| 1 | <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 2. Fast Start: Cure for Impatience</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="The Official Samba-3 HOWTO and Reference Guide"><link rel="up" href="introduction.html" title="Part I. General Installation"><link rel="prev" href="install.html" title="Chapter 1. How to Install and Test SAMBA"><link rel="next" href="type.html" title="Part II. Server Configuration Basics"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 2. Fast Start: Cure for Impatience</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="install.html">Prev</a> </td><th width="60%" align="center">Part I. General Installation</th><td width="20%" align="right"> <a accesskey="n" href="type.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="FastStart"></a>Chapter 2. Fast Start: Cure for Impatience</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="FastStart.html#id320338">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="FastStart.html#id320357">Description of Example Sites</a></span></dt><dt><span class="sect1"><a href="FastStart.html#id320424">Worked Examples</a></span></dt><dd><dl><dt><span class="sect2"><a href="FastStart.html#id320439">Standalone Server</a></span></dt><dt><span class="sect2"><a href="FastStart.html#id322292">Domain Member Server</a></span></dt><dt><span class="sect2"><a href="FastStart.html#id323205">Domain Controller</a></span></dt></dl></dd></dl></div><p>
|
|---|
| 2 | When we first asked for suggestions for inclusion in the Samba HOWTO documentation,
|
|---|
| 3 | someone wrote asking for example configurations and lots of them. That is remarkably
|
|---|
| 4 | difficult to do without losing a lot of value that can be derived from presenting
|
|---|
| 5 | many extracts from working systems. That is what the rest of this document does.
|
|---|
| 6 | It does so with extensive descriptions of the configuration possibilities within the
|
|---|
| 7 | context of the chapter that covers it. We hope that this chapter is the medicine
|
|---|
| 8 | that has been requested.
|
|---|
| 9 | </p><p>
|
|---|
| 10 | The information in this chapter is very sparse compared with the book “<span class="quote">Samba-3 by Example</span>”
|
|---|
| 11 | that was written after the original version of this book was nearly complete. “<span class="quote">Samba-3 by Example</span>”
|
|---|
| 12 | was the result of feedback from reviewers during the final copy editing of the first edition. It
|
|---|
| 13 | was interesting to see that reader feedback mirrored that given by the original reviewers.
|
|---|
| 14 | In any case, a month and a half was spent in doing basic research to better understand what
|
|---|
| 15 | new as well as experienced network administrators would best benefit from. The book “<span class="quote">Samba-3 by Example</span>”
|
|---|
| 16 | is the result of that research. What is presented in the few pages of this book is covered
|
|---|
| 17 | far more comprehensively in the second edition of “<span class="quote">Samba-3 by Example</span>”. The second edition
|
|---|
| 18 | of both books will be released at the same time.
|
|---|
| 19 | </p><p>
|
|---|
| 20 | So in summary, the book “<span class="quote">The Official Samba-3 HOWTO & Reference Guide</span>” is intended
|
|---|
| 21 | as the equivalent of an auto mechanic's repair guide. The book “<span class="quote">Samba-3 by Example</span>” is the
|
|---|
| 22 | equivalent of the driver's guide that explains how to drive the car. If you want complete network
|
|---|
| 23 | configuration examples, go to <a href="http://www.samba.org/samba/docs/Samba3-ByExample.pdf" target="_top">Samba-3 by
|
|---|
| 24 | Example</a>.
|
|---|
| 25 | </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id320338"></a>Features and Benefits</h2></div></div></div><p>
|
|---|
| 26 | Samba needs very little configuration to create a basic working system.
|
|---|
| 27 | In this chapter we progress from the simple to the complex, for each providing
|
|---|
| 28 | all steps and configuration file changes needed to make each work. Please note
|
|---|
| 29 | that a comprehensively configured system will likely employ additional smart
|
|---|
| 30 | features. These additional features are covered in the remainder of this document.
|
|---|
| 31 | </p><p>
|
|---|
| 32 | The examples used here have been obtained from a number of people who made
|
|---|
| 33 | requests for example configurations. All identities have been obscured to protect
|
|---|
| 34 | the guilty, and any resemblance to unreal nonexistent sites is deliberate.
|
|---|
| 35 | </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id320357"></a>Description of Example Sites</h2></div></div></div><p>
|
|---|
| 36 | In the first set of configuration examples we consider the case of exceptionally simple system requirements.
|
|---|
| 37 | There is a real temptation to make something that should require little effort much too complex.
|
|---|
| 38 | </p><p>
|
|---|
| 39 | <a href="FastStart.html#anon-ro" title="Anonymous Read-Only Document Server">???</a> documents the type of server that might be sufficient to serve CD-ROM images,
|
|---|
| 40 | or reference document files for network client use. This configuration is also discussed in <a href="StandAloneServer.html" title="Chapter 7. Standalone Servers">???</a>, <a href="StandAloneServer.html#RefDocServer" title="Reference Documentation Server">???</a>. The purpose for this configuration
|
|---|
| 41 | is to provide a shared volume that is read-only that anyone, even guests, can access.
|
|---|
| 42 | </p><p>
|
|---|
| 43 | The second example shows a minimal configuration for a print server that anyone can print to as long as they
|
|---|
| 44 | have the correct printer drivers installed on their computer. This is a mirror of the system described in
|
|---|
| 45 | <a href="StandAloneServer.html" title="Chapter 7. Standalone Servers">???</a>, <a href="StandAloneServer.html#SimplePrintServer" title="Central Print Serving">???</a>.
|
|---|
| 46 | </p><p>
|
|---|
| 47 | The next example is of a secure office file and print server that will be accessible only to users who have an
|
|---|
| 48 | account on the system. This server is meant to closely resemble a workgroup file and print server, but has to
|
|---|
| 49 | be more secure than an anonymous access machine. This type of system will typically suit the needs of a small
|
|---|
| 50 | office. The server provides no network logon facilities, offers no domain control; instead it is just a
|
|---|
| 51 | network-attached storage (NAS) device and a print server.
|
|---|
| 52 | </p><p>
|
|---|
| 53 | The later example consider more complex systems that will either integrate into existing MS Windows networks
|
|---|
| 54 | or replace them entirely. These cover domain member servers as well as Samba domain control (PDC/BDC) and
|
|---|
| 55 | finally describes in detail a large distributed network with branch offices in remote locations.
|
|---|
| 56 | </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id320424"></a>Worked Examples</h2></div></div></div><p>
|
|---|
| 57 | The configuration examples are designed to cover everything necessary to get Samba
|
|---|
| 58 | running. They do not cover basic operating system platform configuration, which is
|
|---|
| 59 | clearly beyond the scope of this text.
|
|---|
| 60 | </p><p>
|
|---|
| 61 | It is also assumed that Samba has been correctly installed, either by way of installation
|
|---|
| 62 | of the packages that are provided by the operating system vendor or through other means.
|
|---|
| 63 | </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id320439"></a>Standalone Server</h3></div></div></div><p>
|
|---|
| 64 | <a class="indexterm" name="id320446"></a>
|
|---|
| 65 | A standalone server implies no more than the fact that it is not a domain controller
|
|---|
| 66 | and it does not participate in domain control. It can be a simple, workgroup-like
|
|---|
| 67 | server, or it can be a complex server that is a member of a domain security context.
|
|---|
| 68 | </p><p>
|
|---|
| 69 | As the examples are developed, every attempt is made to progress the system toward greater capability, just as
|
|---|
| 70 | one might expect would happen in a real business office as that office grows in size and its needs change.
|
|---|
| 71 | </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="anon-ro"></a>Anonymous Read-Only Document Server</h4></div></div></div><p>
|
|---|
| 72 | <a class="indexterm" name="id320475"></a>
|
|---|
| 73 | The purpose of this type of server is to make available to any user
|
|---|
| 74 | any documents or files that are placed on the shared resource. The
|
|---|
| 75 | shared resource could be a CD-ROM drive, a CD-ROM image, or a file
|
|---|
| 76 | storage area.
|
|---|
| 77 | </p><div class="itemizedlist"><ul type="disc"><li><p>
|
|---|
| 78 | The file system share point will be <code class="filename">/export</code>.
|
|---|
| 79 | </p></li><li><p>
|
|---|
| 80 | All files will be owned by a user called Jack Baumbach.
|
|---|
| 81 | Jack's login name will be <span class="emphasis"><em>jackb</em></span>. His password will be
|
|---|
| 82 | <span class="emphasis"><em>m0r3pa1n</em></span> of course, that's just the example we are
|
|---|
| 83 | using; do not use this in a production environment because
|
|---|
| 84 | all readers of this document will know it.
