| 1 | <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>winbindd</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en"><a name="winbindd.8"></a><div class="titlepage"></div><div class="refnamediv"><h2>Name</h2><p>winbindd — Name Service Switch daemon for resolving names
|
|---|
| 2 | from NT servers</p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><div class="cmdsynopsis"><p><code class="literal">winbindd</code> [-F] [-S] [-i] [-Y] [-d <debug level>] [-s <smb config file>] [-n]</p></div></div><div class="refsect1" lang="en"><a name="id259558"></a><h2>DESCRIPTION</h2><p>This program is part of the <a href="samba.7.html"><span class="citerefentry"><span class="refentrytitle">samba</span>(7)</span></a> suite.</p><p><code class="literal">winbindd</code> is a daemon that provides
|
|---|
| 3 | a number of services to the Name Service Switch capability found
|
|---|
| 4 | in most modern C libraries, to arbitary applications via PAM
|
|---|
| 5 | and <code class="literal">ntlm_auth</code> and to Samba itself.</p><p>Even if winbind is not used for nsswitch, it still provides a
|
|---|
| 6 | service to <code class="literal">smbd</code>, <code class="literal">ntlm_auth</code>
|
|---|
| 7 | and the <code class="literal">pam_winbind.so</code> PAM module, by managing connections to
|
|---|
| 8 | domain controllers. In this configuraiton the
|
|---|
| 9 | <a class="indexterm" name="id259361"></a>idmap uid and
|
|---|
| 10 | <a class="indexterm" name="id259368"></a>idmap gid
|
|---|
| 11 | parameters are not required. (This is known as `netlogon proxy only mode'.)</p><p> The Name Service Switch allows user
|
|---|
| 12 | and system information to be obtained from different databases
|
|---|
| 13 | services such as NIS or DNS. The exact behaviour can be configured
|
|---|
| 14 | throught the <code class="filename">/etc/nsswitch.conf</code> file.
|
|---|
| 15 | Users and groups are allocated as they are resolved to a range
|
|---|
| 16 | of user and group ids specified by the administrator of the
|
|---|
| 17 | Samba system.</p><p>The service provided by <code class="literal">winbindd</code> is called `winbind' and
|
|---|
| 18 | can be used to resolve user and group information from a
|
|---|
| 19 | Windows NT server. The service can also provide authentication
|
|---|
| 20 | services via an associated PAM module. </p><p>
|
|---|
| 21 | The <code class="filename">pam_winbind</code> module supports the
|
|---|
| 22 | <em class="parameter"><code>auth</code></em>, <em class="parameter"><code>account</code></em>
|
|---|
| 23 | and <em class="parameter"><code>password</code></em>
|
|---|
| 24 | module-types. It should be noted that the
|
|---|
| 25 | <em class="parameter"><code>account</code></em> module simply performs a getpwnam() to verify that
|
|---|
| 26 | the system can obtain a uid for the user, as the domain
|
|---|
| 27 | controller has already performed access control. If the
|
|---|
| 28 | <code class="filename">libnss_winbind</code> library has been correctly
|
|---|
| 29 | installed, or an alternate source of names configured, this should always succeed.
|
|---|
| 30 | </p><p>The following nsswitch databases are implemented by
|
|---|
| 31 | the winbindd service: </p><div class="variablelist"><dl><dt><span class="term">hosts</span></dt><dd><p>This feature is only available on IRIX.
|
|---|
| 32 | User information traditionally stored in
|
|---|
| 33 | the <code class="filename">hosts(5)</code> file and used by
|
|---|
| 34 | <code class="literal">gethostbyname(3)</code> functions. Names are
|
|---|
| 35 | resolved through the WINS server or by broadcast.
