| 774 | Certain functions of the <command>smbpasswd</command> tool have been split between the
|
|---|
| 775 | new <command>smbpasswd</command> utility, the <command>net</command> tool, and the new <command>pdbedit</command>
|
|---|
| 776 | utility. See the respective man pages for details.
|
|---|
| 777 | </para>
|
|---|
| 778 |
|
|---|
| 779 | </sect3>
|
|---|
| 780 |
|
|---|
| 781 | <sect3>
|
|---|
| 782 | <title>LDAP</title>
|
|---|
| 783 |
|
|---|
| 784 | <para>
|
|---|
| 785 | This section outlines the new features effecting Samba/LDAP integration.
|
|---|
| 786 | </para>
|
|---|
| 787 |
|
|---|
| 788 | <sect4>
|
|---|
| 789 | <title>New Schema</title>
|
|---|
| 790 |
|
|---|
| 791 | <para>
|
|---|
| 792 | <indexterm><primary>object class</primary></indexterm>
|
|---|
| 793 | <indexterm><primary>sambaSamAccount</primary></indexterm>
|
|---|
| 794 | <indexterm><primary>LDIF</primary></indexterm>
|
|---|
| 795 | <indexterm><primary>attributes</primary></indexterm>
|
|---|
| 796 | A new object class (sambaSamAccount) has been introduced to replace
|
|---|
| 797 | the old sambaAccount. This change aids in the renaming of attributes
|
|---|
| 798 | to prevent clashes with attributes from other vendors. There is a
|
|---|
| 799 | conversion script (examples/LDAP/convertSambaAccount) to modify an LDIF
|
|---|
| 800 | file to the new schema.
|
|---|
| 801 | </para>
|
|---|
| 802 |
|
|---|
| 803 | <para>
|
|---|
| 804 | Example:
|
|---|
| 805 | <indexterm><primary>ldapsearch</primary></indexterm>
|
|---|
| 806 | </para>
|
|---|
| 807 | <para><screen>
|
|---|
| 808 | &prompt;ldapsearch .... -LLL -b "ou=people,dc=..." > old.ldif
|
|---|
| 809 | &prompt;convertSambaAccount --sid <DOM SID> --input old.ldif --output new.ldif
|
|---|
| 810 | </screen></para>
|
|---|
| 811 |
|
|---|
| 812 | <para>
|
|---|
| 813 | <indexterm><primary>net</primary><secondary>getlocalsid</secondary></indexterm>
|
|---|
| 814 | The <DOM SID> can be obtained by running
|
|---|
| 815 | <screen>
|
|---|
| 816 | &prompt;<userinput>net getlocalsid <DOMAINNAME></userinput>
|
|---|
| 817 | </screen>
|
|---|
| 818 | <indexterm><primary>PDC</primary></indexterm>
|
|---|
| 819 | on the Samba PDC as root.
|
|---|
| 820 | </para>
|
|---|
| 821 |
|
|---|
| 822 | <para>
|
|---|
| 823 | Under Samba-2.x the domain SID can be obtained by executing:
|
|---|
| 824 | <indexterm><primary>smbpasswd</primary></indexterm>
|
|---|
| 825 | <screen>
|
|---|
| 826 | &prompt;<userinput>smbpasswd -S <DOMAINNAME></userinput>
|
|---|
| 827 | </screen>
|
|---|
| 828 | </para>
|
|---|
| 829 |
|
|---|
| 830 | <para>
|
|---|
| 831 | <indexterm><primary>old sambaAccount</primary></indexterm>
|
|---|
| 832 | <indexterm><primary>ldapsam_compat</primary></indexterm>
|
|---|
| 833 | <indexterm><primary>object class declaration</primary></indexterm>
|
|---|
| 834 | <indexterm><primary>samba.schema</primary></indexterm>
|
|---|
| 835 | The old <literal>sambaAccount</literal> schema may still be used by specifying the
|
|---|
| 836 | <parameter>ldapsam_compat</parameter> passdb backend. However, the sambaAccount and
|
|---|
| 837 | associated attributes have been moved to the historical section of
|
|---|
| 838 | the schema file and must be uncommented before use if needed.
|
|---|
| 839 | The Samba-2.2 object class declaration for a <literal>sambaAccount</literal> has not changed
|
|---|
| 840 | in the Samba-3 <filename>samba.schema</filename> file.
