Context Navigation

source: vendor/3.5.9/docs/htmldocs/Samba3-ByExample/small.html

Visit:

Last change on this file was 597, checked in by Herwig Bauernfeind, 14 years ago
Samba 3.5: Update vendor to version 3.5.9
File size: 61.8 KB

Line
1	<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 2. Small Office Networking</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="simple.html" title="Chapter 1. No-Frills Samba Servers"><link rel="next" href="secure.html" title="Chapter 3. Secure Office Networking"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 2. Small Office Networking</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="simple.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="secure.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 2. Small Office Networking"><div class="titlepage"><div><div><h2 class="title"><a name="small"></a>Chapter 2. Small Office Networking</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="small.html#id327308">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id327326">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id327371">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id327416">Technical Issues</a></span></dt><dt><span class="sect2"><a href="small.html#id327588">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id327606">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id329058">Validation</a></span></dt><dt><span class="sect2"><a href="small.html#id329633">Notebook Computers: A Special Case</a></span></dt><dt><span class="sect2"><a href="small.html#id329652">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id329716">Questions and Answers</a></span></dt></dl></div><p>
2	<a class="link" href="simple.html" title="Chapter 1. No-Frills Samba Servers">“No-Frills Samba Servers”</a> focused on the basics of simple yet effective
3	network solutions. Network administrators who take pride in their work
4	(that's most of us, right?) take care to deliver what our users want,
5	but not too much more. If we make things too complex, we confound our users
6	and increase costs of network ownership. A professional network manager
7	avoids the temptation to put too much pizazz into the way that the network
8	operates. Some creativity is helpful, but keep it under control
9	good advice that the following two scenarios illustrate.
10	</p><p>
11	<a class="indexterm" name="id327280"></a>
12	In one case the network administrator of a mid-sized company spent three
13	months building a new network to replace an old Netware server. What he
14	delivered had all the bells and whistles he could muster. There were a
15	few teething problems during the changeover, nothing serious but a little
16	disruptive all the same. Users were exposed to many changes at once. The
17	network administrator was asked to resign two months after implementing
18	the new system because so many staff complained they had lost time and
19	were not happy with the new network. Everything was automated, and he
20	delivered more features than any advanced user could think of. He was
21	just too smart for his own good.
22	</p><p>
23	In the case of the other company, a new network manager was appointed
24	to oversee the replacement of a LanTastic network with an MS Windows
25	NT 4.0 network. He had the replacement installed and operational within
26	two weeks. Before installation and changeover, he called a meeting to
27	explain to all users what was going to happen, how it would affect them,
28	and that he would be available 24 hours a day to help them transition.
29	One week after conversion, he held another meeting asking for cooperation
30	in the introduction of a few new features that would help to make life
31	easier. Network users were thrilled with the help he provided. The network
32	he implemented was nowhere near as complex as in the first example, had fewer
33	features, and yet he had happy users. Months later he was still adding
34	new innovations. He always asked the users if a
35	particular feature was what they wanted. He asked his boss for a raise
36	and got it. He often told me, <span class="quote">“<span class="quote">Always keep a few new tricks up your
37	sleeves for when you need them.</span>”</span> Was he smart? You decide. Let's
38	get on with our next exercise.
39	</p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id327308"></a>Introduction</h2></div></div></div><p>
40	Abmas Accounting has grown. Mr. Meany likes you and says he knew you
41	were the right person for the job. That's why he asked you to install the
42	new server. The past few months have been hard work. You advised Mr. Meany
43	that it is time for a change. Abmas now has 52 users, having acquired an
44	investment consulting business recently. The new users were added to the
45	network without any problems.
46	</p><p>
47	Some of the Windows clients are nearly past their use-by date. You found damaged and unusable software on
48	some of the workstations that came with the acquired business and found some machines in need of both
49	hardware and software maintenance.
50	</p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id327326"></a>Assignment Tasks</h3></div></div></div><p>
51	<a class="indexterm" name="id327333"></a>
52	Mr. Meany is retiring in 12 months. Before he goes, he wants you to help ensure
53	that the business is running efficiently. Many of the new staff want notebook
54	computers. They visit customer business premises and need to use local network
55	facilities; these users are technically competent. The company uses a
56	business application that requires Windows XP Professional. In short, a complete
57	client upgrade is about to happen. Mr. Meany told you that he is working
58	on another business acquisition and that by the time he retires there will be
59	80 to 100 users.
60	</p><p>
61	Mr. Meany is not concerned about security. He wants to make it easier for
62	staff to do their work. He has hired you to help him appoint a full-time
63	network manager before he retires. Above all, he says he is investing in
64	the ability to grow. He is determined to live his lifelong dream and
65	hand the business over to a bright and capable executive who can make
66	things happen. This means your network design must cope well with
67	growth.
68	</p><p>
69	In a few months, Abmas will require an Internet connection for email and so
70	that staff can easily obtain software updates. Mr. Meany is warming up to
71	the installation of antivirus software but is not yet ready to approve
72	this expense. He told you to spend the money a virus scanner costs
73	on better quality notebook computers for mobile users.
74	</p><p>
75	One of Mr. Meany's golfing partners convinced him to buy new laser
76	printers, one black only, the other a color laser printer. Staff support
77	the need for a color printer so they can present more attractive proposals
78	and reports.
79	</p><p>
80	Mr. Meany also asked if it would be possible for one of the staff to manage
81	user accounts from the Windows desktop. That person will be responsible for
82	basic operations.
83	</p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id327371"></a>Dissection and Discussion</h2></div></div></div><p>
84	What are the key requirements in this business example? A quick review indicates
85	a need for
86	</p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
87	Scalability, from 52 to over 100 users in 12 months
88	</p></li><li class="listitem"><p>
89	Mobile computing capability
90	<a class="indexterm" name="id327391"></a>
91	</p></li><li class="listitem"><p>
92	Improved reliability and usability
93	</p></li><li class="listitem"><p>
94	Easier administration
95	</p></li></ul></div><p>
96	In this instance the installed Linux system is assumed to be a Red Hat Linux Fedora Core2 server
97	(as in <a class="link" href="simple.html#AccountingOffice" title="Accounting Office">“Accounting Office”</a>).
98
99	</p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id327416"></a>Technical Issues</h3></div></div></div><p>
100	<a class="indexterm" name="id327424"></a>
101	<a class="indexterm" name="id327430"></a>
102	<a class="indexterm" name="id327436"></a>
103	<a class="indexterm" name="id327443"></a>
104	<a class="indexterm" name="id327449"></a>
105	It is time to implement a domain security environment. You will use the <code class="constant">
106	smbpasswd</code> (default) backend. You should implement a DHCP server. There is no need to
107	run DNS at this time, but the system will use WINS. The domain name will be <code class="constant">
108	BILLMORE</code>. This time, the name of the server will be <code class="constant">SLEETH</code>.
109	</p><p>
110	All printers will be configured as DHCP clients. The DHCP server will assign
111	the printer a fixed IP address by way of its Ethernet interface (MAC) address.
