| 1 | <?xml version="1.0" encoding="iso-8859-1"?>
|
|---|
| 2 | <!DOCTYPE refentry PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
|
|---|
| 3 | <refentry id="winbindd.8">
|
|---|
| 4 |
|
|---|
| 5 | <refmeta>
|
|---|
| 6 | <refentrytitle>winbindd</refentrytitle>
|
|---|
| 7 | <manvolnum>8</manvolnum>
|
|---|
| 8 | <refmiscinfo class="source">Samba</refmiscinfo>
|
|---|
| 9 | <refmiscinfo class="manual">System Administration tools</refmiscinfo>
|
|---|
| 10 | <refmiscinfo class="version">3.6</refmiscinfo>
|
|---|
| 11 | </refmeta>
|
|---|
| 12 |
|
|---|
| 13 |
|
|---|
| 14 | <refnamediv>
|
|---|
| 15 | <refname>winbindd</refname>
|
|---|
| 16 | <refpurpose>Name Service Switch daemon for resolving names
|
|---|
| 17 | from NT servers</refpurpose>
|
|---|
| 18 | </refnamediv>
|
|---|
| 19 |
|
|---|
| 20 | <refsynopsisdiv>
|
|---|
| 21 | <cmdsynopsis>
|
|---|
| 22 | <command>winbindd</command>
|
|---|
| 23 | <arg choice="opt">-D</arg>
|
|---|
| 24 | <arg choice="opt">-F</arg>
|
|---|
| 25 | <arg choice="opt">-S</arg>
|
|---|
| 26 | <arg choice="opt">-i</arg>
|
|---|
| 27 | <arg choice="opt">-Y</arg>
|
|---|
| 28 | <arg choice="opt">-d <debug level></arg>
|
|---|
| 29 | <arg choice="opt">-s <smb config file></arg>
|
|---|
| 30 | <arg choice="opt">-n</arg>
|
|---|
| 31 | </cmdsynopsis>
|
|---|
| 32 | </refsynopsisdiv>
|
|---|
| 33 |
|
|---|
| 34 | <refsect1>
|
|---|
| 35 | <title>DESCRIPTION</title>
|
|---|
| 36 |
|
|---|
| 37 | <para>This program is part of the <citerefentry><refentrytitle>samba</refentrytitle>
|
|---|
| 38 | <manvolnum>7</manvolnum></citerefentry> suite.</para>
|
|---|
| 39 |
|
|---|
| 40 | <para><command>winbindd</command> is a daemon that provides
|
|---|
| 41 | a number of services to the Name Service Switch capability found
|
|---|
| 42 | in most modern C libraries, to arbitrary applications via PAM
|
|---|
| 43 | and <command>ntlm_auth</command> and to Samba itself.</para>
|
|---|
| 44 |
|
|---|
| 45 | <para>Even if winbind is not used for nsswitch, it still provides a
|
|---|
| 46 | service to <command>smbd</command>, <command>ntlm_auth</command>
|
|---|
| 47 | and the <command>pam_winbind.so</command> PAM module, by managing connections to
|
|---|
| 48 | domain controllers. In this configuration the
|
|---|
| 49 | <smbconfoption name="idmap config * : range"/>
|
|---|
| 50 | parameter is not required. (This is known as `netlogon proxy only mode'.)</para>
|
|---|
| 51 |
|
|---|
| 52 | <para> The Name Service Switch allows user
|
|---|
| 53 | and system information to be obtained from different databases
|
|---|
| 54 | services such as NIS or DNS. The exact behaviour can be configured
|
|---|
| 55 | through the <filename>/etc/nsswitch.conf</filename> file.