|
|---|
| 36 | </p></dd><dt><span class="term">passwd</span></dt><dd><p>User information traditionally stored in
|
|---|
| 37 | the <code class="filename">passwd(5)</code> file and used by
|
|---|
| 38 | <code class="literal">getpwent(3)</code> functions. </p></dd><dt><span class="term">group</span></dt><dd><p>Group information traditionally stored in
|
|---|
| 39 | the <code class="filename">group(5)</code> file and used by
|
|---|
| 40 | <code class="literal">getgrent(3)</code> functions. </p></dd></dl></div><p>For example, the following simple configuration in the
|
|---|
| 41 | <code class="filename">/etc/nsswitch.conf</code> file can be used to initially
|
|---|
| 42 | resolve user and group information from <code class="filename">/etc/passwd
|
|---|
| 43 | </code> and <code class="filename">/etc/group</code> and then from the
|
|---|
| 44 | Windows NT server.
|
|---|
| 45 | </p><pre class="programlisting">
|
|---|
| 46 | passwd: files winbind
|
|---|
| 47 | group: files winbind
|
|---|
| 48 | ## only available on IRIX; Linux users should us libnss_wins.so
|
|---|
| 49 | hosts: files dns winbind
|
|---|
| 50 | </pre><p>The following simple configuration in the
|
|---|
| 51 | <code class="filename">/etc/nsswitch.conf</code> file can be used to initially
|
|---|
| 52 | resolve hostnames from <code class="filename">/etc/hosts</code> and then from the
|
|---|
| 53 | WINS server.</p><pre class="programlisting">
|
|---|
| 54 | hosts: files wins
|
|---|
| 55 | </pre></div><div class="refsect1" lang="en"><a name="id260125"></a><h2>OPTIONS</h2><div class="variablelist"><dl><dt><span class="term">-F</span></dt><dd><p>If specified, this parameter causes
|
|---|
| 56 | the main <code class="literal">winbindd</code> process to not daemonize,
|
|---|
| 57 | i.e. double-fork and disassociate with the terminal.
|
|---|
| 58 | Child processes are still created as normal to service
|
|---|
| 59 | each connection request, but the main process does not
|
|---|
| 60 | exit. This operation mode is suitable for running
|
|---|
| 61 | <code class="literal">winbindd</code> under process supervisors such
|
|---|
| 62 | as <code class="literal">supervise</code> and <code class="literal">svscan</code>
|
|---|
| 63 | from Daniel J. Bernstein's <code class="literal">daemontools</code>
|
|---|
| 64 | package, or the AIX process monitor.
|
|---|
| 65 | </p></dd><dt><span class="term">-S</span></dt><dd><p>If specified, this parameter causes
|
|---|
| 66 | <code class="literal">winbindd</code> to log to standard output rather
|
|---|
| 67 | than a file.</p></dd><dt><span class="term">-V</span></dt><dd><p>Prints the program version number.
|
|---|
| 68 | </p></dd><dt><span class="term">-s <configuration file></span></dt><dd><p>The file specified contains the
|
|---|
| 69 | configuration details required by the server. The
|
|---|
| 70 | information in this file includes server-specific
|
|---|
| 71 | information such as what printcap file to use, as well
|
|---|
| 72 | as descriptions of all the services that the server is
|
|---|
| 73 | to provide. See <code class="filename">smb.conf</code> for more information.
|
|---|
| 74 | The default configuration file name is determined at
|
|---|
| 75 | compile time.</p></dd><dt><span class="term">-d|--debuglevel=level</span></dt><dd><p><em class="replaceable"><code>level</code></em> is an integer
|
|---|
| 76 | from 0 to 10. The default value if this parameter is
|
|---|
| 77 | not specified is zero.</p><p>The higher this value, the more detail will be
|
|---|
| 78 | logged to the log files about the activities of the
|
|---|
| 79 | server. At level 0, only critical errors and serious
|
|---|
| 80 | warnings will be logged. Level 1 is a reasonable level for
|
|---|
| 81 | day-to-day running - it generates a small amount of
|
|---|
| 82 | information about operations carried out.</p><p>Levels above 1 will generate considerable
|
|---|
| 83 | amounts of log data, and should only be used when
|
|---|
| 84 | investigating a problem. Levels above 3 are designed for
|
|---|
| 85 | use only by developers and generate HUGE amounts of log
|
|---|
| 86 | data, most of which is extremely cryptic.</p><p>Note that specifying this parameter here will
|
|---|
| 87 | override the <a class="indexterm" name="id300475"></a> parameter
|
|---|
| 88 | in the <code class="filename">smb.conf</code> file.</p></dd><dt><span class="term">-l|--logfile=logdirectory</span></dt><dd><p>Base directory name for log/debug files. The extension
|
|---|
| 89 | <code class="constant">".progname"</code> will be appended (e.g. log.smbclient,
|
|---|
| 90 | log.smbd, etc...). The log file is never removed by the client.