112	See <a class="link" href="small.html#dhcp01" title="Example 2.2. Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf">“Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf”</a>.
113	</p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
114	The <code class="filename">smb.conf</code> file you are creating in this exercise can be used with equal effectiveness
115	with Samba-2.2.x series releases. This is deliberate so that in the next chapter it is
116	possible to start with the installation that you have created here, migrate it
117	to a Samba-3 configuration, and then secure the system further. Configurations following
118	this one utilize features that may not be supported in Samba-2.2.x releases.
119	However, you should note that the examples in each chapter start with the assumption
120	that a fresh new installation is being effected.
121	</p></div><p>
122	Later on, when the Internet connection is implemented, you will add DNS as well as
123	other enhancements. It is important that you plan accordingly.
124	</p><p>
125	<a class="indexterm" name="id327498"></a>
126	You have split the network into two separate areas. Each has its own Ethernet switch.
127	There are 20 users on the accounting network and 32 users on the financial services
128	network. The server has two network interfaces, one serving each network. The
129	network printers will be located in a central area. You plan to install the new
130	printers and keep the old printer in use also.
131	</p><p>
132	You will provide separate file storage areas for each business entity. The old system
133	will go away, accounting files will be handled under a single directory, and files will
134	be stored under customer name, not under a personal work area. Staff will be made
135	responsible for file location, so the old share point must be maintained.
136	</p><p>
137	Given that DNS will not be used, you will configure WINS name resolution for UNIX
138	hostname name resolution.
139	</p><p>
140	<a class="indexterm" name="id327521"></a>
141	<a class="indexterm" name="id327530"></a>
142	It is necessary to map Windows Domain Groups to UNIX groups. It is
143	advisable to also map Windows Local Groups to UNIX groups. Additionally, the two
144	key staff groups in the firm are accounting staff and financial services staff.
145	For these, it is necessary to create UNIX groups as well as Windows Domain Groups.
146	</p><p>
147	In the sample <code class="filename">smb.conf</code> file, you have configured Samba to call the UNIX
148	<code class="literal">groupadd</code> to add group entries. This utility does not permit
149	the addition of group names that contain uppercase characters or spaces. This
150	is considered a bug. The <code class="literal">groupadd</code> is part of the
151	<code class="literal">shadow-utils</code> open source software package. A later release
152	of this package may have been patched to resolve this bug. If your operating
153	platform has this bug, it means that attempts to add a Windows Domain Group that
154	has either a space or uppercase characters in it will fail. See
155	<span class="emphasis"><em>TOSHARG2</em></span>, Chapter 11, Section 11.3.1, Example 11.1, for
156	more information.
157	</p><p>
158	<a class="indexterm" name="id327576"></a>
159	Vendor-supplied printer drivers will be installed on each client. The CUPS print
160	spooler on the UNIX host will be operated in <code class="constant">raw</code> mode.
161	</p></div><div class="sect2" title="Political Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id327588"></a>Political Issues</h3></div></div></div><p>
162	Mr. Meany is an old-school manager. He sets the rules and wants to see compliance.
163	He is willing to spend money on things he believes are of value. You need more
164	time to convince him of real priorities.
165	</p><p>
166	Go ahead, buy better notebooks. Wouldn't it be neat if they happened to be
167	supplied with antivirus software? Above all, demonstrate good purchase value and remember
168	to make your users happy.
169	</p></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id327606"></a>Implementation</h2></div></div></div><p>
170	<a class="indexterm" name="id327614"></a>
171	In this example, the assumption is made that this server is being configured from a clean start.
172	The alternate approach could be to demonstrate the migration of the system that is documented
173	in <a class="link" href="simple.html#AcctgNet" title="Implementation">“Implementation”</a> to meet the new requirements. The decision to treat this case, as with
174	future examples, as a new installation is based on the premise that you can determine
175	the migration steps from the information provided in <a class="link" href="ntmigration.html" title="Chapter 9. Migrating NT4 Domain to Samba-3">“Migrating NT4 Domain to Samba-3”</a>.
176	Additionally, a fresh installation makes the example easier to follow.
177	</p><p>
178	<a class="indexterm" name="id327636"></a>
179	Each user will be given a home directory on the UNIX system, which will be available as a private
180	share. Two additional shares will be created, one for the accounting department and the other for
181	the financial services department. Network users will be given access to these shares by way
182	of group membership.
183	</p><p>
184	<a class="indexterm" name="id327648"></a>
185	UNIX group membership is the primary mechanism by which Windows Domain users will be granted
186	rights and privileges within the Windows environment.
187	</p><p>
188	<a class="indexterm" name="id327661"></a>
189	The user <code class="literal">alanm</code> will be made the owner of all files. This will be preserved
190	by setting the sticky bit (set UID/GID) on the top-level directories.
191	</p><p>
192	</p><div class="figure"><a name="acct2net"></a><p class="title"><b>Figure 2.1. Abmas Accounting 52-User Network Topology</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/acct2net.png" alt="Abmas Accounting 52-User Network Topology"></div></div></div><p><br class="figure-break">
193	</p><div class="procedure" title="Procedure 2.1. Server Installation Steps"><a name="id327717"></a><p class="title"><b>Procedure 2.1. Server Installation Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>
194	Using UNIX/Linux system tools, name the server <code class="constant">sleeth</code>.
195	</p></li><li class="step" title="Step 2"><p>
196	<a class="indexterm" name="id327737"></a>
197	Place an entry for the machine <code class="constant">sleeth</code> in the <code class="filename">/etc/hosts</code>.
198	The printers are network attached, so there should be entries for the
199	network printers also. An example <code class="filename">/etc/hosts</code> file is shown here:
200	</p><pre class="screen">
201	192.168.1.1 sleeth sleeth1
202	192.168.2.1 sleeth2
203	192.168.1.10 hplj6
204	192.168.1.11 hplj4
205	192.168.2.10 qms
206	</pre><p>
207	</p></li><li class="step" title="Step 3"><p>
208	Install the Samba-3 binary RPM from the Samba-Team FTP site.
209	</p></li><li class="step" title="Step 4"><p>
210	Install the ISC DHCP server using the UNIX/Linux system tools available to you.
211	</p></li><li class="step" title="Step 5"><p>
212	<a class="indexterm" name="id327784"></a>
213	<a class="indexterm" name="id327791"></a>
214	<a class="indexterm" name="id327797"></a>
215	<a class="indexterm" name="id327803"></a>
216	Because Samba will be operating over two network interfaces and clients on each side
217	may want to be able to reach clients on the other side, it is imperative that IP forwarding
218	is enabled. Use the system tool of your choice to enable IP forwarding. In the
219	absence of such a tool on the Linux system, add to the <code class="filename">/etc/rc.d/rc.local</code>
220	file an entry as follows:
221	</p><pre class="screen">
222	echo 1 > /proc/sys/net/ipv4/ip_forward
223	</pre><p>
224	This causes the Linux kernel to forward IP packets so that it acts as a router.
225	</p></li><li class="step" title="Step 6"><p>
226	Install the <code class="filename">smb.conf</code> file as shown in <a class="link" href="small.html#acct2conf" title="Example 2.3. Accounting Office Network smb.conf File [globals] Section">“Accounting Office Network smb.conf File [globals] Section”</a> and
227	<a class="link" href="small.html#acct3conf" title="Example 2.4. Accounting Office Network smb.conf File Services and Shares Section">“Accounting Office Network smb.conf File Services and Shares Section”</a>. Combine these two examples to form a single
228	<code class="filename">/etc/samba/smb.conf</code> file.
229	</p></li><li class="step" title="Step 7"><p>
230	<a class="indexterm" name="id327856"></a>
231	Add the user <code class="literal">root</code> to the Samba password backend:
232	</p><pre class="screen">
233	<code class="prompt">root# </code> smbpasswd -a root
234	New SMB password: XXXXXXX
235	Retype new SMB password: XXXXXXX
236	<code class="prompt">root# </code>
237	</pre><p>
238	<a class="indexterm" name="id327884"></a>
239	This is the Windows Domain Administrator password. Never delete this account from
240	the password backend after Windows Domain Groups have been initialized. If you delete
241	this account, your system is crippled. You cannot restore this account,
242	and your Samba server can no longer be administered.
243	</p></li><li class="step" title="Step 8"><p>
244	<a class="indexterm" name="id327899"></a>
245	Create the username map file to permit the <code class="constant">root</code> account to be called
246	<code class="constant">Administrator</code> from the Windows network environment. To do this, create
247	the file <code class="filename">/etc/samba/smbusers</code> with the following contents:
248	</p><pre class="screen">
249	####
250	# User mapping file
251	####
252	# File Format
253	# -----------
254	# Unix_ID = Windows_ID
255	#
256	# Examples:
257	# root = Administrator
258	# janes = "Jane Smith"
259	# jimbo = Jim Bones
260	#
261	# Note: If the name contains a space it must be double quoted.
262	# In the example above the name 'jimbo' will be mapped to Windows
263	# user names 'Jim' and 'Bones' because the space was not quoted.
264	#######################################################################
265	root = Administrator
266	####
267	# End of File
268	####
269	</pre><p>
270	</p></li><li class="step" title="Step 9"><p>
271	<a class="indexterm" name="id327933"></a>
272	Create and map Windows Domain Groups to UNIX groups. A sample script is provided in
273	<a class="link" href="small.html#initGrps" title="Example 2.1. Script to Map Windows NT Groups to UNIX Groups">“Script to Map Windows NT Groups to UNIX Groups”</a>. Create a file containing this script. We called ours
274	<code class="filename">/etc/samba/initGrps.sh</code>. Set this file so it can be executed,
275	and then execute the script. Sample output should be as follows:
276
277	</p><div class="example"><a name="initGrps"></a><p class="title"><b>Example 2.1. Script to Map Windows NT Groups to UNIX Groups</b></p><div class="example-contents"><a class="indexterm" name="id327958"></a><pre class="screen">
278	#!/bin/bash
279	#
280	# initGrps.sh
281	#
282
283	# Create UNIX groups
284	groupadd acctsdep
285	groupadd finsrvcs
286
287	# Map Windows Domain Groups to UNIX groups
288	net groupmap add ntgroup="Domain Admins" unixgroup=root type=d
289	net groupmap add ntgroup="Domain Users" unixgroup=users type=d
290	net groupmap add ntgroup="Domain Guests" unixgroup=nobody type=d
291
292	# Add Functional Domain Groups
293	net groupmap add ntgroup="Accounts Dept" unixgroup=acctsdep type=d
294	net groupmap add ntgroup="Financial Services" unixgroup=finsrvcs type=d
295	</pre></div></div><p><br class="example-break">
296
297	</p><pre class="screen">
298	<code class="prompt">root# </code> chmod 755 initGrps.sh
299	<code class="prompt">root# </code> cd /etc/samba
300	<code class="prompt">root# </code> ./initGrps.sh
301	Updated mapping entry for Domain Admins
302	Updated mapping entry for Domain Users
303	Updated mapping entry for Domain Guests
304	No rid or sid specified, choosing algorithmic mapping
305	Successfully added group Accounts Dept to the mapping db
306	No rid or sid specified, choosing algorithmic mapping
307	Successfully added group Domain Guests to the mapping db
308
309	<code class="prompt">root# </code> cd /etc/samba
310	<code class="prompt">root# </code> net groupmap list \| sort
311	Account Operators (S-1-5-32-548) -> -1
312	Accounts Dept (S-1-5-21-194350-25496802-3394589-2003) -> acctsdep
313	Administrators (S-1-5-32-544) -> -1
314	Backup Operators (S-1-5-32-551) -> -1
315	Domain Admins (S-1-5-21-194350-25496802-3394589-512) -> root
316	Domain Guests (S-1-5-21-194350-25496802-3394589-514) -> nobody
317	Domain Users (S-1-5-21-194350-25496802-3394589-513) -> users
318	Financial Services (S-1-5-21-194350-25496802-3394589-2005) -> finsrvcs
319	Guests (S-1-5-32-546) -> -1
320	Power Users (S-1-5-32-547) -> -1
321	Print Operators (S-1-5-32-550) -> -1
322	Replicators (S-1-5-32-552) -> -1
323	System Operators (S-1-5-32-549) -> -1
324	Users (S-1-5-32-545) -> -1
325	</pre><p>
326	</p></li><li class="step" title="Step 10"><p>
327	<a class="indexterm" name="id328022"></a>
328	<a class="indexterm" name="id328029"></a>
329	<a class="indexterm" name="id328037"></a>
330	For each user who needs to be given a Windows Domain account, make an entry in the
331	<code class="filename">/etc/passwd</code> file as well as in the Samba password backend.