|
|---|
| 85 | </p></li></ul></div><div class="procedure"><a name="id320519"></a><p class="title"><b>Procedure 2.1. Installation Procedure: Read-Only Server</b></p><div class="example"><a name="anon-example"></a><p class="title"><b>Example 2.1. Anonymous Read-Only Server Configuration</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id320652"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id320665"></a><em class="parameter"><code>netbios name = HOBBIT</code></em></td></tr><tr><td><a class="indexterm" name="id320677"></a><em class="parameter"><code>security = share</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[data]</code></em></td></tr><tr><td><a class="indexterm" name="id320699"></a><em class="parameter"><code>comment = Data</code></em></td></tr><tr><td><a class="indexterm" name="id320711"></a><em class="parameter"><code>path = /export</code></em></td></tr><tr><td><a class="indexterm" name="id320724"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id320736"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr></table></div></div><br class="example-break"><ol type="1"><li><p>
|
|---|
| 86 | Add user to system (with creation of the user's home directory):
|
|---|
| 87 | </p><pre class="screen">
|
|---|
| 88 | <code class="prompt">root# </code><strong class="userinput"><code>useradd -c "Jack Baumbach" -m -g users -p m0r3pa1n jackb</code></strong>
|
|---|
| 89 | </pre><p>
|
|---|
| 90 | </p></li><li><p>
|
|---|
| 91 | Create directory, and set permissions and ownership:
|
|---|
| 92 | </p><pre class="screen">
|
|---|
| 93 | <code class="prompt">root# </code><strong class="userinput"><code>mkdir /export</code></strong>
|
|---|
| 94 | <code class="prompt">root# </code><strong class="userinput"><code>chmod u+rwx,g+rx,o+rx /export</code></strong>
|
|---|
| 95 | <code class="prompt">root# </code><strong class="userinput"><code>chown jackb.users /export</code></strong>
|
|---|
| 96 | </pre><p>
|
|---|
| 97 | </p></li><li><p>
|
|---|
| 98 | Copy the files that should be shared to the <code class="filename">/export</code>
|
|---|
| 99 | directory.
|
|---|
| 100 | </p></li><li><p>
|
|---|
| 101 | Install the Samba configuration file (<code class="filename">/etc/samba/smb.conf</code>)
|
|---|
| 102 | as shown in <a href="FastStart.html#anon-example" title="Example 2.1. Anonymous Read-Only Server Configuration">Anonymous Read-Only Server Configuration</a>.
|
|---|
| 103 | </p></li><li><p>
|
|---|
| 104 | Test the configuration file by executing the following command:
|
|---|
| 105 | </p><pre class="screen">
|
|---|
| 106 | <code class="prompt">root# </code><strong class="userinput"><code>testparm</code></strong>
|
|---|
| 107 | </pre><p>
|
|---|
| 108 | Alternatively, where you are operating from a master configuration file called
|
|---|
| 109 | <code class="filename">smb.conf.master</code>, the following sequence of commands might prove
|
|---|
| 110 | more appropriate:
|
|---|
| 111 | </p><pre class="screen">
|
|---|
| 112 | <code class="prompt">root# </code> cd /etc/samba
|
|---|
| 113 | <code class="prompt">root# </code> testparm -s smb.conf.master > smb.conf
|
|---|
| 114 | <code class="prompt">root# </code> testparm
|
|---|
| 115 | </pre><p>
|
|---|
| 116 | Note any error messages that might be produced. Proceed only if error-free output has been
|
|---|
| 117 | obtained. An example of typical output that should be generated from the above configuration
|
|---|
| 118 | file is shown here:
|
|---|
| 119 | </p><pre class="screen">
|
|---|
| 120 | Load smb config files from /etc/samba/smb.conf
|
|---|
| 121 | Processing section "[data]"
|
|---|
| 122 | Loaded services file OK.
|
|---|
| 123 | Server role: ROLE_STANDALONE
|
|---|
| 124 | Press enter to see a dump of your service definitions
|
|---|
| 125 | <strong class="userinput"><code>[Press enter]</code></strong>
|
|---|
| 126 |
|
|---|
| 127 | # Global parameters
|
|---|
| 128 | [global]
|
|---|
| 129 | workgroup = MIDEARTH
|
|---|
| 130 | netbios name = HOBBIT
|
|---|
| 131 | security = share
|
|---|
| 132 |
|
|---|
| 133 | [data]
|
|---|
| 134 | comment = Data
|
|---|
| 135 | path = /export
|
|---|
| 136 | read only = Yes
|
|---|
| 137 | guest only = Yes
|
|---|
| 138 | </pre><p>
|
|---|
| 139 | </p></li><li><p>
|
|---|
| 140 | Start Samba using the method applicable to your operating system platform. The method that
|
|---|
| 141 | should be used is platform dependent. Refer to <a href="compiling.html#startingSamba" title="Starting the smbd nmbd and winbindd">Starting Samba</a>
|
|---|
| 142 | for further information regarding the starting of Samba.
|
|---|
| 143 | </p></li><li><p>
|
|---|
| 144 | Configure your MS Windows client for workgroup <span class="emphasis"><em>MIDEARTH</em></span>,
|
|---|
| 145 | set the machine name to ROBBINS, reboot, wait a few (2 - 5) minutes,
|
|---|
| 146 | then open Windows Explorer and visit the Network Neighborhood.
|
|---|
| 147 | The machine HOBBIT should be visible. When you click this machine
|
|---|
| 148 | icon, it should open up to reveal the <span class="emphasis"><em>data</em></span> share. After
|
|---|
| 149 | you click the share, it should open up to reveal the files previously
|
|---|
| 150 | placed in the <code class="filename">/export</code> directory.
|
|---|
| 151 | </p></li></ol></div><p>
|
|---|
| 152 | The information above (following # Global parameters) provides the complete
|
|---|
| 153 | contents of the <code class="filename">/etc/samba/smb.conf</code> file.
|
|---|
| 154 | </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id320872"></a>Anonymous Read-Write Document Server</h4></div></div></div><p>
|
|---|
| 155 | <a class="indexterm" name="id320880"></a>
|
|---|
| 156 | We should view this configuration as a progression from the previous example.
|
|---|
| 157 | The difference is that shared access is now forced to the user identity of jackb
|
|---|
| 158 | and to the primary group jackb belongs to. One other refinement we can make is to
|
|---|
| 159 | add the user <span class="emphasis"><em>jackb</em></span> to the <code class="filename">smbpasswd</code> file.
|
|---|
| 160 | To do this, execute:
|
|---|
| 161 | </p><pre class="screen">
|
|---|
| 162 | <code class="prompt">root# </code><strong class="userinput"><code>smbpasswd -a jackb</code></strong>
|
|---|
| 163 | New SMB password: <strong class="userinput"><code>m0r3pa1n</code></strong>
|
|---|
| 164 | Retype new SMB password: <strong class="userinput"><code>m0r3pa1n</code></strong>
|
|---|
| 165 | Added user jackb.
|
|---|
| 166 | </pre><p>
|
|---|
| 167 | Addition of this user to the <code class="filename">smbpasswd</code> file allows all files
|
|---|
| 168 | to be displayed in the Explorer Properties boxes as belonging to <span class="emphasis"><em>jackb</em></span>
|
|---|
| 169 | instead of to <span class="emphasis"><em>User Unknown</em></span>.
|
|---|
| 170 | </p><p>
|
|---|
| 171 | The complete, modified <code class="filename">smb.conf</code> file is as shown in <a href="FastStart.html#anon-rw" title="Example 2.2. Modified Anonymous Read-Write smb.conf">???</a>.
|
|---|
| 172 | </p><div class="example"><a name="anon-rw"></a><p class="title"><b>Example 2.2. Modified Anonymous Read-Write smb.conf</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id320988"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id321000"></a><em class="parameter"><code>netbios name = HOBBIT</code></em></td></tr><tr><td><a class="indexterm" name="id321013"></a><em class="parameter"><code>security = SHARE</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[data]</code></em></td></tr><tr><td><a class="indexterm" name="id321034"></a><em class="parameter"><code>comment = Data</code></em></td></tr><tr><td><a class="indexterm" name="id321047"></a><em class="parameter"><code>path = /export</code></em></td></tr><tr><td><a class="indexterm" name="id321060"></a><em class="parameter"><code>force user = jackb</code></em></td></tr><tr><td><a class="indexterm" name="id321072"></a><em class="parameter"><code>force group = users</code></em></td></tr><tr><td><a class="indexterm" name="id321085"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id321097"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id321112"></a>Anonymous Print Server</h4></div></div></div><p>
|
|---|
| 173 | <a class="indexterm" name="id321120"></a>
|
|---|
| 174 | An anonymous print server serves two purposes:
|
|---|
| 175 | </p><div class="itemizedlist"><ul type="disc"><li><p>
|
|---|
| 176 | It allows printing to all printers from a single location.
