| 1 | <?xml version="1.0" encoding="iso-8859-1"?>
|
|---|
| 2 | <!DOCTYPE chapter PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
|
|---|
| 3 | <chapter id="FastStart">
|
|---|
| 4 | <chapterinfo>
|
|---|
| 5 | &author.jht;
|
|---|
| 6 | </chapterinfo>
|
|---|
| 7 |
|
|---|
| 8 | <title>Fast Start: Cure for Impatience</title>
|
|---|
| 9 |
|
|---|
| 10 | <para>
|
|---|
| 11 | When we first asked for suggestions for inclusion in the Samba HOWTO documentation,
|
|---|
| 12 | someone wrote asking for example configurations &smbmdash; and lots of them. That is remarkably
|
|---|
| 13 | difficult to do without losing a lot of value that can be derived from presenting
|
|---|
| 14 | many extracts from working systems. That is what the rest of this document does.
|
|---|
| 15 | It does so with extensive descriptions of the configuration possibilities within the
|
|---|
| 16 | context of the chapter that covers it. We hope that this chapter is the medicine
|
|---|
| 17 | that has been requested.
|
|---|
| 18 | </para>
|
|---|
| 19 |
|
|---|
| 20 | <para>
|
|---|
| 21 | The information in this chapter is very sparse compared with the book <quote>Samba-3 by Example</quote>
|
|---|
| 22 | that was written after the original version of this book was nearly complete. <quote>Samba-3 by Example</quote>
|
|---|
| 23 | was the result of feedback from reviewers during the final copy editing of the first edition. It
|
|---|
| 24 | was interesting to see that reader feedback mirrored that given by the original reviewers.
|
|---|
| 25 | In any case, a month and a half was spent in doing basic research to better understand what
|
|---|
| 26 | new as well as experienced network administrators would best benefit from. The book <quote>Samba-3 by Example</quote>
|
|---|
| 27 | is the result of that research. What is presented in the few pages of this book is covered
|
|---|
| 28 | far more comprehensively in the second edition of <quote>Samba-3 by Example</quote>. The second edition
|
|---|
| 29 | of both books will be released at the same time.
|
|---|
| 30 | </para>
|
|---|
| 31 |
|
|---|
| 32 | <para>
|
|---|
| 33 | So in summary, the book <quote>The Official Samba-3 HOWTO & Reference Guide</quote> is intended
|
|---|
| 34 | as the equivalent of an auto mechanic's repair guide. The book <quote>Samba-3 by Example</quote> is the
|
|---|
| 35 | equivalent of the driver's guide that explains how to drive the car. If you want complete network
|
|---|
| 36 | configuration examples, go to <ulink url="http://www.samba.org/samba/docs/Samba3-ByExample.pdf">Samba-3 by
|
|---|
| 37 | Example</ulink>.
|
|---|
| 38 | </para>
|
|---|
| 39 |
|
|---|
| 40 | <sect1>
|
|---|
| 41 | <title>Features and Benefits</title>
|
|---|
| 42 |
|
|---|
| 43 | <para>
|
|---|
| 44 | Samba needs very little configuration to create a basic working system.
|
|---|
| 45 | In this chapter we progress from the simple to the complex, for each providing
|
|---|
| 46 | all steps and configuration file changes needed to make each work. Please note
|
|---|
| 47 | that a comprehensively configured system will likely employ additional smart
|
|---|
| 48 | features. These additional features are covered in the remainder of this document.
|
|---|
| 49 | </para>
|
|---|
| 50 |
|
|---|
| 51 | <para>
|
|---|
| 52 | The examples used here have been obtained from a number of people who made
|
|---|
| 53 | requests for example configurations. All identities have been obscured to protect
|
|---|
| 54 | the guilty, and any resemblance to unreal nonexistent sites is deliberate.
|
|---|
| 55 | </para>
|
|---|
| 56 |
|
|---|
| 57 | </sect1>
|
|---|
| 58 |
|
|---|
| 59 | <sect1>
|
|---|
| 60 | <title>Description of Example Sites</title>
|
|---|
| 61 |
|
|---|
| 62 | <para>
|
|---|
| 63 | In the first set of configuration examples we consider the case of exceptionally simple system requirements.
|
|---|
| 64 | There is a real temptation to make something that should require little effort much too complex.
|
|---|
| 65 | </para>
|
|---|
| 66 |
|
|---|
| 67 | <para>
|
|---|
| 68 | <link linkend="anon-ro"></link> documents the type of server that might be sufficient to serve CD-ROM images,
|
|---|
| 69 | or reference document files for network client use. This configuration is also discussed in <link
|
|---|
| 70 | linkend="StandAloneServer"></link>, <link linkend="RefDocServer"></link>. The purpose for this configuration
|
|---|
| 71 | is to provide a shared volume that is read-only that anyone, even guests, can access.
|
|---|
| 72 | </para>
|
|---|
| 73 |
|
|---|
| 74 | <para>
|
|---|
| 75 | The second example shows a minimal configuration for a print server that anyone can print to as long as they
|
|---|
| 76 | have the correct printer drivers installed on their computer. This is a mirror of the system described in
|
|---|
| 77 | <link linkend="StandAloneServer"></link>, <link linkend="SimplePrintServer"></link>.
|
|---|
| 78 | </para>
|
|---|
| 79 |
|
|---|
| 80 | <para>
|
|---|
| 81 | The next example is of a secure office file and print server that will be accessible only to users who have an
|
|---|
| 82 | account on the system. This server is meant to closely resemble a workgroup file and print server, but has to
|
|---|
| 83 | be more secure than an anonymous access machine. This type of system will typically suit the needs of a small
|
|---|
| 84 | office. The server provides no network logon facilities, offers no domain control; instead it is just a
|
|---|
| 85 | network-attached storage (NAS) device and a print server.
|
|---|
| 86 | </para>
|
|---|
| 87 |
|
|---|
| 88 | <para>
|
|---|
| 89 | The later example consider more complex systems that will either integrate into existing MS Windows networks
|
|---|
| 90 | or replace them entirely. These cover domain member servers as well as Samba domain control (PDC/BDC) and
|
|---|
| 91 | finally describes in detail a large distributed network with branch offices in remote locations.
|
|---|
| 92 | </para>
|
|---|
| 93 |
|
|---|
| 94 | </sect1>
|
|---|
| 95 |
|
|---|
| 96 | <sect1>
|
|---|
| 97 | <title>Worked Examples</title>
|
|---|
| 98 |
|
|---|
| 99 | <para>
|
|---|
| 100 | The configuration examples are designed to cover everything necessary to get Samba
|
|---|
| 101 | running. They do not cover basic operating system platform configuration, which is
|
|---|
| 102 | clearly beyond the scope of this text.
|
|---|
| 103 | </para>
|
|---|
| 104 |
|
|---|
| 105 | <para>
|
|---|
| 106 | It is also assumed that Samba has been correctly installed, either by way of installation
|
|---|
| 107 | of the packages that are provided by the operating system vendor or through other means.
|
|---|
| 108 | </para>
|
|---|
| 109 |
|
|---|
| 110 | <sect2>
|
|---|
| 111 | <title>Standalone Server</title>
|
|---|
| 112 |
|
|---|
| 113 | <para>
|
|---|
| 114 | <indexterm><primary>Server Type</primary><secondary>Stand-alone</secondary></indexterm>
|
|---|
| 115 | A standalone server implies no more than the fact that it is not a domain controller
|
|---|
| 116 | and it does not participate in domain control. It can be a simple, workgroup-like
|
|---|
| 117 | server, or it can be a complex server that is a member of a domain security context.
|
|---|
| 118 | </para>
|
|---|
| 119 |
|
|---|
| 120 | <para>
|
|---|
| 121 | As the examples are developed, every attempt is made to progress the system toward greater capability, just as
|
|---|
| 122 | one might expect would happen in a real business office as that office grows in size and its needs change.
|
|---|
| 123 | </para>
|
|---|
| 124 |
|
|---|
| 125 | <sect3 id="anon-ro">
|
|---|
| 126 | <title>Anonymous Read-Only Document Server</title>
|
|---|
| 127 |
|
|---|
| 128 | <para>
|
|---|
| 129 | <indexterm><primary>read only</primary><secondary>server</secondary></indexterm>
|
|---|
| 130 | The purpose of this type of server is to make available to any user
|
|---|
| 131 | any documents or files that are placed on the shared resource. The
|
|---|
| 132 | shared resource could be a CD-ROM drive, a CD-ROM image, or a file
|
|---|
| 133 | storage area.
|
|---|
| 134 | </para>
|
|---|
| 135 |
|
|---|
| 136 | <itemizedlist>
|
|---|
| 137 | <listitem><para>
|
|---|
| 138 | The file system share point will be <filename>/export</filename>.
|
|---|
| 139 | </para></listitem>
|
|---|
| 140 |
|
|---|
| 141 | <listitem><para>
|
|---|
| 142 | All files will be owned by a user called Jack Baumbach.
|
|---|
| 143 | Jack's login name will be <emphasis>jackb</emphasis>. His password will be
|
|---|
| 144 | <emphasis>m0r3pa1n</emphasis> &smbmdash; of course, that's just the example we are
|
|---|
| 145 | using; do not use this in a production environment because
|
|---|
| 146 | all readers of this document will know it.
|
|---|
| 147 | </para></listitem>
|
|---|
| 148 | </itemizedlist>
|
|---|
| 149 |
|
|---|
| 150 | <procedure>
|
|---|
| 151 | <title>Installation Procedure: Read-Only Server</title>
|
|---|
| 152 | <step><para>
|
|---|
| 153 | Add user to system (with creation of the user's home directory):
|
|---|
| 154 | <screen>
|
|---|
| 155 | &rootprompt;<userinput>useradd -c "Jack Baumbach" -m -g users -p m0r3pa1n jackb</userinput>
|
|---|
| 156 | </screen>
|
|---|
| 157 | </para></step>
|
|---|
| 158 |
|
|---|
| 159 | <step><para>
|
|---|
| 160 | Create directory, and set permissions and ownership:
|
|---|
| 161 | <screen>
|
|---|
| 162 | &rootprompt;<userinput>mkdir /export</userinput>
|
|---|
| 163 | &rootprompt;<userinput>chmod u+rwx,g+rx,o+rx /export</userinput>
|
|---|
| 164 | &rootprompt;<userinput>chown jackb.users /export</userinput>
|
|---|
| 165 | </screen>
|
|---|
| 166 | </para></step>
|
|---|
| 167 |
|
|---|
| 168 | <step><para>
|
|---|
| 169 | Copy the files that should be shared to the <filename>/export</filename>
|
|---|
| 170 | directory.
|
|---|
| 171 | </para></step>
|
|---|
| 172 |
|
|---|
| 173 | <step><para>
|
|---|
| 174 | Install the Samba configuration file (<filename>/etc/samba/smb.conf</filename>)
|
|---|
| 175 | as shown in <link linkend="anon-example">Anonymous Read-Only Server Configuration</link>.