332	Use the system tool of your choice to create the UNIX system accounts, and use the Samba
333	<code class="literal">smbpasswd</code> program to create the Domain user accounts.
334	</p><p>
335	<a class="indexterm" name="id328059"></a>
336	<a class="indexterm" name="id328066"></a>
337	<a class="indexterm" name="id328072"></a>
338	There are a number of tools for user management under UNIX, such as
339	<code class="literal">useradd</code> and <code class="literal">adduser</code>, as well as a plethora of custom
340	tools. With the tool of your choice, create a home directory for each user.
341	</p></li><li class="step" title="Step 11"><p>
342	Using the preferred tool for your UNIX system, add each user to the UNIX groups created
343	previously, as necessary. File system access control will be based on UNIX group membership.
344	</p></li><li class="step" title="Step 12"><p>
345	Create the directory mount point for the disk subsystem that is mounted to provide
346	data storage for company files. In this case the mount point is indicated in the <code class="filename">smb.conf</code>
347	file is <code class="filename">/data</code>. Format the file system as required, mount the formatted
348	file system partition using <code class="literal">mount</code>,
349	and make the appropriate changes in <code class="filename">/etc/fstab</code>.
350	</p></li><li class="step" title="Step 13"><p>
351	Create the top-level file storage directories are follows:
352	</p><pre class="screen">
353	<code class="prompt">root# </code> mkdir -p /data/{accounts,finsvcs}
354	<code class="prompt">root# </code> chown -R root:root /data
355	<code class="prompt">root# </code> chown -R alanm:acctsdep /data/accounts
356	<code class="prompt">root# </code> chown -R alanm:finsrvcs /data/finsrvcs
357	<code class="prompt">root# </code> chmod -R ug+rwx,o+rx-w /data
358	</pre><p>
359	Each department is responsible for creating its own directory structure within its
360	share. The directory root of the <code class="literal">accounts</code> share is <code class="filename">/data/accounts</code>.
361	The directory root of the <code class="literal">finsvcs</code> share is <code class="filename">/data/finsvcs</code>.
362	</p></li><li class="step" title="Step 14"><p>
363	Configure the printers with the IP addresses as shown in <a class="link" href="small.html#acct2net" title="Figure 2.1. Abmas Accounting 52-User Network Topology">“Abmas Accounting 52-User Network Topology”</a>.
364	Follow the instructions in the manufacturers' manuals to permit printing to port 9100.
365	This allows the CUPS spooler to print using raw mode protocols.
366	<a class="indexterm" name="id328203"></a>
367	<a class="indexterm" name="id328209"></a>
368	</p></li><li class="step" title="Step 15"><p>
369	<a class="indexterm" name="id328222"></a>
370	<a class="indexterm" name="id328230"></a>
371	Configure the CUPS Print Queues as follows:
372	</p><pre class="screen">
373	<code class="prompt">root# </code> lpadmin -p hplj4 -v socket://192.168.1.11:9100 -E
374	<code class="prompt">root# </code> lpadmin -p hplj6 -v socket://192.168.1.10:9100 -E
375	<code class="prompt">root# </code> lpadmin -p qms -v socket://192.168.2.10:9100 -E
376	</pre><p>
377	<a class="indexterm" name="id328257"></a>
378	This creates the necessary print queues with no assigned print filter.
379	</p></li><li class="step" title="Step 16"><p>
380	<a class="indexterm" name="id328270"></a>
381	<a class="indexterm" name="id328277"></a>
382	<a class="indexterm" name="id328283"></a>
383	Edit the file <code class="filename">/etc/cups/mime.convs</code> to uncomment the line:
384	</p><pre class="screen">
385	application/octet-stream application/vnd.cups-raw 0 -
386	</pre><p>
387	</p></li><li class="step" title="Step 17"><p>
388	<a class="indexterm" name="id328306"></a>
389	Edit the file <code class="filename">/etc/cups/mime.types</code> to uncomment the line:
390	</p><pre class="screen">
391	application/octet-stream
392	</pre><p>
393	</p></li><li class="step" title="Step 18"><p>
394	<a class="indexterm" name="id328329"></a>
395	Using your favorite system editor, create an <code class="filename">/etc/dhcpd.conf</code> with the
396	contents as shown in <a class="link" href="small.html#dhcp01" title="Example 2.2. Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf">“Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf”</a>.
397	</p><div class="example"><a name="dhcp01"></a><p class="title"><b>Example 2.2. Abmas Accounting DHCP Server Configuration File <code class="filename">/etc/dhcpd.conf</code></b></p><div class="example-contents"><a class="indexterm" name="id328359"></a><pre class="screen">
398	default-lease-time 86400;
399	max-lease-time 172800;
400	default-lease-time 86400;
401
402	option ntp-servers 192.168.1.1;
403	option domain-name "abmas.biz";
404	option domain-name-servers 192.168.1.1, 192.168.2.1;
405	option netbios-name-servers 192.168.1.1, 192.168.2.1;
406	option netbios-node-type 8;
407	### NOTE ###
408	# netbios-node-type=8 means set clients to Hybrid Mode
409	# so they will use Unicast communication with the WINS
410	# server and thus reduce the level of UDP broadcast
411	# traffic by up to 90%.
412	############
413
414	subnet 192.168.1.0 netmask 255.255.255.0 {
415	range dynamic-bootp 192.168.1.128 192.168.1.254;
416	option subnet-mask 255.255.255.0;
417	option routers 192.168.1.1;
418	allow unknown-clients;
419	host hplj4 {
420	hardware ethernet 08:00:46:7a:35:e4;
421	fixed-address 192.168.1.10;
422	}
423	host hplj6 {
424	hardware ethernet 00:03:47:cb:81:e0;
425	fixed-address 192.168.1.11;
426	}
427	}
428	subnet 192.168.2.0 netmask 255.255.255.0 {
429	range dynamic-bootp 192.168.2.128 192.168.2.254;
430	option subnet-mask 255.255.255.0;
431	option routers 192.168.2.1;
432	allow unknown-clients;
433	host qms {
434	hardware ethernet 01:04:31:db:e1:c0;
435	fixed-address 192.168.1.10;