|
|---|
| 177 | </p></li><li><p>
|
|---|
| 178 | It reduces network traffic congestion due to many users trying
|
|---|
| 179 | to access a limited number of printers.
|
|---|
| 180 | </p></li></ul></div><p>
|
|---|
| 181 | In the simplest of anonymous print servers, it is common to require the installation
|
|---|
| 182 | of the correct printer drivers on the Windows workstation. In this case the print
|
|---|
| 183 | server will be designed to just pass print jobs through to the spooler, and the spooler
|
|---|
| 184 | should be configured to do raw pass-through to the printer. In other words, the print
|
|---|
| 185 | spooler should not filter or process the data stream being passed to the printer.
|
|---|
| 186 | </p><p>
|
|---|
| 187 | In this configuration, it is undesirable to present the Add Printer Wizard, and we do
|
|---|
| 188 | not want to have automatic driver download, so we disable it in the following
|
|---|
| 189 | configuration. <a href="FastStart.html#anon-print" title="Example 2.3. Anonymous Print Server smb.conf">???</a> is the resulting <code class="filename">smb.conf</code> file.
|
|---|
| 190 | </p><div class="example"><a name="anon-print"></a><p class="title"><b>Example 2.3. Anonymous Print Server smb.conf</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id321195"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id321207"></a><em class="parameter"><code>netbios name = LUTHIEN</code></em></td></tr><tr><td><a class="indexterm" name="id321220"></a><em class="parameter"><code>security = share</code></em></td></tr><tr><td><a class="indexterm" name="id321232"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id321245"></a><em class="parameter"><code>disable spoolss = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id321257"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id321270"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id321292"></a><em class="parameter"><code>comment = All Printers</code></em></td></tr><tr><td><a class="indexterm" name="id321304"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id321317"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id321329"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id321342"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id321354"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><p>
|
|---|
| 191 | The above configuration is not ideal. It uses no smart features, and it deliberately
|
|---|
| 192 | presents a less than elegant solution. But it is basic, and it does print. Samba makes
|
|---|
| 193 | use of the direct printing application program interface that is provided by CUPS.
|
|---|
| 194 | When Samba has been compiled and linked with the CUPS libraries, the default printing
|
|---|
| 195 | system will be CUPS. By specifying that the printcap name is CUPS, Samba will use
|
|---|
| 196 | the CUPS library API to communicate directly with CUPS for all printer functions.
|
|---|
| 197 | It is possible to force the use of external printing commands by setting the value
|
|---|
| 198 | of the <em class="parameter"><code>printing</code></em> to either SYSV or BSD, and thus the value of
|
|---|
| 199 | the parameter <em class="parameter"><code>printcap name</code></em> must be set to something other than
|
|---|
| 200 | CUPS. In such case, it could be set to the name of any file that contains a list
|
|---|
| 201 | of printers that should be made available to Windows clients.
|
|---|
| 202 | </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
|
|---|
| 203 | Windows users will need to install a local printer and then change the print
|
|---|
| 204 | to device after installation of the drivers. The print to device can then be set to
|
|---|
| 205 | the network printer on this machine.
|
|---|
| 206 | </p></div><p>
|
|---|
| 207 | Make sure that the directory <code class="filename">/var/spool/samba</code> is capable of being used
|
|---|
| 208 | as intended. The following steps must be taken to achieve this:
|
|---|
| 209 | </p><div class="itemizedlist"><ul type="disc"><li><p>
|
|---|
| 210 | The directory must be owned by the superuser (root) user and group:
|
|---|
| 211 | </p><pre class="screen">
|
|---|
| 212 | <code class="prompt">root# </code><strong class="userinput"><code>chown root.root /var/spool/samba</code></strong>
|
|---|
| 213 | </pre><p>
|
|---|
| 214 | </p></li><li><p>
|
|---|
| 215 | Directory permissions should be set for public read-write with the
|
|---|
| 216 | sticky bit set as shown:
|
|---|
| 217 | </p><pre class="screen">
|
|---|
| 218 | <code class="prompt">root# </code><strong class="userinput"><code>chmod a+twrx /var/spool/samba</code></strong>
|
|---|
| 219 | </pre><p>
|
|---|
| 220 | The purpose of setting the sticky bit is to prevent who does not own the temporary print file
|
|---|
| 221 | from being able to take control of it with the potential for devious misuse.
|
|---|
| 222 | </p></li></ul></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
|
|---|
| 223 | <a class="indexterm" name="id321457"></a>
|
|---|
| 224 | <a class="indexterm" name="id321466"></a>
|
|---|
| 225 | On CUPS-enabled systems there is a facility to pass raw data directly to the printer without
|
|---|
| 226 | intermediate processing via CUPS print filters. Where use of this mode of operation is desired,
|
|---|
| 227 | it is necessary to configure a raw printing device. It is also necessary to enable the raw mime
|
|---|
| 228 | handler in the <code class="filename">/etc/mime.conv</code> and <code class="filename">/etc/mime.types</code>
|
|---|
| 229 | files. Refer to <a href="CUPS-printing.html#cups-raw" title="Explicitly Enable “raw” Printing for application/octet-stream">???</a>.
|
|---|
| 230 | </p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id321496"></a>Secure Read-Write File and Print Server</h4></div></div></div><p>
|
|---|
| 231 | We progress now from simple systems to a server that is slightly more complex.
|
|---|
| 232 | </p><p>
|
|---|
| 233 | Our new server will require a public data storage area in which only authenticated
|
|---|
| 234 | users (i.e., those with a local account) can store files, as well as a home directory.
|
|---|
| 235 | There will be one printer that should be available for everyone to use.
|
|---|
| 236 | </p><p>
|
|---|
| 237 | In this hypothetical environment (no espionage was conducted to obtain this data),
|
|---|
| 238 | the site is demanding a simple environment that is <span class="emphasis"><em>secure enough</em></span>
|
|---|
| 239 | but not too difficult to use.
|
|---|
| 240 | </p><p>
|
|---|
| 241 | Site users will be Jack Baumbach, Mary Orville, and Amed Sehkah. Each will have
|
|---|
| 242 | a password (not shown in further examples). Mary will be the printer administrator and will
|
|---|
| 243 | own all files in the public share.
|
|---|
| 244 | </p><p>
|
|---|
| 245 | This configuration will be based on <span class="emphasis"><em>user-level security</em></span> that
|
|---|
| 246 | is the default, and for which the default is to store Microsoft Windows-compatible
|
|---|
| 247 | encrypted passwords in a file called <code class="filename">/etc/samba/smbpasswd</code>.
|
|---|
| 248 | The default <code class="filename">smb.conf</code> entry that makes this happen is
|
|---|
| 249 | <a class="indexterm" name="id321544"></a>passdb backend = smbpasswd, guest. Since this is the default,
|
|---|
| 250 | it is not necessary to enter it into the configuration file. Note that the guest backend is
|
|---|
| 251 | added to the list of active passdb backends no matter whether it specified directly in Samba configuration
|
|---|
| 252 | file or not.
|
|---|
| 253 | </p><div class="procedure"><a name="id321554"></a><p class="title"><b>Procedure 2.2. Installing the Secure Office Server</b></p><div class="example"><a name="OfficeServer"></a><p class="title"><b>Example 2.4. Secure Office Server smb.conf</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id321657"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id321670"></a><em class="parameter"><code>netbios name = OLORIN</code></em></td></tr><tr><td><a class="indexterm" name="id321682"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id321695"></a><em class="parameter"><code>disable spoolss = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id321708"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id321720"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id321742"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id321754"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id321767"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id321779"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[public]</code></em></td></tr><tr><td><a class="indexterm" name="id321801"></a><em class="parameter"><code>comment = Data</code></em></td></tr><tr><td><a class="indexterm" name="id321813"></a><em class="parameter"><code>path = /export</code></em></td></tr><tr><td><a class="indexterm" name="id321826"></a><em class="parameter"><code>force user = maryo</code></em></td></tr><tr><td><a class="indexterm" name="id321838"></a><em class="parameter"><code>force group = users</code></em></td></tr><tr><td><a class="indexterm" name="id321851"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id321872"></a><em class="parameter"><code>comment = All Printers</code></em></td></tr><tr><td><a class="indexterm" name="id321885"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id321898"></a><em class="parameter"><code>printer admin = root, maryo</code></em></td></tr><tr><td><a class="indexterm" name="id321910"></a><em class="parameter"><code>create mask = 0600</code></em></td></tr><tr><td><a class="indexterm" name="id321923"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id321935"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id321948"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id321960"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><ol type="1"><li><p>
|
|---|
| 254 | <a class="indexterm" name="id321565"></a>
|
|---|
| 255 | Add all users to the operating system:
|
|---|
| 256 | </p><pre class="screen">
|
|---|
| 257 | <code class="prompt">root# </code><strong class="userinput"><code>useradd -c "Jack Baumbach" -m -g users -p m0r3pa1n jackb</code></strong>
|
|---|
| 258 | <code class="prompt">root# </code><strong class="userinput"><code>useradd -c "Mary Orville" -m -g users -p secret maryo</code></strong>
|
|---|
| 259 | <code class="prompt">root# </code><strong class="userinput"><code>useradd -c "Amed Sehkah" -m -g users -p secret ameds</code></strong>
|
|---|
| 260 | </pre><p>
|
|---|
| 261 | </p></li><li><p>
|
|---|
| 262 | Configure the Samba <code class="filename">smb.conf</code> file as shown in <a href="FastStart.html#OfficeServer" title="Example 2.4. Secure Office Server smb.conf">???</a>.
