source: vendor/3.5.9/docs/htmldocs/Samba3-ByExample/Big500users.html

Last change on this file was 597, checked in by Herwig Bauernfeind, 14 years ago

Samba 3.5: Update vendor to version 3.5.9
File size: 95.4 KB
Line 
1<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 4. The 500-User Office</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="secure.html" title="Chapter 3. Secure Office Networking"><link rel="next" href="happy.html" title="Chapter 5. Making Happy Users"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 4. The 500-User Office</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="secure.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="happy.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 4. The 500-User Office"><div class="titlepage"><div><div><h2 class="title"><a name="Big500users"></a>Chapter 4. The 500-User Office</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="Big500users.html#id336007">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id336038">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id336113">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id336141">Technical Issues</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id336318">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id336338">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#ch5-dnshcp-setup">Installation of DHCP, DNS, and Samba Control Files</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id337052">Server Preparation: All Servers</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id337568">Server-Specific Preparation</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5-procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id340544">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id340597">Questions and Answers</a></span></dt></dl></div><p>
2 The Samba-3 networking you explored in <a class="link" href="secure.html" title="Chapter 3. Secure Office Networking">&#8220;Secure Office Networking&#8221;</a> covers the finer points of
3 configuration of peripheral services such as DHCP and DNS, and WINS. You experienced
4 implementation of a simple configuration of the services that are important adjuncts
5 to successful deployment of Samba.
6 </p><p>
7 An analysis of the history of postings to the Samba mailing list easily demonstrates
8 that the two most prevalent Samba problem areas are
9 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
10 Defective resolution of a NetBIOS name to its IP address
11 </p></li><li class="listitem"><p>
12 Printing problems
13 </p></li></ul></div><p>
14 The exercises
15 so far in this book have focused on implementation of the simplest printing processes
16 involving no print job processing intelligence. In this chapter, you maintain
17 that same approach to printing, but <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">&#8220;Making Happy Users&#8221;</a> presents an opportunity
18 to make printing more complex for the administrator while making it easier for the user.
19 </p><p>
20 <a class="indexterm" name="id335954"></a>
21 <a class="indexterm" name="id335961"></a>
22 <a class="indexterm" name="id335967"></a>
23 <a class="link" href="secure.html" title="Chapter 3. Secure Office Networking">&#8220;Secure Office Networking&#8221;</a> demonstrates operation of a DHCP server and a DNS server
24 as well as a central WINS server. You validated the operation of these services and
25 saw an effective implementation of a Samba domain controller using the
26 <em class="parameter"><code>tdbsam</code></em> passdb backend.
27 </p><p>
28 The objective of this chapter is to introduce more complex techniques that can be used to
29 improve manageability of Samba as networking needs grow. In this chapter, you implement
30 a distributed DHCP server environment, a distributed DNS server arrangement, a centralized
31 WINS server, and a centralized Samba domain controller.
32 </p><p>
33 A note of caution is important regarding the Samba configuration that is used in this
34 chapter. The use of a single domain controller on a routed, multisegment network is
35 a poor design choice that leads to potential network user complaints.
36 This chapter demonstrates some successful
37 techniques in deployment and configuration management. This should be viewed as a
38 foundation chapter for complex Samba deployments.
39 </p><p>
40 As you master the techniques presented here, you may find much better methods to
41 improve network management and control while reducing human resource overheads.
42 You should take the opportunity to innovate and expand on the methods presented
43 here and explore them to the fullest.
44 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id336007"></a>Introduction</h2></div></div></div><p>
45 Business continues to go well for Abmas. Mr. Meany is driving your success and the
46 network continues to grow thanks to the hard work Christine has done. You recently
47 hired Stanley Soroka as manager of information systems. Christine recommended Stan
48 to the role. She told you Stan is so good at handling Samba that he can make a cast
49 iron rocking horse that is embedded in concrete kick like a horse at a rodeo. You
50 need skills like his. Christine and Stan get along just fine. Let's see what
51 you can get out of this pair as they plot the next-generation networks.
52 </p><p>
53 Ten months ago Abmas closed an acquisition of a property insurance business. The
54 founder lost interest in the business and decided to sell it to Mr. Meany. Because
55 they were former university classmates, the purchase was concluded with mutual assent.
56 The acquired business is located at the other end of town in much larger facilities.
57 The old Abmas building has become too small. Located on the same campus as the newly
58 acquired business are two empty buildings that are ideal to provide Abmas with
59 opportunity for growth.
60 </p><p>
61 Abmas has now completed the purchase of the two empty buildings, and you are
62 to install a new network and relocate staff in nicely furnished new facilities.
63 The new network is to be used to fully integrate company operations. You have
64 decided to locate the new network operations control center in the larger building
65 in which the insurance group is located to take advantage of an ideal floor space
66 and to allow Stan and Christine to fully stage the new network and test it before
67 it is rolled out. Your strategy is to complete the new network so that it
68 is ready for operation when the old office moves into the new premises.
69 </p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id336038"></a>Assignment Tasks</h3></div></div></div><p>
70 The acquired business had 280 network users. The old Abmas building housed
71 220 network users in unbelievably cramped conditions. The network that
72 initially served 130 users now handles 220 users quite well.
73 </p><p>
74 The two businesses will be fully merged to create a single campus company.
75 The Property Insurance Group (PIG) houses 300 employees, the new Accounting
76 Services Group (ASG) will be in a small building (BLDG1) that houses 50
77 employees, and the Financial Services Group (FSG) will be housed in a large
78 building that has capacity for growth (BLDG2). Building 2 houses 150 network
79 users.
80 </p><p>
81 You have decided to connect the building using fiber optic links between new
82 routers. As a backup, the buildings are interconnected using line-of-sight
83 high-speed infrared facilities. The infrared connection provides a
84 secondary route to be used during periods of high demand for network
85 bandwidth.
86 </p><p>
87 The Internet gateway is upgraded to 15 Mb/sec service. Your ISP
88 provides on your premises a fully managed Cisco PIX firewall. You no longer need
89 to worry about firewall facilities on your network.
90 </p><p>
91 Stanley and Christine have purchased new server hardware. Christine wants to
92 roll out a network that has whistles and bells. Stan wants to start off with
93 a simple to manage, not-too-complex network. He believes that network
94 users need to be gradually introduced to new features and capabilities and not
95 rushed into an environment that may cause disorientation and loss of productivity.
96 </p><p>
97 Your intrepid network team has decided to implement a network configuration
98 that closely mirrors the successful system you installed in the old Abmas building.
99 The new network infrastructure is owned by Abmas, but all desktop systems
100 are being procured through a new out-source services and leasing company. Under
101 the terms of a deal with Mr. M. Proper (CEO), DirectPointe, Inc., provides
102 all desktop systems and includes full level-one help desk support for
103 a flat per-machine monthly fee. The deal allows you to add workstations on demand.
104 This frees Stan and Christine to deal with deeper issues as they emerge and
105 permits Stan to work on creating new future value-added services.
106 </p><p>
107 DirectPointe Inc. receives from you a new standard desktop configuration
108 every four months. They automatically roll that out to each desktop system.
109 You must keep DirectPointe informed of all changes.
110 </p><p><a class="indexterm" name="id336088"></a>
111 The new network has a single Samba Primary Domain Controller (PDC) located in the
112 Network Operation Center (NOC). Buildings 1 and 2 each have a local server
113 for local application servicing. It is a domain member. The new system
114 uses the <em class="parameter"><code>tdbsam</code></em> passdb backend.
115 </p><p>
116 Printing is based on raw pass-through facilities just as it has been used so far.
117 All printer drivers are installed on the desktop and notebook computers.
118 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id336113"></a>Dissection and Discussion</h2></div></div></div><p>
119 <a class="indexterm" name="id336121"></a>
120 The example you are building in this chapter is of a network design that works, but this
121 does not make it a design that is recommended. As a general rule, there should be at least
122 one Backup Domain Controller (BDC) per 150 Windows network clients. The principle behind
123 this recommendation is that correct operation of MS Windows clients requires rapid
124 network response to all SMB/CIFS requests. The same rule says that if there are more than
125 50 clients per domain controller, they are too busy to service requests. Let's put such
126 rules aside and recognize that network load affects the integrity of domain controller
127 responsiveness. This network will have 500 clients serviced by one central domain
128 controller. This is not a good omen for user satisfaction. You, of course, address this
129 very soon (see <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">&#8220;Making Happy Users&#8221;</a>).
130 </p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id336141"></a>Technical Issues</h3></div></div></div><p>
131 Stan has talked you into a horrible compromise, but it is addressed. Just make
132 certain that the performance of this network is well validated before going live.
133 </p><p>
134 Design decisions made in this design include the following:
135 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
136 <a class="indexterm" name="id336161"></a>
137 <a class="indexterm" name="id336168"></a>
138 <a class="indexterm" name="id336174"></a>
139 A single PDC is being implemented. This limitation is based on the choice not to
140 use LDAP. Many network administrators fear using LDAP because of the perceived
141 complexity of implementation and management of an LDAP-based backend for all user
142 identity management as well as to store network access credentials.
143 </p></li><li class="listitem"><p>
144 <a class="indexterm" name="id336188"></a>
145 <a class="indexterm" name="id336195"></a>
146 Because of the refusal to use an LDAP (ldapsam) passdb backend at this time, the
147 only choice that makes sense with 500 users is to use the tdbsam passwd backend.
148 This type of backend is not receptive to replication to BDCs. If the tdbsam
149 <code class="filename">passdb.tdb</code> file is replicated to BDCs using
150 <code class="literal">rsync</code>, there are two potential problems: (1) data that is in
151 memory but not yet written to disk will not be replicated, and (2) domain member
152 machines periodically change the secret machine password. When this happens, there
153 is no mechanism to return the changed password to the PDC.