|
|---|
| 56 | Users and groups are allocated as they are resolved to a range
|
|---|
| 57 | of user and group ids specified by the administrator of the
|
|---|
| 58 | Samba system.</para>
|
|---|
| 59 |
|
|---|
| 60 | <para>The service provided by <command>winbindd</command> is called `winbind' and
|
|---|
| 61 | can be used to resolve user and group information from a
|
|---|
| 62 | Windows NT server. The service can also provide authentication
|
|---|
| 63 | services via an associated PAM module. </para>
|
|---|
| 64 |
|
|---|
| 65 | <para>
|
|---|
| 66 | The <filename>pam_winbind</filename> module supports the
|
|---|
| 67 | <parameter>auth</parameter>, <parameter>account</parameter>
|
|---|
| 68 | and <parameter>password</parameter>
|
|---|
| 69 | module-types. It should be noted that the
|
|---|
| 70 | <parameter>account</parameter> module simply performs a getpwnam() to verify that
|
|---|
| 71 | the system can obtain a uid for the user, as the domain
|
|---|
| 72 | controller has already performed access control. If the
|
|---|
| 73 | <filename>libnss_winbind</filename> library has been correctly
|
|---|
| 74 | installed, or an alternate source of names configured, this should always succeed.
|
|---|
| 75 | </para>
|
|---|
| 76 |
|
|---|
| 77 | <para>The following nsswitch databases are implemented by
|
|---|
| 78 | the winbindd service: </para>
|
|---|
| 79 |
|
|---|
| 80 | <variablelist>
|
|---|
| 81 | <varlistentry>
|
|---|
| 82 | <term>hosts</term>
|
|---|
| 83 | <listitem><para>This feature is only available on IRIX.
|
|---|
| 84 | User information traditionally stored in
|
|---|
| 85 | the <filename>hosts(5)</filename> file and used by
|
|---|
| 86 | <command>gethostbyname(3)</command> functions. Names are
|
|---|
| 87 | resolved through the WINS server or by broadcast.
|
|---|
| 88 | </para></listitem>
|
|---|
| 89 | </varlistentry>
|
|---|
| 90 |
|
|---|
| 91 | <varlistentry>
|
|---|
| 92 | <term>passwd</term>
|
|---|
| 93 | <listitem><para>User information traditionally stored in
|
|---|
| 94 | the <filename>passwd(5)</filename> file and used by
|
|---|
| 95 | <command>getpwent(3)</command> functions. </para></listitem>
|
|---|
| 96 | </varlistentry>
|
|---|
| 97 |
|
|---|
| 98 | <varlistentry>
|
|---|
| 99 | <term>group</term>
|
|---|
| 100 | <listitem><para>Group information traditionally stored in
|
|---|
| 101 | the <filename>group(5)</filename> file and used by
|
|---|
| 102 | <command>getgrent(3)</command> functions. </para></listitem>
|
|---|
| 103 | </varlistentry>
|
|---|
| 104 | </variablelist>
|
|---|
| 105 |
|
|---|
| 106 | <para>For example, the following simple configuration in the
|
|---|
| 107 | <filename>/etc/nsswitch.conf</filename> file can be used to initially
|
|---|
| 108 | resolve user and group information from <filename>/etc/passwd
|
|---|
| 109 | </filename> and <filename>/etc/group</filename> and then from the
|
|---|
| 110 | Windows NT server.