|
|---|
| 176 | </para></step>
|
|---|
| 177 |
|
|---|
| 178 | <example id="anon-example">
|
|---|
| 179 | <title>Anonymous Read-Only Server Configuration</title>
|
|---|
| 180 | <smbconfblock>
|
|---|
| 181 | <smbconfcomment>Global parameters</smbconfcomment>
|
|---|
| 182 | <smbconfsection name="[global]"/>
|
|---|
| 183 | <smbconfoption name="workgroup">MIDEARTH</smbconfoption>
|
|---|
| 184 | <smbconfoption name="netbios name">HOBBIT</smbconfoption>
|
|---|
| 185 | <smbconfoption name="security">share</smbconfoption>
|
|---|
| 186 |
|
|---|
| 187 | <smbconfsection name="[data]"/>
|
|---|
| 188 | <smbconfoption name="comment">Data</smbconfoption>
|
|---|
| 189 | <smbconfoption name="path">/export</smbconfoption>
|
|---|
| 190 | <smbconfoption name="read only">Yes</smbconfoption>
|
|---|
| 191 | <smbconfoption name="guest ok">Yes</smbconfoption>
|
|---|
| 192 | </smbconfblock>
|
|---|
| 193 | </example>
|
|---|
| 194 |
|
|---|
| 195 | <step><para>
|
|---|
| 196 | Test the configuration file by executing the following command:
|
|---|
| 197 | <screen>
|
|---|
| 198 | &rootprompt;<userinput>testparm</userinput>
|
|---|
| 199 | </screen>
|
|---|
| 200 | Alternatively, where you are operating from a master configuration file called
|
|---|
| 201 | <filename>smb.conf.master</filename>, the following sequence of commands might prove
|
|---|
| 202 | more appropriate:
|
|---|
| 203 | <screen>
|
|---|
| 204 | &rootprompt; cd /etc/samba
|
|---|
| 205 | &rootprompt; testparm -s smb.conf.master > smb.conf
|
|---|
| 206 | &rootprompt; testparm
|
|---|
| 207 | </screen>
|
|---|
| 208 | Note any error messages that might be produced. Proceed only if error-free output has been
|
|---|
| 209 | obtained. An example of typical output that should be generated from the above configuration
|
|---|
| 210 | file is shown here:
|
|---|
| 211 | <screen>
|
|---|
| 212 | Load smb config files from /etc/samba/smb.conf
|
|---|
| 213 | Processing section "[data]"
|
|---|
| 214 | Loaded services file OK.
|
|---|
| 215 | Server role: ROLE_STANDALONE
|
|---|
| 216 | Press enter to see a dump of your service definitions
|
|---|
| 217 | <userinput>[Press enter]</userinput>
|
|---|
| 218 |
|
|---|
| 219 | # Global parameters
|
|---|
| 220 | [global]
|
|---|
| 221 | workgroup = MIDEARTH
|
|---|
| 222 | netbios name = HOBBIT
|
|---|
| 223 | security = share
|
|---|
| 224 |
|
|---|
| 225 | [data]
|
|---|
| 226 | comment = Data
|
|---|
| 227 | path = /export
|
|---|
| 228 | read only = Yes
|
|---|
| 229 | guest only = Yes
|
|---|
| 230 | </screen>
|
|---|
| 231 | </para></step>
|
|---|
| 232 |
|
|---|
| 233 | <step><para>
|
|---|
| 234 | Start Samba using the method applicable to your operating system platform. The method that
|
|---|
| 235 | should be used is platform dependent. Refer to <link linkend="startingSamba">Starting Samba</link>
|
|---|
| 236 | for further information regarding the starting of Samba.
|
|---|
| 237 | </para></step>
|
|---|
| 238 |
|
|---|
| 239 | <step><para>
|
|---|
| 240 | Configure your MS Windows client for workgroup <emphasis>MIDEARTH</emphasis>,
|
|---|
| 241 | set the machine name to ROBBINS, reboot, wait a few (2 - 5) minutes,
|
|---|
| 242 | then open Windows Explorer and visit the Network Neighborhood.
|
|---|
| 243 | The machine HOBBIT should be visible. When you click this machine
|
|---|
| 244 | icon, it should open up to reveal the <emphasis>data</emphasis> share. After
|
|---|
| 245 | you click the share, it should open up to reveal the files previously
|
|---|
| 246 | placed in the <filename>/export</filename> directory.
|
|---|
| 247 | </para></step>
|
|---|
| 248 | </procedure>
|
|---|
| 249 |
|
|---|
| 250 | <para>
|
|---|
| 251 | The information above (following # Global parameters) provides the complete
|
|---|
| 252 | contents of the <filename>/etc/samba/smb.conf</filename> file.
|
|---|
| 253 | </para>
|
|---|
| 254 |
|
|---|
| 255 | </sect3>
|
|---|
| 256 |
|
|---|
| 257 | <sect3>
|
|---|
| 258 | <title>Anonymous Read-Write Document Server</title>
|
|---|
| 259 |
|
|---|
| 260 | <para>
|
|---|
| 261 | <indexterm><primary>anonymous</primary><secondary>read-write server</secondary></indexterm>
|
|---|
| 262 | We should view this configuration as a progression from the previous example.
|
|---|
| 263 | The difference is that shared access is now forced to the user identity of jackb
|
|---|
| 264 | and to the primary group jackb belongs to. One other refinement we can make is to
|
|---|
| 265 | add the user <emphasis>jackb</emphasis> to the <filename>smbpasswd</filename> file.
|
|---|
| 266 | To do this, execute:
|
|---|
| 267 | <screen>
|
|---|
| 268 | &rootprompt;<userinput>smbpasswd -a jackb</userinput>
|
|---|
| 269 | New SMB password: <userinput>m0r3pa1n</userinput>
|
|---|
| 270 | Retype new SMB password: <userinput>m0r3pa1n</userinput>
|
|---|
| 271 | Added user jackb.
|
|---|
| 272 | </screen>
|
|---|
| 273 | Addition of this user to the <filename>smbpasswd</filename> file allows all files
|
|---|
| 274 | to be displayed in the Explorer Properties boxes as belonging to <emphasis>jackb</emphasis>
|
|---|
| 275 | instead of to <emphasis>User Unknown</emphasis>.
|
|---|
| 276 | </para>
|
|---|
| 277 |
|
|---|
| 278 | <para>
|
|---|
| 279 | The complete, modified &smb.conf; file is as shown in <link linkend="anon-rw"/>.
|
|---|
| 280 | </para>
|
|---|
| 281 |
|
|---|
| 282 | <example id="anon-rw">
|
|---|
| 283 | <title>Modified Anonymous Read-Write smb.conf</title>
|
|---|
| 284 | <smbconfblock>
|
|---|
| 285 | <smbconfcomment>Global parameters</smbconfcomment>
|
|---|
| 286 | <smbconfsection name="[global]"/>
|
|---|
| 287 | <smbconfoption name="workgroup">MIDEARTH</smbconfoption>
|
|---|
| 288 | <smbconfoption name="netbios name">HOBBIT</smbconfoption>
|
|---|
| 289 | <smbconfoption name="security">SHARE</smbconfoption>
|
|---|
| 290 |
|
|---|
| 291 | <smbconfsection name="[data]"/>
|
|---|
| 292 | <smbconfoption name="comment">Data</smbconfoption>
|
|---|
| 293 | <smbconfoption name="path">/export</smbconfoption>
|
|---|
| 294 | <smbconfoption name="force user">jackb</smbconfoption>
|
|---|
| 295 | <smbconfoption name="force group">users</smbconfoption>
|
|---|
| 296 | <smbconfoption name="read only">No</smbconfoption>
|
|---|
| 297 | <smbconfoption name="guest ok">Yes</smbconfoption>
|
|---|
| 298 | </smbconfblock>
|
|---|
| 299 | </example>
|
|---|
| 300 |
|
|---|
| 301 | </sect3>
|
|---|
| 302 |
|
|---|
| 303 | <sect3>
|
|---|
| 304 | <title>Anonymous Print Server</title>
|
|---|
| 305 |
|
|---|
| 306 | <para>
|
|---|
| 307 | <indexterm><primary>anonymous</primary><secondary>print server</secondary></indexterm>
|
|---|
| 308 | An anonymous print server serves two purposes:
|
|---|
| 309 | </para>
|
|---|
| 310 |
|
|---|
| 311 | <itemizedlist>
|
|---|
| 312 | <listitem><para>
|
|---|
| 313 | It allows printing to all printers from a single location.
|
|---|
| 314 | </para></listitem>
|
|---|
| 315 |
|
|---|
| 316 | <listitem><para>
|
|---|
| 317 | It reduces network traffic congestion due to many users trying
|
|---|
| 318 | to access a limited number of printers.
|
|---|
| 319 | </para></listitem>
|
|---|
| 320 | </itemizedlist>
|
|---|
| 321 |
|
|---|
| 322 | <para>
|
|---|
| 323 | In the simplest of anonymous print servers, it is common to require the installation
|
|---|
| 324 | of the correct printer drivers on the Windows workstation. In this case the print
|
|---|
| 325 | server will be designed to just pass print jobs through to the spooler, and the spooler
|
|---|
| 326 | should be configured to do raw pass-through to the printer. In other words, the print
|
|---|
| 327 | spooler should not filter or process the data stream being passed to the printer.
|
|---|
| 328 | </para>
|
|---|
| 329 |
|
|---|
| 330 | <para>
|
|---|
| 331 | In this configuration, it is undesirable to present the Add Printer Wizard, and we do
|
|---|
| 332 | not want to have automatic driver download, so we disable it in the following
|
|---|
| 333 | configuration. <link linkend="anon-print"></link> is the resulting &smb.conf; file.