|
|---|
| 263 | </p></li><li><p>
|
|---|
| 264 | Initialize the Microsoft Windows password database with the new users:
|
|---|
| 265 | </p><pre class="screen">
|
|---|
| 266 | <code class="prompt">root# </code><strong class="userinput"><code>smbpasswd -a root</code></strong>
|
|---|
| 267 | New SMB password: <strong class="userinput"><code>bigsecret</code></strong>
|
|---|
| 268 | Reenter smb password: <strong class="userinput"><code>bigsecret</code></strong>
|
|---|
| 269 | Added user root.
|
|---|
| 270 |
|
|---|
| 271 | <code class="prompt">root# </code><strong class="userinput"><code>smbpasswd -a jackb</code></strong>
|
|---|
| 272 | New SMB password: <strong class="userinput"><code>m0r3pa1n</code></strong>
|
|---|
| 273 | Retype new SMB password: <strong class="userinput"><code>m0r3pa1n</code></strong>
|
|---|
| 274 | Added user jackb.
|
|---|
| 275 |
|
|---|
| 276 | <code class="prompt">root# </code><strong class="userinput"><code>smbpasswd -a maryo</code></strong>
|
|---|
| 277 | New SMB password: <strong class="userinput"><code>secret</code></strong>
|
|---|
| 278 | Reenter smb password: <strong class="userinput"><code>secret</code></strong>
|
|---|
| 279 | Added user maryo.
|
|---|
| 280 |
|
|---|
| 281 | <code class="prompt">root# </code><strong class="userinput"><code>smbpasswd -a ameds</code></strong>
|
|---|
| 282 | New SMB password: <strong class="userinput"><code>mysecret</code></strong>
|
|---|
| 283 | Reenter smb password: <strong class="userinput"><code>mysecret</code></strong>
|
|---|
| 284 | Added user ameds.
|
|---|
| 285 | </pre><p>
|
|---|
| 286 | </p></li><li><p>
|
|---|
| 287 | Install printer using the CUPS Web interface. Make certain that all
|
|---|
| 288 | printers that will be shared with Microsoft Windows clients are installed
|
|---|
| 289 | as raw printing devices.
|
|---|
| 290 | </p></li><li><p>
|
|---|
| 291 | Start Samba using the operating system administrative interface.
|
|---|
| 292 | Alternately, this can be done manually by executing:
|
|---|
| 293 | <a class="indexterm" name="id322092"></a>
|
|---|
| 294 | <a class="indexterm" name="id322099"></a>
|
|---|
| 295 | <a class="indexterm" name="id322106"></a>
|
|---|
| 296 | <a class="indexterm" name="id322115"></a>
|
|---|
| 297 | </p><pre class="screen">
|
|---|
| 298 | <code class="prompt">root# </code><strong class="userinput"><code> nmbd; smbd;</code></strong>
|
|---|
| 299 | </pre><p>
|
|---|
| 300 | Both applications automatically execute as daemons. Those who are paranoid about
|
|---|
| 301 | maintaining control can add the <code class="constant">-D</code> flag to coerce them to start
|
|---|
| 302 | up in daemon mode.
|
|---|
| 303 | </p></li><li><p>
|
|---|
| 304 | Configure the <code class="filename">/export</code> directory:
|
|---|
| 305 | </p><pre class="screen">
|
|---|
| 306 | <code class="prompt">root# </code><strong class="userinput"><code>mkdir /export</code></strong>
|
|---|
| 307 | <code class="prompt">root# </code><strong class="userinput"><code>chown maryo.users /export</code></strong>
|
|---|
| 308 | <code class="prompt">root# </code><strong class="userinput"><code>chmod u=rwx,g=rwx,o-rwx /export</code></strong>
|
|---|
| 309 | </pre><p>
|
|---|
| 310 | </p></li><li><p>
|
|---|
| 311 | Check that Samba is running correctly:
|
|---|
| 312 | </p><pre class="screen">
|
|---|
| 313 | <code class="prompt">root# </code><strong class="userinput"><code>smbclient -L localhost -U%</code></strong>
|
|---|
| 314 | Domain=[MIDEARTH] OS=[UNIX] Server=[Samba-3.0.20]
|
|---|
| 315 |
|
|---|
| 316 | Sharename Type Comment
|
|---|
| 317 | --------- ---- -------
|
|---|
| 318 | public Disk Data
|
|---|
| 319 | IPC$ IPC IPC Service (Samba-3.0.20)
|
|---|
| 320 | ADMIN$ IPC IPC Service (Samba-3.0.20)
|
|---|
| 321 | hplj4 Printer hplj4
|
|---|
| 322 |
|
|---|
| 323 | Server Comment
|
|---|
| 324 | --------- -------
|
|---|
| 325 | OLORIN Samba-3.0.20
|
|---|
| 326 |
|
|---|
| 327 | Workgroup Master
|
|---|
| 328 | --------- -------
|
|---|
| 329 | MIDEARTH OLORIN
|
|---|
| 330 | </pre><p>
|
|---|
| 331 | The following error message indicates that Samba was not running:
|
|---|
| 332 | </p><pre class="screen">
|
|---|
| 333 | <code class="prompt">root# </code> smbclient -L olorin -U%
|
|---|
| 334 | Error connecting to 192.168.1.40 (Connection refused)
|
|---|
| 335 | Connection to olorin failed
|
|---|
| 336 | </pre><p>
|
|---|
| 337 | </p></li><li><p>
|
|---|
| 338 | Connect to OLORIN as maryo:
|
|---|
| 339 | </p><pre class="screen">
|
|---|
| 340 | <code class="prompt">root# </code><strong class="userinput"><code>smbclient //olorin/maryo -Umaryo%secret</code></strong>
|
|---|
| 341 | OS=[UNIX] Server=[Samba-3.0.20]
|
|---|
| 342 | smb: \> <strong class="userinput"><code>dir</code></strong>
|
|---|
| 343 | . D 0 Sat Jun 21 10:58:16 2003
|
|---|
| 344 | .. D 0 Sat Jun 21 10:54:32 2003
|
|---|
| 345 | Documents D 0 Fri Apr 25 13:23:58 2003
|
|---|
| 346 | DOCWORK D 0 Sat Jun 14 15:40:34 2003
|
|---|
| 347 | OpenOffice.org D 0 Fri Apr 25 13:55:16 2003
|
|---|
| 348 | .bashrc H 1286 Fri Apr 25 13:23:58 2003
|
|---|
| 349 | .netscape6 DH 0 Fri Apr 25 13:55:13 2003
|
|---|
| 350 | .mozilla DH 0 Wed Mar 5 11:50:50 2003
|
|---|
| 351 | .kermrc H 164 Fri Apr 25 13:23:58 2003
|
|---|
| 352 | .acrobat DH 0 Fri Apr 25 15:41:02 2003
|
|---|
| 353 |
|
|---|
| 354 | 55817 blocks of size 524288. 34725 blocks available
|
|---|
| 355 | smb: \> <strong class="userinput"><code>q</code></strong>
|
|---|
| 356 | </pre><p>
|
|---|
| 357 | </p></li></ol></div><p>
|
|---|
| 358 | By now you should be getting the hang of configuration basics. Clearly, it is time to
|
|---|
| 359 | explore slightly more complex examples. For the remainder of this chapter we abbreviate
|
|---|
| 360 | instructions, since there are previous examples.
|
|---|
| 361 | </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id322292"></a>Domain Member Server</h3></div></div></div><p>
|
|---|
| 362 | <a class="indexterm" name="id322299"></a>
|
|---|
| 363 | In this instance we consider the simplest server configuration we can get away with
|
|---|
| 364 | to make an accounting department happy. Let's be warned, the users are accountants and they
|
|---|
| 365 | do have some nasty demands. There is a budget for only one server for this department.
|
|---|
| 366 | </p><p>
|
|---|
| 367 | The network is managed by an internal Information Services Group (ISG), to which we belong.