|
|---|
| 111 | </para>
|
|---|
| 112 |
|
|---|
| 113 | <programlisting>
|
|---|
| 114 | passwd: files winbind
|
|---|
| 115 | group: files winbind
|
|---|
| 116 | ## only available on IRIX: use winbind to resolve hosts:
|
|---|
| 117 | # hosts: files dns winbind
|
|---|
| 118 | ## All other NSS enabled systems should use libnss_wins.so like this:
|
|---|
| 119 | hosts: files dns wins
|
|---|
| 120 |
|
|---|
| 121 | </programlisting>
|
|---|
| 122 |
|
|---|
| 123 | <para>The following simple configuration in the
|
|---|
| 124 | <filename>/etc/nsswitch.conf</filename> file can be used to initially
|
|---|
| 125 | resolve hostnames from <filename>/etc/hosts</filename> and then from the
|
|---|
| 126 | WINS server.</para>
|
|---|
| 127 | <programlisting>
|
|---|
| 128 | hosts: files wins
|
|---|
| 129 | </programlisting>
|
|---|
| 130 |
|
|---|
| 131 | </refsect1>
|
|---|
| 132 |
|
|---|
| 133 |
|
|---|
| 134 | <refsect1>
|
|---|
| 135 | <title>OPTIONS</title>
|
|---|
| 136 |
|
|---|
| 137 | <variablelist>
|
|---|
| 138 | <varlistentry>
|
|---|
| 139 | <term>-D</term>
|
|---|
| 140 | <listitem><para>If specified, this parameter causes
|
|---|
| 141 | the server to operate as a daemon. That is, it detaches
|
|---|
| 142 | itself and runs in the background on the appropriate port.
|
|---|
| 143 | This switch is assumed if <command>winbindd</command> is
|
|---|
| 144 | executed on the command line of a shell.
|
|---|
| 145 | </para></listitem>
|
|---|
| 146 | </varlistentry>
|
|---|
| 147 |
|
|---|
| 148 | <varlistentry>
|
|---|
| 149 | <term>-F</term>
|
|---|
| 150 | <listitem><para>If specified, this parameter causes
|
|---|
| 151 | the main <command>winbindd</command> process to not daemonize,
|
|---|
| 152 | i.e. double-fork and disassociate with the terminal.
|
|---|
| 153 | Child processes are still created as normal to service
|
|---|
| 154 | each connection request, but the main process does not
|
|---|
| 155 | exit. This operation mode is suitable for running
|
|---|
| 156 | <command>winbindd</command> under process supervisors such
|
|---|
| 157 | as <command>supervise</command> and <command>svscan</command>
|
|---|
| 158 | from Daniel J. Bernstein's <command>daemontools</command>
|
|---|
| 159 | package, or the AIX process monitor.
|
|---|
| 160 | </para></listitem>
|
|---|
| 161 | </varlistentry>
|
|---|
| 162 |
|
|---|
| 163 | <varlistentry>
|
|---|
| 164 | <term>-S</term>
|
|---|
| 165 | <listitem><para>If specified, this parameter causes
|
|---|
| 166 | <command>winbindd</command> to log to standard output rather
|
|---|
| 167 | than a file.</para></listitem>
|
|---|
| 168 | </varlistentry>
|
|---|
| 169 |
|
|---|
| 170 | &stdarg.server.debug;
|
|---|
| 171 | &popt.common.samba;
|
|---|
| 172 | &stdarg.help;
|
|---|
| 173 |
|
|---|
| 174 | <varlistentry>
|
|---|
| 175 | <term>-i</term>
|
|---|
| 176 | <listitem><para>Tells <command>winbindd</command> to not
|
|---|
| 177 | become a daemon and detach from the current terminal. This
|
|---|
| 178 | option is used by developers when interactive debugging
|
|---|
| 179 | of <command>winbindd</command> is required.
|
|---|
| 180 | <command>winbindd</command> also logs to standard output,
|
|---|
| 181 | as if the <command>-S</command> parameter had been given.
|
|---|
| 182 | </para></listitem>
|
|---|
| 183 | </varlistentry>
|
|---|
| 184 |
|
|---|
| 185 | <varlistentry>
|
|---|
| 186 | <term>-n</term>
|
|---|
| 187 | <listitem><para>Disable caching. This means winbindd will
|
|---|
| 188 | always have to wait for a response from the domain controller
|
|---|
| 189 | before it can respond to a client and this thus makes things
|
|---|
| 190 | slower. The results will however be more accurate, since
|
|---|
| 191 | results from the cache might not be up-to-date. This
|
|---|
| 192 | might also temporarily hang winbindd if the DC doesn't respond.