|
|---|
| 334 | </para>
|
|---|
| 335 |
|
|---|
| 336 | <example id="anon-print">
|
|---|
| 337 | <title>Anonymous Print Server smb.conf</title>
|
|---|
| 338 | <smbconfblock>
|
|---|
| 339 | <smbconfcomment>Global parameters</smbconfcomment>
|
|---|
| 340 | <smbconfsection name="[global]"/>
|
|---|
| 341 | <smbconfoption name="workgroup">MIDEARTH</smbconfoption>
|
|---|
| 342 | <smbconfoption name="netbios name">LUTHIEN</smbconfoption>
|
|---|
| 343 | <smbconfoption name="security">share</smbconfoption>
|
|---|
| 344 | <smbconfoption name="printcap name">cups</smbconfoption>
|
|---|
| 345 | <smbconfoption name="disable spoolss">Yes</smbconfoption>
|
|---|
| 346 | <smbconfoption name="show add printer wizard">No</smbconfoption>
|
|---|
| 347 | <smbconfoption name="printing">cups</smbconfoption>
|
|---|
| 348 |
|
|---|
| 349 | <smbconfsection name="[printers]"/>
|
|---|
| 350 | <smbconfoption name="comment">All Printers</smbconfoption>
|
|---|
| 351 | <smbconfoption name="path">/var/spool/samba</smbconfoption>
|
|---|
| 352 | <smbconfoption name="guest ok">Yes</smbconfoption>
|
|---|
| 353 | <smbconfoption name="printable">Yes</smbconfoption>
|
|---|
| 354 | <smbconfoption name="use client driver">Yes</smbconfoption>
|
|---|
| 355 | <smbconfoption name="browseable">No</smbconfoption>
|
|---|
| 356 | </smbconfblock>
|
|---|
| 357 | </example>
|
|---|
| 358 |
|
|---|
| 359 | <para>
|
|---|
| 360 | The above configuration is not ideal. It uses no smart features, and it deliberately
|
|---|
| 361 | presents a less than elegant solution. But it is basic, and it does print. Samba makes
|
|---|
| 362 | use of the direct printing application program interface that is provided by CUPS.
|
|---|
| 363 | When Samba has been compiled and linked with the CUPS libraries, the default printing
|
|---|
| 364 | system will be CUPS. By specifying that the printcap name is CUPS, Samba will use
|
|---|
| 365 | the CUPS library API to communicate directly with CUPS for all printer functions.
|
|---|
| 366 | It is possible to force the use of external printing commands by setting the value
|
|---|
| 367 | of the <parameter>printing</parameter> to either SYSV or BSD, and thus the value of
|
|---|
| 368 | the parameter <parameter>printcap name</parameter> must be set to something other than
|
|---|
| 369 | CUPS. In such case, it could be set to the name of any file that contains a list
|
|---|
| 370 | of printers that should be made available to Windows clients.
|
|---|
| 371 | </para>
|
|---|
| 372 |
|
|---|
| 373 | <note><para>
|
|---|
| 374 | Windows users will need to install a local printer and then change the print
|
|---|
| 375 | to device after installation of the drivers. The print to device can then be set to
|
|---|
| 376 | the network printer on this machine.
|
|---|
| 377 | </para></note>
|
|---|
| 378 |
|
|---|
| 379 | <para>
|
|---|
| 380 | Make sure that the directory <filename>/var/spool/samba</filename> is capable of being used
|
|---|
| 381 | as intended. The following steps must be taken to achieve this:
|
|---|
| 382 | </para>
|
|---|
| 383 |
|
|---|
| 384 | <itemizedlist>
|
|---|
| 385 | <listitem><para>
|
|---|
| 386 | The directory must be owned by the superuser (root) user and group:
|
|---|
| 387 | <screen>
|
|---|
| 388 | &rootprompt;<userinput>chown root.root /var/spool/samba</userinput>
|
|---|
| 389 | </screen>
|
|---|
| 390 | </para></listitem>
|
|---|
| 391 |
|
|---|
| 392 | <listitem><para>
|
|---|
| 393 | Directory permissions should be set for public read-write with the
|
|---|
| 394 | sticky bit set as shown:
|
|---|
| 395 | <screen>
|
|---|
| 396 | &rootprompt;<userinput>chmod a+twrx /var/spool/samba</userinput>
|
|---|
| 397 | </screen>
|
|---|
| 398 | The purpose of setting the sticky bit is to prevent who does not own the temporary print file
|
|---|
| 399 | from being able to take control of it with the potential for devious misuse.
|
|---|
| 400 | </para></listitem>
|
|---|
| 401 | </itemizedlist>
|
|---|
| 402 |
|
|---|
| 403 |
|
|---|
| 404 | <note><para>
|
|---|
| 405 | <indexterm><primary>MIME</primary><secondary>raw</secondary></indexterm>
|
|---|
| 406 | <indexterm><primary>raw printing</primary></indexterm>
|
|---|
| 407 | On CUPS-enabled systems there is a facility to pass raw data directly to the printer without
|
|---|
| 408 | intermediate processing via CUPS print filters. Where use of this mode of operation is desired,
|
|---|
| 409 | it is necessary to configure a raw printing device. It is also necessary to enable the raw mime
|
|---|
| 410 | handler in the <filename>/etc/mime.conv</filename> and <filename>/etc/mime.types</filename>
|
|---|
| 411 | files. Refer to <link linkend="cups-raw"></link>.
|
|---|
| 412 | </para></note>
|
|---|
| 413 |
|
|---|
| 414 | </sect3>
|
|---|
| 415 |
|
|---|
| 416 | <sect3>
|
|---|
| 417 |
|
|---|
| 418 | <title>Secure Read-Write File and Print Server</title>
|
|---|
| 419 |
|
|---|
| 420 | <para>
|
|---|
| 421 | We progress now from simple systems to a server that is slightly more complex.
|
|---|
| 422 | </para>
|
|---|
| 423 |
|
|---|
| 424 | <para>
|
|---|
| 425 | Our new server will require a public data storage area in which only authenticated
|
|---|
| 426 | users (i.e., those with a local account) can store files, as well as a home directory.
|
|---|
| 427 | There will be one printer that should be available for everyone to use.
|
|---|
| 428 | </para>
|
|---|
| 429 |
|
|---|
| 430 | <para>
|
|---|
| 431 | In this hypothetical environment (no espionage was conducted to obtain this data),
|
|---|
| 432 | the site is demanding a simple environment that is <emphasis>secure enough</emphasis>
|
|---|
| 433 | but not too difficult to use.
|
|---|
| 434 | </para>
|
|---|
| 435 |
|
|---|
| 436 | <para>
|
|---|
| 437 | Site users will be Jack Baumbach, Mary Orville, and Amed Sehkah. Each will have
|
|---|
| 438 | a password (not shown in further examples). Mary will be the printer administrator and will
|
|---|
| 439 | own all files in the public share.
|
|---|
| 440 | </para>
|
|---|
| 441 |
|
|---|
| 442 | <para>
|
|---|
| 443 | This configuration will be based on <emphasis>user-level security</emphasis> that
|
|---|
| 444 | is the default, and for which the default is to store Microsoft Windows-compatible
|
|---|
| 445 | encrypted passwords in a file called <filename>/etc/samba/smbpasswd</filename>.
|
|---|
| 446 | The default &smb.conf; entry that makes this happen is
|
|---|
| 447 | <smbconfoption name="passdb backend">smbpasswd, guest</smbconfoption>. Since this is the default,
|
|---|
| 448 | it is not necessary to enter it into the configuration file. Note that the guest backend is
|
|---|
| 449 | added to the list of active passdb backends no matter whether it specified directly in Samba configuration
|
|---|
| 450 | file or not.
|
|---|
| 451 | </para>
|
|---|
| 452 |
|
|---|
| 453 |
|
|---|
| 454 | <procedure>
|
|---|
| 455 | <title>Installing the Secure Office Server</title>
|
|---|
| 456 | <step><para>
|
|---|
| 457 | <indexterm><primary>office server</primary></indexterm>
|
|---|
| 458 | Add all users to the operating system:
|
|---|
| 459 | <screen>
|
|---|
| 460 | &rootprompt;<userinput>useradd -c "Jack Baumbach" -m -g users -p m0r3pa1n jackb</userinput>
|
|---|
| 461 | &rootprompt;<userinput>useradd -c "Mary Orville" -m -g users -p secret maryo</userinput>
|
|---|
| 462 | &rootprompt;<userinput>useradd -c "Amed Sehkah" -m -g users -p secret ameds</userinput>
|
|---|
| 463 | </screen>
|
|---|
| 464 | </para></step>
|
|---|
| 465 |
|
|---|
| 466 | <step><para>
|
|---|
| 467 | Configure the Samba &smb.conf; file as shown in <link linkend="OfficeServer"/>.
|
|---|
| 468 | </para></step>
|
|---|
| 469 |
|
|---|
| 470 | <example id="OfficeServer">
|
|---|
| 471 | <title>Secure Office Server smb.conf</title>
|
|---|
| 472 | <smbconfblock>
|
|---|
| 473 | <smbconfcomment>Global parameters</smbconfcomment>
|
|---|
| 474 | <smbconfsection name="[global]"/>
|
|---|
| 475 | <smbconfoption name="workgroup">MIDEARTH</smbconfoption>
|
|---|
| 476 | <smbconfoption name="netbios name">OLORIN</smbconfoption>
|
|---|
| 477 | <smbconfoption name="printcap name">cups</smbconfoption>
|
|---|
| 478 | <smbconfoption name="disable spoolss">Yes</smbconfoption>
|
|---|
| 479 | <smbconfoption name="show add printer wizard">No</smbconfoption>
|
|---|
| 480 | <smbconfoption name="printing">cups</smbconfoption>
|
|---|
| 481 |
|
|---|
| 482 | <smbconfsection name="[homes]"/>
|
|---|
| 483 | <smbconfoption name="comment">Home Directories</smbconfoption>
|
|---|
| 484 | <smbconfoption name="valid users">%S</smbconfoption>
|
|---|
| 485 | <smbconfoption name="read only">No</smbconfoption>
|
|---|
| 486 | <smbconfoption name="browseable">No</smbconfoption>
|
|---|
| 487 |
|
|---|
| 488 | <smbconfsection name="[public]"/>
|
|---|
| 489 | <smbconfoption name="comment">Data</smbconfoption>
|
|---|
| 490 | <smbconfoption name="path">/export</smbconfoption>
|
|---|
| 491 | <smbconfoption name="force user">maryo</smbconfoption>
|
|---|
| 492 | <smbconfoption name="force group">users</smbconfoption>
|
|---|
| 493 | <smbconfoption name="read only">No</smbconfoption>
|
|---|
| 494 |
|
|---|
| 495 | <smbconfsection name="[printers]"/>
|
|---|
| 496 | <smbconfoption name="comment">All Printers</smbconfoption>
|
|---|
| 497 | <smbconfoption name="path">/var/spool/samba</smbconfoption>
|
|---|
| 498 | <smbconfoption name="printer admin">root, maryo</smbconfoption>
|
|---|
| 499 | <smbconfoption name="create mask">0600</smbconfoption>
|
|---|
| 500 | <smbconfoption name="guest ok">Yes</smbconfoption>
|
|---|
| 501 | <smbconfoption name="printable">Yes</smbconfoption>
|
|---|
| 502 | <smbconfoption name="use client driver">Yes</smbconfoption>
|
|---|
| 503 | <smbconfoption name="browseable">No</smbconfoption>
|
|---|
| 504 | </smbconfblock>
|
|---|
| 505 | </example>
|
|---|
| 506 |
|
|---|
| 507 | <step><para>
|
|---|
| 508 | Initialize the Microsoft Windows password database with the new users:
|
|---|
| 509 | <screen>
|
|---|
| 510 | &rootprompt;<userinput>smbpasswd -a root</userinput>
|
|---|
| 511 | New SMB password: <userinput>bigsecret</userinput>
|
|---|
| 512 | Reenter smb password: <userinput>bigsecret</userinput>
|
|---|
| 513 | Added user root.