436	}
437	}
438	subnet 127.0.0.0 netmask 255.0.0.0 {
439	}
440	</pre></div></div><p><br class="example-break">
441	</p></li><li class="step" title="Step 19"><p>
442	Use the standard system tool to start Samba and CUPS and configure them to start
443	automatically at every system reboot. For example,
444	</p><p>
445	<a class="indexterm" name="id328392"></a>
446	<a class="indexterm" name="id328398"></a>
447	<a class="indexterm" name="id328404"></a>
448	<a class="indexterm" name="id328411"></a>
449	<a class="indexterm" name="id328417"></a>
450	</p><pre class="screen">
451	<code class="prompt">root# </code> chkconfig dhcp on
452	<code class="prompt">root# </code> chkconfig smb on
453	<code class="prompt">root# </code> chkconfig cups on
454	<code class="prompt">root# </code> /etc/rc.d/init.d/dhcp restart
455	<code class="prompt">root# </code> /etc/rc.d/init.d/smb restart
456	<code class="prompt">root# </code> /etc/rc.d/init.d/cups restart
457	</pre><p>
458	</p></li><li class="step" title="Step 20"><p>
459	<a class="indexterm" name="id328466"></a>
460	<a class="indexterm" name="id328472"></a>
461	<a class="indexterm" name="id328480"></a>
462	<a class="indexterm" name="id328487"></a>
463	<a class="indexterm" name="id328493"></a>
464	<a class="indexterm" name="id328499"></a>
465	Configure the name service switch (NSS) to handle WINS-based name resolution.
466	Since this system does not use a DNS server, it is safe to remove this option from
467	the NSS configuration. Edit the <code class="filename">/etc/nsswitch.conf</code> file so that
468	the <code class="constant">hosts:</code> entry looks like this:
469	</p><pre class="screen">
470	hosts: files wins
471	</pre><p>
472	</p></li></ol></div><div class="example"><a name="acct2conf"></a><p class="title"><b>Example 2.3. Accounting Office Network <code class="filename">smb.conf</code> File [globals] Section</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id328555"></a><em class="parameter"><code>workgroup = BILLMORE</code></em></td></tr><tr><td><a class="indexterm" name="id328565"></a><em class="parameter"><code>passwd chat = NewPassword* %n\nRe-enternewpassword %n\n Passwordchanged*</code></em></td></tr><tr><td><a class="indexterm" name="id328576"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id328587"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id328597"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id328607"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id328618"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id328628"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m -G users '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id328639"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id328649"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id328659"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id328670"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -A '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id328681"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id328692"></a><em class="parameter"><code>logon script = scripts\login.bat</code></em></td></tr><tr><td><a class="indexterm" name="id328702"></a><em class="parameter"><code>logon path = </code></em></td></tr><tr><td><a class="indexterm" name="id328713"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id328723"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id328734"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id328744"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id328754"></a><em class="parameter"><code>printing = CUPS</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="acct3conf"></a><p class="title"><b>Example 2.4. Accounting Office Network <code class="filename">smb.conf</code> File Services and Shares Section</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id328794"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id328805"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id328815"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id328825"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id328844"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id328855"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id328865"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id328875"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id328886"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id328896"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id328915"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id328925"></a><em class="parameter"><code>path = /data/%U</code></em></td></tr><tr><td><a class="indexterm" name="id328936"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id328946"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id328965"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id328975"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id328986"></a><em class="parameter"><code>valid users = %G</code></em></td></tr><tr><td><a class="indexterm" name="id328996"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[finsrvcs]</code></em></td></tr><tr><td><a class="indexterm" name="id329015"></a><em class="parameter"><code>comment = Financial Service Files</code></em></td></tr><tr><td><a class="indexterm" name="id329025"></a><em class="parameter"><code>path = /data/finsrvcs</code></em></td></tr><tr><td><a class="indexterm" name="id329036"></a><em class="parameter"><code>valid users = %G</code></em></td></tr><tr><td><a class="indexterm" name="id329046"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="sect2" title="Validation"><div class="titlepage"><div><div><h3 class="title"><a name="id329058"></a>Validation</h3></div></div></div><p>
473	Does everything function as it ought? That is the key question at this point.
474	Here are some simple steps to validate your Samba server configuration.
475	</p><div class="procedure" title="Procedure 2.2. Validation Steps"><a name="id329068"></a><p class="title"><b>Procedure 2.2. Validation Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>
476	<a class="indexterm" name="id329078"></a>
477	If your <code class="filename">smb.conf</code> file has bogus options or parameters, this may cause Samba
478	to refuse to start. The first step should always be to validate the contents
479	of this file by running:
480	</p><pre class="screen">
481	<code class="prompt">root# </code> testparm -s
482	Load smb config files from smb.conf
483	Processing section "[homes]"
484	Processing section "[printers]"
485	Processing section "[netlogon]"
486	Processing section "[accounts]"
487	Processing section "[service]"
488	Loaded services file OK.
489	# Global parameters
490	[global]
491	workgroup = BILLMORE
492	passwd chat = NewPassword* \
493	%n\n Re-enternewpassword %n\n Passwordchanged*
494	username map = /etc/samba/smbusers
495	syslog = 0
496	name resolve order = wins bcast hosts
497	printcap name = CUPS
498	show add printer wizard = No
499	add user script = /usr/sbin/useradd -m -G users '%u'
500	delete user script = /usr/sbin/userdel -r '%u'
501	add group script = /usr/sbin/groupadd '%g'
502	delete group script = /usr/sbin/groupdel '%g'
503	add user to group script = /usr/sbin/usermod -A '%g' '%u'
504	add machine script = /usr/sbin/useradd
505	-s /bin/false -d /var/lib/nobody '%u'
506	logon script = scripts\logon.bat
507	logon path =
508	logon drive = X:
509	domain logons = Yes
510	preferred master = Yes
511	wins support = Yes
512	...
513	### Remainder cut to save space ###
514	</pre><p>
515	The inclusion of an invalid parameter (say one called dogbert) would generate an
516	error as follows:
517	</p><pre class="screen">
518	Unknown parameter encountered: "dogbert"
519	Ignoring unknown parameter "dogbert"
520	</pre><p>
521	Clear away all errors before proceeding, and start or restart samba as necessary.
522	</p></li><li class="step" title="Step 2"><p>
523	<a class="indexterm" name="id329135"></a>
524	<a class="indexterm" name="id329141"></a>
525	<a class="indexterm" name="id329148"></a>
526	<a class="indexterm" name="id329154"></a>
527	Check that the Samba server is running:
528	</p><pre class="screen">
529	<code class="prompt">root# </code> ps ax \| grep mbd
530	14244 ? S 0:00 /usr/sbin/nmbd -D
531	14245 ? S 0:00 /usr/sbin/nmbd -D
532	14290 ? S 0:00 /usr/sbin/smbd -D
533
534	$rootprompt; ps ax \| grep winbind
535	14293 ? S 0:00 /usr/sbin/winbindd -D
536	14295 ? S 0:00 /usr/sbin/winbindd -D
537	</pre><p>
538	The <code class="literal">winbindd</code> daemon is running in split mode (normal), so there are also
539	two instances of it. For more information regarding <code class="literal">winbindd</code>, see
540	<span class="emphasis"><em>TOSHARG2</em></span>, Chapter 23, Section 23.3. The single instance of
541	<code class="literal">smbd</code> is normal.