|
|---|
| 193 | </para></listitem>
|
|---|
| 194 | </varlistentry>
|
|---|
| 195 |
|
|---|
| 196 | <varlistentry>
|
|---|
| 197 | <term>-Y</term>
|
|---|
| 198 | <listitem><para>Single daemon mode. This means winbindd will run
|
|---|
| 199 | as a single process (the mode of operation in Samba 2.2). Winbindd's
|
|---|
| 200 | default behavior is to launch a child process that is responsible for
|
|---|
| 201 | updating expired cache entries.
|
|---|
| 202 | </para></listitem>
|
|---|
| 203 | </varlistentry>
|
|---|
| 204 |
|
|---|
| 205 | </variablelist>
|
|---|
| 206 | </refsect1>
|
|---|
| 207 |
|
|---|
| 208 |
|
|---|
| 209 | <refsect1>
|
|---|
| 210 | <title>NAME AND ID RESOLUTION</title>
|
|---|
| 211 |
|
|---|
| 212 | <para>Users and groups on a Windows NT server are assigned
|
|---|
| 213 | a security id (SID) which is globally unique when the
|
|---|
| 214 | user or group is created. To convert the Windows NT user or group
|
|---|
| 215 | into a unix user or group, a mapping between SIDs and unix user
|
|---|
| 216 | and group ids is required. This is one of the jobs that <command>
|
|---|
| 217 | winbindd</command> performs. </para>
|
|---|
| 218 |
|
|---|
| 219 | <para>As winbindd users and groups are resolved from a server, user
|
|---|
| 220 | and group ids are allocated from a specified range. This
|
|---|
| 221 | is done on a first come, first served basis, although all existing
|
|---|
| 222 | users and groups will be mapped as soon as a client performs a user
|
|---|
| 223 | or group enumeration command. The allocated unix ids are stored
|
|---|
| 224 | in a database and will be remembered. </para>
|
|---|
| 225 |
|
|---|
| 226 | <para>WARNING: The SID to unix id database is the only location
|
|---|
| 227 | where the user and group mappings are stored by winbindd. If this
|
|---|
| 228 | store is deleted or corrupted, there is no way for winbindd to
|
|---|
| 229 | determine which user and group ids correspond to Windows NT user
|
|---|
| 230 | and group rids. </para>
|
|---|
| 231 |
|
|---|
| 232 | </refsect1>
|
|---|
| 233 |
|
|---|
| 234 |
|
|---|
| 235 | <refsect1>
|
|---|
| 236 | <title>CONFIGURATION</title>
|
|---|
| 237 |
|
|---|
| 238 | <para>Configuration of the <command>winbindd</command> daemon
|
|---|
| 239 | is done through configuration parameters in the <citerefentry>
|
|---|
| 240 | <refentrytitle>smb.conf</refentrytitle><manvolnum>5</manvolnum>
|
|---|
| 241 | </citerefentry> file. All parameters should be specified in the
|
|---|
| 242 | [global] section of smb.conf. </para>
|
|---|
| 243 |
|
|---|
| 244 | <itemizedlist>
|
|---|
| 245 | <listitem><para>
|
|---|
| 246 | <smbconfoption name="winbind separator"/></para></listitem>
|
|---|
| 247 | <listitem><para>
|
|---|
| 248 | <smbconfoption name="idmap config * : range"/></para></listitem>
|
|---|
| 249 | <listitem><para>
|
|---|
| 250 | <smbconfoption name="idmap config * : backend"/></para></listitem>
|
|---|
| 251 | <listitem><para>
|
|---|
| 252 | <smbconfoption name="winbind cache time"/></para></listitem>
|
|---|
| 253 | <listitem><para>
|
|---|
| 254 | <smbconfoption name="winbind enum users"/></para></listitem>
|
|---|
| 255 | <listitem><para>
|
|---|
| 256 | <smbconfoption name="winbind enum groups"/></para></listitem>
|
|---|
| 257 | <listitem><para>
|
|---|
| 258 | <smbconfoption name="template homedir"/></para></listitem>
|
|---|
| 259 | <listitem><para>
|
|---|
| 260 | <smbconfoption name="template shell"/></para></listitem>
|
|---|
| 261 | <listitem><para>
|
|---|
| 262 | <smbconfoption name="winbind use default domain"/></para></listitem>
|
|---|
| 263 | <listitem><para>
|
|---|
| 264 | <smbconfoption name="winbind: rpc only"/>
|
|---|
| 265 | Setting this parameter forces winbindd to use RPC
|
|---|
| 266 | instead of LDAP to retrieve information from Domain
|
|---|
| 267 | Controllers.