154 </p></li><li class="listitem"><p>
155 All domain user, group, and machine accounts are managed on the PDC. This makes
156 for a simple mode of operation but has to be balanced with network performance and
157 integrity of operations considerations.
158 </p></li><li class="listitem"><p>
159 <a class="indexterm" name="id336229"></a>
160 A single central WINS server is being used. The PDC is also the WINS server.
161 Any attempt to operate a routed network without a WINS server while using NetBIOS
162 over TCP/IP protocols does not work unless on each client the name resolution
163 entries for the PDC are added to the <code class="filename">LMHOSTS</code>. This file is
164 normally located on the Windows XP Professional client in the
165 <code class="filename">C:\WINDOWS\SYSTEM32\ETC\DRIVERS</code> directory.
166 </p></li><li class="listitem"><p>
167 At this time the Samba WINS database cannot be replicated. That is
168 why a single WINS server is being implemented. This should work without a problem.
169 </p></li><li class="listitem"><p>
170 <a class="indexterm" name="id336261"></a>
171 BDCs make use of <code class="literal">winbindd</code> to provide
172 access to domain security credentials for file system access and object storage.
173 </p></li><li class="listitem"><p>
174 <a class="indexterm" name="id336279"></a>
175 <a class="indexterm" name="id336288"></a>
176 Configuration of Windows XP Professional clients is achieved using DHCP. Each
177 subnet has its own DHCP server. Backup DHCP serving is provided by one
178 alternate DHCP server. This necessitates enabling of the DHCP Relay agent on
179 all routers. The DHCP Relay agent must be programmed to pass DHCP Requests from the
180 network directed at the backup DHCP server.
181 </p></li><li class="listitem"><p>
182 All network users are granted the ability to print to any printer that is
183 network-attached. All printers are available from each server. Print jobs that
184 are spooled to a printer that is not on the local network segment are automatically
185 routed to the print spooler that is in control of that printer. The specific details
186 of how this might be done are demonstrated for one example only.
187 </p></li><li class="listitem"><p>
188 The network address and subnetmask chosen provide 1022 usable IP addresses in
189 each subnet. If in the future more addresses are required, it would make sense
190 to add further subnets rather than change addressing.
191 </p></li></ul></div></div><div class="sect2" title="Political Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id336318"></a>Political Issues</h3></div></div></div><p>
192 This case gets close to the real world. You and I know the right way to implement
193 domain control. Politically, we have to navigate a minefield. In this case, the need is to
194 get the PDC rolled out in compliance with expectations and also to be ready to save the day
195 by having the real solution ready before it is needed. That real solution is presented in
196 <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">&#8220;Making Happy Users&#8221;</a>.
197 </p></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id336338"></a>Implementation</h2></div></div></div><p>
198 The following configuration process begins following installation of Red Hat Fedora Core2 on the
199 three servers shown in the network topology diagram in <a class="link" href="Big500users.html#chap05net" title="Figure 4.1. Network Topology 500 User Network Using tdbsam passdb backend.">&#8220;Network Topology 500 User Network Using tdbsam passdb backend.&#8221;</a>. You have
200 selected hardware that is appropriate to the task.
201 </p><div class="figure"><a name="chap05net"></a><p class="title"><b>Figure 4.1. Network Topology 500 User Network Using tdbsam passdb backend.</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap5-net.png" width="270" alt="Network Topology 500 User Network Using tdbsam passdb backend."></div></div></div><br class="figure-break"><div class="sect2" title="Installation of DHCP, DNS, and Samba Control Files"><div class="titlepage"><div><div><h3 class="title"><a name="ch5-dnshcp-setup"></a>Installation of DHCP, DNS, and Samba Control Files</h3></div></div></div><p>
202 Carefully install the configuration files into the correct locations as shown in
203 <a class="link" href="Big500users.html#ch5-filelocations" title="Table 4.1. Domain: MEGANET, File Locations for Servers">&#8220;Domain: MEGANET, File Locations for Servers&#8221;</a>. You should validate that the full file path is
204 correct as shown.
205 </p><p>
206 The abbreviation shown in this table as <code class="constant">{VLN}</code> refers to
207 the directory location beginning with <code class="filename">/var/lib/named</code>.
208 </p><div class="table"><a name="ch5-filelocations"></a><p class="title"><b>Table 4.1. Domain: <code class="constant">MEGANET</code>, File Locations for Servers</b></p><div class="table-contents"><table summary="Domain: MEGANET, File Locations for Servers" border="1"><colgroup><col align="left"><col align="left"><col align="center"><col align="center"><col align="center"></colgroup><thead><tr><th colspan="2" align="center">File Information</th><th colspan="3" align="center">Server Name</th></tr><tr><th align="center">Source</th><th align="center">Target Location</th><th align="center">MASSIVE</th><th align="center">BLDG1</th><th align="center">BLDG2</th></tr></thead><tbody><tr><td align="left"><a class="link" href="Big500users.html#ch5-massivesmb" title="Example 4.1. Server: MASSIVE (PDC), File: /etc/samba/smb.conf">&#8220;Server: MASSIVE (PDC), File: /etc/samba/smb.conf&#8221;</a></td><td align="left"><code class="filename">/etc/samba/smb.conf</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-dc-common" title="Example 4.2. Server: MASSIVE (PDC), File: /etc/samba/dc-common.conf">&#8220;Server: MASSIVE (PDC), File: /etc/samba/dc-common.conf&#8221;</a></td><td align="left"><code class="filename">/etc/samba/dc-common.conf</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-commonsmb" title="Example 4.3. Common Samba Configuration File: /etc/samba/common.conf">&#8220;Common Samba Configuration File: /etc/samba/common.conf&#8221;</a></td><td align="left"><code class="filename">/etc/samba/common.conf</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-bldg1-smb" title="Example 4.4. Server: BLDG1 (Member), File: smb.conf">&#8220;Server: BLDG1 (Member), File: smb.conf&#8221;</a></td><td align="left"><code class="filename">/etc/samba/smb.conf</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-bldg2-smb" title="Example 4.5. Server: BLDG2 (Member), File: smb.conf">&#8220;Server: BLDG2 (Member), File: smb.conf&#8221;</a></td><td align="left"><code class="filename">/etc/samba/smb.conf</code></td><td align="center">No</td><td align="center">No</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-dommem-smb" title="Example 4.6. Common Domain Member Include File: dom-mem.conf">&#8220;Common Domain Member Include File: dom-mem.conf&#8221;</a></td><td align="left"><code class="filename">/etc/samba/dommem.conf</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#massive-dhcp" title="Example 4.7. Server: MASSIVE, File: dhcpd.conf">&#8220;Server: MASSIVE, File: dhcpd.conf&#8221;</a></td><td align="left"><code class="filename">/etc/dhcpd.conf</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#bldg1dhcp" title="Example 4.8. Server: BLDG1, File: dhcpd.conf">&#8220;Server: BLDG1, File: dhcpd.conf&#8221;</a></td><td align="left"><code class="filename">/etc/dhcpd.conf</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#bldg2dhcp" title="Example 4.9. Server: BLDG2, File: dhcpd.conf">&#8220;Server: BLDG2, File: dhcpd.conf&#8221;</a></td><td align="left"><code class="filename">/etc/dhcpd.conf</code></td><td align="center">No</td><td align="center">No</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#massive-nameda" title="Example 4.10. Server: MASSIVE, File: named.conf, Part: A">&#8220;Server: MASSIVE, File: named.conf, Part: A&#8221;</a></td><td align="left"><code class="filename">/etc/named.conf (part A)</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#massive-namedb" title="Example 4.11. Server: MASSIVE, File: named.conf, Part: B">&#8220;Server: MASSIVE, File: named.conf, Part: B&#8221;</a></td><td align="left"><code class="filename">/etc/named.conf (part B)</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#massive-namedc" title="Example 4.12. Server: MASSIVE, File: named.conf, Part: C">&#8220;Server: MASSIVE, File: named.conf, Part: C&#8221;</a></td><td align="left"><code class="filename">/etc/named.conf (part C)</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#abmasbizdns" title="Example 4.13. Forward Zone File: abmas.biz.hosts">&#8220;Forward Zone File: abmas.biz.hosts&#8221;</a></td><td align="left"><code class="filename">{VLN}/master/abmas.biz.hosts</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#abmasusdns" title="Example 4.14. Forward Zone File: abmas.biz.hosts">&#8220;Forward Zone File: abmas.biz.hosts&#8221;</a></td><td align="left"><code class="filename">{VLN}/master/abmas.us.hosts</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#bldg12nameda" title="Example 4.15. Servers: BLDG1/BLDG2, File: named.conf, Part: A">&#8220;Servers: BLDG1/BLDG2, File: named.conf, Part: A&#8221;</a></td><td align="left"><code class="filename">/etc/named.conf (part A)</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#bldg12namedb" title="Example 4.16. Servers: BLDG1/BLDG2, File: named.conf, Part: B">&#8220;Servers: BLDG1/BLDG2, File: named.conf, Part: B&#8221;</a></td><td align="left"><code class="filename">/etc/named.conf (part B)</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="appendix.html#loopback" title="Example 15.3. DNS Localhost Forward Zone File: /var/lib/named/localhost.zone">&#8220;DNS Localhost Forward Zone File: /var/lib/named/localhost.zone&#8221;</a></td><td align="left"><code class="filename">{VLN}/localhost.zone</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="appendix.html#dnsloopy" title="Example 15.4. DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone">&#8220;DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone&#8221;</a></td><td align="left"><code class="filename">{VLN}/127.0.0.zone</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="appendix.html#roothint" title="Example 15.5. DNS Root Name Server Hint File: /var/lib/named/root.hint">&#8220;DNS Root Name Server Hint File: /var/lib/named/root.hint&#8221;</a></td><td align="left"><code class="filename">{VLN}/root.hint</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr></tbody></table></div></div><br class="table-break"></div><div class="sect2" title="Server Preparation: All Servers"><div class="titlepage"><div><div><h3 class="title"><a name="id337052"></a>Server Preparation: All Servers</h3></div></div></div><p>
209 The following steps apply to all servers. Follow each step carefully.
210 </p><div class="procedure" title="Procedure 4.1. Server Preparation Steps"><a name="id337062"></a><p class="title"><b>Procedure 4.1. Server Preparation Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>
211 Using the UNIX/Linux system tools, set the name of the server as shown in the network
212 topology diagram in <a class="link" href="Big500users.html#chap05net" title="Figure 4.1. Network Topology 500 User Network Using tdbsam passdb backend.">&#8220;Network Topology 500 User Network Using tdbsam passdb backend.&#8221;</a>. For SUSE Linux products, the tool
213 that permits this is called <code class="literal">yast2</code>; for Red Hat Linux products,
214 you can use the <code class="literal">netcfg</code> tool.