|
|---|
| 514 |
|
|---|
| 515 | &rootprompt;<userinput>smbpasswd -a jackb</userinput>
|
|---|
| 516 | New SMB password: <userinput>m0r3pa1n</userinput>
|
|---|
| 517 | Retype new SMB password: <userinput>m0r3pa1n</userinput>
|
|---|
| 518 | Added user jackb.
|
|---|
| 519 |
|
|---|
| 520 | &rootprompt;<userinput>smbpasswd -a maryo</userinput>
|
|---|
| 521 | New SMB password: <userinput>secret</userinput>
|
|---|
| 522 | Reenter smb password: <userinput>secret</userinput>
|
|---|
| 523 | Added user maryo.
|
|---|
| 524 |
|
|---|
| 525 | &rootprompt;<userinput>smbpasswd -a ameds</userinput>
|
|---|
| 526 | New SMB password: <userinput>mysecret</userinput>
|
|---|
| 527 | Reenter smb password: <userinput>mysecret</userinput>
|
|---|
| 528 | Added user ameds.
|
|---|
| 529 | </screen>
|
|---|
| 530 | </para></step>
|
|---|
| 531 |
|
|---|
| 532 | <step><para>
|
|---|
| 533 | Install printer using the CUPS Web interface. Make certain that all
|
|---|
| 534 | printers that will be shared with Microsoft Windows clients are installed
|
|---|
| 535 | as raw printing devices.
|
|---|
| 536 | </para></step>
|
|---|
| 537 |
|
|---|
| 538 | <step><para>
|
|---|
| 539 | Start Samba using the operating system administrative interface.
|
|---|
| 540 | Alternately, this can be done manually by executing:
|
|---|
| 541 | <indexterm><primary>smbd</primary></indexterm>
|
|---|
| 542 | <indexterm><primary>nmbd</primary></indexterm>
|
|---|
| 543 | <indexterm><primary>starting samba</primary><secondary>smbd</secondary></indexterm>
|
|---|
| 544 | <indexterm><primary>starting samba</primary><secondary>nmbd</secondary></indexterm>
|
|---|
| 545 | <screen>
|
|---|
| 546 | &rootprompt;<userinput> nmbd; smbd;</userinput>
|
|---|
| 547 | </screen>
|
|---|
| 548 | Both applications automatically execute as daemons. Those who are paranoid about
|
|---|
| 549 | maintaining control can add the <constant>-D</constant> flag to coerce them to start
|
|---|
| 550 | up in daemon mode.
|
|---|
| 551 | </para></step>
|
|---|
| 552 |
|
|---|
| 553 | <step><para>
|
|---|
| 554 | Configure the <filename>/export</filename> directory:
|
|---|
| 555 | <screen>
|
|---|
| 556 | &rootprompt;<userinput>mkdir /export</userinput>
|
|---|
| 557 | &rootprompt;<userinput>chown maryo.users /export</userinput>
|
|---|
| 558 | &rootprompt;<userinput>chmod u=rwx,g=rwx,o-rwx /export</userinput>
|
|---|
| 559 | </screen>
|
|---|
| 560 | </para></step>
|
|---|
| 561 |
|
|---|
| 562 | <step><para>
|
|---|
| 563 | Check that Samba is running correctly:
|
|---|
| 564 | <screen>
|
|---|
| 565 | &rootprompt;<userinput>smbclient -L localhost -U%</userinput>
|
|---|
| 566 | Domain=[MIDEARTH] OS=[UNIX] Server=[Samba-3.0.20]
|
|---|
| 567 |
|
|---|
| 568 | Sharename Type Comment
|
|---|
| 569 | --------- ---- -------
|
|---|
| 570 | public Disk Data
|
|---|
| 571 | IPC$ IPC IPC Service (Samba-3.0.20)
|
|---|
| 572 | ADMIN$ IPC IPC Service (Samba-3.0.20)
|
|---|
| 573 | hplj4 Printer hplj4
|
|---|
| 574 |
|
|---|
| 575 | Server Comment
|
|---|
| 576 | --------- -------
|
|---|
| 577 | OLORIN Samba-3.0.20
|
|---|
| 578 |
|
|---|
| 579 | Workgroup Master
|
|---|
| 580 | --------- -------
|
|---|
| 581 | MIDEARTH OLORIN
|
|---|
| 582 | </screen>
|
|---|
| 583 | The following error message indicates that Samba was not running:
|
|---|
| 584 | <screen>
|
|---|
| 585 | &rootprompt; smbclient -L olorin -U%
|
|---|
| 586 | Error connecting to 192.168.1.40 (Connection refused)
|
|---|
| 587 | Connection to olorin failed
|
|---|
| 588 | </screen>
|
|---|
| 589 | </para></step>
|
|---|
| 590 |
|
|---|
| 591 | <step><para>
|
|---|
| 592 | Connect to OLORIN as maryo:
|
|---|
| 593 | <screen>
|
|---|
| 594 | &rootprompt;<userinput>smbclient //olorin/maryo -Umaryo%secret</userinput>
|
|---|
| 595 | OS=[UNIX] Server=[Samba-3.0.20]
|
|---|
| 596 | smb: \> <userinput>dir</userinput>
|
|---|
| 597 | . D 0 Sat Jun 21 10:58:16 2003
|
|---|
| 598 | .. D 0 Sat Jun 21 10:54:32 2003
|
|---|
| 599 | Documents D 0 Fri Apr 25 13:23:58 2003
|
|---|
| 600 | DOCWORK D 0 Sat Jun 14 15:40:34 2003
|
|---|
| 601 | OpenOffice.org D 0 Fri Apr 25 13:55:16 2003
|
|---|
| 602 | .bashrc H 1286 Fri Apr 25 13:23:58 2003
|
|---|
| 603 | .netscape6 DH 0 Fri Apr 25 13:55:13 2003
|
|---|
| 604 | .mozilla DH 0 Wed Mar 5 11:50:50 2003
|
|---|
| 605 | .kermrc H 164 Fri Apr 25 13:23:58 2003
|
|---|
| 606 | .acrobat DH 0 Fri Apr 25 15:41:02 2003
|
|---|
| 607 |
|
|---|
| 608 | 55817 blocks of size 524288. 34725 blocks available
|
|---|
| 609 | smb: \> <userinput>q</userinput>
|
|---|
| 610 | </screen>
|
|---|
| 611 | </para></step>
|
|---|
| 612 | </procedure>
|
|---|
| 613 |
|
|---|
| 614 | <para>
|
|---|
| 615 | By now you should be getting the hang of configuration basics. Clearly, it is time to
|
|---|
| 616 | explore slightly more complex examples. For the remainder of this chapter we abbreviate
|
|---|
| 617 | instructions, since there are previous examples.
|
|---|
| 618 | </para>
|
|---|
| 619 |
|
|---|
| 620 | </sect3>
|
|---|
| 621 |
|
|---|
| 622 | </sect2>
|
|---|
| 623 |
|
|---|
| 624 | <sect2>
|
|---|
| 625 | <title>Domain Member Server</title>
|
|---|
| 626 |
|
|---|
| 627 | <para>
|
|---|
| 628 | <indexterm><primary>Server Type</primary><secondary>Domain Member</secondary></indexterm>
|
|---|
| 629 | In this instance we consider the simplest server configuration we can get away with
|
|---|
| 630 | to make an accounting department happy. Let's be warned, the users are accountants and they
|
|---|
| 631 | do have some nasty demands. There is a budget for only one server for this department.
|
|---|
| 632 | </para>
|
|---|
| 633 |
|
|---|
| 634 | <para>
|
|---|
| 635 | The network is managed by an internal Information Services Group (ISG), to which we belong.
|
|---|
| 636 | Internal politics are typical of a medium-sized organization; Human Resources is of the
|
|---|
| 637 | opinion that they run the ISG because they are always adding and disabling users. Also,
|
|---|
| 638 | departmental managers have to fight tooth and nail to gain basic network resources access for
|
|---|
| 639 | their staff. Accounting is different, though, they get exactly what they want. So this should
|
|---|
| 640 | set the scene.
|
|---|
| 641 | </para>
|
|---|
| 642 |
|
|---|
| 643 | <para>
|
|---|
| 644 | We use the users from the last example. The accounting department
|
|---|
| 645 | has a general printer that all departmental users may use. There is also a check printer
|
|---|
| 646 | that may be used only by the person who has authority to print checks. The chief financial
|
|---|
| 647 | officer (CFO) wants that printer to be completely restricted and for it to be located in the
|
|---|
| 648 | private storage area in her office. It therefore must be a network printer.
|
|---|
| 649 | </para>
|
|---|
| 650 |
|
|---|
| 651 | <para>
|
|---|
| 652 | The accounting department uses an accounting application called <emphasis>SpytFull</emphasis>
|
|---|
| 653 | that must be run from a central application server. The software is licensed to run only off
|
|---|
| 654 | one server, there are no workstation components, and it is run off a mapped share. The data
|
|---|
| 655 | store is in a UNIX-based SQL backend. The UNIX gurus look after that, so this is not our
|
|---|
| 656 | problem.
|
|---|
| 657 | </para>
|
|---|
| 658 |
|
|---|
| 659 | <para>
|
|---|
| 660 | The accounting department manager (maryo) wants a general filing system as well as a separate
|
|---|
| 661 | file storage area for form letters (nastygrams). The form letter area should be read-only to
|
|---|
| 662 | all accounting staff except the manager. The general filing system has to have a structured
|
|---|
| 663 | layout with a general area for all staff to store general documents as well as a separate
|
|---|
| 664 | file area for each member of her team that is private to that person, but she wants full
|
|---|
| 665 | access to all areas. Users must have a private home share for personal work-related files
|
|---|
| 666 | and for materials not related to departmental operations.
|
|---|
| 667 | </para>
|
|---|
| 668 |
|
|---|
| 669 | <sect3>
|
|---|
| 670 | <title>Example Configuration</title>
|
|---|
| 671 |
|
|---|
| 672 | <para>
|
|---|
| 673 | The server <emphasis>valinor</emphasis> will be a member server of the company domain.
|
|---|
| 674 | Accounting will have only a local server. User accounts will be on the domain controllers,
|
|---|
| 675 | as will desktop profiles and all network policy files.
|
|---|
| 676 | </para>
|
|---|
| 677 |
|
|---|
| 678 | <procedure>
|
|---|
| 679 | <step><para>
|
|---|
| 680 | Do not add users to the UNIX/Linux server; all of this will run off the
|
|---|
| 681 | central domain.