|
|---|
| 268 | </para></listitem>
|
|---|
| 269 | </itemizedlist>
|
|---|
| 270 | </refsect1>
|
|---|
| 271 |
|
|---|
| 272 |
|
|---|
| 273 | <refsect1>
|
|---|
| 274 | <title>EXAMPLE SETUP</title>
|
|---|
| 275 |
|
|---|
| 276 | <para>
|
|---|
| 277 | To setup winbindd for user and group lookups plus
|
|---|
| 278 | authentication from a domain controller use something like the
|
|---|
| 279 | following setup. This was tested on an early Red Hat Linux box.
|
|---|
| 280 | </para>
|
|---|
| 281 |
|
|---|
| 282 | <para>In <filename>/etc/nsswitch.conf</filename> put the
|
|---|
| 283 | following:
|
|---|
| 284 | <programlisting>
|
|---|
| 285 | passwd: files winbind
|
|---|
| 286 | group: files winbind
|
|---|
| 287 | </programlisting>
|
|---|
| 288 | </para>
|
|---|
| 289 |
|
|---|
| 290 | <para>In <filename>/etc/pam.d/*</filename> replace the <parameter>
|
|---|
| 291 | auth</parameter> lines with something like this:
|
|---|
| 292 | <programlisting>
|
|---|
| 293 | auth required /lib/security/pam_securetty.so
|
|---|
| 294 | auth required /lib/security/pam_nologin.so
|
|---|
| 295 | auth sufficient /lib/security/pam_winbind.so
|
|---|
| 296 | auth required /lib/security/pam_unix.so \
|
|---|
| 297 | use_first_pass shadow nullok
|
|---|
| 298 | </programlisting>
|
|---|
| 299 | </para>
|
|---|
| 300 |
|
|---|
| 301 | <note><para>
|
|---|
| 302 | The PAM module pam_unix has recently replaced the module pam_pwdb.
|
|---|
| 303 | Some Linux systems use the module pam_unix2 in place of pam_unix.
|
|---|
| 304 | </para></note>
|
|---|
| 305 |
|
|---|
| 306 | <para>Note in particular the use of the <parameter>sufficient
|
|---|
| 307 | </parameter> keyword and the <parameter>use_first_pass</parameter> keyword. </para>
|
|---|
| 308 |
|
|---|
| 309 | <para>Now replace the account lines with this: </para>
|
|---|
| 310 |
|
|---|
| 311 | <para><command>account required /lib/security/pam_winbind.so
|
|---|
| 312 | </command></para>
|
|---|
| 313 |
|
|---|
| 314 | <para>The next step is to join the domain. To do that use the
|
|---|
| 315 | <command>net</command> program like this: </para>
|
|---|
| 316 |
|
|---|
| 317 | <para><command>net join -S PDC -U Administrator</command></para>
|
|---|
| 318 |
|
|---|
| 319 | <para>The username after the <parameter>-U</parameter> can be any
|
|---|
| 320 | Domain user that has administrator privileges on the machine.