215 Verify that your hostname is correctly set by running:
216</p><pre class="screen">
217<code class="prompt">root# </code> uname -n
218</pre><p>
219 An alternate method to verify the hostname is:
220</p><pre class="screen">
221<code class="prompt">root# </code> hostname -f
222</pre><p>
223 </p></li><li class="step" title="Step 2"><p>
224 <a class="indexterm" name="id337123"></a>
225 <a class="indexterm" name="id337130"></a>
226 Edit your <code class="filename">/etc/hosts</code> file to include the primary names and addresses
227 of all network interfaces that are on the host server. This is necessary so that during
228 startup the system is able to resolve all its own names to the IP address prior to
229 startup of the DNS server. You should check the startup order of your system. If the
230 CUPS print server is started before the DNS server (<code class="literal">named</code>), you
231 should also include an entry for the printers in the <code class="filename">/etc/hosts</code> file.
232 </p></li><li class="step" title="Step 3"><p>
233 <a class="indexterm" name="id337165"></a>
234 All DNS name resolution should be handled locally. To ensure that the server is configured
235 correctly to handle this, edit <code class="filename">/etc/resolv.conf</code> so it has the following
236 content:
237</p><pre class="screen">
238search abmas.us abmas.biz
239nameserver 127.0.0.1
240</pre><p>
241 This instructs the name resolver function (when configured correctly) to ask the DNS server
242 that is running locally to resolve names to addresses.
243 </p></li><li class="step" title="Step 4"><p>
244 <a class="indexterm" name="id337193"></a>
245 <a class="indexterm" name="id337200"></a>
246 Add the <code class="constant">root</code> user to the password backend:
247</p><pre class="screen">
248<code class="prompt">root# </code> smbpasswd -a root
249New SMB password: XXXXXXXX
250Retype new SMB password: XXXXXXXX
251<code class="prompt">root# </code>
252</pre><p>
253 The <code class="constant">root</code> account is the UNIX equivalent of the Windows domain administrator.
254 This account is essential in the regular maintenance of your Samba server. It must never be
255 deleted. If for any reason the account is deleted, you may not be able to recreate this account
256 without considerable trouble.
257 </p></li><li class="step" title="Step 5"><p>
258 <a class="indexterm" name="id337241"></a>
259 <a class="indexterm" name="id337248"></a>
260 Create the username map file to permit the <code class="constant">root</code> account to be called
261 <code class="constant">Administrator</code> from the Windows network environment. To do this, create
262 the file <code class="filename">/etc/samba/smbusers</code> with the following contents:
263</p><pre class="screen">
264####
265# User mapping file
266####
267# File Format
268# -----------
269# Unix_ID = Windows_ID
270#
271# Examples:
272# root = Administrator
273# janes = "Jane Smith"
274# jimbo = Jim Bones
275#
276# Note: If the name contains a space it must be double quoted.
277# In the example above the name 'jimbo' will be mapped to Windows
278# user names 'Jim' and 'Bones' because the space was not quoted.
279#######################################################################
280root = Administrator
281####
282# End of File
283####
284</pre><p>
285 </p></li><li class="step" title="Step 6"><p>
286 Configure all network-attached printers to have a fixed IP address.
287 </p></li><li class="step" title="Step 7"><p>
288 Create an entry in the DNS database on the server <code class="constant">MASSIVE</code>
289 in both the forward lookup database for the zone <code class="constant">abmas.biz.hosts</code>
290 and in the reverse lookup database for the network segment that the printer is
291 located in. Example configuration files for similar zones were presented in <a class="link" href="secure.html" title="Chapter 3. Secure Office Networking">&#8220;Secure Office Networking&#8221;</a>,
292 <a class="link" href="secure.html#abmasbiz" title="Example 3.14. DNS Abmas.biz Forward Zone File">&#8220;DNS Abmas.biz Forward Zone File&#8221;</a> and <a class="link" href="secure.html#eth2zone" title="Example 3.13. DNS 192.168.2 Reverse Zone File">&#8220;DNS 192.168.2 Reverse Zone File&#8221;</a>.
293 </p></li><li class="step" title="Step 8"><p>
294 Follow the instructions in the printer manufacturer's manuals to permit printing
295 to port 9100. Use any other port the manufacturer specifies for direct mode,
296 raw printing. This allows the CUPS spooler to print using raw mode protocols.
297 <a class="indexterm" name="id337328"></a>
298 <a class="indexterm" name="id337335"></a>
299 </p></li><li class="step" title="Step 9"><p>
300 <a class="indexterm" name="id337348"></a>
301 Only on the server to which the printer is attached configure the CUPS Print
302 Queues as follows:
303</p><pre class="screen">
304<code class="prompt">root# </code> lpadmin -p <em class="parameter"><code>printque</code></em> -v socket://<em class="parameter"><code>printer-name</code></em>.abmas.biz:9100 -E
305</pre><p>
306 <a class="indexterm" name="id337382"></a>
307 This step creates the necessary print queue to use no assigned print filter. This
308 is ideal for raw printing, that is, printing without use of filters.
309 The name <em class="parameter"><code>printque</code></em> is the name you have assigned for
310 the particular printer.
311 </p></li><li class="step" title="Step 10"><p>
312 Print queues may not be enabled at creation. Make certain that the queues
313 you have just created are enabled by executing the following:
314</p><pre class="screen">
315<code class="prompt">root# </code> /usr/bin/enable <em class="parameter"><code>printque</code></em>
316</pre><p>
317 </p></li><li class="step" title="Step 11"><p>
318 Even though your print queue may be enabled, it is still possible that it
319 does not accept print jobs. A print queue services incoming printing
320 requests only when configured to do so. Ensure that your print queue is
321 set to accept incoming jobs by executing the following command:
322</p><pre class="screen">
323<code class="prompt">root# </code> /usr/bin/accept <em class="parameter"><code>printque</code></em>
324</pre><p>
325 </p></li><li class="step" title="Step 12"><p>
326 <a class="indexterm" name="id337455"></a>
327 <a class="indexterm" name="id337461"></a>
328 <a class="indexterm" name="id337468"></a>
329 This step, as well as the next one, may be omitted where CUPS version 1.1.18
330 or later is in use. Although it does no harm to follow it anyway, and may
331 help to avoid time spent later trying to figure out why print jobs may be
332 disappearing without a trace. Look at these two steps as <span class="emphasis"><em>insurance</em></span>
333 against lost time. Edit file <code class="filename">/etc/cups/mime.convs</code> to
334 uncomment the line:
335</p><pre class="screen">
336application/octet-stream application/vnd.cups-raw 0 -
337</pre><p>
338 </p></li><li class="step" title="Step 13"><p>
339 <a class="indexterm" name="id337500"></a>
340 Edit the file <code class="filename">/etc/cups/mime.types</code> to uncomment the line:
341</p><pre class="screen">
342application/octet-stream
343</pre><p>
344 </p></li><li class="step" title="Step 14"><p>
345 Refer to the CUPS printing manual for instructions regarding how to configure
346 CUPS so that print queues that reside on CUPS servers on remote networks
347 route print jobs to the print server that owns that queue. The default setting
348 on your CUPS server may automatically discover remotely installed printers and
349 may permit this functionality without requiring specific configuration.
350 </p></li><li class="step" title="Step 15"><p>
351 As part of the roll-out program, you need to configure the application's
352 server shares. This can be done once on the central server and may then be
353 replicated using a tool such as <code class="literal">rsync</code>. Refer to the man
354 page for <code class="literal">rsync</code> for details regarding use. The notes in
355 <a class="link" href="secure.html#ch4appscfg" title="Application Share Configuration">&#8220;Application Share Configuration&#8221;</a> may help in your decisions to use an application
356 server facility.
357 </p></li></ol></div><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
358 Logon scripts that are run from a domain controller (PDC or BDC) are capable of using semi-intelligent
359 processes to automap Windows client drives to an application server that is nearest to the client. This
360 is considerably more difficult when a single PDC is used on a routed network. It can be done, but not
361 as elegantly as you see in the next chapter.
362 </p></div></div><div class="sect2" title="Server-Specific Preparation"><div class="titlepage"><div><div><h3 class="title"><a name="id337568"></a>Server-Specific Preparation</h3></div></div></div><p>
363 There are some steps that apply to particular server functionality only. Each step is critical
364 to correct server operation. The following step-by-step installation guidance will assist you
365 in working through the process of configuring the PDC and then both BDC's.