|
|---|
| 91 | </p></dd><dt><span class="term">-h|--help</span></dt><dd><p>Print a summary of command line options.
|
|---|
| 92 | </p></dd><dt><span class="term">-i</span></dt><dd><p>Tells <code class="literal">winbindd</code> to not
|
|---|
| 93 | become a daemon and detach from the current terminal. This
|
|---|
| 94 | option is used by developers when interactive debugging
|
|---|
| 95 | of <code class="literal">winbindd</code> is required.
|
|---|
| 96 | <code class="literal">winbindd</code> also logs to standard output,
|
|---|
| 97 | as if the <code class="literal">-S</code> parameter had been given.
|
|---|
| 98 | </p></dd><dt><span class="term">-n</span></dt><dd><p>Disable caching. This means winbindd will
|
|---|
| 99 | always have to wait for a response from the domain controller
|
|---|
| 100 | before it can respond to a client and this thus makes things
|
|---|
| 101 | slower. The results will however be more accurate, since
|
|---|
| 102 | results from the cache might not be up-to-date. This
|
|---|
| 103 | might also temporarily hang winbindd if the DC doesn't respond.
|
|---|
| 104 | </p></dd><dt><span class="term">-Y</span></dt><dd><p>Single daemon mode. This means winbindd will run
|
|---|
| 105 | as a single process (the mode of operation in Samba 2.2). Winbindd's
|
|---|
| 106 | default behavior is to launch a child process that is responsible for
|
|---|
| 107 | updating expired cache entries.
|
|---|
| 108 | </p></dd></dl></div></div><div class="refsect1" lang="en"><a name="id300582"></a><h2>NAME AND ID RESOLUTION</h2><p>Users and groups on a Windows NT server are assigned
|
|---|
| 109 | a security id (SID) which is globally unique when the
|
|---|
| 110 | user or group is created. To convert the Windows NT user or group
|
|---|
| 111 | into a unix user or group, a mapping between SIDs and unix user
|
|---|
| 112 | and group ids is required. This is one of the jobs that <code class="literal">
|
|---|
| 113 | winbindd</code> performs. </p><p>As winbindd users and groups are resolved from a server, user
|
|---|
| 114 | and group ids are allocated from a specified range. This
|
|---|
| 115 | is done on a first come, first served basis, although all existing
|
|---|
| 116 | users and groups will be mapped as soon as a client performs a user
|
|---|
| 117 | or group enumeration command. The allocated unix ids are stored
|
|---|
| 118 | in a database and will be remembered. </p><p>WARNING: The SID to unix id database is the only location
|
|---|
| 119 | where the user and group mappings are stored by winbindd. If this
|
|---|
| 120 | store is deleted or corrupted, there is no way for winbindd to
|
|---|
| 121 | determine which user and group ids correspond to Windows NT user
|
|---|
| 122 | and group rids. </p><p>See the <a class="indexterm" name="id300614"></a> or the old <a class="indexterm" name="id300619"></a> parameters in
|
|---|
| 123 | <code class="filename">smb.conf</code> for options for sharing this
|
|---|
| 124 | database, such as via LDAP.</p></div><div class="refsect1" lang="en"><a name="id300634"></a><h2>CONFIGURATION</h2><p>Configuration of the <code class="literal">winbindd</code> daemon
|
|---|
| 125 | is done through configuration parameters in the <a href="smb.conf.5.html"><span class="citerefentry"><span class="refentrytitle">smb.conf</span>(5)</span></a> file. All parameters should be specified in the