|
|---|
| 321 | Substitute the name or IP of your PDC for "PDC".</para>
|
|---|
| 322 |
|
|---|
| 323 | <para>Next copy <filename>libnss_winbind.so</filename> to
|
|---|
| 324 | <filename>/lib</filename> and <filename>pam_winbind.so
|
|---|
| 325 | </filename> to <filename>/lib/security</filename>. A symbolic link needs to be
|
|---|
| 326 | made from <filename>/lib/libnss_winbind.so</filename> to
|
|---|
| 327 | <filename>/lib/libnss_winbind.so.2</filename>. If you are using an
|
|---|
| 328 | older version of glibc then the target of the link should be
|
|---|
| 329 | <filename>/lib/libnss_winbind.so.1</filename>.</para>
|
|---|
| 330 |
|
|---|
| 331 | <para>Finally, setup a <citerefentry><refentrytitle>smb.conf</refentrytitle>
|
|---|
| 332 | <manvolnum>5</manvolnum></citerefentry> containing directives like the
|
|---|
| 333 | following:
|
|---|
| 334 | <programlisting>
|
|---|
| 335 | [global]
|
|---|
| 336 | winbind separator = +
|
|---|
| 337 | winbind cache time = 10
|
|---|
| 338 | template shell = /bin/bash
|
|---|
| 339 | template homedir = /home/%D/%U
|
|---|
| 340 | idmap config * : range = 10000-20000
|
|---|
| 341 | workgroup = DOMAIN
|
|---|
| 342 | security = domain
|
|---|
| 343 | password server = *
|
|---|
| 344 | </programlisting></para>
|
|---|
| 345 |
|
|---|
| 346 |
|
|---|
| 347 | <para>Now start winbindd and you should find that your user and
|
|---|
| 348 | group database is expanded to include your NT users and groups,
|
|---|
| 349 | and that you can login to your unix box as a domain user, using
|
|---|
| 350 | the DOMAIN+user syntax for the username. You may wish to use the
|
|---|
| 351 | commands <command>getent passwd</command> and <command>getent group
|
|---|
| 352 | </command> to confirm the correct operation of winbindd.</para>
|
|---|
| 353 | </refsect1>
|
|---|
| 354 |
|
|---|
| 355 |
|
|---|
| 356 | <refsect1>
|
|---|
| 357 | <title>NOTES</title>
|
|---|
| 358 |
|
|---|
| 359 | <para>The following notes are useful when configuring and
|
|---|
| 360 | running <command>winbindd</command>: </para>
|
|---|
| 361 |
|
|---|
| 362 | <para><citerefentry><refentrytitle>nmbd</refentrytitle>
|
|---|
| 363 | <manvolnum>8</manvolnum></citerefentry> must be running on the local machine
|
|---|
| 364 | for <command>winbindd</command> to work. </para>
|
|---|
| 365 |
|
|---|
| 366 | <para>PAM is really easy to misconfigure. Make sure you know what
|
|---|
| 367 | you are doing when modifying PAM configuration files. It is possible
|
|---|
| 368 | to set up PAM such that you can no longer log into your system. </para>
|
|---|
| 369 |
|
|---|
| 370 | <para>If more than one UNIX machine is running <command>winbindd</command>,
|
|---|
| 371 | then in general the user and groups ids allocated by winbindd will not
|
|---|
| 372 | be the same. The user and group ids will only be valid for the local
|
|---|
| 373 | machine, unless a shared <smbconfoption name="idmap config * : backend"/> is configured.</para>
|
|---|
| 374 |
|
|---|
| 375 | <para>If the the Windows NT SID to UNIX user and group id mapping
|
|---|
| 376 | file is damaged or destroyed then the mappings will be lost. </para>
|
|---|
| 377 | </refsect1>
|
|---|
| 378 |
|
|---|
| 379 |
|
|---|
| 380 | <refsect1>
|
|---|
| 381 | <title>SIGNALS</title>
|
|---|
| 382 |
|
|---|