366 </p><div class="sect3" title="Configuration for Server: MASSIVE"><div class="titlepage"><div><div><h4 class="title"><a name="id337579"></a>Configuration for Server: <code class="constant">MASSIVE</code></h4></div></div></div><p>
367 The steps presented here attempt to implement Samba installation in a generic manner. While
368 some steps are clearly specific to Linux, it should not be too difficult to apply them to
369 your platform of choice.
370 </p><div class="procedure" title="Procedure 4.2. Primary Domain Controller Preparation"><a name="id337592"></a><p class="title"><b>Procedure 4.2. Primary Domain Controller Preparation</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>
371 <a class="indexterm" name="id337603"></a>
372 <a class="indexterm" name="id337610"></a>
373 The host server acts as a router between the two internal network segments as well
374 as for all Internet access. This necessitates that IP forwarding be enabled. This can be
375 achieved by adding to the <code class="filename">/etc/rc.d/boot.local</code> an entry as follows:
376</p><pre class="screen">
377echo 1 &gt; /proc/sys/net/ipv4/ip_forward
378</pre><p>
379 To ensure that your kernel is capable of IP forwarding during configuration, you may wish to execute
380 that command manually also. This setting permits the Linux system to act as a router.
381 </p></li><li class="step" title="Step 2"><p>
382 This server is dual hosted (i.e., has two network interfaces) one goes to the Internet
383 and the other to a local network that has a router that is the gateway to the remote networks.
384 You must therefore configure the server with route table entries so that it can find machines
385 on the remote networks. You can do this using the appropriate system tools for your Linux
386 server or using static entries that you place in one of the system startup files. It is best
387 to always use the tools that the operating system vendor provided. In the case of SUSE Linux, the
388 best tool to do this is YaST (refer to SUSE Administration Manual); in the case of Red Hat,
389 this is best done using the graphical system configuration tools (see the Red Hat documentation).
390 An example of how this may be done manually is as follows:
391</p><pre class="screen">
392<code class="prompt">root# </code> route add net 172.16.4.0 netmask 255.255.252.0 gw 172.16.0.128
393<code class="prompt">root# </code> route add net 172.16.8.0 netmask 255.255.252.0 gw 172.16.0.128
394</pre><p>
395 If you just execute these commands manually, the route table entries you have created are
396 not persistent across system reboots. You may add these commands directly to the local
397 startup files as follows: (SUSE) <code class="filename">/etc/rc.d/boot.local</code>, (Red Hat)
398 <code class="filename">/etc/rc.d/init.d/rc.local</code>.
399 </p></li><li class="step" title="Step 3"><p>
400 <a class="indexterm" name="id337688"></a>
401 The final step that must be completed is to edit the <code class="filename">/etc/nsswitch.conf</code> file.
402 This file controls the operation of the various resolver libraries that are part of the Linux
403 Glibc libraries. Edit this file so that it contains the following entries:
404</p><pre class="screen">
405hosts: files dns wins
406</pre><p>
407 </p></li><li class="step" title="Step 4"><p>
408 <a class="indexterm" name="id337715"></a>
409 Create and map Windows domain groups to UNIX groups. A sample script is provided in
410 <a class="link" href="Big500users.html#ch5-initgrps" title="Example 4.17. Initialize Groups Script, File: /etc/samba/initGrps.sh">&#8220;Initialize Groups Script, File: /etc/samba/initGrps.sh&#8221;</a>. Create a file containing this script. You called yours
411 <code class="filename">/etc/samba/initGrps.sh</code>. Set this file so it can be executed
412 and then execute the script. An example of the execution of this script as well as its
413 validation are shown in Section 4.3.2, Step 5.
414 </p></li><li class="step" title="Step 5"><p>
415 <a class="indexterm" name="id337743"></a>
416 <a class="indexterm" name="id337750"></a>
417 <a class="indexterm" name="id337759"></a>
418 For each user who needs to be given a Windows domain account, make an entry in the
419 <code class="filename">/etc/passwd</code> file as well as in the Samba password backend.
420 Use the system tool of your choice to create the UNIX system account, and use the Samba
421 <code class="literal">smbpasswd</code> to create a domain user account.
422 </p><p>
423 <a class="indexterm" name="id337784"></a>
424 <a class="indexterm" name="id337790"></a>
425 <a class="indexterm" name="id337797"></a>
426 There are a number of tools for user management under UNIX, such as
427 <code class="literal">useradd</code>, <code class="literal">adduser</code>, as well as a plethora of custom
428 tools. With the tool of your choice, create a home directory for each user.
429 </p></li><li class="step" title="Step 6"><p>
430 Using the preferred tool for your UNIX system, add each user to the UNIX groups created
431 previously as necessary. File system access control is based on UNIX group membership.
432 </p></li><li class="step" title="Step 7"><p>
433 Create the directory mount point for the disk subsystem that is to be mounted to provide
434 data storage for company files, in this case, the mount point indicated in the <code class="filename">smb.conf</code>
435 file is <code class="filename">/data</code>. Format the file system as required and mount the formatted
436 file system partition using appropriate system tools.
437 </p></li><li class="step" title="Step 8"><p>
438 <a class="indexterm" name="id337856"></a>
439 Create the top-level file storage directories for data and applications as follows:
440</p><pre class="screen">
441<code class="prompt">root# </code> mkdir -p /data/{accounts,finsvcs,pidata}
442<code class="prompt">root# </code> mkdir -p /apps
443<code class="prompt">root# </code> chown -R root:root /data
444<code class="prompt">root# </code> chown -R root:root /apps
445<code class="prompt">root# </code> chown -R bjordan:accounts /data/accounts
446<code class="prompt">root# </code> chown -R bjordan:finsvcs /data/finsvcs
447<code class="prompt">root# </code> chown -R bjordan:finsvcs /data/pidata
448<code class="prompt">root# </code> chmod -R ug+rwxs,o-rwx /data
449<code class="prompt">root# </code> chmod -R ug+rwx,o+rx-w /apps
450</pre><p>
451 Each department is responsible for creating its own directory structure within the departmental
452 share. The directory root of the <code class="literal">accounts</code> share is <code class="filename">/data/accounts</code>.
453 The directory root of the <code class="literal">finsvcs</code> share is <code class="filename">/data/finsvcs</code>.
454 The <code class="filename">/apps</code> directory is the root of the <code class="constant">apps</code> share
455 that provides the application server infrastructure.
456 </p></li><li class="step" title="Step 9"><p>
457 The <code class="filename">smb.conf</code> file specifies an infrastructure to support roaming profiles and network
458 logon services. You can now create the file system infrastructure to provide the
459 locations on disk that these services require. Adequate planning is essential
460 because desktop profiles can grow to be quite large. For planning purposes, a minimum of
461 200 MB of storage should be allowed per user for profile storage. The following
462 commands create the directory infrastructure needed:
463</p><pre class="screen">
464<code class="prompt">root# </code> mkdir -p /var/spool/samba
465<code class="prompt">root# </code> mkdir -p /var/lib/samba/{netlogon/scripts,profiles}
466<code class="prompt">root# </code> chown -R root:root /var/spool/samba
467<code class="prompt">root# </code> chown -R root:root /var/lib/samba
468<code class="prompt">root# </code> chmod a+rwxt /var/spool/samba
469</pre><p>
470 For each user account that is created on the system, the following commands should be
471 executed:
472</p><pre class="screen">
473<code class="prompt">root# </code> mkdir /var/lib/samba/profiles/'username'
474<code class="prompt">root# </code> chown 'username':users /var/lib/samba/profiles/'username'
475<code class="prompt">root# </code> chmod ug+wrx,o+rx,-w /var/lib/samba/profiles/'username'
476</pre><p>
477 </p></li><li class="step" title="Step 10"><p>
478 <a class="indexterm" name="id338048"></a>
479 <a class="indexterm" name="id338055"></a>
480 Create a logon script. It is important that each line is correctly terminated with
481 a carriage return and line-feed combination (i.e., DOS encoding). The following procedure
482 works if the right tools (<code class="constant">unxi2dos</code> and <code class="constant">dos2unix</code>) are installed.
483 First, create a file called <code class="filename">/var/lib/samba/netlogon/scripts/logon.bat.unix</code>
484 with the following contents:
485</p><pre class="screen">
486net time \\massive /set /yes
487net use h: /home
488</pre><p>
489 Convert the UNIX file to a DOS file:
490</p><pre class="screen">
491<code class="prompt">root# </code> dos2unix &lt; /var/lib/samba/netlogon/scripts/logon.bat.unix \
492 &gt; /var/lib/samba/netlogon/scripts/logon.bat
493</pre><p>
494 </p></li><li class="step" title="Step 11"><p>
495 There is one preparatory step without which you cannot have a working Samba network
496 environment. You must add an account for each network user. You can do this by executing
497 the following steps for each user:
498</p><pre class="screen">
499<code class="prompt">root# </code> useradd -m <em class="parameter"><code>username</code></em>
500<code class="prompt">root# </code> passwd <em class="parameter"><code>username</code></em>
501Changing password for <em class="parameter"><code>username</code></em>.
502New password: XXXXXXXX
503Re-enter new password: XXXXXXXX
504Password changed
505<code class="prompt">root# </code> smbpasswd -a <em class="parameter"><code>username</code></em>
506New SMB password: XXXXXXXX
507Retype new SMB password: XXXXXXXX
508Added user <em class="parameter"><code>username</code></em>.