|
|---|
| 368 | Internal politics are typical of a medium-sized organization; Human Resources is of the
|
|---|
| 369 | opinion that they run the ISG because they are always adding and disabling users. Also,
|
|---|
| 370 | departmental managers have to fight tooth and nail to gain basic network resources access for
|
|---|
| 371 | their staff. Accounting is different, though, they get exactly what they want. So this should
|
|---|
| 372 | set the scene.
|
|---|
| 373 | </p><p>
|
|---|
| 374 | We use the users from the last example. The accounting department
|
|---|
| 375 | has a general printer that all departmental users may use. There is also a check printer
|
|---|
| 376 | that may be used only by the person who has authority to print checks. The chief financial
|
|---|
| 377 | officer (CFO) wants that printer to be completely restricted and for it to be located in the
|
|---|
| 378 | private storage area in her office. It therefore must be a network printer.
|
|---|
| 379 | </p><p>
|
|---|
| 380 | The accounting department uses an accounting application called <span class="emphasis"><em>SpytFull</em></span>
|
|---|
| 381 | that must be run from a central application server. The software is licensed to run only off
|
|---|
| 382 | one server, there are no workstation components, and it is run off a mapped share. The data
|
|---|
| 383 | store is in a UNIX-based SQL backend. The UNIX gurus look after that, so this is not our
|
|---|
| 384 | problem.
|
|---|
| 385 | </p><p>
|
|---|
| 386 | The accounting department manager (maryo) wants a general filing system as well as a separate
|
|---|
| 387 | file storage area for form letters (nastygrams). The form letter area should be read-only to
|
|---|
| 388 | all accounting staff except the manager. The general filing system has to have a structured
|
|---|
| 389 | layout with a general area for all staff to store general documents as well as a separate
|
|---|
| 390 | file area for each member of her team that is private to that person, but she wants full
|
|---|
| 391 | access to all areas. Users must have a private home share for personal work-related files
|
|---|
| 392 | and for materials not related to departmental operations.
|
|---|
| 393 | </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id322348"></a>Example Configuration</h4></div></div></div><p>
|
|---|
| 394 | The server <span class="emphasis"><em>valinor</em></span> will be a member server of the company domain.
|
|---|
| 395 | Accounting will have only a local server. User accounts will be on the domain controllers,
|
|---|
| 396 | as will desktop profiles and all network policy files.
|
|---|
| 397 | </p><div class="procedure"><div class="example"><a name="fast-member-server"></a><p class="title"><b>Example 2.5. Member Server smb.conf (Globals)</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id322428"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id322441"></a><em class="parameter"><code>netbios name = VALINOR</code></em></td></tr><tr><td><a class="indexterm" name="id322454"></a><em class="parameter"><code>security = DOMAIN</code></em></td></tr><tr><td><a class="indexterm" name="id322466"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id322479"></a><em class="parameter"><code>disable spoolss = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id322491"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id322504"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id322516"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id322529"></a><em class="parameter"><code>winbind use default domain = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id322542"></a><em class="parameter"><code>printing = cups</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="fast-memberserver-shares"></a><p class="title"><b>Example 2.6. Member Server smb.conf (Shares and Services)</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id322579"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id322592"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id322604"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id322617"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[spytfull]</code></em></td></tr><tr><td><a class="indexterm" name="id322638"></a><em class="parameter"><code>comment = Accounting Application Only</code></em></td></tr><tr><td><a class="indexterm" name="id322651"></a><em class="parameter"><code>path = /export/spytfull</code></em></td></tr><tr><td><a class="indexterm" name="id322663"></a><em class="parameter"><code>valid users = @Accounts</code></em></td></tr><tr><td><a class="indexterm" name="id322676"></a><em class="parameter"><code>admin users = maryo</code></em></td></tr><tr><td><a class="indexterm" name="id322688"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[public]</code></em></td></tr><tr><td><a class="indexterm" name="id322710"></a><em class="parameter"><code>comment = Data</code></em></td></tr><tr><td><a class="indexterm" name="id322722"></a><em class="parameter"><code>path = /export/public</code></em></td></tr><tr><td><a class="indexterm" name="id322735"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id322756"></a><em class="parameter"><code>comment = All Printers</code></em></td></tr><tr><td><a class="indexterm" name="id322769"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id322781"></a><em class="parameter"><code>printer admin = root, maryo</code></em></td></tr><tr><td><a class="indexterm" name="id322794"></a><em class="parameter"><code>create mask = 0600</code></em></td></tr><tr><td><a class="indexterm" name="id322807"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id322819"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id322832"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id322844"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><ol type="1"><li><p>
|
|---|
| 398 | Do not add users to the UNIX/Linux server; all of this will run off the
|
|---|
| 399 | central domain.
|
|---|
| 400 | </p></li><li><p>
|
|---|
| 401 | Configure <code class="filename">smb.conf</code> according to <a href="FastStart.html#fast-member-server" title="Example 2.5. Member Server smb.conf (Globals)">Member server smb.conf
|
|---|
| 402 | (globals)</a> and <a href="FastStart.html#fast-memberserver-shares" title="Example 2.6. Member Server smb.conf (Shares and Services)">Member server smb.conf (shares
|
|---|
| 403 | and services)</a>.
|
|---|
| 404 | </p></li><li><p>
|
|---|
| 405 | <a class="indexterm" name="id322863"></a>
|
|---|
| 406 | Join the domain. Note: Do not start Samba until this step has been completed!
|
|---|
| 407 | </p><pre class="screen">
|
|---|
| 408 | <code class="prompt">root# </code><strong class="userinput"><code>net rpc join -Uroot%'bigsecret'</code></strong>
|
|---|
| 409 | Joined domain MIDEARTH.
|
|---|
| 410 | </pre><p>
|
|---|
| 411 | </p></li><li><p>
|
|---|
| 412 | Make absolutely certain that you disable (shut down) the <code class="literal">nscd</code>
|
|---|
| 413 | daemon on any system on which <code class="literal">winbind</code> is configured to run.
|
|---|
| 414 | </p></li><li><p>
|
|---|
| 415 | Start Samba following the normal method for your operating system platform.
|
|---|
| 416 | If you wish to do this manually, execute as root:
|
|---|
| 417 | <a class="indexterm" name="id322917"></a>
|
|---|
| 418 | <a class="indexterm" name="id322924"></a>
|
|---|
| 419 | <a class="indexterm" name="id322931"></a>
|
|---|
| 420 | <a class="indexterm" name="id322937"></a>
|
|---|
| 421 | <a class="indexterm" name="id322947"></a>
|
|---|
| 422 | <a class="indexterm" name="id322956"></a>
|
|---|
| 423 | </p><pre class="screen">
|
|---|
| 424 | <code class="prompt">root# </code><strong class="userinput"><code>nmbd; smbd; winbindd;</code></strong>
|
|---|
| 425 | </pre><p>
|
|---|
| 426 | </p></li><li><p>
|
|---|
| 427 | Configure the name service switch (NSS) control file on your system to resolve user and group names
|
|---|
| 428 | via winbind. Edit the following lines in <code class="filename">/etc/nsswitch.conf</code>:
|
|---|
| 429 | </p><pre class="programlisting">
|
|---|
| 430 | passwd: files winbind
|
|---|
| 431 | group: files winbind
|
|---|
| 432 | hosts: files dns winbind
|
|---|
| 433 | </pre><p>
|
|---|
| 434 | </p></li><li><p>
|
|---|
| 435 | Set the password for <code class="literal">wbinfo</code> to use:
|
|---|
| 436 | </p><pre class="screen">
|
|---|
| 437 | <code class="prompt">root# </code><strong class="userinput"><code>wbinfo --set-auth-user=root%'bigsecret'</code></strong>
|
|---|
| 438 | </pre><p>
|
|---|
| 439 | </p></li><li><p>
|
|---|
| 440 | Validate that domain user and group credentials can be correctly resolved by executing:
|
|---|
| 441 | </p><pre class="screen">
|
|---|
| 442 | <code class="prompt">root# </code><strong class="userinput"><code>wbinfo -u</code></strong>
|
|---|
| 443 | MIDEARTH\maryo
|
|---|
| 444 | MIDEARTH\jackb
|
|---|
| 445 | MIDEARTH\ameds
|
|---|
| 446 | ...
|
|---|
| 447 | MIDEARTH\root
|
|---|
| 448 |
|
|---|
| 449 | <code class="prompt">root# </code><strong class="userinput"><code>wbinfo -g</code></strong>
|
|---|
| 450 | MIDEARTH\Domain Users
|
|---|
| 451 | MIDEARTH\Domain Admins
|
|---|
| 452 | MIDEARTH\Domain Guests
|
|---|
| 453 | ...