| 383 | <para>The following signals can be used to manipulate the
|
|---|
| 384 | <command>winbindd</command> daemon. </para>
|
|---|
| 385 |
|
|---|
| 386 | <variablelist>
|
|---|
| 387 | <varlistentry>
|
|---|
| 388 | <term>SIGHUP</term>
|
|---|
| 389 | <listitem><para>Reload the <citerefentry><refentrytitle>smb.conf</refentrytitle>
|
|---|
| 390 | <manvolnum>5</manvolnum></citerefentry> file and
|
|---|
| 391 | apply any parameter changes to the running
|
|---|
| 392 | version of winbindd. This signal also clears any cached
|
|---|
| 393 | user and group information. The list of other domains trusted
|
|---|
| 394 | by winbindd is also reloaded. </para></listitem>
|
|---|
| 395 | </varlistentry>
|
|---|
| 396 |
|
|---|
| 397 | <varlistentry>
|
|---|
| 398 | <term>SIGUSR2</term>
|
|---|
| 399 | <listitem><para>The SIGUSR2 signal will cause <command>
|
|---|
| 400 | winbindd</command> to write status information to the winbind
|
|---|
| 401 | log file.</para>
|
|---|
| 402 |
|
|---|
| 403 | <para>Log files are stored in the filename specified by the
|
|---|
| 404 | log file parameter.</para></listitem>
|
|---|
| 405 | </varlistentry>
|
|---|
| 406 | </variablelist>
|
|---|
| 407 | </refsect1>
|
|---|
| 408 |
|
|---|
| 409 | <refsect1>
|
|---|
| 410 | <title>FILES</title>
|
|---|
| 411 |
|
|---|
| 412 | <variablelist>
|
|---|
| 413 | <varlistentry>
|
|---|
| 414 | <term><filename>/etc/nsswitch.conf(5)</filename></term>
|
|---|
| 415 | <listitem><para>Name service switch configuration file.</para>
|
|---|
| 416 | </listitem>
|
|---|
| 417 | </varlistentry>
|
|---|
| 418 |
|
|---|
| 419 | <varlistentry>
|
|---|
| 420 | <term>/tmp/.winbindd/pipe</term>
|
|---|
| 421 | <listitem><para>The UNIX pipe over which clients communicate with
|
|---|
| 422 | the <command>winbindd</command> program. For security reasons, the
|
|---|
| 423 | winbind client will only attempt to connect to the winbindd daemon
|
|---|
| 424 | if both the <filename>/tmp/.winbindd</filename> directory
|
|---|
| 425 | and <filename>/tmp/.winbindd/pipe</filename> file are owned by
|
|---|
| 426 | root. </para></listitem>
|
|---|
| 427 | </varlistentry>
|
|---|
| 428 |
|
|---|
| 429 | <varlistentry>
|
|---|
| 430 | <term>$LOCKDIR/winbindd_privileged/pipe</term>
|
|---|
| 431 | <listitem><para>The UNIX pipe over which 'privileged' clients
|
|---|
| 432 | communicate with the <command>winbindd</command> program. For security
|
|---|
| 433 | reasons, access to some winbindd functions - like those needed by
|
|---|
| 434 | the <command>ntlm_auth</command> utility - is restricted. By default,
|
|---|
| 435 | only users in the 'root' group will get this access, however the administrator
|
|---|
| 436 | may change the group permissions on $LOCKDIR/winbindd_privileged to allow
|
|---|
| 437 | programs like 'squid' to use ntlm_auth.
|
|---|
| 438 | Note that the winbind client will only attempt to connect to the winbindd daemon
|
|---|
| 439 | if both the <filename>$LOCKDIR/winbindd_privileged</filename> directory
|
|---|
| 440 | and <filename>$LOCKDIR/winbindd_privileged/pipe</filename> file are owned by
|
|---|
| 441 | root. </para></listitem>
|
|---|
| 442 | </varlistentry>
|
|---|
| 443 |
|
|---|
| 444 | <varlistentry>
|
|---|
| 445 | <term>/lib/libnss_winbind.so.X</term>
|
|---|
| 446 | <listitem><para>Implementation of name service switch library.