|
|---|
| 126 | [global] section of smb.conf. </p><div class="itemizedlist"><ul type="disc"><li><p>
|
|---|
| 127 | <a class="indexterm" name="id300664"></a>winbind separator</p></li><li><p>
|
|---|
| 128 | <a class="indexterm" name="id300675"></a>idmap uid</p></li><li><p>
|
|---|
| 129 | <a class="indexterm" name="id300687"></a>idmap gid</p></li><li><p>
|
|---|
| 130 | <a class="indexterm" name="id300698"></a>idmap backend</p></li><li><p>
|
|---|
| 131 | <a class="indexterm" name="id300709"></a>winbind cache time</p></li><li><p>
|
|---|
| 132 | <a class="indexterm" name="id300721"></a>winbind enum users</p></li><li><p>
|
|---|
| 133 | <a class="indexterm" name="id300732"></a>winbind enum groups</p></li><li><p>
|
|---|
| 134 | <a class="indexterm" name="id300743"></a>template homedir</p></li><li><p>
|
|---|
| 135 | <a class="indexterm" name="id300755"></a>template shell</p></li><li><p>
|
|---|
| 136 | <a class="indexterm" name="id300766"></a>winbind use default domain</p></li><li><p>
|
|---|
| 137 | <a class="indexterm" name="id300778"></a>winbind: rpc only
|
|---|
| 138 | Setting this parameter forces winbindd to use RPC
|
|---|
| 139 | instead of LDAP to retrieve information from Domain
|
|---|
| 140 | Controllers.
|
|---|
| 141 | </p></li></ul></div></div><div class="refsect1" lang="en"><a name="id300789"></a><h2>EXAMPLE SETUP</h2><p>
|
|---|
| 142 | To setup winbindd for user and group lookups plus
|
|---|
| 143 | authentication from a domain controller use something like the
|
|---|
| 144 | following setup. This was tested on an early Red Hat Linux box.
|
|---|
| 145 | </p><p>In <code class="filename">/etc/nsswitch.conf</code> put the
|
|---|
| 146 | following:
|
|---|
| 147 | </p><pre class="programlisting">
|
|---|
| 148 | passwd: files winbind
|
|---|
| 149 | group: files winbind
|
|---|
| 150 | </pre><p>
|
|---|
| 151 | </p><p>In <code class="filename">/etc/pam.d/*</code> replace the <em class="parameter"><code>
|
|---|
| 152 | auth</code></em> lines with something like this:
|
|---|
| 153 | </p><pre class="programlisting">
|
|---|
| 154 | auth required /lib/security/pam_securetty.so
|
|---|
| 155 | auth required /lib/security/pam_nologin.so
|
|---|
| 156 | auth sufficient /lib/security/pam_winbind.so
|
|---|
| 157 | auth required /lib/security/pam_unix.so \
|
|---|
| 158 | use_first_pass shadow nullok
|
|---|
| 159 | </pre><p>
|
|---|
| 160 | </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
|
|---|
| 161 | The PAM module pam_unix has recently replaced the module pam_pwdb.
|
|---|
| 162 | Some Linux systems use the module pam_unix2 in place of pam_unix.
|
|---|
| 163 | </p></div><p>Note in particular the use of the <em class="parameter"><code>sufficient
|
|---|
| 164 | </code></em> keyword and the <em class="parameter"><code>use_first_pass</code></em> keyword. </p><p>Now replace the account lines with this: </p><p><code class="literal">account required /lib/security/pam_winbind.so
|
|---|
| 165 | </code></p><p>The next step is to join the domain. To do that use the
|
|---|
| 166 | <code class="literal">net</code> program like this: </p><p><code class="literal">net join -S PDC -U Administrator</code></p><p>The username after the <em class="parameter"><code>-U</code></em> can be any
|
|---|
| 167 | Domain user that has administrator privileges on the machine.