|
|---|
| 454 | MIDEARTH\Accounts
|
|---|
| 455 | </pre><p>
|
|---|
| 456 | </p></li><li><p>
|
|---|
| 457 | Check that <code class="literal">winbind</code> is working. The following demonstrates correct
|
|---|
| 458 | username resolution via the <code class="literal">getent</code> system utility:
|
|---|
| 459 | </p><pre class="screen">
|
|---|
| 460 | <code class="prompt">root# </code><strong class="userinput"><code>getent passwd maryo</code></strong>
|
|---|
| 461 | maryo:x:15000:15003:Mary Orville:/home/MIDEARTH/maryo:/bin/false
|
|---|
| 462 | </pre><p>
|
|---|
| 463 | </p></li><li><p>
|
|---|
| 464 | A final test that we have this under control might be reassuring:
|
|---|
| 465 | </p><pre class="screen">
|
|---|
| 466 | <code class="prompt">root# </code><strong class="userinput"><code>touch /export/a_file</code></strong>
|
|---|
| 467 | <code class="prompt">root# </code><strong class="userinput"><code>chown maryo /export/a_file</code></strong>
|
|---|
| 468 | <code class="prompt">root# </code><strong class="userinput"><code>ls -al /export/a_file</code></strong>
|
|---|
| 469 | ...
|
|---|
| 470 | -rw-r--r-- 1 maryo users 11234 Jun 21 15:32 a_file
|
|---|
| 471 | ...
|
|---|
| 472 |
|
|---|
| 473 | <code class="prompt">root# </code><strong class="userinput"><code>rm /export/a_file</code></strong>
|
|---|
| 474 | </pre><p>
|
|---|
| 475 | </p></li><li><p>
|
|---|
| 476 | Configuration is now mostly complete, so this is an opportune time
|
|---|
| 477 | to configure the directory structure for this site:
|
|---|
| 478 | </p><pre class="screen">
|
|---|
| 479 | <code class="prompt">root# </code><strong class="userinput"><code>mkdir -p /export/{spytfull,public}</code></strong>
|
|---|
| 480 | <code class="prompt">root# </code><strong class="userinput"><code>chmod ug=rwxS,o=x /export/{spytfull,public}</code></strong>
|
|---|
| 481 | <code class="prompt">root# </code><strong class="userinput"><code>chown maryo.Accounts /export/{spytfull,public}</code></strong>
|
|---|
| 482 | </pre><p>
|
|---|
| 483 | </p></li></ol></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id323205"></a>Domain Controller</h3></div></div></div><p>
|
|---|
| 484 | <a class="indexterm" name="id323213"></a>
|
|---|
| 485 | For the remainder of this chapter the focus is on the configuration of domain control.
|
|---|
| 486 | The examples that follow are for two implementation strategies. Remember, our objective is
|
|---|
| 487 | to create a simple but working solution. The remainder of this book should help to highlight
|
|---|
| 488 | opportunity for greater functionality and the complexity that goes with it.
|
|---|
| 489 | </p><p>
|
|---|
| 490 | A domain controller configuration can be achieved with a simple configuration using the new
|
|---|
| 491 | tdbsam password backend. This type of configuration is good for small
|
|---|
| 492 | offices, but has limited scalability (cannot be replicated), and performance can be expected
|
|---|
| 493 | to fall as the size and complexity of the domain increases.
|
|---|
| 494 | </p><p>
|
|---|
| 495 | The use of tdbsam is best limited to sites that do not need
|
|---|
| 496 | more than a Primary Domain Controller (PDC). As the size of a domain grows the need
|
|---|
| 497 | for additional domain controllers becomes apparent. Do not attempt to under-resource
|
|---|
| 498 | a Microsoft Windows network environment; domain controllers provide essential
|
|---|
| 499 | authentication services. The following are symptoms of an under-resourced domain control
|
|---|
| 500 | environment:
|
|---|
| 501 | </p><div class="itemizedlist"><ul type="disc"><li><p>
|
|---|
| 502 | Domain logons intermittently fail.
|
|---|
| 503 | </p></li><li><p>
|
|---|
| 504 | File access on a domain member server intermittently fails, giving a permission denied
|
|---|
| 505 | error message.
|
|---|
| 506 | </p></li></ul></div><p>
|
|---|
| 507 | A more scalable domain control authentication backend option might use
|
|---|
| 508 | Microsoft Active Directory or an LDAP-based backend. Samba-3 provides
|
|---|
| 509 | for both options as a domain member server. As a PDC, Samba-3 is not able to provide
|
|---|
| 510 | an exact alternative to the functionality that is available with Active Directory.
|
|---|
| 511 | Samba-3 can provide a scalable LDAP-based PDC/BDC solution.
|
|---|
| 512 | </p><p>
|
|---|
| 513 | The tdbsam authentication backend provides no facility to replicate
|
|---|
| 514 | the contents of the database, except by external means (i.e., there is no self-contained protocol
|
|---|
| 515 | in Samba-3 for Security Account Manager database [SAM] replication).
|
|---|
| 516 | </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
|
|---|
| 517 | If you need more than one domain controller, do not use a tdbsam authentication backend.
|
|---|
| 518 | </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id323270"></a>Example: Engineering Office</h4></div></div></div><p>
|
|---|
| 519 | The engineering office network server we present here is designed to demonstrate use
|
|---|
| 520 | of the new tdbsam password backend. The tdbsam
|
|---|
| 521 | facility is new to Samba-3. It is designed to provide many user and machine account controls
|
|---|
| 522 | that are possible with Microsoft Windows NT4. It is safe to use this in smaller networks.
|
|---|
| 523 | </p><div class="procedure"><div class="example"><a name="fast-engoffice-global"></a><p class="title"><b>Example 2.7. Engineering Office smb.conf (globals)</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id323337"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id323349"></a><em class="parameter"><code>netbios name = FRODO</code></em></td></tr><tr><td><a class="indexterm" name="id323362"></a><em class="parameter"><code>passdb backend = tdbsam</code></em></td></tr><tr><td><a class="indexterm" name="id323374"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id323387"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m %u</code></em></td></tr><tr><td><a class="indexterm" name="id323400"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r %u</code></em></td></tr><tr><td><a class="indexterm" name="id323412"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd %g</code></em></td></tr><tr><td><a class="indexterm" name="id323425"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel %g</code></em></td></tr><tr><td><a class="indexterm" name="id323438"></a><em class="parameter"><code>add user to group script = /usr/sbin/groupmod -A %u %g</code></em></td></tr><tr><td><a class="indexterm" name="id323451"></a><em class="parameter"><code>delete user from group script = /usr/sbin/groupmod -R %u %g</code></em></td></tr><tr><td><a class="indexterm" name="id323464"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody %u</code></em></td></tr><tr><td># Note: The following specifies the default logon script.</td></tr><tr><td># Per user logon scripts can be specified in the user account using pdbedit </td></tr><tr><td><a class="indexterm" name="id323485"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td># This sets the default profile path. Set per user paths with pdbedit</td></tr><tr><td><a class="indexterm" name="id323502"></a><em class="parameter"><code>logon path = \\%L\Profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id323514"></a><em class="parameter"><code>logon drive = H:</code></em></td></tr><tr><td><a class="indexterm" name="id323527"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id323539"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id323552"></a><em class="parameter"><code>os level = 35</code></em></td></tr><tr><td><a class="indexterm" name="id323564"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id323577"></a><em class="parameter"><code>domain master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id323589"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id323602"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id323614"></a><em class="parameter"><code>printing = cups</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="fast-engoffice-shares"></a><p class="title"><b>Example 2.8. Engineering Office smb.conf (shares and services)</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id323651"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id323664"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id323677"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id323689"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td># Printing auto-share (makes printers available thru CUPS)</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id323714"></a><em class="parameter"><code>comment = All Printers</code></em></td></tr><tr><td><a class="indexterm" name="id323727"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id323740"></a><em class="parameter"><code>printer admin = root, maryo</code></em></td></tr><tr><td><a class="indexterm" name="id323752"></a><em class="parameter"><code>create mask = 0600</code></em></td></tr><tr><td><a class="indexterm" name="id323765"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id323777"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id323790"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id323811"></a><em class="parameter"><code>comment = Printer Drivers Share</code></em></td></tr><tr><td><a class="indexterm" name="id323824"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id323837"></a><em class="parameter"><code>write list = maryo, root</code></em></td></tr><tr><td><a class="indexterm" name="id323849"></a><em class="parameter"><code>printer admin = maryo, root</code></em></td></tr><tr><td># Needed to support domain logons</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id323874"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id323887"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id323900"></a><em class="parameter"><code>admin users = root, maryo</code></em></td></tr><tr><td><a class="indexterm" name="id323912"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id323925"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td># For profiles to work, create a user directory under the path</td></tr><tr><td># shown. i.e., mkdir -p /var/lib/samba/profiles/maryo</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[Profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id323954"></a><em class="parameter"><code>comment = Roaming Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id323967"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id323979"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id323992"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td># Other resource (share/printer) definitions would follow below.</td></tr></table></div></div><br class="example-break"><ol type="1"><li><p>
|
|---|
| 524 | A working PDC configuration using the tdbsam
|
|---|
| 525 | password backend can be found in <a href="FastStart.html#fast-engoffice-global" title="Example 2.7. Engineering Office smb.conf (globals)">Engineering Office smb.conf
|
|---|
| 526 | (globals)</a> together with <a href="FastStart.html#fast-engoffice-shares" title="Example 2.8. Engineering Office smb.conf (shares and services)">Engineering Office smb.conf
|
|---|
| 527 | (shares and services)</a>:
|
|---|
| 528 | <a class="indexterm" name="id323306"></a>
|
|---|
| 529 | </p></li><li><p>
|
|---|
| 530 | Create UNIX group accounts as needed using a suitable operating system tool:
|
|---|
| 531 | </p><pre class="screen">
|
|---|
| 532 | <code class="prompt">root# </code><strong class="userinput"><code>groupadd ntadmins</code></strong>
|
|---|
| 533 | <code class="prompt">root# </code><strong class="userinput"><code>groupadd designers</code></strong>
|
|---|
| 534 | <code class="prompt">root# </code><strong class="userinput"><code>groupadd engineers</code></strong>
|
|---|
| 535 | <code class="prompt">root# </code><strong class="userinput"><code>groupadd qateam</code></strong>
|
|---|
| 536 | </pre><p>
|
|---|
| 537 | </p></li><li><p>
|
|---|
| 538 | Create user accounts on the system using the appropriate tool
|
|---|
| 539 | provided with the operating system. Make sure all user home directories
|
|---|
| 540 | are created also. Add users to groups as required for access control
|
|---|
| 541 | on files, directories, printers, and as required for use in the Samba
|
|---|
| 542 | environment.