|
|---|
| 682 | </para></step>
|
|---|
| 683 |
|
|---|
| 684 | <step><para>
|
|---|
| 685 | Configure &smb.conf; according to <link linkend="fast-member-server">Member server smb.conf
|
|---|
| 686 | (globals)</link> and <link linkend="fast-memberserver-shares">Member server smb.conf (shares
|
|---|
| 687 | and services)</link>.
|
|---|
| 688 | </para></step>
|
|---|
| 689 |
|
|---|
| 690 | <example id="fast-member-server">
|
|---|
| 691 | <title>Member Server smb.conf (Globals)</title>
|
|---|
| 692 | <smbconfblock>
|
|---|
| 693 | <smbconfcomment>Global parameters</smbconfcomment>
|
|---|
| 694 | <smbconfsection name="[global]"/>
|
|---|
| 695 | <smbconfoption name="workgroup">MIDEARTH</smbconfoption>
|
|---|
| 696 | <smbconfoption name="netbios name">VALINOR</smbconfoption>
|
|---|
| 697 | <smbconfoption name="security">DOMAIN</smbconfoption>
|
|---|
| 698 | <smbconfoption name="printcap name">cups</smbconfoption>
|
|---|
| 699 | <smbconfoption name="disable spoolss">Yes</smbconfoption>
|
|---|
| 700 | <smbconfoption name="show add printer wizard">No</smbconfoption>
|
|---|
| 701 | <smbconfoption name="idmap uid">15000-20000</smbconfoption>
|
|---|
| 702 | <smbconfoption name="idmap gid">15000-20000</smbconfoption>
|
|---|
| 703 | <smbconfoption name="winbind use default domain">Yes</smbconfoption>
|
|---|
| 704 | <smbconfoption name="printing">cups</smbconfoption>
|
|---|
| 705 | </smbconfblock>
|
|---|
| 706 | </example>
|
|---|
| 707 |
|
|---|
| 708 | <example id="fast-memberserver-shares">
|
|---|
| 709 | <title>Member Server smb.conf (Shares and Services)</title>
|
|---|
| 710 | <smbconfblock>
|
|---|
| 711 | <smbconfsection name="[homes]"/>
|
|---|
| 712 | <smbconfoption name="comment">Home Directories</smbconfoption>
|
|---|
| 713 | <smbconfoption name="valid users">%S</smbconfoption>
|
|---|
| 714 | <smbconfoption name="read only">No</smbconfoption>
|
|---|
| 715 | <smbconfoption name="browseable">No</smbconfoption>
|
|---|
| 716 |
|
|---|
| 717 | <smbconfsection name="[spytfull]"/>
|
|---|
| 718 | <smbconfoption name="comment">Accounting Application Only</smbconfoption>
|
|---|
| 719 | <smbconfoption name="path">/export/spytfull</smbconfoption>
|
|---|
| 720 | <smbconfoption name="valid users">@Accounts</smbconfoption>
|
|---|
| 721 | <smbconfoption name="admin users">maryo</smbconfoption>
|
|---|
| 722 | <smbconfoption name="read only">Yes</smbconfoption>
|
|---|
| 723 |
|
|---|
| 724 | <smbconfsection name="[public]"/>
|
|---|
| 725 | <smbconfoption name="comment">Data</smbconfoption>
|
|---|
| 726 | <smbconfoption name="path">/export/public</smbconfoption>
|
|---|
| 727 | <smbconfoption name="read only">No</smbconfoption>
|
|---|
| 728 |
|
|---|
| 729 | <smbconfsection name="[printers]"/>
|
|---|
| 730 | <smbconfoption name="comment">All Printers</smbconfoption>
|
|---|
| 731 | <smbconfoption name="path">/var/spool/samba</smbconfoption>
|
|---|
| 732 | <smbconfoption name="printer admin">root, maryo</smbconfoption>
|
|---|
| 733 | <smbconfoption name="create mask">0600</smbconfoption>
|
|---|
| 734 | <smbconfoption name="guest ok">Yes</smbconfoption>
|
|---|
| 735 | <smbconfoption name="printable">Yes</smbconfoption>
|
|---|
| 736 | <smbconfoption name="use client driver">Yes</smbconfoption>
|
|---|
| 737 | <smbconfoption name="browseable">No</smbconfoption>
|
|---|
| 738 | </smbconfblock>
|
|---|
| 739 | </example>
|
|---|
| 740 |
|
|---|
| 741 | <step><para>
|
|---|
| 742 | <indexterm><primary>net</primary><secondary>rpc</secondary></indexterm>
|
|---|
| 743 | Join the domain. Note: Do not start Samba until this step has been completed!
|
|---|
| 744 | <screen>
|
|---|
| 745 | &rootprompt;<userinput>net rpc join -Uroot%'bigsecret'</userinput>
|
|---|
| 746 | Joined domain MIDEARTH.
|
|---|
| 747 | </screen>
|
|---|
| 748 | </para></step>
|
|---|
| 749 |
|
|---|
| 750 | <step><para>
|
|---|
| 751 | Make absolutely certain that you disable (shut down) the <command>nscd</command>
|
|---|
| 752 | daemon on any system on which <command>winbind</command> is configured to run.
|
|---|
| 753 | </para></step>
|
|---|
| 754 |
|
|---|
| 755 | <step><para>
|
|---|
| 756 | Start Samba following the normal method for your operating system platform.
|
|---|
| 757 | If you wish to do this manually, execute as root:
|
|---|
| 758 | <indexterm><primary>smbd</primary></indexterm>
|
|---|
| 759 | <indexterm><primary>nmbd</primary></indexterm>
|
|---|
| 760 | <indexterm><primary>winbindd</primary></indexterm>
|
|---|
| 761 | <indexterm><primary>starting samba</primary><secondary>smbd</secondary></indexterm>
|
|---|
| 762 | <indexterm><primary>starting samba</primary><secondary>nmbd</secondary></indexterm>
|
|---|
| 763 | <indexterm><primary>starting samba</primary><secondary>winbindd</secondary></indexterm>
|
|---|
| 764 | <screen>
|
|---|
| 765 | &rootprompt;<userinput>nmbd; smbd; winbindd;</userinput>
|
|---|
| 766 | </screen>
|
|---|
| 767 | </para></step>
|
|---|
| 768 |
|
|---|
| 769 | <step><para>
|
|---|
| 770 | Configure the name service switch (NSS) control file on your system to resolve user and group names
|
|---|
| 771 | via winbind. Edit the following lines in <filename>/etc/nsswitch.conf</filename>:
|
|---|
| 772 | <programlisting>
|
|---|
| 773 | passwd: files winbind
|
|---|
| 774 | group: files winbind
|
|---|
| 775 | hosts: files dns winbind
|
|---|
| 776 | </programlisting>
|
|---|
| 777 | </para></step>
|
|---|
| 778 |
|
|---|
| 779 | <step><para>
|
|---|
| 780 | Set the password for <command>wbinfo</command> to use:
|
|---|
| 781 | <screen>
|
|---|
| 782 | &rootprompt;<userinput>wbinfo --set-auth-user=root%'bigsecret'</userinput>
|
|---|
| 783 | </screen>
|
|---|
| 784 | </para></step>
|
|---|
| 785 |
|
|---|
| 786 | <step><para>
|
|---|
| 787 | Validate that domain user and group credentials can be correctly resolved by executing:
|
|---|
| 788 | <screen>
|
|---|
| 789 | &rootprompt;<userinput>wbinfo -u</userinput>
|
|---|
| 790 | MIDEARTH\maryo
|
|---|
| 791 | MIDEARTH\jackb
|
|---|
| 792 | MIDEARTH\ameds
|
|---|
| 793 | ...
|
|---|
| 794 | MIDEARTH\root
|
|---|
| 795 |
|
|---|
| 796 | &rootprompt;<userinput>wbinfo -g</userinput>
|
|---|
| 797 | MIDEARTH\Domain Users
|
|---|
| 798 | MIDEARTH\Domain Admins
|
|---|
| 799 | MIDEARTH\Domain Guests
|
|---|
| 800 | ...
|
|---|
| 801 | MIDEARTH\Accounts
|
|---|
| 802 | </screen>
|
|---|
| 803 | </para></step>
|
|---|
| 804 |
|
|---|
| 805 | <step><para>
|
|---|
| 806 | Check that <command>winbind</command> is working. The following demonstrates correct
|
|---|
| 807 | username resolution via the <command>getent</command> system utility:
|
|---|
| 808 | <screen>
|
|---|
| 809 | &rootprompt;<userinput>getent passwd maryo</userinput>
|
|---|
| 810 | maryo:x:15000:15003:Mary Orville:/home/MIDEARTH/maryo:/bin/false
|
|---|
| 811 | </screen>
|
|---|
| 812 | </para></step>
|
|---|
| 813 |
|
|---|
| 814 | <step><para>
|
|---|
| 815 | A final test that we have this under control might be reassuring:
|
|---|
| 816 | <screen>
|
|---|
| 817 | &rootprompt;<userinput>touch /export/a_file</userinput>
|
|---|
| 818 | &rootprompt;<userinput>chown maryo /export/a_file</userinput>
|
|---|
| 819 | &rootprompt;<userinput>ls -al /export/a_file</userinput>
|
|---|
| 820 | ...
|
|---|
| 821 | -rw-r--r-- 1 maryo users 11234 Jun 21 15:32 a_file
|
|---|
| 822 | ...
|
|---|
| 823 |
|
|---|
| 824 | &rootprompt;<userinput>rm /export/a_file</userinput>
|
|---|
| 825 | </screen>
|
|---|
| 826 | </para></step>
|
|---|
| 827 |
|
|---|
| 828 | <step><para>
|
|---|
| 829 | Configuration is now mostly complete, so this is an opportune time
|
|---|
| 830 | to configure the directory structure for this site:
|
|---|
| 831 | <screen>
|
|---|
| 832 | &rootprompt;<userinput>mkdir -p /export/{spytfull,public}</userinput>
|
|---|
| 833 | &rootprompt;<userinput>chmod ug=rwxS,o=x /export/{spytfull,public}</userinput>
|
|---|
| 834 | &rootprompt;<userinput>chown maryo.Accounts /export/{spytfull,public}</userinput>
|
|---|
| 835 | </screen>
|
|---|
| 836 | </para></step>
|
|---|
| 837 | </procedure>
|
|---|
| 838 |
|
|---|
| 839 | </sect3>
|
|---|
| 840 |
|
|---|
| 841 | </sect2>
|
|---|
| 842 |
|
|---|
| 843 | <sect2>
|
|---|
| 844 | <title>Domain Controller</title>
|
|---|
| 845 |
|
|---|
| 846 |
|
|---|
| 847 | <para>
|
|---|
| 848 | <indexterm><primary>Server Type</primary><secondary>Domain Controller</secondary></indexterm>
|
|---|
| 849 | For the remainder of this chapter the focus is on the configuration of domain control.