|
|---|
| 168 | Substitute the name or IP of your PDC for "PDC".</p><p>Next copy <code class="filename">libnss_winbind.so</code> to
|
|---|
| 169 | <code class="filename">/lib</code> and <code class="filename">pam_winbind.so
|
|---|
| 170 | </code> to <code class="filename">/lib/security</code>. A symbolic link needs to be
|
|---|
| 171 | made from <code class="filename">/lib/libnss_winbind.so</code> to
|
|---|
| 172 | <code class="filename">/lib/libnss_winbind.so.2</code>. If you are using an
|
|---|
| 173 | older version of glibc then the target of the link should be
|
|---|
| 174 | <code class="filename">/lib/libnss_winbind.so.1</code>.</p><p>Finally, setup a <a href="smb.conf.5.html"><span class="citerefentry"><span class="refentrytitle">smb.conf</span>(5)</span></a> containing directives like the
|
|---|
| 175 | following:
|
|---|
| 176 | </p><pre class="programlisting">
|
|---|
| 177 | [global]
|
|---|
| 178 | winbind separator = +
|
|---|
| 179 | winbind cache time = 10
|
|---|
| 180 | template shell = /bin/bash
|
|---|
| 181 | template homedir = /home/%D/%U
|
|---|
| 182 | idmap uid = 10000-20000
|
|---|
| 183 | idmap gid = 10000-20000
|
|---|
| 184 | workgroup = DOMAIN
|
|---|
| 185 | security = domain
|
|---|
| 186 | password server = *
|
|---|
| 187 | </pre><p>Now start winbindd and you should find that your user and
|
|---|
| 188 | group database is expanded to include your NT users and groups,
|
|---|
| 189 | and that you can login to your unix box as a domain user, using
|
|---|
| 190 | the DOMAIN+user syntax for the username. You may wish to use the
|
|---|
| 191 | commands <code class="literal">getent passwd</code> and <code class="literal">getent group
|
|---|
| 192 | </code> to confirm the correct operation of winbindd.</p></div><div class="refsect1" lang="en"><a name="id300980"></a><h2>NOTES</h2><p>The following notes are useful when configuring and
|
|---|
| 193 | running <code class="literal">winbindd</code>: </p><p><a href="nmbd.8.html"><span class="citerefentry"><span class="refentrytitle">nmbd</span>(8)</span></a> must be running on the local machine
|
|---|
| 194 | for <code class="literal">winbindd</code> to work. </p><p>PAM is really easy to misconfigure. Make sure you know what
|
|---|
| 195 | you are doing when modifying PAM configuration files. It is possible
|
|---|
| 196 | to set up PAM such that you can no longer log into your system. </p><p>If more than one UNIX machine is running <code class="literal">winbindd</code>,
|
|---|
| 197 | then in general the user and groups ids allocated by winbindd will not
|
|---|
| 198 | be the same. The user and group ids will only be valid for the local
|
|---|
| 199 | machine, unless a shared <a class="indexterm" name="id301027"></a> is configured.</p><p>If the the Windows NT SID to UNIX user and group id mapping
|
|---|
| 200 | file is damaged or destroyed then the mappings will be lost. </p></div><div class="refsect1" lang="en"><a name="id301040"></a><h2>SIGNALS</h2><p>The following signals can be used to manipulate the
|
|---|
| 201 | <code class="literal">winbindd</code> daemon. </p><div class="variablelist"><dl><dt><span class="term">SIGHUP</span></dt><dd><p>Reload the <a href="smb.conf.5.html"><span class="citerefentry"><span class="refentrytitle">smb.conf</span>(5)</span></a> file and
|
|---|
| 202 | apply any parameter changes to the running
|
|---|
| 203 | version of winbindd. This signal also clears any cached
|
|---|
| 204 | user and group information. The list of other domains trusted
|
|---|
| 205 | by winbindd is also reloaded. </p></dd><dt><span class="term">SIGUSR2</span></dt><dd><p>The SIGUSR2 signal will cause <code class="literal">
|
|---|
| 206 | winbindd</code> to write status information to the winbind
|
|---|
| 207 | log file.</p><p>Log files are stored in the filename specified by the
|
|---|
| 208 | log file parameter.</p></dd></dl></div></div><div class="refsect1" lang="en"><a name="id301102"></a><h2>FILES</h2><div class="variablelist"><dl><dt><span class="term"><code class="filename">/etc/nsswitch.conf(5)</code></span></dt><dd><p>Name service switch configuration file.</p></dd><dt><span class="term">/tmp/.winbindd/pipe</span></dt><dd><p>The UNIX pipe over which clients communicate with
|
|---|
| 209 | the <code class="literal">winbindd</code> program. For security reasons, the
|
|---|
| 210 | winbind client will only attempt to connect to the winbindd daemon
|
|---|
| 211 | if both the <code class="filename">/tmp/.winbindd</code> directory
|
|---|
| 212 | and <code class="filename">/tmp/.winbindd/pipe</code> file are owned by
|
|---|
| 213 | root. </p></dd><dt><span class="term">$LOCKDIR/winbindd_privileged/pipe</span></dt><dd><p>The UNIX pipe over which 'privileged' clients
|
|---|
| 214 | communicate with the <code class="literal">winbindd</code> program. For security
|
|---|
| 215 | reasons, access to some winbindd functions - like those needed by
|
|---|
| 216 | the <code class="literal">ntlm_auth</code> utility - is restricted. By default,
|
|---|
| 217 | only users in the 'root' group will get this access, however the administrator
|
|---|
| 218 | may change the group permissions on $LOCKDIR/winbindd_privileged to allow
|
|---|
| 219 | programs like 'squid' to use ntlm_auth.