|
|---|
| 543 | </p></li><li><p>
|
|---|
| 544 | <a class="indexterm" name="id324078"></a>
|
|---|
| 545 | <a class="indexterm" name="id324087"></a>
|
|---|
| 546 | Assign each of the UNIX groups to NT groups by executing this shell script
|
|---|
| 547 | (You could name the script <code class="filename">initGroups.sh</code>):
|
|---|
| 548 | </p><pre class="screen">
|
|---|
| 549 | #!/bin/bash
|
|---|
| 550 | #### Keep this as a shell script for future re-use
|
|---|
| 551 |
|
|---|
| 552 | # First assign well known groups
|
|---|
| 553 | net groupmap add ntgroup="Domain Admins" unixgroup=ntadmins rid=512 type=d
|
|---|
| 554 | net groupmap add ntgroup="Domain Users" unixgroup=users rid=513 type=
|
|---|
| 555 | net groupmap add ntgroup="Domain Guests" unixgroup=nobody rid=514 type=d
|
|---|
| 556 |
|
|---|
| 557 | # Now for our added Domain Groups
|
|---|
| 558 | net groupmap add ntgroup="Designers" unixgroup=designers type=d
|
|---|
| 559 | net groupmap add ntgroup="Engineers" unixgroup=engineers type=d
|
|---|
| 560 | net groupmap add ntgroup="QA Team" unixgroup=qateam type=d
|
|---|
| 561 | </pre><p>
|
|---|
| 562 | </p></li><li><p>
|
|---|
| 563 | Create the <code class="filename">scripts</code> directory for use in the
|
|---|
| 564 | <em class="parameter"><code>[NETLOGON]</code></em> share:
|
|---|
| 565 | </p><pre class="screen">
|
|---|
| 566 | <code class="prompt">root# </code><strong class="userinput"><code>mkdir -p /var/lib/samba/netlogon/scripts</code></strong>
|
|---|
| 567 | </pre><p>
|
|---|
| 568 | Place the logon scripts that will be used (batch or cmd scripts)
|
|---|
| 569 | in this directory.
|
|---|
| 570 | </p></li></ol></div><p>
|
|---|
| 571 | The above configuration provides a functional PDC
|
|---|
| 572 | system to which must be added file shares and printers as required.
|
|---|
| 573 | </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id324155"></a>A Big Organization</h4></div></div></div><p>
|
|---|
| 574 | In this section we finally get to review in brief a Samba-3 configuration that
|
|---|
| 575 | uses a Lightweight Directory Access (LDAP)-based authentication backend. The
|
|---|
| 576 | main reasons for this choice are to provide the ability to host primary
|
|---|
| 577 | and Backup Domain Control (BDC), as well as to enable a higher degree of
|
|---|
| 578 | scalability to meet the needs of a very distributed environment.
|
|---|
| 579 | </p><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id324167"></a>The Primary Domain Controller</h5></div></div></div><p>
|
|---|
| 580 | This is an example of a minimal configuration to run a Samba-3 PDC
|
|---|
| 581 | using an LDAP authentication backend. It is assumed that the operating system
|
|---|
| 582 | has been correctly configured.
|
|---|
| 583 | </p><p>
|
|---|
| 584 | The Idealx scripts (or equivalent) are needed to manage LDAP-based POSIX and/or
|
|---|
| 585 | SambaSamAccounts. The Idealx scripts may be downloaded from the <a href="http://www.idealx.org" target="_top">
|
|---|
| 586 | Idealx</a> Web site. They may also be obtained from the Samba tarball. Linux
|
|---|
| 587 | distributions tend to install the Idealx scripts in the
|
|---|
| 588 | <code class="filename">/usr/share/doc/packages/sambaXXXXXX/examples/LDAP/smbldap-tools</code> directory.
|
|---|
| 589 | Idealx scripts version <code class="constant">smbldap-tools-0.9.1</code> are known to work well.
|
|---|
| 590 | </p><div class="procedure"><div class="example"><a name="fast-ldap"></a><p class="title"><b>Example 2.9. LDAP backend smb.conf for PDC</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id324384"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id324396"></a><em class="parameter"><code>netbios name = FRODO</code></em></td></tr><tr><td><a class="indexterm" name="id324409"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id324421"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id324434"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id324447"></a><em class="parameter"><code>add user script = /usr/local/sbin/smbldap-useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id324460"></a><em class="parameter"><code>delete user script = /usr/local/sbin/smbldap-userdel %u</code></em></td></tr><tr><td><a class="indexterm" name="id324472"></a><em class="parameter"><code>add group script = /usr/local/sbin/smbldap-groupadd -p '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id324485"></a><em class="parameter"><code>delete group script = /usr/local/sbin/smbldap-groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id324498"></a><em class="parameter"><code>add user to group script = /usr/local/sbin/smbldap-groupmod -m '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id324511"></a><em class="parameter"><code>delete user from group script = /usr/local/sbin/smbldap-groupmod -x '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id324525"></a><em class="parameter"><code>set primary group script = /usr/local/sbin/smbldap-usermod -g '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id324538"></a><em class="parameter"><code>add machine script = /usr/local/sbin/smbldap-useradd -w '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id324551"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id324563"></a><em class="parameter"><code>logon path = \\%L\Profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id324576"></a><em class="parameter"><code>logon drive = H:</code></em></td></tr><tr><td><a class="indexterm" name="id324588"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id324601"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id324614"></a><em class="parameter"><code>os level = 35</code></em></td></tr><tr><td><a class="indexterm" name="id324626"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id324639"></a><em class="parameter"><code>domain master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id324651"></a><em class="parameter"><code>ldap suffix = dc=quenya,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id324664"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id324676"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id324689"></a><em class="parameter"><code>ldap group suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id324702"></a><em class="parameter"><code>ldap idmap suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id324714"></a><em class="parameter"><code>ldap admin dn = cn=Manager</code></em></td></tr><tr><td><a class="indexterm" name="id324727"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id324740"></a><em class="parameter"><code>ldap passwd sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id324752"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id324765"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id324777"></a><em class="parameter"><code>printing = cups</code></em></td></tr></table></div></div><br class="example-break"><ol type="1"><li><p>
|
|---|
| 591 | Obtain from the Samba sources <code class="filename">~/examples/LDAP/samba.schema</code>
|
|---|
| 592 | and copy it to the <code class="filename">/etc/openldap/schema/</code> directory.
|
|---|
| 593 | </p></li><li><p>
|
|---|
| 594 | Set up the LDAP server. This example is suitable for OpenLDAP 2.1.x.
|
|---|
| 595 | The <code class="filename">/etc/openldap/slapd.conf</code> file.