|
|---|
| 841 | </para>
|
|---|
| 842 |
|
|---|
| 843 | <para>
|
|---|
| 844 | Other new object classes and their uses include:
|
|---|
| 845 | </para>
|
|---|
| 846 |
|
|---|
| 847 | <itemizedlist>
|
|---|
| 848 | <listitem><para>
|
|---|
| 849 | <indexterm><primary>sambaDomain</primary></indexterm>
|
|---|
| 850 | <indexterm><primary>domain information</primary></indexterm>
|
|---|
| 851 | <indexterm><primary>RID</primary></indexterm>
|
|---|
| 852 | <indexterm><primary>ldap suffix</primary></indexterm>
|
|---|
| 853 | <indexterm><primary>ldapsam</primary></indexterm>
|
|---|
| 854 | <indexterm><primary>idmap</primary></indexterm>
|
|---|
| 855 | <literal>sambaDomain</literal> &smbmdash; domain information used to allocate RIDs
|
|---|
| 856 | for users and groups as necessary. The attributes are added
|
|---|
| 857 | in <quote>ldap suffix</quote> directory entry automatically if
|
|---|
| 858 | an idmap UID/GID range has been set and the <quote>ldapsam</quote>
|
|---|
| 859 | passdb backend has been selected.
|
|---|
| 860 | </para></listitem>
|
|---|
| 861 |
|
|---|
| 862 | <listitem><para>
|
|---|
| 863 | <indexterm><primary>sambaGroupMapping</primary></indexterm>
|
|---|
| 864 | <indexterm><primary>ldap group suffix</primary></indexterm>
|
|---|
| 865 | <indexterm><primary>net groupmap</primary></indexterm>
|
|---|
| 866 | sambaGroupMapping &smbmdash; an object representing the
|
|---|
| 867 | relationship between a posixGroup and a Windows
|
|---|
| 868 | group/SID. These entries are stored in the <quote>ldap
|
|---|
| 869 | group suffix</quote> and managed by the <quote>net groupmap</quote> command.
|
|---|
| 870 | </para></listitem>
|
|---|
| 871 |
|
|---|
| 872 | <listitem><para>
|
|---|
| 873 | <indexterm><primary>sambaUNIXIdPool</primary></indexterm>
|
|---|
| 874 | <indexterm><primary>ldap idmap suffix</primary></indexterm>
|
|---|
| 875 | <indexterm><primary>idmap UID</primary></indexterm>
|
|---|
| 876 | <indexterm><primary>idmap GID</primary></indexterm>
|
|---|
| 877 | <literal>sambaUNIXIdPool</literal> &smbmdash; created in the <quote>ldap idmap suffix</quote> entry
|
|---|
| 878 | automatically and contains the next available <quote>idmap UID</quote> and
|
|---|
| 879 | <quote>idmap GID</quote>.
|
|---|
| 880 | </para></listitem>
|
|---|
| 881 |
|
|---|
| 882 | <listitem><para>
|
|---|
| 883 | <indexterm><primary>sambaIdmapEntry</primary></indexterm>
|
|---|
| 884 | <indexterm><primary>idmap_ldap module</primary></indexterm>
|
|---|
| 885 | <literal>sambaIdmapEntry</literal> &smbmdash; object storing a mapping between a
|
|---|
| 886 | SID and a UNIX UID/GID. These objects are created by the
|
|---|
| 887 | idmap_ldap module as needed.
|
|---|
| 888 | </para></listitem>
|
|---|
| 889 | </itemizedlist>
|
|---|
| 890 |
|
|---|
| 891 | </sect4>
|
|---|
| 892 |
|
|---|
| 893 | <sect4>
|
|---|
| 894 | <title>New Suffix for Searching</title>
|
|---|
| 895 |
|
|---|
| 896 | <para>
|
|---|
| 897 | <indexterm><primary>LDAP queries</primary></indexterm>
|
|---|
| 898 | <indexterm><primary>passdb backend</primary></indexterm>
|
|---|
| 899 | <indexterm><primary>ldap suffix</primary></indexterm>
|
|---|
| 900 | <indexterm><primary>ldap user suffix</primary></indexterm>
|
|---|
| 901 | <indexterm><primary>ldap machine suffix</primary></indexterm>
|
|---|
| 902 | <indexterm><primary>ldap group suffix</primary></indexterm>
|
|---|
| 903 | <indexterm><primary>ldap idmap suffix</primary></indexterm>
|
|---|
| 904 | The following new &smb.conf; parameters have been added to aid in directing
|
|---|
| 905 | certain LDAP queries when <parameter>passdb backend = ldapsam://...</parameter> has been
|
|---|
| 906 | specified.