509</pre><p>
510 You do, of course, use a valid user login ID in place of <em class="parameter"><code>username</code></em>.
511 </p></li><li class="step" title="Step 12"><p>
512 Follow the processes shown in <a class="link" href="Big500users.html#ch5-procstart" title="Process Startup Configuration">&#8220;Process Startup Configuration&#8221;</a> to start all services.
513 </p></li><li class="step" title="Step 13"><p>
514 Your server is ready for validation testing. Do not proceed with the steps in
515 <a class="link" href="Big500users.html#ch5-domsvrspec" title="Configuration Specific to Domain Member Servers: BLDG1, BLDG2">&#8220;Configuration Specific to Domain Member Servers: BLDG1, BLDG2&#8221;</a> until after the operation of the server has been
516 validated following the same methods as outlined in <a class="link" href="secure.html" title="Chapter 3. Secure Office Networking">&#8220;Secure Office Networking&#8221;</a>, <a class="link" href="secure.html#ch4valid" title="Validation">&#8220;Validation&#8221;</a>.
517 </p></li></ol></div></div><div class="sect3" title="Configuration Specific to Domain Member Servers: BLDG1, BLDG2"><div class="titlepage"><div><div><h4 class="title"><a name="ch5-domsvrspec"></a>Configuration Specific to Domain Member Servers: <code class="constant">BLDG1, BLDG2</code></h4></div></div></div><p>
518 The following steps will guide you through the nuances of implementing BDCs for the broadcast
519 isolated network segments. Remember that if the target installation platform is not Linux, it may
520 be necessary to adapt some commands to the equivalent on the target platform.
521 </p><div class="procedure" title="Procedure 4.3. Backup Domain Controller Configuration Steps"><a name="id338227"></a><p class="title"><b>Procedure 4.3. Backup Domain Controller Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>
522 <a class="indexterm" name="id338238"></a>
523 The final step that must be completed is to edit the <code class="filename">/etc/nsswitch.conf</code> file.
524 This file controls the operation of the various resolver libraries that are part of the Linux
525 Glibc libraries. Edit this file so that it contains the following entries:
526</p><pre class="screen">
527passwd: files winbind
528group: files winbind
529hosts: files dns wins
530</pre><p>
531 </p></li><li class="step" title="Step 2"><p>
532 Follow the steps outlined in <a class="link" href="Big500users.html#ch5-procstart" title="Process Startup Configuration">&#8220;Process Startup Configuration&#8221;</a> to start all services. Do not
533 start Samba at this time. Samba is controlled by the process called <code class="literal">smb</code>.
534 </p></li><li class="step" title="Step 3"><p>
535 <a class="indexterm" name="id338286"></a>
536 You must now attempt to join the domain member servers to the domain. The following
537 instructions should be executed to effect this:
538</p><pre class="screen">
539<code class="prompt">root# </code> net rpc join
540</pre><p>
541 </p></li><li class="step" title="Step 4"><p>
542 <a class="indexterm" name="id338316"></a>
543 You now start the Samba services by executing:
544</p><pre class="screen">
545<code class="prompt">root# </code> service smb start
546</pre><p>
547 </p></li><li class="step" title="Step 5"><p>
548 Your server is ready for validation testing. Do not proceed with the steps in
549 <a class="link" href="Big500users.html#ch5-domsvrspec" title="Configuration Specific to Domain Member Servers: BLDG1, BLDG2">&#8220;Configuration Specific to Domain Member Servers: BLDG1, BLDG2&#8221;</a> until after the operation of the server has been
550 validated following the same methods as outlined in <a class="link" href="secure.html#ch4valid" title="Validation">&#8220;Validation&#8221;</a>.
551 </p></li></ol></div></div></div><div class="example"><a name="ch5-massivesmb"></a><p class="title"><b>Example 4.1. Server: MASSIVE (PDC), File: <code class="filename">/etc/samba/smb.conf</code></b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id338398"></a><em class="parameter"><code>workgroup = MEGANET</code></em></td></tr><tr><td><a class="indexterm" name="id338409"></a><em class="parameter"><code>netbios name = MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id338421"></a><em class="parameter"><code>interfaces = eth1, lo</code></em></td></tr><tr><td><a class="indexterm" name="id338432"></a><em class="parameter"><code>bind interfaces only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id338444"></a><em class="parameter"><code>passdb backend = tdbsam</code></em></td></tr><tr><td><a class="indexterm" name="id338455"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id338467"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id338478"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id338490"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id338502"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id338514"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -G '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id338526"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id338538"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id338549"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id338560"></a><em class="parameter"><code>include = /etc/samba/dc-common.conf</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id338581"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id338593"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id338604"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id338624"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id338636"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id338648"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id338668"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id338680"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id338691"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-dc-common"></a><p class="title"><b>Example 4.2. Server: MASSIVE (PDC), File: <code class="filename">/etc/samba/dc-common.conf</code></b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id338738"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id338749"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id338761"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id338773"></a><em class="parameter"><code>logon path = \%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id338784"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id338796"></a><em class="parameter"><code>logon home = \%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id338807"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id338819"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id338830"></a><em class="parameter"><code>include = /etc/samba/common.conf</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id338851"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id338862"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id338874"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id338885"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id338906"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id338917"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id338929"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id338940"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id338961"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id338972"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id338984"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id338995"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-commonsmb"></a><p class="title"><b>Example 4.3. Common Samba Configuration File: <code class="filename">/etc/samba/common.conf</code></b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id339038"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id339050"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id339061"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id339073"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id339084"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id339096"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id339107"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id339119"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id339130"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id339142"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id339154"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id339165"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id339177"></a><em class="parameter"><code>utmp = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id339188"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id339200"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id339211"></a><em class="parameter"><code>veto files = /*.eml/*.nws/*.{*}/</code></em></td></tr><tr><td><a class="indexterm" name="id339223"></a><em class="parameter"><code>veto oplock files = /*.doc/*.xls/*.mdb/</code></em></td></tr><tr><td><a class="indexterm" name="id339235"></a><em class="parameter"><code>include = </code></em></td></tr><tr><td># Share and Service Definitions are common to all servers</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id339259"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id339270"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id339282"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id339293"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id339305"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id339316"></a><em class="parameter"><code>default devmode = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id339328"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id339348"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id339360"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id339371"></a><em class="parameter"><code>admin users = bjordan</code></em></td></tr><tr><td><a class="indexterm" name="id339383"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-bldg1-smb"></a><p class="title"><b>Example 4.4. Server: BLDG1 (Member), File: smb.conf</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id339425"></a><em class="parameter"><code>workgroup = MEGANET</code></em></td></tr><tr><td><a class="indexterm" name="id339436"></a><em class="parameter"><code>netbios name = BLDG1</code></em></td></tr><tr><td><a class="indexterm" name="id339448"></a><em class="parameter"><code>include = /etc/samba/dom-mem.conf</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-bldg2-smb"></a><p class="title"><b>Example 4.5. Server: BLDG2 (Member), File: smb.conf</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id339490"></a><em class="parameter"><code>workgroup = MEGANET</code></em></td></tr><tr><td><a class="indexterm" name="id339501"></a><em class="parameter"><code>netbios name = BLDG2</code></em></td></tr><tr><td><a class="indexterm" name="id339512"></a><em class="parameter"><code>include = /etc/samba/dom-mem.conf</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-dommem-smb"></a><p class="title"><b>Example 4.6. Common Domain Member Include File: dom-mem.conf</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id339555"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id339566"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id339578"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id339590"></a><em class="parameter"><code>wins server = 172.16.0.1</code></em></td></tr><tr><td><a class="indexterm" name="id339601"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id339613"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id339624"></a><em class="parameter"><code>include = /etc/samba/common.conf</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="massive-dhcp"></a><p class="title"><b>Example 4.7. Server: MASSIVE, File: dhcpd.conf</b></p><div class="example-contents"><pre class="screen">
552# Abmas Accounting Inc.
553
554default-lease-time 86400;
555max-lease-time 172800;
556default-lease-time 86400;
557ddns-updates on;
558ddns-update-style interim;
559
560option ntp-servers 172.16.0.1;
561option domain-name "abmas.biz";
562option domain-name-servers 172.16.0.1, 172.16.4.1;
563option netbios-name-servers 172.16.0.1;
564option netbios-node-type 8;
565
566subnet 172.16.1.0 netmask 255.255.252.0 {
567 range dynamic-bootp 172.16.1.0 172.16.2.255;
568 option subnet-mask 255.255.252.0;
569 option routers 172.16.0.1, 172.16.0.128;
570 allow unknown-clients;
571 }
572subnet 172.16.4.0 netmask 255.255.252.0 {
573 range dynamic-bootp 172.16.7.0 172.16.7.254;
574 option subnet-mask 255.255.252.0;
575 option routers 172.16.4.128;
576 allow unknown-clients;
577 }
578subnet 172.16.8.0 netmask 255.255.252.0 {
579 range dynamic-bootp 172.16.11.0 172.16.11.254;
580 option subnet-mask 255.255.252.0;
581 option routers 172.16.4.128;
582 allow unknown-clients;
583 }
584subnet 127.0.0.0 netmask 255.0.0.0 {
585 }
586subnet 123.45.67.64 netmask 255.255.255.252 {
587 }
588</pre></div></div><br class="example-break"><div class="example"><a name="bldg1dhcp"></a><p class="title"><b>Example 4.8. Server: BLDG1, File: dhcpd.conf</b></p><div class="example-contents"><pre class="screen">
589# Abmas Accounting Inc.