|
|---|
| 447 | </para></listitem>
|
|---|
| 448 | </varlistentry>
|
|---|
| 449 |
|
|---|
| 450 | <varlistentry>
|
|---|
| 451 | <term>$LOCKDIR/winbindd_idmap.tdb</term>
|
|---|
| 452 | <listitem><para>Storage for the Windows NT rid to UNIX user/group
|
|---|
| 453 | id mapping. The lock directory is specified when Samba is initially
|
|---|
| 454 | compiled using the <parameter>--with-lockdir</parameter> option.
|
|---|
| 455 | This directory is by default <filename>/usr/local/samba/var/locks
|
|---|
| 456 | </filename>. </para></listitem>
|
|---|
| 457 | </varlistentry>
|
|---|
| 458 |
|
|---|
| 459 | <varlistentry>
|
|---|
| 460 | <term>$LOCKDIR/winbindd_cache.tdb</term>
|
|---|
| 461 | <listitem><para>Storage for cached user and group information.
|
|---|
| 462 | </para></listitem>
|
|---|
| 463 | </varlistentry>
|
|---|
| 464 | </variablelist>
|
|---|
| 465 | </refsect1>
|
|---|
| 466 |
|
|---|
| 467 |
|
|---|
| 468 | <refsect1>
|
|---|
| 469 | <title>VERSION</title>
|
|---|
| 470 |
|
|---|
| 471 | <para>This man page is correct for version 3 of
|
|---|
| 472 | the Samba suite.</para>
|
|---|
| 473 | </refsect1>
|
|---|
| 474 |
|
|---|
| 475 | <refsect1>
|
|---|
| 476 | <title>SEE ALSO</title>
|
|---|
| 477 |
|
|---|
| 478 | <para><filename>nsswitch.conf(5)</filename>, <citerefentry>
|
|---|
| 479 | <refentrytitle>samba</refentrytitle>
|
|---|
| 480 | <manvolnum>7</manvolnum></citerefentry>, <citerefentry>
|
|---|
| 481 | <refentrytitle>wbinfo</refentrytitle>
|
|---|
| 482 | <manvolnum>1</manvolnum></citerefentry>, <citerefentry>
|
|---|
| 483 | <refentrytitle>ntlm_auth</refentrytitle>
|
|---|
| 484 | <manvolnum>8</manvolnum></citerefentry>, <citerefentry>
|
|---|
| 485 | <refentrytitle>smb.conf</refentrytitle>
|
|---|
| 486 | <manvolnum>5</manvolnum></citerefentry>, <citerefentry>
|
|---|
| 487 | <refentrytitle>pam_winbind</refentrytitle>
|
|---|
| 488 | <manvolnum>8</manvolnum></citerefentry></para>
|
|---|
| 489 | </refsect1>
|
|---|
| 490 |
|
|---|
| 491 | <refsect1>
|
|---|
| 492 | <title>AUTHOR</title>
|
|---|
| 493 |
|
|---|
| 494 | <para>The original Samba software and related utilities
|
|---|
| 495 | were created by Andrew Tridgell. Samba is now developed
|
|---|
| 496 | by the Samba Team as an Open Source project similar
|
|---|
| 497 | to the way the Linux kernel is developed.</para>
|
|---|
| 498 |
|
|---|
| 499 | <para><command>wbinfo</command> and <command>winbindd</command> were
|
|---|
| 500 | written by Tim Potter.</para>
|
|---|
| 501 |
|
|---|
| 502 | <para>The conversion to DocBook for Samba 2.2 was done
|
|---|
| 503 | by Gerald Carter. The conversion to DocBook XML 4.2 for
|
|---|
| 504 | Samba 3.0 was done by Alexander Bokovoy.</para>
|
|---|
| 505 | </refsect1>
|
|---|
| 506 |
|
|---|
| 507 | </refentry>
|
|---|