|
|---|
| 850 | The examples that follow are for two implementation strategies. Remember, our objective is
|
|---|
| 851 | to create a simple but working solution. The remainder of this book should help to highlight
|
|---|
| 852 | opportunity for greater functionality and the complexity that goes with it.
|
|---|
| 853 | </para>
|
|---|
| 854 |
|
|---|
| 855 | <para>
|
|---|
| 856 | A domain controller configuration can be achieved with a simple configuration using the new
|
|---|
| 857 | tdbsam password backend. This type of configuration is good for small
|
|---|
| 858 | offices, but has limited scalability (cannot be replicated), and performance can be expected
|
|---|
| 859 | to fall as the size and complexity of the domain increases.
|
|---|
| 860 | </para>
|
|---|
| 861 |
|
|---|
| 862 | <para>
|
|---|
| 863 | The use of tdbsam is best limited to sites that do not need
|
|---|
| 864 | more than a Primary Domain Controller (PDC). As the size of a domain grows the need
|
|---|
| 865 | for additional domain controllers becomes apparent. Do not attempt to under-resource
|
|---|
| 866 | a Microsoft Windows network environment; domain controllers provide essential
|
|---|
| 867 | authentication services. The following are symptoms of an under-resourced domain control
|
|---|
| 868 | environment:
|
|---|
| 869 | </para>
|
|---|
| 870 |
|
|---|
| 871 | <itemizedlist>
|
|---|
| 872 | <listitem><para>
|
|---|
| 873 | Domain logons intermittently fail.
|
|---|
| 874 | </para></listitem>
|
|---|
| 875 |
|
|---|
| 876 | <listitem><para>
|
|---|
| 877 | File access on a domain member server intermittently fails, giving a permission denied
|
|---|
| 878 | error message.
|
|---|
| 879 | </para></listitem>
|
|---|
| 880 | </itemizedlist>
|
|---|
| 881 |
|
|---|
| 882 | <para>
|
|---|
| 883 | A more scalable domain control authentication backend option might use
|
|---|
| 884 | Microsoft Active Directory or an LDAP-based backend. Samba-3 provides
|
|---|
| 885 | for both options as a domain member server. As a PDC, Samba-3 is not able to provide
|
|---|
| 886 | an exact alternative to the functionality that is available with Active Directory.
|
|---|
| 887 | Samba-3 can provide a scalable LDAP-based PDC/BDC solution.
|
|---|
| 888 | </para>
|
|---|
| 889 |
|
|---|
| 890 | <para>
|
|---|
| 891 | The tdbsam authentication backend provides no facility to replicate
|
|---|
| 892 | the contents of the database, except by external means (i.e., there is no self-contained protocol
|
|---|
| 893 | in Samba-3 for Security Account Manager database [SAM] replication).
|
|---|
| 894 | </para>
|
|---|
| 895 |
|
|---|
| 896 | <note><para>
|
|---|
| 897 | If you need more than one domain controller, do not use a tdbsam authentication backend.
|
|---|
| 898 | </para></note>
|
|---|
| 899 |
|
|---|
| 900 | <sect3>
|
|---|
| 901 | <title>Example: Engineering Office</title>
|
|---|
| 902 |
|
|---|
| 903 | <para>
|
|---|
| 904 | The engineering office network server we present here is designed to demonstrate use
|
|---|
| 905 | of the new tdbsam password backend. The tdbsam
|
|---|
| 906 | facility is new to Samba-3. It is designed to provide many user and machine account controls
|
|---|
| 907 | that are possible with Microsoft Windows NT4. It is safe to use this in smaller networks.
|
|---|
| 908 | </para>
|
|---|
| 909 |
|
|---|
| 910 | <procedure>
|
|---|
| 911 | <step><para>
|
|---|
| 912 | A working PDC configuration using the tdbsam
|
|---|
| 913 | password backend can be found in <link linkend="fast-engoffice-global">Engineering Office smb.conf
|
|---|
| 914 | (globals)</link> together with <link linkend="fast-engoffice-shares">Engineering Office smb.conf
|
|---|
| 915 | (shares and services)</link>:
|
|---|
| 916 | <indexterm><primary>pdbedit</primary></indexterm>
|
|---|
| 917 | </para></step>
|
|---|
| 918 |
|
|---|
| 919 | <example id="fast-engoffice-global">
|
|---|
| 920 | <title>Engineering Office smb.conf (globals)</title>
|
|---|
| 921 | <smbconfblock>
|
|---|
| 922 | <smbconfsection name="[global]"/>
|
|---|
| 923 | <smbconfoption name="workgroup">MIDEARTH</smbconfoption>
|
|---|
| 924 | <smbconfoption name="netbios name">FRODO</smbconfoption>
|
|---|
| 925 | <smbconfoption name="passdb backend">tdbsam</smbconfoption>
|
|---|
| 926 | <smbconfoption name="printcap name">cups</smbconfoption>
|
|---|
| 927 | <smbconfoption name="add user script">/usr/sbin/useradd -m %u</smbconfoption>
|
|---|
| 928 | <smbconfoption name="delete user script">/usr/sbin/userdel -r %u</smbconfoption>
|
|---|
| 929 | <smbconfoption name="add group script">/usr/sbin/groupadd %g</smbconfoption>
|
|---|
| 930 | <smbconfoption name="delete group script">/usr/sbin/groupdel %g</smbconfoption>
|
|---|
| 931 | <smbconfoption name="add user to group script">/usr/sbin/groupmod -A %u %g</smbconfoption>
|
|---|
| 932 | <smbconfoption name="delete user from group script">/usr/sbin/groupmod -R %u %g</smbconfoption>
|
|---|
| 933 | <smbconfoption name="add machine script">/usr/sbin/useradd -s /bin/false -d /var/lib/nobody %u</smbconfoption>
|
|---|
| 934 | <smbconfcomment>Note: The following specifies the default logon script.</smbconfcomment>
|
|---|
| 935 | <smbconfcomment>Per user logon scripts can be specified in the user account using pdbedit </smbconfcomment>
|
|---|
| 936 | <smbconfoption name="logon script">scripts\logon.bat</smbconfoption>
|
|---|
| 937 | <smbconfcomment>This sets the default profile path. Set per user paths with pdbedit</smbconfcomment>
|
|---|
| 938 | <smbconfoption name="logon path">\\%L\Profiles\%U</smbconfoption>
|
|---|
| 939 | <smbconfoption name="logon drive">H:</smbconfoption>
|
|---|
| 940 | <smbconfoption name="logon home">\\%L\%U</smbconfoption>
|
|---|
| 941 | <smbconfoption name="domain logons">Yes</smbconfoption>
|
|---|
| 942 | <smbconfoption name="os level">35</smbconfoption>
|
|---|
| 943 | <smbconfoption name="preferred master">Yes</smbconfoption>
|
|---|
| 944 | <smbconfoption name="domain master">Yes</smbconfoption>
|
|---|
| 945 | <smbconfoption name="idmap uid">15000-20000</smbconfoption>
|
|---|
| 946 | <smbconfoption name="idmap gid">15000-20000</smbconfoption>
|
|---|
| 947 | <smbconfoption name="printing">cups</smbconfoption>
|
|---|
| 948 | </smbconfblock>
|
|---|
| 949 | </example>
|
|---|
| 950 |
|
|---|
| 951 | <example id="fast-engoffice-shares">
|
|---|
| 952 | <title>Engineering Office smb.conf (shares and services)</title>
|
|---|
| 953 | <smbconfblock>
|
|---|
| 954 | <smbconfsection name="[homes]"/>
|
|---|
| 955 | <smbconfoption name="comment">Home Directories</smbconfoption>
|
|---|
| 956 | <smbconfoption name="valid users">%S</smbconfoption>
|
|---|
| 957 | <smbconfoption name="read only">No</smbconfoption>
|
|---|
| 958 | <smbconfoption name="browseable">No</smbconfoption>
|
|---|
| 959 |
|
|---|
| 960 | <smbconfcomment>Printing auto-share (makes printers available thru CUPS)</smbconfcomment>
|
|---|
| 961 | <smbconfsection name="[printers]"/>
|
|---|
| 962 | <smbconfoption name="comment">All Printers</smbconfoption>
|
|---|
| 963 | <smbconfoption name="path">/var/spool/samba</smbconfoption>
|
|---|
| 964 | <smbconfoption name="printer admin">root, maryo</smbconfoption>
|
|---|
| 965 | <smbconfoption name="create mask">0600</smbconfoption>
|
|---|
| 966 | <smbconfoption name="guest ok">Yes</smbconfoption>
|
|---|
| 967 | <smbconfoption name="printable">Yes</smbconfoption>
|
|---|
| 968 | <smbconfoption name="browseable">No</smbconfoption>
|
|---|
| 969 |
|
|---|
| 970 | <smbconfsection name="[print$]"/>
|
|---|
| 971 | <smbconfoption name="comment">Printer Drivers Share</smbconfoption>
|
|---|
| 972 | <smbconfoption name="path">/var/lib/samba/drivers</smbconfoption>
|
|---|
| 973 | <smbconfoption name="write list">maryo, root</smbconfoption>
|
|---|
| 974 | <smbconfoption name="printer admin">maryo, root</smbconfoption>
|
|---|
| 975 |
|
|---|
| 976 | <smbconfcomment>Needed to support domain logons</smbconfcomment>
|
|---|
| 977 | <smbconfsection name="[netlogon]"/>
|
|---|
| 978 | <smbconfoption name="comment">Network Logon Service</smbconfoption>
|
|---|
| 979 | <smbconfoption name="path">/var/lib/samba/netlogon</smbconfoption>
|
|---|
| 980 | <smbconfoption name="admin users">root, maryo</smbconfoption>
|
|---|
| 981 | <smbconfoption name="guest ok">Yes</smbconfoption>
|
|---|
| 982 | <smbconfoption name="browseable">No</smbconfoption>
|
|---|
| 983 |
|
|---|
| 984 | <smbconfcomment>For profiles to work, create a user directory under the path</smbconfcomment>
|
|---|
| 985 | <smbconfcomment> shown. i.e., mkdir -p /var/lib/samba/profiles/maryo</smbconfcomment>
|
|---|
| 986 | <smbconfsection name="[Profiles]"/>
|
|---|
| 987 | <smbconfoption name="comment">Roaming Profile Share</smbconfoption>
|
|---|
| 988 | <smbconfoption name="path">/var/lib/samba/profiles</smbconfoption>
|
|---|
| 989 | <smbconfoption name="read only">No</smbconfoption>
|
|---|
| 990 | <smbconfoption name="profile acls">Yes</smbconfoption>
|
|---|
| 991 |
|
|---|
| 992 | <smbconfcomment>Other resource (share/printer) definitions would follow below.</smbconfcomment>
|
|---|
| 993 | </smbconfblock>
|
|---|
| 994 | </example>
|
|---|
| 995 |
|
|---|
| 996 | <step><para>
|
|---|
| 997 | Create UNIX group accounts as needed using a suitable operating system tool:
|
|---|
| 998 | <screen>
|
|---|
| 999 | &rootprompt;<userinput>groupadd ntadmins</userinput>
|
|---|
| 1000 | &rootprompt;<userinput>groupadd designers</userinput>
|
|---|
| 1001 | &rootprompt;<userinput>groupadd engineers</userinput>
|
|---|
| 1002 | &rootprompt;<userinput>groupadd qateam</userinput>
|
|---|
| 1003 | </screen>
|
|---|
| 1004 | </para></step>
|
|---|
| 1005 |
|
|---|
| 1006 | <step><para>
|
|---|
| 1007 | Create user accounts on the system using the appropriate tool
|
|---|
| 1008 | provided with the operating system. Make sure all user home directories
|
|---|
| 1009 | are created also. Add users to groups as required for access control
|
|---|
| 1010 | on files, directories, printers, and as required for use in the Samba
|
|---|
| 1011 | environment.