590
591default-lease-time 86400;
592max-lease-time 172800;
593default-lease-time 86400;
594ddns-updates on;
595ddns-update-style ad-hoc;
596
597option ntp-servers 172.16.0.1;
598option domain-name "abmas.biz";
599option domain-name-servers 172.16.0.1, 172.16.4.1;
600option netbios-name-servers 172.16.0.1;
601option netbios-node-type 8;
602
603subnet 172.16.1.0 netmask 255.255.252.0 {
604 range dynamic-bootp 172.16.3.0 172.16.3.255;
605 option subnet-mask 255.255.252.0;
606 option routers 172.16.0.1, 172.16.0.128;
607 allow unknown-clients;
608 }
609subnet 172.16.4.0 netmask 255.255.252.0 {
610 range dynamic-bootp 172.16.5.0 172.16.6.255;
611 option subnet-mask 255.255.252.0;
612 option routers 172.16.4.128;
613 allow unknown-clients;
614 }
615subnet 127.0.0.0 netmask 255.0.0.0 {
616 }
617</pre></div></div><br class="example-break"><div class="example"><a name="bldg2dhcp"></a><p class="title"><b>Example 4.9. Server: BLDG2, File: dhcpd.conf</b></p><div class="example-contents"><pre class="screen">
618# Abmas Accounting Inc.
619
620default-lease-time 86400;
621max-lease-time 172800;
622default-lease-time 86400;
623ddns-updates on;
624ddns-update-style interim;
625
626option ntp-servers 172.16.0.1;
627option domain-name "abmas.biz";
628option domain-name-servers 172.16.0.1, 172.16.4.1;
629option netbios-name-servers 172.16.0.1;
630option netbios-node-type 8;
631
632subnet 172.16.8.0 netmask 255.255.252.0 {
633 range dynamic-bootp 172.16.9.0 172.16.10.255;
634 option subnet-mask 255.255.252.0;
635 option routers 172.16.8.128;
636 allow unknown-clients;
637 }
638subnet 127.0.0.0 netmask 255.0.0.0 {
639 }
640</pre></div></div><br class="example-break"><div class="example"><a name="massive-nameda"></a><p class="title"><b>Example 4.10. Server: MASSIVE, File: named.conf, Part: A</b></p><div class="example-contents"><pre class="screen">
641###
642# Abmas Biz DNS Control File
643###
644# Date: November 15, 2003
645###
646options {
647 directory "/var/lib/named";
648 forwarders {
649 123.45.12.23;
650 123.45.54.32;
651 };
652 forward first;
653 listen-on {
654 mynet;
655 };
656 auth-nxdomain yes;
657 multiple-cnames yes;
658 notify no;
659};
660
661zone "." in {
662 type hint;
663 file "root.hint";
664};
665
666zone "localhost" in {
667 type master;
668 file "localhost.zone";
669};
670
671zone "0.0.127.in-addr.arpa" in {
672 type master;
673 file "127.0.0.zone";
674};
675
676acl mynet {
677 172.16.0.0/24;
678 172.16.4.0/24;
679 172.16.8.0/24;
680 127.0.0.1;
681};
682
683acl seconddns {
684 123.45.54.32;
685};
686</pre></div></div><br class="example-break"><div class="example"><a name="massive-namedb"></a><p class="title"><b>Example 4.11. Server: MASSIVE, File: named.conf, Part: B</b></p><div class="example-contents"><pre class="screen">
687zone "abmas.biz" {
688 type master;
689 file "/var/lib/named/master/abmas.biz.hosts";
690 allow-query {
691 mynet;
692 };
693 allow-transfer {
694 mynet;
695 };
696 allow-update {
697 mynet;
698 };
699};
700
701zone "abmas.us" {
702 type master;
703 file "/var/lib/named/master/abmas.us.hosts";
704 allow-query {
705 all;
706 };
707 allow-transfer {
708 seconddns;
709 };
710};
711</pre></div></div><br class="example-break"><div class="example"><a name="massive-namedc"></a><p class="title"><b>Example 4.12. Server: MASSIVE, File: named.conf, Part: C</b></p><div class="example-contents"><pre class="screen">
712zone "0.16.172.in-addr.arpa" {
713 type master;
714 file "/var/lib/named/master/172.16.0.0.rev";
715 allow-query {
716 mynet;
717 };
718 allow-transfer {
719 mynet;
720 };
721 allow-update {
722 mynet;
723 };
724};
725
726zone "4.16.172.in-addr.arpa" {
727 type master;
728 file "/var/lib/named/master/172.16.4.0.rev";
729 allow-query {
730 mynet;
731 };
732 allow-transfer {
733 mynet;
734 };
735 allow-update {
736 mynet;
737 };
738};
739
740zone "8.16.172.in-addr.arpa" {
741 type master;
742 file "/var/lib/named/master/172.16.8.0.rev";
743 allow-query {
744 mynet;
745 };
746 allow-transfer {
747 mynet;
748 };
749 allow-update {
750 mynet;
751 };
752};
753</pre></div></div><br class="example-break"><div class="example"><a name="abmasbizdns"></a><p class="title"><b>Example 4.13. Forward Zone File: abmas.biz.hosts</b></p><div class="example-contents"><pre class="screen">
754$ORIGIN .
755$TTL 38400 ; 10 hours 40 minutes
756abmas.biz IN SOA massive.abmas.biz. root.abmas.biz. (
757 2003021833 ; serial
758 10800 ; refresh (3 hours)
759 3600 ; retry (1 hour)
760 604800 ; expire (1 week)
761 38400 ; minimum (10 hours 40 minutes)
762 )
763 NS massive.abmas.biz.
764 NS bldg1.abmas.biz.
765 NS bldg2.abmas.biz.
766 MX 10 massive.abmas.biz.
767$ORIGIN abmas.biz.
768massive A 172.16.0.1
769router0 A 172.16.0.128
770bldg1 A 172.16.4.1
771router4 A 172.16.4.128
772bldg2 A 172.16.8.1
773router8 A 172.16.8.128
774</pre></div></div><br class="example-break"><div class="example"><a name="abmasusdns"></a><p class="title"><b>Example 4.14. Forward Zone File: abmas.biz.hosts</b></p><div class="example-contents"><pre class="screen">
775$ORIGIN .
776$TTL 38400 ; 10 hours 40 minutes
777abmas.us IN SOA server.abmas.us. root.abmas.us. (
778 2003021833 ; serial
779 10800 ; refresh (3 hours)
780 3600 ; retry (1 hour)
781 604800 ; expire (1 week)
782 38400 ; minimum (10 hours 40 minutes)
783 )
784 NS dns.abmas.us.
785 NS dns2.abmas.us.
786 MX 10 mail.abmas.us.
787$ORIGIN abmas.us.
788server A 123.45.67.66
789dns2 A 123.45.54.32
790gw A 123.45.67.65
791www CNAME server
792mail CNAME server
793dns CNAME server
794</pre></div></div><br class="example-break"><div class="example"><a name="bldg12nameda"></a><p class="title"><b>Example 4.15. Servers: BLDG1/BLDG2, File: named.conf, Part: A</b></p><div class="example-contents"><pre class="screen">
795###
796# Abmas Biz DNS Control File
797###
798# Date: November 15, 2003
799###
800options {
801 directory "/var/lib/named";
802 forwarders {
803 172.16.0.1;
804 };
805 forward first;
806 listen-on {
807 mynet;
808 };
809 auth-nxdomain yes;
810 multiple-cnames yes;
811 notify no;
812};
813
814zone "." in {
815 type hint;
816 file "root.hint";
817};
818
819zone "localhost" in {
820 type master;
821 file "localhost.zone";
822};
823
824zone "0.0.127.in-addr.arpa" in {
825 type master;
826 file "127.0.0.zone";
827};
828
829acl mynet {
830 172.16.0.0/24;
831 172.16.4.0/24;
832 172.16.8.0/24;
833 127.0.0.1;
834};
835
836acl seconddns {
837 123.45.54.32;
838};
839</pre></div></div><br class="example-break"><div class="example"><a name="bldg12namedb"></a><p class="title"><b>Example 4.16. Servers: BLDG1/BLDG2, File: named.conf, Part: B</b></p><div class="example-contents"><pre class="screen">
840zone "abmas.biz" {
841 type slave;
842 file "/var/lib/named/slave/abmas.biz.hosts";
843 allow-query {
844 mynet;
845 };
846 allow-transfer {
847 mynet;
848 };
849};
850
851zone "0.16.172.in-addr.arpa" {
852 type slave;
853 file "/var/lib/slave/master/172.16.0.0.rev";
854 allow-query {
855 mynet;
856 };
857 allow-transfer {
858 mynet;
859 };
860};
861
862zone "4.16.172.in-addr.arpa" {
863 type slave;
864 file "/var/lib/named/slave/172.16.4.0.rev";
865 allow-query {
866 mynet;
867 };
868 allow-transfer {
869 mynet;
870 };
871};
872
873zone "8.16.172.in-addr.arpa" {
874 type slave;
875 file "/var/lib/named/slave/172.16.8.0.rev";
876 allow-query {
877 mynet;
878 };
879 allow-transfer {
880 mynet;
881 };
882};
883</pre></div></div><br class="example-break"><div class="example"><a name="ch5-initgrps"></a><p class="title"><b>Example 4.17. Initialize Groups Script, File: /etc/samba/initGrps.sh</b></p><div class="example-contents"><pre class="screen">
884#!/bin/bash
885
886# Create UNIX groups
887groupadd acctsdep
888groupadd finsrvcs
889groupadd piops
890
891# Map Windows Domain Groups to UNIX groups
892net groupmap add ntgroup="Domain Admins" unixgroup=root type=d
893net groupmap add ntgroup="Domain Users" unixgroup=users type=d
894net groupmap add ntgroup="Domain Guests" unixgroup=nobody type=d
895
896# Add Functional Domain Groups
897net groupmap add ntgroup="Accounts Dept" unixgroup=acctsdep type=d
898net groupmap add ntgroup="Financial Services" unixgroup=finsrvcs type=d
899net groupmap add ntgroup="Insurance Group" unixgroup=piops type=d
900</pre></div></div><br class="example-break"><div class="sect2" title="Process Startup Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="ch5-procstart"></a>Process Startup Configuration</h3></div></div></div><p>
901 <a class="indexterm" name="id339909"></a>
902 <a class="indexterm" name="id339916"></a>
903 There are two essential steps to process startup configuration. A process
904 must be configured so that it is automatically restarted each time the server
905 is rebooted. This step involves use of the <code class="literal">chkconfig</code> tool that
906 created appropriate symbolic links from the master daemon control file that is
907 located in the <code class="filename">/etc/rc.d</code> directory to the <code class="filename">/etc/rc'x'.d</code>
908 directories. Links are created so that when the system run-level is changed, the
909 necessary start or kill script is run.