|
|---|
| 907 | </para>
|
|---|
| 908 |
|
|---|
| 909 | <itemizedlist>
|
|---|
| 910 | <listitem><para>ldap suffix &smbmdash; used to search for user and computer accounts.</para></listitem>
|
|---|
| 911 | <listitem><para>ldap user suffix &smbmdash; used to store user accounts.</para></listitem>
|
|---|
| 912 | <listitem><para>ldap machine suffix &smbmdash; used to store machine trust accounts.</para></listitem>
|
|---|
| 913 | <listitem><para>ldap group suffix &smbmdash; location of posixGroup/sambaGroupMapping entries.</para></listitem>
|
|---|
| 914 | <listitem><para>ldap idmap suffix &smbmdash; location of sambaIdmapEntry objects.</para></listitem>
|
|---|
| 915 | </itemizedlist>
|
|---|
| 916 |
|
|---|
| 917 | <para>
|
|---|
| 918 | <indexterm><primary>ldap suffix</primary></indexterm>
|
|---|
| 919 | <indexterm><primary>subsuffix parameters</primary></indexterm>
|
|---|
| 920 | If an <parameter>ldap suffix</parameter> is defined, it will be appended to all of the
|
|---|
| 921 | remaining subsuffix parameters. In this case, the order of the suffix
|
|---|
| 922 | listings in &smb.conf; is important. Always place the <parameter>ldap suffix</parameter> first
|
|---|
| 923 | in the list.
|
|---|
| 924 | </para>
|
|---|
| 925 |
|
|---|
| 926 | <para>
|
|---|
| 927 | Due to a limitation in Samba's &smb.conf; parsing, you should not surround
|
|---|
| 928 | the domain names with quotation marks.
|
|---|
| 929 | </para>
|
|---|
| 930 |
|
|---|
| 931 | </sect4>
|
|---|
| 932 |
|
|---|
| 933 | <sect4>
|
|---|
| 934 | <title>IdMap LDAP Support</title>
|
|---|
| 935 |
|
|---|
| 936 | <para>
|
|---|
| 937 | <indexterm><primary>idmap backend</primary></indexterm>
|
|---|
| 938 | Samba-3 supports an LDAP backend for the idmap subsystem. The
|
|---|
| 939 | following options inform Samba that the idmap table should be
|
|---|
| 940 | stored on the directory server <emphasis>onterose</emphasis> in the ou=Idmap,dc=quenya,dc=org partition.
|
|---|
| 941 | </para>
|
|---|
| 942 |
|
|---|
| 943 | <smbconfblock>
|
|---|
| 944 | <smbconfsection name="[global]"/>
|
|---|
| 945 | <member>...</member>
|
|---|
| 946 | <smbconfoption name="idmap backend">ldap:ldap://onterose/</smbconfoption>
|
|---|
| 947 | <smbconfoption name="ldap idmap suffix">ou=Idmap</smbconfoption>
|
|---|
| 948 | <smbconfoption name="idmap uid">40000-50000</smbconfoption>
|
|---|
| 949 | <smbconfoption name="idmap gid">40000-50000</smbconfoption>
|
|---|
| 950 | </smbconfblock>
|
|---|
| 951 |
|
|---|
| 952 | <para>
|
|---|
| 953 | <indexterm><primary>NFS</primary></indexterm>
|
|---|
| 954 | This configuration allows Winbind installations on multiple servers to
|
|---|
| 955 | share a UID/GID number space, thus avoiding the interoperability problems
|
|---|
| 956 | with NFS that were present in Samba-2.2.
|
|---|
| 957 | </para>
|
|---|
| 958 |
|
|---|
| 959 | </sect4>
|
|---|
| 960 |
|
|---|
| 961 | </sect3>
|
|---|
| 962 |
|
|---|
| 963 | </sect2>
|
|---|
| 964 |
|
|---|
| 965 | </sect1>
|
|---|
| 966 |
|
|---|
| 967 | </chapter>
|
|---|