|
|---|
| 1012 | </para></step>
|
|---|
| 1013 |
|
|---|
| 1014 |
|
|---|
| 1015 | <step><para>
|
|---|
| 1016 | <indexterm><primary>net</primary><secondary>groupmap</secondary></indexterm>
|
|---|
| 1017 | <indexterm><primary>initGroups.sh</primary></indexterm>
|
|---|
| 1018 | Assign each of the UNIX groups to NT groups by executing this shell script
|
|---|
| 1019 | (You could name the script <filename>initGroups.sh</filename>):
|
|---|
| 1020 | <screen>
|
|---|
| 1021 | #!/bin/bash
|
|---|
| 1022 | #### Keep this as a shell script for future re-use
|
|---|
| 1023 |
|
|---|
| 1024 | # First assign well known groups
|
|---|
| 1025 | net groupmap add ntgroup="Domain Admins" unixgroup=ntadmins rid=512 type=d
|
|---|
| 1026 | net groupmap add ntgroup="Domain Users" unixgroup=users rid=513 type=
|
|---|
| 1027 | net groupmap add ntgroup="Domain Guests" unixgroup=nobody rid=514 type=d
|
|---|
| 1028 |
|
|---|
| 1029 | # Now for our added Domain Groups
|
|---|
| 1030 | net groupmap add ntgroup="Designers" unixgroup=designers type=d
|
|---|
| 1031 | net groupmap add ntgroup="Engineers" unixgroup=engineers type=d
|
|---|
| 1032 | net groupmap add ntgroup="QA Team" unixgroup=qateam type=d
|
|---|
| 1033 | </screen>
|
|---|
| 1034 | </para></step>
|
|---|
| 1035 |
|
|---|
| 1036 | <step><para>
|
|---|
| 1037 | Create the <filename>scripts</filename> directory for use in the
|
|---|
| 1038 | <smbconfsection name="[NETLOGON]"/> share:
|
|---|
| 1039 | <screen>
|
|---|
| 1040 | &rootprompt;<userinput>mkdir -p /var/lib/samba/netlogon/scripts</userinput>
|
|---|
| 1041 | </screen>
|
|---|
| 1042 | Place the logon scripts that will be used (batch or cmd scripts)
|
|---|
| 1043 | in this directory.
|
|---|
| 1044 | </para></step>
|
|---|
| 1045 | </procedure>
|
|---|
| 1046 |
|
|---|
| 1047 | <para>
|
|---|
| 1048 | The above configuration provides a functional PDC
|
|---|
| 1049 | system to which must be added file shares and printers as required.
|
|---|
| 1050 | </para>
|
|---|
| 1051 |
|
|---|
| 1052 | </sect3>
|
|---|
| 1053 |
|
|---|
| 1054 | <sect3>
|
|---|
| 1055 | <title>A Big Organization</title>
|
|---|
| 1056 |
|
|---|
| 1057 | <para>
|
|---|
| 1058 | In this section we finally get to review in brief a Samba-3 configuration that
|
|---|
| 1059 | uses a Lightweight Directory Access (LDAP)-based authentication backend. The
|
|---|
| 1060 | main reasons for this choice are to provide the ability to host primary
|
|---|
| 1061 | and Backup Domain Control (BDC), as well as to enable a higher degree of
|
|---|
| 1062 | scalability to meet the needs of a very distributed environment.
|
|---|
| 1063 | </para>
|
|---|
| 1064 |
|
|---|
| 1065 | <sect4>
|
|---|
| 1066 | <title>The Primary Domain Controller</title>
|
|---|
| 1067 |
|
|---|
| 1068 | <para>
|
|---|
| 1069 | This is an example of a minimal configuration to run a Samba-3 PDC
|
|---|
| 1070 | using an LDAP authentication backend. It is assumed that the operating system
|
|---|
| 1071 | has been correctly configured.
|
|---|
| 1072 | </para>
|
|---|
| 1073 |
|
|---|
| 1074 | <para>
|
|---|
| 1075 | The Idealx scripts (or equivalent) are needed to manage LDAP-based POSIX and/or
|
|---|
| 1076 | SambaSamAccounts. The Idealx scripts may be downloaded from the <ulink url="http://www.idealx.org">
|
|---|
| 1077 | Idealx</ulink> Web site. They may also be obtained from the Samba tarball. Linux
|
|---|
| 1078 | distributions tend to install the Idealx scripts in the
|
|---|
| 1079 | <filename>/usr/share/doc/packages/sambaXXXXXX/examples/LDAP/smbldap-tools</filename> directory.
|
|---|
| 1080 | Idealx scripts version <constant>smbldap-tools-0.9.1</constant> are known to work well.
|
|---|
| 1081 | </para>
|
|---|
| 1082 |
|
|---|
| 1083 | <procedure>
|
|---|
| 1084 | <step><para>
|
|---|
| 1085 | Obtain from the Samba sources <filename>~/examples/LDAP/samba.schema</filename>
|
|---|
| 1086 | and copy it to the <filename>/etc/openldap/schema/</filename> directory.
|
|---|
| 1087 | </para></step>
|
|---|
| 1088 |
|
|---|
| 1089 | <step><para>
|
|---|
| 1090 | Set up the LDAP server. This example is suitable for OpenLDAP 2.1.x.
|
|---|
| 1091 | The <filename>/etc/openldap/slapd.conf</filename> file.
|
|---|
| 1092 | <indexterm><primary>/etc/openldap/slapd.conf</primary></indexterm>
|
|---|
| 1093 | <title>Example slapd.conf File</title>
|
|---|
| 1094 | <screen>
|
|---|
| 1095 | # Note commented out lines have been removed
|
|---|
| 1096 | include /etc/openldap/schema/core.schema
|
|---|
| 1097 | include /etc/openldap/schema/cosine.schema
|
|---|
| 1098 | include /etc/openldap/schema/inetorgperson.schema
|
|---|
| 1099 | include /etc/openldap/schema/nis.schema
|
|---|
| 1100 | include /etc/openldap/schema/samba.schema
|
|---|
| 1101 |
|
|---|
| 1102 | pidfile /var/run/slapd/slapd.pid
|
|---|
| 1103 | argsfile /var/run/slapd/slapd.args
|
|---|
| 1104 |
|
|---|
| 1105 | database bdb
|
|---|
| 1106 | suffix "dc=quenya,dc=org"
|
|---|
| 1107 | rootdn "cn=Manager,dc=quenya,dc=org"
|
|---|
| 1108 | rootpw {SSHA}06qDkonA8hk6W6SSnRzWj0/pBcU3m0/P
|
|---|
| 1109 | # The password for the above is 'nastyon3'
|
|---|
| 1110 |
|
|---|
| 1111 | directory /var/lib/ldap
|
|---|
| 1112 |
|
|---|
| 1113 | index objectClass eq
|
|---|
| 1114 | index cn pres,sub,eq
|
|---|
| 1115 | index sn pres,sub,eq
|
|---|
| 1116 | index uid pres,sub,eq
|
|---|
| 1117 | index displayName pres,sub,eq
|
|---|
| 1118 | index uidNumber eq
|
|---|
| 1119 | index gidNumber eq
|
|---|
| 1120 | index memberUid eq
|
|---|
| 1121 | index sambaSID eq
|
|---|
| 1122 | index sambaPrimaryGroupSID eq
|
|---|
| 1123 | index sambaDomainName eq
|
|---|
| 1124 | index default sub
|
|---|
| 1125 | </screen>
|
|---|
| 1126 | </para></step>
|
|---|
| 1127 |
|
|---|
| 1128 | <step><para>
|
|---|
| 1129 | Create the following file <filename>initdb.ldif</filename>:
|
|---|
| 1130 | <indexterm><primary>initdb.ldif</primary></indexterm>
|
|---|
| 1131 | <programlisting>
|
|---|
| 1132 | # Organization for SambaXP Demo
|
|---|
| 1133 | dn: dc=quenya,dc=org
|
|---|
| 1134 | objectclass: dcObject
|
|---|
| 1135 | objectclass: organization
|
|---|
| 1136 | dc: quenya
|
|---|
| 1137 | o: SambaXP Demo
|
|---|
| 1138 | description: The SambaXP Demo LDAP Tree
|
|---|
| 1139 |
|
|---|
| 1140 | # Organizational Role for Directory Management
|
|---|
| 1141 | dn: cn=Manager,dc=quenya,dc=org
|
|---|
| 1142 | objectclass: organizationalRole
|
|---|
| 1143 | cn: Manager
|
|---|
| 1144 | description: Directory Manager
|
|---|
| 1145 |
|
|---|
| 1146 | # Setting up the container for users
|
|---|
| 1147 | dn: ou=People, dc=quenya, dc=org
|
|---|
| 1148 | objectclass: top
|
|---|
| 1149 | objectclass: organizationalUnit
|
|---|
| 1150 | ou: People
|
|---|
| 1151 |
|
|---|
| 1152 | # Set up an admin handle for People OU
|
|---|
| 1153 | dn: cn=admin, ou=People, dc=quenya, dc=org
|
|---|
| 1154 | cn: admin
|
|---|
| 1155 | objectclass: top
|
|---|
| 1156 | objectclass: organizationalRole
|
|---|
| 1157 | objectclass: simpleSecurityObject
|
|---|
| 1158 | userPassword: {SSHA}0jBHgQ1vp4EDX2rEMMfIudvRMJoGwjVb
|
|---|
| 1159 | # The password for above is 'mordonL8'
|
|---|
| 1160 | </programlisting>
|
|---|
| 1161 | </para></step>
|
|---|
| 1162 |
|
|---|
| 1163 | <step><para>
|
|---|
| 1164 | Load the initial data above into the LDAP database:
|
|---|
| 1165 | <screen>
|
|---|
| 1166 | &rootprompt;<userinput>slapadd -v -l initdb.ldif</userinput>
|
|---|
| 1167 | </screen>
|
|---|
| 1168 | </para></step>
|
|---|
| 1169 |
|
|---|
| 1170 | <step><para>
|
|---|
| 1171 | Start the LDAP server using the appropriate tool or method for
|
|---|
| 1172 | the operating system platform on which it is installed.