910 </p><p>
911 <a class="indexterm" name="id339948"></a>
912 In the event that a service is provided not as a daemon but via the internetworking
913 super daemon (<code class="literal">inetd</code> or <code class="literal">xinetd</code>), then the <code class="literal">chkconfig</code>
914 tool makes the necessary entries in the <code class="filename">/etc/xinetd.d</code> directory
915 and sends a hang-up (HUP) signal to the super daemon, thus forcing it to
916 re-read its control files.
917 </p><p>
918 Last, each service must be started to permit system validation to proceed. The following steps
919 are for a Red Hat Linux system, please adapt them to suit the target OS platform on which you
920 are installing Samba.
921 </p><div class="procedure" title="Procedure 4.4. Process Startup Configuration Steps"><a name="id339987"></a><p class="title"><b>Procedure 4.4. Process Startup Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>
922 Use the standard system tool to configure each service to restart
923 automatically at every system reboot. For example,
924 <a class="indexterm" name="id340000"></a>
925</p><pre class="screen">
926<code class="prompt">root# </code> chkconfig dhpc on
927<code class="prompt">root# </code> chkconfig named on
928<code class="prompt">root# </code> chkconfig cups on
929<code class="prompt">root# </code> chkconfig smb on
930<code class="prompt">root# </code> chkconfig swat on
931</pre><p>
932 </p></li><li class="step" title="Step 2"><p>
933 <a class="indexterm" name="id340049"></a>
934 <a class="indexterm" name="id340056"></a>
935 <a class="indexterm" name="id340062"></a>
936 Now start each service to permit the system to be validated.
937 Execute each of the following in the sequence shown:
938
939</p><pre class="screen">
940<code class="prompt">root# </code> service dhcp restart
941<code class="prompt">root# </code> service named restart
942<code class="prompt">root# </code> service cups restart
943<code class="prompt">root# </code> service smb restart
944<code class="prompt">root# </code> service swat restart
945</pre><p>
946 </p></li></ol></div></div><div class="sect2" title="Windows Client Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="ch5wincfg"></a>Windows Client Configuration</h3></div></div></div><p>
947 The procedure for desktop client configuration for the network in this chapter is similar to
948 that used for the previous one. There are a few subtle changes that should be noted.
949 </p><div class="procedure" title="Procedure 4.5. Windows Client Configuration Steps"><a name="id340124"></a><p class="title"><b>Procedure 4.5. Windows Client Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>
950 Install MS Windows XP Professional. During installation, configure the client to use DHCP for
951 TCP/IP protocol configuration.
952 <a class="indexterm" name="id340136"></a>
953 <a class="indexterm" name="id340142"></a>
954 DHCP configures all Windows clients to use the WINS Server address that has been defined
955 for the local subnet.
956 </p></li><li class="step" title="Step 2"><p>
957 Join the Windows domain <code class="constant">MEGANET</code>. Use the domain administrator
958 username <code class="constant">root</code> and the SMB password you assigned to this account.
959 A detailed step-by-step procedure for joining a Windows 200x/XP Professional client to
960 a Windows domain is given in <a class="link" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">&#8220;A Collection of Useful Tidbits&#8221;</a>, <a class="link" href="appendix.html#domjoin" title="Joining a Domain: Windows 200x/XP Professional">&#8220;Joining a Domain: Windows 200x/XP Professional&#8221;</a>.
961 Reboot the machine as prompted and then log on using the domain administrator account
962 (<code class="constant">root</code>).
963 </p></li><li class="step" title="Step 3"><p>
964 Verify that the server called <code class="constant">MEGANET</code> is visible in <span class="guimenu">My Network Places</span>,
965 that it is possible to connect to it and see the shares <span class="guimenuitem">accounts</span>,
966 <span class="guimenuitem">apps</span>, and <span class="guimenuitem">finsvcs</span>,
967 and that it is possible to open each share to reveal its contents.
968 </p></li><li class="step" title="Step 4"><p>
969 Create a drive mapping to the <code class="constant">apps</code> share on a server. At this time, it does
970 not particularly matter which application server is used. It is necessary to manually
971 set a persistent drive mapping to the local applications server on each workstation at the time of
972 installation. This step is avoided by the improvements to the design of the network configuration
973 in the next chapter.
974 </p></li><li class="step" title="Step 5"><p>
975 Perform an administrative installation of each application to be used. Select the options
976 that you wish to use. Of course, you choose to run applications over the network, correct?
977 </p></li><li class="step" title="Step 6"><p>
978 Now install all applications to be installed locally. Typical tools include Adobe Acrobat,
979 NTP-based time synchronization software, drivers for specific local devices such as fingerprint
980 scanners, and the like. Probably the most significant application to be locally installed
981 is antivirus software.
982 </p></li><li class="step" title="Step 7"><p>
983 Now install all four printers onto the staging system. The printers you install
984 include the accounting department HP LaserJet 6 and Minolta QMS Magicolor printers, and you
985 also configure use of the identical printers that are located in the financial services department.
986 Install printers on each machine using the following steps:
987 </p><div class="procedure" title="Procedure 4.6. Steps to Install Printer Drivers on Windows Clients"><a name="id340259"></a><p class="title"><b>Procedure 4.6. Steps to Install Printer Drivers on Windows Clients</b></p><ol class="procedure" type="1"><li class="step" title="Step 7.1"><p>
988 Click <span class="guimenu">Start</span> &#8594; <span class="guimenuitem">Settings</span> &#8594; <span class="guimenuitem">Printers</span>+<span class="guiicon">Add Printer</span>+<span class="guibutton">Next</span>. Do not click <span class="guimenuitem">Network printer</span>.
989 Ensure that <span class="guimenuitem">Local printer</span> is selected.
990 </p></li><li class="step" title="Step 7.2"><p>
991 Click <span class="guibutton">Next</span>. In the
992 <span class="guimenuitem">Manufacturer:</span> panel, select <code class="constant">HP</code>.
993 In the <span class="guimenuitem">Printers:</span> panel, select the printer called
994 <code class="constant">HP LaserJet 6</code>. Click <span class="guibutton">Next</span>.
995 </p></li><li class="step" title="Step 7.3"><p>
996 In the <span class="guimenuitem">Available ports:</span> panel, select
997 <code class="constant">FILE:</code>. Accept the default printer name by clicking
998 <span class="guibutton">Next</span>. When asked, <span class="quote">&#8220;<span class="quote">Would you like to print a
999 test page?</span>&#8221;</span>, click <span class="guimenuitem">No</span>. Click
1000 <span class="guibutton">Finish</span>.
1001 </p></li><li class="step" title="Step 7.4"><p>
1002 You may be prompted for the name of a file to print to. If so, close the
1003 dialog panel. Right-click <span class="guiicon">HP LaserJet 6</span> &#8594; <span class="guimenuitem">Properties</span> &#8594; <span class="guisubmenu">Details (Tab)</span>+<span class="guibutton">Add Port</span>.
1004 </p></li><li class="step" title="Step 7.5"><p>
1005 In the <span class="guimenuitem">Network</span> panel, enter the name of
1006 the print queue on the Samba server as follows: <code class="constant">\\BLDG1\hplj6a</code>.
1007 Click <span class="guibutton">OK</span>+<span class="guibutton">OK</span> to complete the installation.
1008 </p></li><li class="step" title="Step 7.6"><p>
1009 Repeat the printer installation steps above for both HP LaserJet 6 printers
1010 as well as for both QMS Magicolor laser printers. Remember to install all
1011 printers but to set the destination port for each to the server on the
1012 local network. For example, a workstation in the accounting group should
1013 have all printers directed at the server <code class="constant">BLDG1</code>.
1014 You may elect to point all desktop workstation configurations at the
1015 server called <code class="constant">MASSIVE</code> and then in your deployment
1016 procedures, it would be wise to document the need to redirect the printer
1017 configuration (as well as the applications server drive mapping) to the
1018 server on the network segment on which the workstation is to be located.
1019 </p></li></ol></div></li><li class="step" title="Step 8"><p>
1020 When you are satisfied that the staging systems are complete, use the appropriate procedure to
1021 remove the client from the domain. Reboot the system, and then log on as the local administrator
1022 and clean out all temporary files stored on the system. Before shutting down, use the disk
1023 defragmentation tool so that the file system is in optimal condition before replication.
1024 </p></li><li class="step" title="Step 9"><p>
1025 Boot the workstation using the Norton (Symantec) Ghosting disk (or CD-ROM) and image the
1026 machine to a network share on the server.