542	</p></li><li class="step" title="Step 3"><p>
543	<a class="indexterm" name="id329199"></a>
544	Check that an anonymous connection can be made to the Samba server:
545	</p><pre class="screen">
546	<code class="prompt">root# </code> smbclient -L localhost -U%
547
548	Sharename Type Comment
549	--------- ---- -------
550	netlogon Disk Network Logon Service
551	accounts Disk Accounting Files
552	finsvcs Disk Financial Service Files
553	IPC$ IPC IPC Service (Samba3)
554	ADMIN$ IPC IPC Service (Samba3)
555	hplj4 Printer Hewlett-Packard LaserJet 4
556	hplj6 Printer Hewlett-Packard LaserJet 6
557	qms Printer QMS Magicolor Laser Printer XXXX
558
559	Server Comment
560	--------- -------
561	SLEETH Samba 3.0.20
562
563	Workgroup Master
564	--------- -------
565	BILLMORE SLEETH
566	</pre><p>
567	This demonstrates that an anonymous listing of shares can be obtained. This is the equivalent
568	of browsing the server from a Windows client to obtain a list of shares on the server.
569	The <code class="constant">-U%</code> argument means to send a <code class="constant">NULL</code> username and
570	a <code class="constant">NULL</code> password.
571	</p></li><li class="step" title="Step 4"><p>
572	<a class="indexterm" name="id329241"></a>
573	<a class="indexterm" name="id329247"></a>
574	<a class="indexterm" name="id329254"></a>
575	Verify that the printers have the IP addresses assigned in the DHCP server configuration file.
576	The easiest way to do this is to ping the printer name. Immediately after the ping response
577	has been received, execute <code class="literal">arp -a</code> to find the MAC address of the printer
578	that has responded. Now you can compare the IP address and the MAC address of the printer
579	with the configuration information in the <code class="filename">/etc/dhcpd.conf</code> file. They
580	should, of course, match. For example,
581	</p><pre class="screen">
582	<code class="prompt">root# </code> ping hplj4
583	PING hplj4 (192.168.1.11) 56(84) bytes of data.
584	64 bytes from hplj4 (192.168.1.11): icmp_seq=1 ttl=64 time=0.113 ms
585
586	<code class="prompt">root# </code> arp -a
587	hplj4 (192.168.1.11) at 08:00:46:7A:35:E4 [ether] on eth0
588	</pre><p>
589	The MAC address <code class="constant">08:00:46:7A:35:E4</code> matches that specified for the
590	IP address from which the printer has responded and the entry for it in the
591	<code class="filename">/etc/dhcpd.conf</code> file.
592	</p></li><li class="step" title="Step 5"><p>
593	<a class="indexterm" name="id329307"></a>
594	Make an authenticated connection to the server using the <code class="literal">smbclient</code> tool:
595	</p><pre class="screen">
596	<code class="prompt">root# </code> smbclient //sleeth/accounts -U alanm
597	Password: XXXXXXX
598	smb: \> dir
599	. D 0 Sun Nov 9 01:28:34 2003
600	.. D 0 Sat Aug 16 17:24:26 2003
601	.mc DH 0 Sat Nov 8 21:57:38 2003
602	.qt DH 0 Fri Sep 5 00:48:25 2003
603	SMB D 0 Sun Oct 19 23:04:30 2003
604	Documents D 0 Sat Nov 1 00:31:51 2003
605	xpsp1a_en_x86.exe 131170400 Sun Nov 2 01:25:44 2003
606
607	65387 blocks of size 65536. 28590 blocks available
608	smb: \> q
609	</pre><p>
610	</p></li></ol></div></div><div class="procedure" title="Procedure 2.3. Windows XP Professional Client Configuration"><a name="id329344"></a><p class="title"><b>Procedure 2.3. Windows XP Professional Client Configuration</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>
611	Configure clients to the network settings shown in <a class="link" href="small.html#acct2net" title="Figure 2.1. Abmas Accounting 52-User Network Topology">“Abmas Accounting 52-User Network Topology”</a>.
612	All clients use DHCP for TCP/IP protocol stack configuration.
613	<a class="indexterm" name="id329359"></a>
614	<a class="indexterm" name="id329366"></a>
615	DHCP configures all Windows clients to use the WINS Server address <code class="constant">192.168.1.1</code>.
616	</p></li><li class="step" title="Step 2"><p>
617	Join the Windows Domain called <code class="constant">BILLMORE</code>. Use the Domain Administrator
618	username <code class="constant">root</code> and the SMB password you assigned to this account.
619	A detailed step-by-step procedure for joining a Windows 200x/XP Professional client to
620	a Windows Domain is given in <a class="link" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">“A Collection of Useful Tidbits”</a>, <a class="link" href="appendix.html#domjoin" title="Joining a Domain: Windows 200x/XP Professional">“Joining a Domain: Windows 200x/XP Professional”</a>.
621	Reboot the machine as prompted and then log on using a Domain User account.
622	</p></li><li class="step" title="Step 3"><p>
623	Verify on each client that the machine called <code class="constant">SLEETH</code>
624	is visible in <span class="guimenu">My Network Places</span>, that it is
625	possible to connect to it and see the shares <span class="guimenuitem">accounts</span>
626	and <span class="guimenuitem">finsvcs</span>,
627	and that it is possible to open that share to reveal its contents.
628	</p></li><li class="step" title="Step 4"><p>
629	Instruct all users to log onto the workstation using their assigned username and password.
630	</p></li><li class="step" title="Step 5"><p>
631	Install a printer on each using the following steps:
632	</p><div class="procedure"><ol class="procedure" type="1"><li class="step" title="Step 5.1"><p>
633	Click <span class="guimenu">Start</span> → <span class="guimenuitem">Settings</span> → <span class="guimenuitem">Printers</span>+<span class="guiicon">Add Printer</span>+<span class="guibutton">Next</span>. Do not click <span class="guimenuitem">Network printer</span>.
634	Ensure that <span class="guimenuitem">Local printer</span> is selected.
635	</p></li><li class="step" title="Step 5.2"><p>
636	Click <span class="guibutton">Next</span>. In the
637	<span class="guimenuitem">Manufacturer:</span> panel, select <code class="constant">HP</code>.
638	In the <span class="guimenuitem">Printers:</span> panel, select the printer called
639	<code class="constant">HP LaserJet 4</code>. Click <span class="guibutton">Next</span>.