|
|---|
| 1173 | </para></step>
|
|---|
| 1174 |
|
|---|
| 1175 | <step><para>
|
|---|
| 1176 | Install the Idealx script files in the <filename>/usr/local/sbin</filename> directory,
|
|---|
| 1177 | then configure the smbldap_conf.pm file to match your system configuration.
|
|---|
| 1178 | </para></step>
|
|---|
| 1179 |
|
|---|
| 1180 | <step><para>
|
|---|
| 1181 | The &smb.conf; file that drives this backend can be found in example <link
|
|---|
| 1182 | linkend="fast-ldap">LDAP backend smb.conf for PDC</link>. Add additional stanzas
|
|---|
| 1183 | as required.
|
|---|
| 1184 | </para></step>
|
|---|
| 1185 |
|
|---|
| 1186 | <example id="fast-ldap">
|
|---|
| 1187 | <title>LDAP backend smb.conf for PDC</title>
|
|---|
| 1188 | <smbconfblock>
|
|---|
| 1189 | <smbconfcomment>Global parameters</smbconfcomment>
|
|---|
| 1190 | <smbconfsection name="[global]"/>
|
|---|
| 1191 | <smbconfoption name="workgroup">MIDEARTH</smbconfoption>
|
|---|
| 1192 | <smbconfoption name="netbios name">FRODO</smbconfoption>
|
|---|
| 1193 | <smbconfoption name="passdb backend">ldapsam:ldap://localhost</smbconfoption>
|
|---|
| 1194 | <smbconfoption name="username map">/etc/samba/smbusers</smbconfoption>
|
|---|
| 1195 | <smbconfoption name="printcap name">cups</smbconfoption>
|
|---|
| 1196 | <smbconfoption name="add user script">/usr/local/sbin/smbldap-useradd -m '%u'</smbconfoption>
|
|---|
| 1197 | <smbconfoption name="delete user script">/usr/local/sbin/smbldap-userdel %u</smbconfoption>
|
|---|
| 1198 | <smbconfoption name="add group script">/usr/local/sbin/smbldap-groupadd -p '%g'</smbconfoption>
|
|---|
| 1199 | <smbconfoption name="delete group script">/usr/local/sbin/smbldap-groupdel '%g'</smbconfoption>
|
|---|
| 1200 | <smbconfoption name="add user to group script">/usr/local/sbin/smbldap-groupmod -m '%u' '%g'</smbconfoption>
|
|---|
| 1201 | <smbconfoption name="delete user from group script">/usr/local/sbin/smbldap-groupmod -x '%u' '%g'</smbconfoption>
|
|---|
| 1202 | <smbconfoption name="set primary group script">/usr/local/sbin/smbldap-usermod -g '%g' '%u'</smbconfoption>
|
|---|
| 1203 | <smbconfoption name="add machine script">/usr/local/sbin/smbldap-useradd -w '%u'</smbconfoption>
|
|---|
| 1204 | <smbconfoption name="logon script">scripts\logon.bat</smbconfoption>
|
|---|
| 1205 | <smbconfoption name="logon path">\\%L\Profiles\%U</smbconfoption>
|
|---|
| 1206 | <smbconfoption name="logon drive">H:</smbconfoption>
|
|---|
| 1207 | <smbconfoption name="logon home">\\%L\%U</smbconfoption>
|
|---|
| 1208 | <smbconfoption name="domain logons">Yes</smbconfoption>
|
|---|
| 1209 | <smbconfoption name="os level">35</smbconfoption>
|
|---|
| 1210 | <smbconfoption name="preferred master">Yes</smbconfoption>
|
|---|
| 1211 | <smbconfoption name="domain master">Yes</smbconfoption>
|
|---|
| 1212 | <smbconfoption name="ldap suffix">dc=quenya,dc=org</smbconfoption>
|
|---|
| 1213 | <smbconfoption name="ldap machine suffix">ou=People</smbconfoption>
|
|---|
| 1214 | <smbconfoption name="ldap user suffix">ou=People</smbconfoption>
|
|---|
| 1215 | <smbconfoption name="ldap group suffix">ou=People</smbconfoption>
|
|---|
| 1216 | <smbconfoption name="ldap idmap suffix">ou=People</smbconfoption>
|
|---|
| 1217 | <smbconfoption name="ldap admin dn">cn=Manager,dc=quenya,dc=org</smbconfoption>
|
|---|
| 1218 | <smbconfoption name="ldap ssl">no</smbconfoption>
|
|---|
| 1219 | <smbconfoption name="ldap passwd sync">Yes</smbconfoption>
|
|---|
| 1220 | <smbconfoption name="idmap uid">15000-20000</smbconfoption>
|
|---|
| 1221 | <smbconfoption name="idmap gid">15000-20000</smbconfoption>
|
|---|
| 1222 | <smbconfoption name="printing">cups</smbconfoption>
|
|---|
| 1223 | </smbconfblock>
|
|---|
| 1224 | </example>
|
|---|
| 1225 |
|
|---|
| 1226 | <step><para>
|
|---|
| 1227 | Add the LDAP password to the <filename>secrets.tdb</filename> file so Samba can update
|
|---|
| 1228 | the LDAP database:
|
|---|
| 1229 | <screen>
|
|---|
| 1230 | &rootprompt;<userinput>smbpasswd -w mordonL8</userinput>
|
|---|
| 1231 | </screen>
|
|---|
| 1232 | </para></step>
|
|---|
| 1233 |
|
|---|
| 1234 | <step><para>
|
|---|
| 1235 | Add users and groups as required. Users and groups added using Samba tools
|
|---|
| 1236 | will automatically be added to both the LDAP backend and the operating
|
|---|
| 1237 | system as required.
|
|---|
| 1238 | </para></step>
|
|---|
| 1239 |
|
|---|
| 1240 | </procedure>
|
|---|
| 1241 |
|
|---|
| 1242 | </sect4>
|
|---|
| 1243 |
|
|---|
| 1244 | <sect4>
|
|---|
| 1245 | <title>Backup Domain Controller</title>
|
|---|
| 1246 |
|
|---|
| 1247 | <para>
|
|---|
| 1248 | <link linkend="fast-bdc"/> shows the example configuration for the BDC. Note that
|
|---|
| 1249 | the &smb.conf; file does not specify the smbldap-tools scripts &smbmdash; they are
|
|---|
| 1250 | not needed on a BDC. Add additional stanzas for shares and printers as required.
|
|---|
| 1251 | </para>
|
|---|
| 1252 |
|
|---|
| 1253 | <procedure>
|
|---|
| 1254 | <step><para>
|
|---|
| 1255 | Decide if the BDC should have its own LDAP server or not. If the BDC is to be
|
|---|
| 1256 | the LDAP server, change the following &smb.conf; as indicated. The default
|
|---|
| 1257 | configuration in <link linkend="fast-bdc">Remote LDAP BDC smb.conf</link>
|
|---|
| 1258 | uses a central LDAP server.
|
|---|
| 1259 | </para></step>
|
|---|
| 1260 |
|
|---|
| 1261 | <example id="fast-bdc">
|
|---|
| 1262 | <title>Remote LDAP BDC smb.conf</title>
|
|---|
| 1263 | <smbconfblock>
|
|---|
| 1264 | <smbconfcomment>Global parameters</smbconfcomment>
|
|---|
| 1265 | <smbconfsection name="[global]"/>
|
|---|
| 1266 | <smbconfoption name="workgroup">MIDEARTH</smbconfoption>
|
|---|
| 1267 | <smbconfoption name="netbios name">GANDALF</smbconfoption>
|
|---|
| 1268 | <smbconfoption name="passdb backend">ldapsam:ldap://frodo.quenya.org</smbconfoption>
|
|---|
| 1269 | <smbconfoption name="username map">/etc/samba/smbusers</smbconfoption>
|
|---|
| 1270 | <smbconfoption name="printcap name">cups</smbconfoption>
|
|---|
| 1271 | <smbconfoption name="logon script">scripts\logon.bat</smbconfoption>
|
|---|
| 1272 | <smbconfoption name="logon path">\\%L\Profiles\%U</smbconfoption>
|
|---|
| 1273 | <smbconfoption name="logon drive">H:</smbconfoption>
|
|---|
| 1274 | <smbconfoption name="logon home">\\%L\%U</smbconfoption>
|
|---|
| 1275 | <smbconfoption name="domain logons">Yes</smbconfoption>
|
|---|
| 1276 | <smbconfoption name="os level">33</smbconfoption>
|
|---|
| 1277 | <smbconfoption name="preferred master">Yes</smbconfoption>
|
|---|
| 1278 | <smbconfoption name="domain master">No</smbconfoption>
|
|---|
| 1279 | <smbconfoption name="ldap suffix">dc=quenya,dc=org</smbconfoption>
|
|---|
| 1280 | <smbconfoption name="ldap machine suffix">ou=People</smbconfoption>
|
|---|
| 1281 | <smbconfoption name="ldap user suffix">ou=People</smbconfoption>
|
|---|
| 1282 | <smbconfoption name="ldap group suffix">ou=People</smbconfoption>
|
|---|
| 1283 | <smbconfoption name="ldap idmap suffix">ou=People</smbconfoption>
|
|---|
| 1284 | <smbconfoption name="ldap admin dn">cn=Manager,dc=quenya,dc=org</smbconfoption>
|
|---|
| 1285 | <smbconfoption name="ldap ssl">no</smbconfoption>
|
|---|
| 1286 | <smbconfoption name="ldap passwd sync">Yes</smbconfoption>
|
|---|
| 1287 | <smbconfoption name="idmap uid">15000-20000</smbconfoption>
|
|---|
| 1288 | <smbconfoption name="idmap gid">15000-20000</smbconfoption>
|
|---|
| 1289 | <smbconfoption name="printing">cups</smbconfoption>
|
|---|
| 1290 | </smbconfblock>
|
|---|
| 1291 | </example>
|
|---|
| 1292 |
|
|---|
| 1293 | <step><para>
|
|---|
| 1294 | Configure the NETLOGON and PROFILES directory as for the PDC in <link linkend="fast-bdc"/>.
|
|---|
| 1295 | </para></step>
|
|---|
| 1296 | </procedure>
|
|---|
| 1297 |
|
|---|
| 1298 | </sect4>
|
|---|
| 1299 |
|
|---|
| 1300 | </sect3>
|
|---|
| 1301 |
|
|---|
| 1302 | </sect2>
|
|---|
| 1303 |
|
|---|
| 1304 | </sect1>
|
|---|
| 1305 |
|
|---|
| 1306 | </chapter>
|
|---|