1027 </p></li><li class="step" title="Step 10"><p>
1028 You may now replicate the image using the appropriate Norton Ghost procedure to the target
1029 machines. Make sure to use the procedure that ensures each machine has a unique
1030 Windows security identifier (SID). When the installation of the disk image is complete, boot the PC.
1031 </p></li><li class="step" title="Step 11"><p>
1032 Log onto the machine as the local Administrator (the only option), and join the machine to
1033 the domain following the procedure set out in <a class="link" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">&#8220;A Collection of Useful Tidbits&#8221;</a>, <a class="link" href="appendix.html#domjoin" title="Joining a Domain: Windows 200x/XP Professional">&#8220;Joining a Domain: Windows 200x/XP Professional&#8221;</a>. You must now set the
1034 persistent drive mapping to the applications server that the user is to use. The system is now
1035 ready for the user to log on, provided you have created a network logon account for that
1036 user, of course.
1037 </p></li><li class="step" title="Step 12"><p>
1038 Instruct all users to log onto the workstation using their assigned username and password.
1039 </p></li></ol></div></div><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id340544"></a>Key Points Learned</h3></div></div></div><p>
1040 The network you have just deployed has been a valuable exercise in forced constraint.
1041 You have deployed a network that works well, although you may soon start to see
1042 performance problems, at which time the modifications demonstrated in <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">&#8220;Making Happy Users&#8221;</a>
1043 bring the network to life. The following key learning points were experienced:
1044 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
1045 The power of using <code class="filename">smb.conf</code> include files
1046 </p></li><li class="listitem"><p>
1047 Use of a single PDC over a routed network
1048 </p></li><li class="listitem"><p>
1049 Joining a Samba-3 domain member server to a Samba-3 domain
1050 </p></li><li class="listitem"><p>
1051 Configuration of winbind to use domain users and groups for Samba access
1052 to resources on the domain member servers
1053 </p></li><li class="listitem"><p>
1054 The introduction of roaming profiles
1055 </p></li></ul></div></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id340597"></a>Questions and Answers</h2></div></div></div><p>
1056 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id340606"></a><dl><dt> <a href="Big500users.html#id340612">
1057 The example smb.conf files in this chapter make use of the include facility.
1058 How may I get to see what the actual working smb.conf settings are?
1059 </a></dt><dt> <a href="Big500users.html#id340660">
1060 Why does the include file common.conf have an empty include statement?
1061 </a></dt><dt> <a href="Big500users.html#id340716">
1062 I accept that the simplest configuration necessary to do the job is the best. The use of tdbsam
1063 passdb backend is much simpler than having to manage an LDAP-based ldapsam passdb backend.
1064 I tried using rsync to replicate the passdb.tdb, and it seems to work fine!
1065 So what is the problem?
1066 </a></dt><dt> <a href="Big500users.html#id340766">
1067 You are using DHCP Relay enabled on the routers as well as a local DHCP server. Will this cause a clash?
1068 </a></dt><dt> <a href="Big500users.html#id340791">
1069 How does the Windows client find the PDC?
1070 </a></dt><dt> <a href="Big500users.html#id340811">
1071 Why did you enable IP forwarding (routing) only on the server called MASSIVE?
1072 </a></dt><dt> <a href="Big500users.html#id340838">
1073 You did nothing special to implement roaming profiles. Why?
1074 </a></dt><dt> <a href="Big500users.html#id340856">
1075 On the domain member computers, you configured winbind in the /etc/nsswitch.conf file.
1076 You did not configure any PAM settings. Is this an omission?
1077 </a></dt><dt> <a href="Big500users.html#id340883">
1078 You are starting SWAT up on this example but have not discussed that anywhere. Why did you do this?
1079 </a></dt><dt> <a href="Big500users.html#id340920">
1080 The domain controller has an auto-shutdown script. Isn't that dangerous?
1081 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id340612"></a><a name="id340615"></a></td><td align="left" valign="top"><p>
1082 The example <code class="filename">smb.conf</code> files in this chapter make use of the <em class="parameter"><code>include</code></em> facility.
1083 How may I get to see what the actual working <code class="filename">smb.conf</code> settings are?
1084 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
1085 You may readily see the net compound effect of the included files by running:
1086</p><pre class="screen">
1087<code class="prompt">root# </code> testparm -s | less
1088</pre><p>
1089 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id340660"></a><a name="id340662"></a></td><td align="left" valign="top"><p>
1090 Why does the include file <code class="filename">common.conf</code> have an empty include statement?
1091 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
1092 The use of the empty include statement nullifies further includes. For example, let's say you
1093 desire to have just an smb.conf file that is built from the array of include files of which the
1094 master control file is called <code class="filename">master.conf</code>. The following command
1095 produces a compound <code class="filename">smb.conf</code> file.
1096</p><pre class="screen">
1097<code class="prompt">root# </code> testparm -s /etc/samba/master.conf &gt; /etc/samba/smb.conf
1098</pre><p>
1099 If the include parameter was not in the common.conf file, the final <code class="filename">smb.conf</code> file leaves
1100 the include in place, even though the file it points to has already been included. This is a bug
1101 that will be fixed at a future date.
1102 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id340716"></a><a name="id340718"></a></td><td align="left" valign="top"><p>
1103 I accept that the simplest configuration necessary to do the job is the best. The use of <em class="parameter"><code>tdbsam</code></em>
1104 passdb backend is much simpler than having to manage an LDAP-based <em class="parameter"><code>ldapsam</code></em> passdb backend.
1105 I tried using <code class="literal">rsync</code> to replicate the <code class="filename">passdb.tdb</code>, and it seems to work fine!
1106 So what is the problem?
1107 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
1108 Replication of the <em class="parameter"><code>tdbsam</code></em> database file can result in loss of currency in its
1109 contents between the PDC and BDCs. The most notable symptom is that workstations may not be able
1110 to log onto the network following a reboot and may have to rejoin the domain to recover network
1111 access capability.
1112 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id340766"></a><a name="id340769"></a></td><td align="left" valign="top"><p>
1113 You are using DHCP Relay enabled on the routers as well as a local DHCP server. Will this cause a clash?
1114 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
1115 No. It is possible to have as many DHCP servers on a network segment as makes sense. A DHCP server
1116 offers an IP address lease, but it is the client that determines which offer is accepted, no matter how many
1117 offers are made. Under normal operation, the client accepts the first offer it receives.
1118 </p><p>
1119 The only exception to this rule is when the client makes a directed request from a specific DHCP server
1120 for renewal of the lease it has. This means that under normal circumstances there is no risk of a clash.
1121 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id340791"></a><a name="id340794"></a></td><td align="left" valign="top"><p>
1122 How does the Windows client find the PDC?
1123 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
1124 The Windows client obtains the WINS server address from the DHCP lease information. It also
1125 obtains from the DHCP lease information the parameter that causes it to use directed UDP (UDP Unicast)
1126 to register itself with the WINS server and to obtain enumeration of vital network information to
1127 enable it to operate successfully.
1128 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id340811"></a><a name="id340813"></a></td><td align="left" valign="top"><p>
1129 Why did you enable IP forwarding (routing) only on the server called <code class="constant">MASSIVE</code>?
1130 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
1131 The server called <code class="constant">MASSIVE</code> is acting as a router to the Internet. No other server
1132 (BLDG1 or BLDG2) has any need for IP forwarding because they are attached only to their own network.
1133 Route table entries are needed to direct MASSIVE to send all traffic intended for the remote network
1134 segments to the router that is its gateway to them.
1135 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id340838"></a><a name="id340840"></a></td><td align="left" valign="top"><p>
1136 You did nothing special to implement roaming profiles. Why?
1137 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
1138 Unless configured to do otherwise, the default behavior with Samba-3 and Windows XP Professional
1139 clients is to use roaming profiles.
1140 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id340856"></a><a name="id340858"></a></td><td align="left" valign="top"><p>
1141 On the domain member computers, you configured winbind in the <code class="filename">/etc/nsswitch.conf</code> file.
1142 You did not configure any PAM settings. Is this an omission?
1143 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
1144 PAM is needed only for authentication. When Samba is using Microsoft encrypted passwords, it makes only
1145 marginal use of PAM. PAM configuration handles only authentication. If you want to log onto the domain
1146 member servers using Windows networking usernames and passwords, it is necessary to configure PAM
1147 to enable the use of winbind. Samba makes use only of the identity resolution facilities of the name
1148 service switch (NSS).
1149 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id340883"></a><a name="id340885"></a></td><td align="left" valign="top"><p>
1150 You are starting SWAT up on this example but have not discussed that anywhere. Why did you do this?
1151 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
1152 Oh, I did not think you would notice that. It is there so that it can be used. This is more fully discussed
1153 in <span class="emphasis"><em>TOSHARG2</em></span>, which has a full chapter dedicated to the subject. While we are on the
1154 subject, it should be noted that you should definitely not use SWAT on any system that makes use
1155 of <code class="filename">smb.conf</code> <em class="parameter"><code>include</code></em> files because SWAT optimizes them out into an aggregated
1156 file but leaves in place a broken reference to the top-layer include file. SWAT was not designed to
1157 handle this functionality gracefully.
1158 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id340920"></a><a name="id340922"></a></td><td align="left" valign="top"><p>
1159 The domain controller has an auto-shutdown script. Isn't that dangerous?
1160 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
1161 Well done, you spotted that! I guess it is dangerous. It is good to know that you can do this, though.
1162 </p></td></tr></tbody></table></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="secure.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="ExNetworks.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="happy.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 3. Secure Office Networking </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 5. Making Happy Users</td></tr></table></div></body></html>
Note: See TracBrowser for help on using the repository browser.