640	</p></li><li class="step" title="Step 5.3"><p>
641	In the <span class="guimenuitem">Available ports:</span> panel, select
642	<code class="constant">FILE:</code>. Accept the default printer name by clicking
643	<span class="guibutton">Next</span>. When asked, <span class="quote">“<span class="quote">Would you like to print a
644	test page?</span>”</span>, click <span class="guimenuitem">No</span>. Click
645	<span class="guibutton">Finish</span>.
646	</p></li><li class="step" title="Step 5.4"><p>
647	You may be prompted for the name of a file to print to. If so, close the
648	dialog panel. Right-click <span class="guiicon">HP LaserJet 4</span> → <span class="guimenuitem">Properties</span> → <span class="guisubmenu">Details (Tab)</span> → <span class="guimenuitem">Add Port</span>.
649	</p></li><li class="step" title="Step 5.5"><p>
650	In the <span class="guimenuitem">Network</span> panel, enter the name of
651	the print queue on the Samba server as follows: <code class="constant">\\SERVER\hplj4</code>.
652	Click <span class="guibutton">OK</span>+<span class="guibutton">OK</span> to complete the installation.
653	</p></li><li class="step" title="Step 5.6"><p>
654	Repeat the printer installation steps above for the HP LaserJet 6 printer
655	as well as for the QMS Magicolor XXXX laser printer.
656	</p></li></ol></div></li></ol></div><div class="sect2" title="Notebook Computers: A Special Case"><div class="titlepage"><div><div><h3 class="title"><a name="id329633"></a>Notebook Computers: A Special Case</h3></div></div></div><p>
657	As a network administrator, you already know how to create local machine accounts for Windows 200x/XP
658	Professional systems. This is the preferred solution to provide continuity of work for notebook users
659	so that absence from the office network environment does not become a barrier to productivity.
660	</p><p>
661	By creating a local machine account that has the same username and password as you create for that
662	user in the Windows Domain environment, the user can log onto the machine locally and still
663	transparently access network resources as if logged onto the domain itself. There are some trade-offs
664	that mean that as the network is more tightly secured, it becomes necessary to modify Windows client
665	configuration somewhat.
666	</p></div><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id329652"></a>Key Points Learned</h3></div></div></div><p>
667	In this network design and implementation exercise, you created a Windows NT4-style Domain
668	Controller using Samba-3.0.20. Following these guidelines, you experienced
669	and implemented several important aspects of Windows networking. In the next chapter,
670	you build on the experience. These are the highlights from this chapter:
671	</p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
672	<a class="indexterm" name="id329669"></a>
673	You implemented a DHCP server, and Microsoft Windows clients were able to obtain all necessary
674	network configuration settings from this server.
675	</p></li><li class="listitem"><p>
676	<a class="indexterm" name="id329681"></a>
677	You created a Windows Domain Controller. You were able to use the network logon service
678	and successfully joined Windows 200x/XP Professional clients to the Domain.
679	</p></li><li class="listitem"><p>
680	<a class="indexterm" name="id329693"></a>
681	You created raw print queues in the CUPS printing system. You maintained a simple
682	printing system so that all users can share centrally managed printers. You installed
683	native printer drivers on the Windows clients.
684	</p></li><li class="listitem"><p>
685	You experienced the benefits of centrally managed user accounts on the server.
686	</p></li><li class="listitem"><p>
687	You offered Mobile notebook users a solution that allows them to continue to work
688	while away from the office and not connected to the corporate network.
689	</p></li></ul></div></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id329716"></a>Questions and Answers</h2></div></div></div><p>
690	Your new Domain Controller is ready to serve you. What does it mean? Here are some questions and answers that
691	may help.
692	</p><div class="qandaset" title="Frequently Asked Questions"><a name="id329726"></a><dl><dt>1. <a href="small.html#id329728">
693	What is the key benefit of using DHCP to configure Windows client TCP/IP stacks?
694	</a></dt><dt>2. <a href="small.html#id329750">
695	Are there any DHCP server configuration parameters in the /etc/dhcpd.conf
696	that should be noted in particular?
697	</a></dt><dt>3. <a href="small.html#id329776">
698	Is it possible to create a Windows Domain account that is specifically called Administrator?
699	</a></dt><dt>4. <a href="small.html#id329810">
700	Why is it necessary to give the Windows Domain Administrator a UNIX UID of 0?
701	</a></dt><dt>5. <a href="small.html#id329843">
702	One of my junior staff needs the ability to add machines to the Domain, but I do not want to give him
703	root access. How can we do this?
704	</a></dt><dt>6. <a href="small.html#id329878">
705	Why must I map Windows Domain Groups to UNIX groups?
706	</a></dt><dt>7. <a href="small.html#id329912">
707	I deleted my root account and now I cannot add it back! What can I do?
708	</a></dt><dt>8. <a href="small.html#id329978">
709	When I run net groupmap list, it reports a group called Administrators
710	as well as Domain Admins. What is the difference between them?
711	</a></dt><dt>9. <a href="small.html#id330018">
712	What is the effect of changing the name of a Samba server or of changing the Domain name?
713	</a></dt><dt>10. <a href="small.html#id330060">
714	How can I manage user accounts from my Windows XP Professional workstation?
715	</a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question" title="1."><td align="left" valign="top"><a name="id329728"></a><a name="id329730"></a><p><b>1.</b></p></td><td align="left" valign="top"><p>
716	What is the key benefit of using DHCP to configure Windows client TCP/IP stacks?
717	</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
718	First and foremost, portability. It means that notebook users can move between
719	the Abmas office and client offices (so long as they, too, use DHCP) without having to manually
720	reconfigure their machines. It also means that when they work from their home environments
721	either using DHCP assigned addressing or when using dial-up networking, settings such as
722	default routes and DNS server addresses that apply only to the Abmas office environment do
723	not interfere with remote operations. This is an extremely important feature of DHCP.
724	</p></td></tr><tr class="question" title="2."><td align="left" valign="top"><a name="id329750"></a><a name="id329752"></a><p><b>2.</b></p></td><td align="left" valign="top"><p>
725	Are there any DHCP server configuration parameters in the <code class="filename">/etc/dhcpd.conf</code>
726	that should be noted in particular?
727	</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
728	Yes. The configuration you created automatically provides each client with the IP address
729	of your WINS server. It also configures the client to preferentially register NetBIOS names
730	with the WINS server, and then instructs the client to first query the WINS server when a
731	NetBIOS machine name needs to be resolved to an IP Address. This configuration
732	results in far lower UDP broadcast traffic than would be the case if WINS was not used.