|
|---|
| 220 | Note that the winbind client will only attempt to connect to the winbindd daemon
|
|---|
| 221 | if both the <code class="filename">$LOCKDIR/winbindd_privileged</code> directory
|
|---|
| 222 | and <code class="filename">$LOCKDIR/winbindd_privileged/pipe</code> file are owned by
|
|---|
| 223 | root. </p></dd><dt><span class="term">/lib/libnss_winbind.so.X</span></dt><dd><p>Implementation of name service switch library.
|
|---|
| 224 | </p></dd><dt><span class="term">$LOCKDIR/winbindd_idmap.tdb</span></dt><dd><p>Storage for the Windows NT rid to UNIX user/group
|
|---|
| 225 | id mapping. The lock directory is specified when Samba is initially
|
|---|
| 226 | compiled using the <em class="parameter"><code>--with-lockdir</code></em> option.
|
|---|
| 227 | This directory is by default <code class="filename">/usr/local/samba/var/locks
|
|---|
| 228 | </code>. </p></dd><dt><span class="term">$LOCKDIR/winbindd_cache.tdb</span></dt><dd><p>Storage for cached user and group information.
|
|---|
| 229 | </p></dd></dl></div></div><div class="refsect1" lang="en"><a name="id301246"></a><h2>VERSION</h2><p>This man page is correct for version 3.0 of
|
|---|
| 230 | the Samba suite.</p></div><div class="refsect1" lang="en"><a name="id301257"></a><h2>SEE ALSO</h2><p><code class="filename">nsswitch.conf(5)</code>, <a href="samba.7.html"><span class="citerefentry"><span class="refentrytitle">samba</span>(7)</span></a>, <a href="wbinfo.1.html"><span class="citerefentry"><span class="refentrytitle">wbinfo</span>(1)</span></a>, <a href="ntlm_auth.8.html"><span class="citerefentry"><span class="refentrytitle">ntlm_auth</span>(8)</span></a>, <a href="smb.conf.5.html"><span class="citerefentry"><span class="refentrytitle">smb.conf</span>(5)</span></a>, <a href="pam_winbind.8.html"><span class="citerefentry"><span class="refentrytitle">pam_winbind</span>(8)</span></a></p></div><div class="refsect1" lang="en"><a name="id301314"></a><h2>AUTHOR</h2><p>The original Samba software and related utilities
|
|---|
| 231 | were created by Andrew Tridgell. Samba is now developed
|
|---|
| 232 | by the Samba Team as an Open Source project similar
|
|---|
| 233 | to the way the Linux kernel is developed.</p><p><code class="literal">wbinfo</code> and <code class="literal">winbindd</code> were
|
|---|
| 234 | written by Tim Potter.</p><p>The conversion to DocBook for Samba 2.2 was done
|
|---|
| 235 | by Gerald Carter. The conversion to DocBook XML 4.2 for
|
|---|
| 236 | Samba 3.0 was done by Alexander Bokovoy.</p></div></div></body></html>
|
|---|