|
|---|
| 596 | <a class="indexterm" name="id324233"></a>
|
|---|
| 597 | <font color="red"><title>Example slapd.conf File</title></font>
|
|---|
| 598 | </p><pre class="screen">
|
|---|
| 599 | # Note commented out lines have been removed
|
|---|
| 600 | include /etc/openldap/schema/core.schema
|
|---|
| 601 | include /etc/openldap/schema/cosine.schema
|
|---|
| 602 | include /etc/openldap/schema/inetorgperson.schema
|
|---|
| 603 | include /etc/openldap/schema/nis.schema
|
|---|
| 604 | include /etc/openldap/schema/samba.schema
|
|---|
| 605 |
|
|---|
| 606 | pidfile /var/run/slapd/slapd.pid
|
|---|
| 607 | argsfile /var/run/slapd/slapd.args
|
|---|
| 608 |
|
|---|
| 609 | database bdb
|
|---|
| 610 | suffix "dc=quenya,dc=org"
|
|---|
| 611 | rootdn "cn=Manager,dc=quenya,dc=org"
|
|---|
| 612 | rootpw {SSHA}06qDkonA8hk6W6SSnRzWj0/pBcU3m0/P
|
|---|
| 613 | # The password for the above is 'nastyon3'
|
|---|
| 614 |
|
|---|
| 615 | directory /var/lib/ldap
|
|---|
| 616 |
|
|---|
| 617 | index objectClass eq
|
|---|
| 618 | index cn pres,sub,eq
|
|---|
| 619 | index sn pres,sub,eq
|
|---|
| 620 | index uid pres,sub,eq
|
|---|
| 621 | index displayName pres,sub,eq
|
|---|
| 622 | index uidNumber eq
|
|---|
| 623 | index gidNumber eq
|
|---|
| 624 | index memberUid eq
|
|---|
| 625 | index sambaSID eq
|
|---|
| 626 | index sambaPrimaryGroupSID eq
|
|---|
| 627 | index sambaDomainName eq
|
|---|
| 628 | index default sub
|
|---|
| 629 | </pre><p>
|
|---|
| 630 | </p></li><li><p>
|
|---|
| 631 | Create the following file <code class="filename">initdb.ldif</code>:
|
|---|
| 632 | <a class="indexterm" name="id324271"></a>
|
|---|
| 633 | </p><pre class="programlisting">
|
|---|
| 634 | # Organization for SambaXP Demo
|
|---|
| 635 | dn: dc=quenya,dc=org
|
|---|
| 636 | objectclass: dcObject
|
|---|
| 637 | objectclass: organization
|
|---|
| 638 | dc: quenya
|
|---|
| 639 | o: SambaXP Demo
|
|---|
| 640 | description: The SambaXP Demo LDAP Tree
|
|---|
| 641 |
|
|---|
| 642 | # Organizational Role for Directory Management
|
|---|
| 643 | dn: cn=Manager,dc=quenya,dc=org
|
|---|
| 644 | objectclass: organizationalRole
|
|---|
| 645 | cn: Manager
|
|---|
| 646 | description: Directory Manager
|
|---|
| 647 |
|
|---|
| 648 | # Setting up the container for users
|
|---|
| 649 | dn: ou=People, dc=quenya, dc=org
|
|---|
| 650 | objectclass: top
|
|---|
| 651 | objectclass: organizationalUnit
|
|---|
| 652 | ou: People
|
|---|
| 653 |
|
|---|
| 654 | # Set up an admin handle for People OU
|
|---|
| 655 | dn: cn=admin, ou=People, dc=quenya, dc=org
|
|---|
| 656 | cn: admin
|
|---|
| 657 | objectclass: top
|
|---|
| 658 | objectclass: organizationalRole
|
|---|
| 659 | objectclass: simpleSecurityObject
|
|---|
| 660 | userPassword: {SSHA}0jBHgQ1vp4EDX2rEMMfIudvRMJoGwjVb
|
|---|
| 661 | # The password for above is 'mordonL8'
|
|---|
| 662 | </pre><p>
|
|---|
| 663 | </p></li><li><p>
|
|---|
| 664 | Load the initial data above into the LDAP database:
|
|---|
| 665 | </p><pre class="screen">
|
|---|
| 666 | <code class="prompt">root# </code><strong class="userinput"><code>slapadd -v -l initdb.ldif</code></strong>
|
|---|
| 667 | </pre><p>
|
|---|
| 668 | </p></li><li><p>
|
|---|
| 669 | Start the LDAP server using the appropriate tool or method for
|
|---|
| 670 | the operating system platform on which it is installed.
|
|---|
| 671 | </p></li><li><p>
|
|---|
| 672 | Install the Idealx script files in the <code class="filename">/usr/local/sbin</code> directory,
|
|---|
| 673 | then configure the smbldap_conf.pm file to match your system configuration.
|
|---|
| 674 | </p></li><li><p>
|
|---|
| 675 | The <code class="filename">smb.conf</code> file that drives this backend can be found in example <a href="FastStart.html#fast-ldap" title="Example 2.9. LDAP backend smb.conf for PDC">LDAP backend smb.conf for PDC</a>. Add additional stanzas
|
|---|
| 676 | as required.
|
|---|
| 677 | </p></li><li><p>
|
|---|
| 678 | Add the LDAP password to the <code class="filename">secrets.tdb</code> file so Samba can update
|
|---|
| 679 | the LDAP database:
|
|---|
| 680 | </p><pre class="screen">
|
|---|
| 681 | <code class="prompt">root# </code><strong class="userinput"><code>smbpasswd -w mordonL8</code></strong>
|
|---|
| 682 | </pre><p>
|
|---|
| 683 | </p></li><li><p>
|
|---|
| 684 | Add users and groups as required. Users and groups added using Samba tools
|
|---|
| 685 | will automatically be added to both the LDAP backend and the operating
|
|---|
| 686 | system as required.
|
|---|
| 687 | </p></li></ol></div></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id324830"></a>Backup Domain Controller</h5></div></div></div><p>
|
|---|
| 688 | <a href="FastStart.html#fast-bdc" title="Example 2.10. Remote LDAP BDC smb.conf">???</a> shows the example configuration for the BDC. Note that
|
|---|
| 689 | the <code class="filename">smb.conf</code> file does not specify the smbldap-tools scripts they are
|
|---|
| 690 | not needed on a BDC. Add additional stanzas for shares and printers as required.
|
|---|
| 691 | </p><div class="procedure"><div class="example"><a name="fast-bdc"></a><p class="title"><b>Example 2.10. Remote LDAP BDC smb.conf</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id324905"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id324918"></a><em class="parameter"><code>netbios name = GANDALF</code></em></td></tr><tr><td><a class="indexterm" name="id324930"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://frodo.quenya.org</code></em></td></tr><tr><td><a class="indexterm" name="id324943"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id324956"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id324968"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id324981"></a><em class="parameter"><code>logon path = \\%L\Profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id324994"></a><em class="parameter"><code>logon drive = H:</code></em></td></tr><tr><td><a class="indexterm" name="id325006"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id325019"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id325031"></a><em class="parameter"><code>os level = 33</code></em></td></tr><tr><td><a class="indexterm" name="id325044"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id325056"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id325069"></a><em class="parameter"><code>ldap suffix = dc=quenya,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id325082"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id325094"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id325107"></a><em class="parameter"><code>ldap group suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id325120"></a><em class="parameter"><code>ldap idmap suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id325132"></a><em class="parameter"><code>ldap admin dn = cn=Manager</code></em></td></tr><tr><td><a class="indexterm" name="id325145"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id325157"></a><em class="parameter"><code>ldap passwd sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id325170"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id325182"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id325195"></a><em class="parameter"><code>printing = cups</code></em></td></tr></table></div></div><br class="example-break"><ol type="1"><li><p>
|
|---|
| 692 | Decide if the BDC should have its own LDAP server or not. If the BDC is to be
|
|---|
| 693 | the LDAP server, change the following <code class="filename">smb.conf</code> as indicated. The default
|
|---|
| 694 | configuration in <a href="FastStart.html#fast-bdc" title="Example 2.10. Remote LDAP BDC smb.conf">Remote LDAP BDC smb.conf</a>
|
|---|
| 695 | uses a central LDAP server.
|
|---|
| 696 | </p></li><li><p>
|
|---|
| 697 | Configure the NETLOGON and PROFILES directory as for the PDC in <a href="FastStart.html#fast-bdc" title="Example 2.10. Remote LDAP BDC smb.conf">???</a>.
|
|---|
| 698 | </p></li></ol></div></div></div></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="install.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="introduction.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="type.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 1. How to Install and Test SAMBA </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Part II. Server Configuration Basics</td></tr></table></div></body></html>
|
|---|