733	</p></td></tr><tr class="question" title="3."><td align="left" valign="top"><a name="id329776"></a><a name="id329778"></a><p><b>3.</b></p></td><td align="left" valign="top"><p>
734	Is it possible to create a Windows Domain account that is specifically called <code class="constant">Administrator</code>?
735	</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
736	You can surely create a Windows Domain account called <code class="constant">Administrator</code>. It is also
737	possible to map that account so that it has the effective UNIX UID of 0. This way it isn't
738	necessary to use the <em class="parameter"><code>username map</code></em> facility to map this account to the UNIX
739	account called <code class="constant">root</code>.
740	</p></td></tr><tr class="question" title="4."><td align="left" valign="top"><a name="id329810"></a><a name="id329812"></a><p><b>4.</b></p></td><td align="left" valign="top"><p>
741	Why is it necessary to give the Windows Domain <code class="constant">Administrator</code> a UNIX UID of 0?
742	</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
743	The Windows Domain <code class="constant">Administrator</code> account is the most privileged account that
744	exists on the Windows platform. This user can change any setting, add, delete, or modify user
745	accounts, and completely reconfigure the system. The equivalent to this account in the UNIX
746	environment is the <code class="constant">root</code> account. If you want to permit the Windows Domain
747	Administrator to manage accounts as well as permissions, privileges, and security
748	settings within the Domain and on the Samba server, equivalent rights must be assigned. This is
749	achieved with the <code class="constant">root</code> UID equal to 0.
750	</p></td></tr><tr class="question" title="5."><td align="left" valign="top"><a name="id329843"></a><a name="id329845"></a><p><b>5.</b></p></td><td align="left" valign="top"><p>
751	One of my junior staff needs the ability to add machines to the Domain, but I do not want to give him
752	<code class="constant">root</code> access. How can we do this?
753	</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
754	Users who are members of the <code class="constant">Domain Admins</code> group can add machines to the
755	Domain. This group is mapped to the UNIX group account called <code class="constant">root</code>
756	(or the equivalent <code class="constant">wheel</code> on some UNIX systems) that has a GID of 0.
757	This must be the primary GID of the account of the user who is a member of the Windows <code class="constant">
758	Domain Admins</code> account.
759	</p></td></tr><tr class="question" title="6."><td align="left" valign="top"><a name="id329878"></a><a name="id329880"></a><p><b>6.</b></p></td><td align="left" valign="top"><p>
760	Why must I map Windows Domain Groups to UNIX groups?
761	</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
762	Samba-3 does not permit a Domain Group to become visible to Domain network clients unless the account
763	has a UNIX group account equivalent. The Domain groups that should be given UNIX equivalents are
764	<span class="guimenu">Domain Guests</span>, <span class="guimenu">Domain Users</span>, and <span class="guimenu">Domain Admins</span>.
765	</p></td></tr><tr class="question" title="7."><td align="left" valign="top"><a name="id329912"></a><a name="id329914"></a><p><b>7.</b></p></td><td align="left" valign="top"><p>
766	I deleted my <code class="constant">root</code> account and now I cannot add it back! What can I do?
767	</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
768	This is a nasty problem. Fortunately, there is a solution.
769	</p><div class="procedure"><ol class="procedure" type="1"><li class="step" title="Step 1"><p>
770	Back up your existing configuration files in case you need to restore them.
771	</p></li><li class="step" title="Step 2"><p>
772	Rename the <code class="filename">group_mapping.tdb</code> file.
773	</p></li><li class="step" title="Step 3"><p>
774	Use the <code class="literal">smbpasswd</code> to add the root account.
775	</p></li><li class="step" title="Step 4"><p>
776	Restore the <code class="filename">group_mapping.tdb</code> file.
777	</p></li></ol></div></td></tr><tr class="question" title="8."><td align="left" valign="top"><a name="id329978"></a><a name="id329980"></a><p><b>8.</b></p></td><td align="left" valign="top"><p>
778	When I run <code class="literal">net groupmap list</code>, it reports a group called <span class="guimenu">Administrators</span>
779	as well as <span class="guimenu">Domain Admins</span>. What is the difference between them?
780	</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
781	The group called <span class="guimenu">Administrators</span> is representative of the same account that would be
782	present as the Local Group account on a Domain Member server or workstation. Samba uses only Domain
783	Groups at this time. A Workstation or Server Local Group has no meaning in a Samba context. This
784	may change at some later date. These accounts are provided only so that security objects are correctly shown.
785	</p></td></tr><tr class="question" title="9."><td align="left" valign="top"><a name="id330018"></a><a name="id330020"></a><p><b>9.</b></p></td><td align="left" valign="top"><p>
786	What is the effect of changing the name of a Samba server or of changing the Domain name?
787	</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
788	If you elect to change the name of the Samba server, on restarting <code class="literal">smbd</code>,
789	Windows security identifiers are changed. In the case of a standalone server or a Domain Member server,
790	the machine SID is changed. This may break Domain membership. In the case of a change of the Domain name
791	(Workgroup name), the Domain SID is changed. This affects all Domain memberships.
792	</p><p>
793	If it becomes necessary to change either the server name or the Domain name, be sure to back up the respective
794	SID before the change is made. You can back up the SID using the <code class="literal">net getlocalsid</code> (Samba-3)
795	or the <code class="literal">smbpasswd</code> (Samba-2.2.x). To change the SID, you use the same tool. Be sure
796	to check the man page for this command for detailed instructions regarding the steps involved.
797	</p></td></tr><tr class="question" title="10."><td align="left" valign="top"><a name="id330060"></a><a name="id330062"></a><p><b>10.</b></p></td><td align="left" valign="top"><p>
798	How can I manage user accounts from my Windows XP Professional workstation?
799	</p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
800	Samba-3 implements a Windows NT4-style security domain architecture. This type of Domain cannot
801	be managed using tools present on a Windows XP Professional installation. You may download from the
802	Microsoft Web site the SRVTOOLS.EXE package. Extract it into the directory from which you wish to use
803	it. This package extracts the tools: <code class="literal">User Manager for Domains</code>, <code class="literal">Server Manager</code>, and <code class="literal">Event
804	Viewer</code>. You may use the <span class="guimenu">User Manager for Domains</span> to manage your Samba-3
805	Domain user and group accounts. Of course, you do need to be logged on as the <code class="constant">Administrator</code>
806	for the Samba-3 Domain. It may help to log on as the <code class="constant">root</code> account.
807	</p></td></tr></tbody></table></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="simple.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="ExNetworks.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="secure.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 1. No-Frills Samba Servers </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 3. Secure Office Networking</td></tr></table></div></body></html>

Note: See TracBrowser for help on using the repository browser.

Download in other formats: