| 1 | <?xml version="1.0" encoding="iso-8859-1"?>
|
|---|
| 2 | <!DOCTYPE refentry PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
|
|---|
| 3 | <refentry id="winbindd.8">
|
|---|
| 4 |
|
|---|
| 5 | <refmeta>
|
|---|
| 6 | <refentrytitle>winbindd</refentrytitle>
|
|---|
| 7 | <manvolnum>8</manvolnum>
|
|---|
| 8 | <refmiscinfo class="source">Samba</refmiscinfo>
|
|---|
| 9 | <refmiscinfo class="manual">System Administration tools</refmiscinfo>
|
|---|
| 10 | <refmiscinfo class="version">3.6</refmiscinfo>
|
|---|
| 11 | </refmeta>
|
|---|
| 12 |
|
|---|
| 13 |
|
|---|
| 14 | <refnamediv>
|
|---|
| 15 | <refname>winbindd</refname>
|
|---|
| 16 | <refpurpose>Name Service Switch daemon for resolving names
|
|---|
| 17 | from NT servers</refpurpose>
|
|---|
| 18 | </refnamediv>
|
|---|
| 19 |
|
|---|
| 20 | <refsynopsisdiv>
|
|---|
| 21 | <cmdsynopsis>
|
|---|
| 22 | <command>winbindd</command>
|
|---|
| 23 | <arg choice="opt">-D</arg>
|
|---|
| 24 | <arg choice="opt">-F</arg>
|
|---|
| 25 | <arg choice="opt">-S</arg>
|
|---|
| 26 | <arg choice="opt">-i</arg>
|
|---|
| 27 | <arg choice="opt">-d <debug level></arg>
|
|---|
| 28 | <arg choice="opt">-s <smb config file></arg>
|
|---|
| 29 | <arg choice="opt">-n</arg>
|
|---|
| 30 | </cmdsynopsis>
|
|---|
| 31 | </refsynopsisdiv>
|
|---|
| 32 |
|
|---|
| 33 | <refsect1>
|
|---|
| 34 | <title>DESCRIPTION</title>
|
|---|
| 35 |
|
|---|
| 36 | <para>This program is part of the <citerefentry><refentrytitle>samba</refentrytitle>
|
|---|
| 37 | <manvolnum>7</manvolnum></citerefentry> suite.</para>
|
|---|
| 38 |
|
|---|
| 39 | <para><command>winbindd</command> is a daemon that provides
|
|---|
| 40 | a number of services to the Name Service Switch capability found
|
|---|
| 41 | in most modern C libraries, to arbitrary applications via PAM
|
|---|
| 42 | and <command>ntlm_auth</command> and to Samba itself.</para>
|
|---|
| 43 |
|
|---|
| 44 | <para>Even if winbind is not used for nsswitch, it still provides a
|
|---|
| 45 | service to <command>smbd</command>, <command>ntlm_auth</command>
|
|---|
| 46 | and the <command>pam_winbind.so</command> PAM module, by managing connections to
|
|---|
| 47 | domain controllers. In this configuration the
|
|---|
| 48 | <smbconfoption name="idmap config * : range"/>
|
|---|
| 49 | parameter is not required. (This is known as `netlogon proxy only mode'.)</para>
|
|---|
| 50 |
|
|---|
| 51 | <para> The Name Service Switch allows user
|
|---|
| 52 | and system information to be obtained from different databases
|
|---|
| 53 | services such as NIS or DNS. The exact behaviour can be configured
|
|---|
| 54 | through the <filename>/etc/nsswitch.conf</filename> file.
|
|---|
| 55 | Users and groups are allocated as they are resolved to a range
|
|---|
| 56 | of user and group ids specified by the administrator of the
|
|---|
| 57 | Samba system.</para>
|
|---|
| 58 |
|
|---|
| 59 | <para>The service provided by <command>winbindd</command> is called `winbind' and
|
|---|
| 60 | can be used to resolve user and group information from a
|
|---|
| 61 | Windows NT server. The service can also provide authentication
|
|---|
| 62 | services via an associated PAM module. </para>
|
|---|
| 63 |
|
|---|
| 64 | <para>
|
|---|
| 65 | The <filename>pam_winbind</filename> module supports the
|
|---|
| 66 | <parameter>auth</parameter>, <parameter>account</parameter>
|
|---|
| 67 | and <parameter>password</parameter>
|
|---|
| 68 | module-types. It should be noted that the
|
|---|
| 69 | <parameter>account</parameter> module simply performs a getpwnam() to verify that
|
|---|
| 70 | the system can obtain a uid for the user, as the domain
|
|---|
| 71 | controller has already performed access control. If the
|
|---|
| 72 | <filename>libnss_winbind</filename> library has been correctly
|
|---|
| 73 | installed, or an alternate source of names configured, this should always succeed.
|
|---|
| 74 | </para>
|
|---|
| 75 |
|
|---|
| 76 | <para>The following nsswitch databases are implemented by
|
|---|
| 77 | the winbindd service: </para>
|
|---|
| 78 |
|
|---|
| 79 | <variablelist>
|
|---|
| 80 | <varlistentry>
|
|---|
| 81 | <term>hosts</term>
|
|---|
| 82 | <listitem><para>This feature is only available on IRIX.
|
|---|
| 83 | User information traditionally stored in
|
|---|
| 84 | the <filename>hosts(5)</filename> file and used by
|
|---|
| 85 | <command>gethostbyname(3)</command> functions. Names are
|
|---|
| 86 | resolved through the WINS server or by broadcast.
|
|---|
| 87 | </para></listitem>
|
|---|
| 88 | </varlistentry>
|
|---|
| 89 |
|
|---|
| 90 | <varlistentry>
|
|---|
| 91 | <term>passwd</term>
|
|---|
| 92 | <listitem><para>User information traditionally stored in
|
|---|
| 93 | the <filename>passwd(5)</filename> file and used by
|
|---|
| 94 | <command>getpwent(3)</command> functions. </para></listitem>
|
|---|
| 95 | </varlistentry>
|
|---|
| 96 |
|
|---|
| 97 | <varlistentry>
|
|---|
| 98 | <term>group</term>
|
|---|
| 99 | <listitem><para>Group information traditionally stored in
|
|---|
| 100 | the <filename>group(5)</filename> file and used by
|
|---|
| 101 | <command>getgrent(3)</command> functions. </para></listitem>
|
|---|
| 102 | </varlistentry>
|
|---|
| 103 | </variablelist>
|
|---|
| 104 |
|
|---|
| 105 | <para>For example, the following simple configuration in the
|
|---|
| 106 | <filename>/etc/nsswitch.conf</filename> file can be used to initially
|
|---|
| 107 | resolve user and group information from <filename>/etc/passwd
|
|---|
| 108 | </filename> and <filename>/etc/group</filename> and then from the
|
|---|
| 109 | Windows NT server.
|
|---|
| 110 | </para>
|
|---|
| 111 |
|
|---|
| 112 | <programlisting>
|
|---|
| 113 | passwd: files winbind
|
|---|
| 114 | group: files winbind
|
|---|
| 115 | ## only available on IRIX: use winbind to resolve hosts:
|
|---|
| 116 | # hosts: files dns winbind
|
|---|
| 117 | ## All other NSS enabled systems should use libnss_wins.so like this:
|
|---|
| 118 | hosts: files dns wins
|
|---|
| 119 |
|
|---|
| 120 | </programlisting>
|
|---|
| 121 |
|
|---|
| 122 | <para>The following simple configuration in the
|
|---|
| 123 | <filename>/etc/nsswitch.conf</filename> file can be used to initially
|
|---|
| 124 | resolve hostnames from <filename>/etc/hosts</filename> and then from the
|
|---|
| 125 | WINS server.</para>
|
|---|
| 126 | <programlisting>
|
|---|
| 127 | hosts: files wins
|
|---|
| 128 | </programlisting>
|
|---|
| 129 |
|
|---|
| 130 | </refsect1>
|
|---|
| 131 |
|
|---|
| 132 |
|
|---|
| 133 | <refsect1>
|
|---|
| 134 | <title>OPTIONS</title>
|
|---|
| 135 |
|
|---|
| 136 | <variablelist>
|
|---|
| 137 | <varlistentry>
|
|---|
| 138 | <term>-D</term>
|
|---|
| 139 | <listitem><para>If specified, this parameter causes
|
|---|
| 140 | the server to operate as a daemon. That is, it detaches
|
|---|
| 141 | itself and runs in the background on the appropriate port.
|
|---|
| 142 | This switch is assumed if <command>winbindd</command> is
|
|---|
| 143 | executed on the command line of a shell.
|
|---|
| 144 | </para></listitem>
|
|---|
| 145 | </varlistentry>
|
|---|
| 146 |
|
|---|
| 147 | <varlistentry>
|
|---|
| 148 | <term>-F</term>
|
|---|
| 149 | <listitem><para>If specified, this parameter causes
|
|---|
| 150 | the main <command>winbindd</command> process to not daemonize,
|
|---|
| 151 | i.e. double-fork and disassociate with the terminal.
|
|---|
| 152 | Child processes are still created as normal to service
|
|---|
| 153 | each connection request, but the main process does not
|
|---|
| 154 | exit. This operation mode is suitable for running
|
|---|
| 155 | <command>winbindd</command> under process supervisors such
|
|---|
| 156 | as <command>supervise</command> and <command>svscan</command>
|
|---|
| 157 | from Daniel J. Bernstein's <command>daemontools</command>
|
|---|
| 158 | package, or the AIX process monitor.
|
|---|
| 159 | </para></listitem>
|
|---|
| 160 | </varlistentry>
|
|---|
| 161 |
|
|---|
| 162 | <varlistentry>
|
|---|
| 163 | <term>-S</term>
|
|---|
| 164 | <listitem><para>If specified, this parameter causes
|
|---|
| 165 | <command>winbindd</command> to log to standard output rather
|
|---|
| 166 | than a file.</para></listitem>
|
|---|
| 167 | </varlistentry>
|
|---|
| 168 |
|
|---|
| 169 | &stdarg.server.debug;
|
|---|
| 170 | &popt.common.samba;
|
|---|
| 171 | &stdarg.help;
|
|---|
| 172 |
|
|---|
| 173 | <varlistentry>
|
|---|
| 174 | <term>-i</term>
|
|---|
| 175 | <listitem><para>Tells <command>winbindd</command> to not
|
|---|
| 176 | become a daemon and detach from the current terminal. This
|
|---|
| 177 | option is used by developers when interactive debugging
|
|---|
| 178 | of <command>winbindd</command> is required.
|
|---|
| 179 | <command>winbindd</command> also logs to standard output,
|
|---|
| 180 | as if the <command>-S</command> parameter had been given.
|
|---|
| 181 | </para></listitem>
|
|---|
| 182 | </varlistentry>
|
|---|
| 183 |
|
|---|
| 184 | <varlistentry>
|
|---|
| 185 | <term>-n</term>
|
|---|
| 186 | <listitem><para>Disable caching. This means winbindd will
|
|---|
| 187 | always have to wait for a response from the domain controller
|
|---|
| 188 | before it can respond to a client and this thus makes things
|
|---|
| 189 | slower. The results will however be more accurate, since
|
|---|
| 190 | results from the cache might not be up-to-date. This
|
|---|
| 191 | might also temporarily hang winbindd if the DC doesn't respond.
|
|---|
| 192 | </para></listitem>
|
|---|
| 193 | </varlistentry>
|
|---|
| 194 |
|
|---|
| 195 | </variablelist>
|
|---|
| 196 | </refsect1>
|
|---|
| 197 |
|
|---|
| 198 |
|
|---|
| 199 | <refsect1>
|
|---|
| 200 | <title>NAME AND ID RESOLUTION</title>
|
|---|
| 201 |
|
|---|
| 202 | <para>Users and groups on a Windows NT server are assigned
|
|---|
| 203 | a security id (SID) which is globally unique when the
|
|---|
| 204 | user or group is created. To convert the Windows NT user or group
|
|---|
| 205 | into a unix user or group, a mapping between SIDs and unix user
|
|---|
| 206 | and group ids is required. This is one of the jobs that <command>
|
|---|
| 207 | winbindd</command> performs. </para>
|
|---|
| 208 |
|
|---|
| 209 | <para>As winbindd users and groups are resolved from a server, user
|
|---|
| 210 | and group ids are allocated from a specified range. This
|
|---|
| 211 | is done on a first come, first served basis, although all existing
|
|---|
| 212 | users and groups will be mapped as soon as a client performs a user
|
|---|
| 213 | or group enumeration command. The allocated unix ids are stored
|
|---|
| 214 | in a database and will be remembered. </para>
|
|---|
| 215 |
|
|---|
| 216 | <para>WARNING: The SID to unix id database is the only location
|
|---|
| 217 | where the user and group mappings are stored by winbindd. If this
|
|---|
| 218 | store is deleted or corrupted, there is no way for winbindd to
|
|---|
| 219 | determine which user and group ids correspond to Windows NT user
|
|---|
| 220 | and group rids. </para>
|
|---|
| 221 |
|
|---|
| 222 | </refsect1>
|
|---|
| 223 |
|
|---|
| 224 |
|
|---|
| 225 | <refsect1>
|
|---|
| 226 | <title>CONFIGURATION</title>
|
|---|
| 227 |
|
|---|
| 228 | <para>Configuration of the <command>winbindd</command> daemon
|
|---|
| 229 | is done through configuration parameters in the <citerefentry>
|
|---|
| 230 | <refentrytitle>smb.conf</refentrytitle><manvolnum>5</manvolnum>
|
|---|
| 231 | </citerefentry> file. All parameters should be specified in the
|
|---|
| 232 | [global] section of smb.conf. </para>
|
|---|
| 233 |
|
|---|
| 234 | <itemizedlist>
|
|---|
| 235 | <listitem><para>
|
|---|
| 236 | <smbconfoption name="winbind separator"/></para></listitem>
|
|---|
| 237 | <listitem><para>
|
|---|
| 238 | <smbconfoption name="idmap config * : range"/></para></listitem>
|
|---|
| 239 | <listitem><para>
|
|---|
| 240 | <smbconfoption name="idmap config * : backend"/></para></listitem>
|
|---|
| 241 | <listitem><para>
|
|---|
| 242 | <smbconfoption name="winbind cache time"/></para></listitem>
|
|---|
| 243 | <listitem><para>
|
|---|
| 244 | <smbconfoption name="winbind enum users"/></para></listitem>
|
|---|
| 245 | <listitem><para>
|
|---|
| 246 | <smbconfoption name="winbind enum groups"/></para></listitem>
|
|---|
| 247 | <listitem><para>
|
|---|
| 248 | <smbconfoption name="template homedir"/></para></listitem>
|
|---|
| 249 | <listitem><para>
|
|---|
| 250 | <smbconfoption name="template shell"/></para></listitem>
|
|---|
| 251 | <listitem><para>
|
|---|
| 252 | <smbconfoption name="winbind use default domain"/></para></listitem>
|
|---|
| 253 | <listitem><para>
|
|---|
| 254 | <smbconfoption name="winbind: rpc only"/>
|
|---|
| 255 | Setting this parameter forces winbindd to use RPC
|
|---|
| 256 | instead of LDAP to retrieve information from Domain
|
|---|
| 257 | Controllers.
|
|---|
| 258 | </para></listitem>
|
|---|
| 259 | </itemizedlist>
|
|---|
| 260 | </refsect1>
|
|---|
| 261 |
|
|---|
| 262 |
|
|---|
| 263 | <refsect1>
|
|---|
| 264 | <title>EXAMPLE SETUP</title>
|
|---|
| 265 |
|
|---|
| 266 | <para>
|
|---|
| 267 | To setup winbindd for user and group lookups plus
|
|---|
| 268 | authentication from a domain controller use something like the
|
|---|
| 269 | following setup. This was tested on an early Red Hat Linux box.
|
|---|
| 270 | </para>
|
|---|
| 271 |
|
|---|
| 272 | <para>In <filename>/etc/nsswitch.conf</filename> put the
|
|---|
| 273 | following:
|
|---|
| 274 | <programlisting>
|
|---|
| 275 | passwd: files winbind
|
|---|
| 276 | group: files winbind
|
|---|
| 277 | </programlisting>
|
|---|
| 278 | </para>
|
|---|
| 279 |
|
|---|
| 280 | <para>In <filename>/etc/pam.d/*</filename> replace the <parameter>
|
|---|
| 281 | auth</parameter> lines with something like this:
|
|---|
| 282 | <programlisting>
|
|---|
| 283 | auth required /lib/security/pam_securetty.so
|
|---|
| 284 | auth required /lib/security/pam_nologin.so
|
|---|
| 285 | auth sufficient /lib/security/pam_winbind.so
|
|---|
| 286 | auth required /lib/security/pam_unix.so \
|
|---|
| 287 | use_first_pass shadow nullok
|
|---|
| 288 | </programlisting>
|
|---|
| 289 | </para>
|
|---|
| 290 |
|
|---|
| 291 | <note><para>
|
|---|
| 292 | The PAM module pam_unix has recently replaced the module pam_pwdb.
|
|---|
| 293 | Some Linux systems use the module pam_unix2 in place of pam_unix.
|
|---|
| 294 | </para></note>
|
|---|
| 295 |
|
|---|
| 296 | <para>Note in particular the use of the <parameter>sufficient
|
|---|
| 297 | </parameter> keyword and the <parameter>use_first_pass</parameter> keyword. </para>
|
|---|
| 298 |
|
|---|
| 299 | <para>Now replace the account lines with this: </para>
|
|---|
| 300 |
|
|---|
| 301 | <para><command>account required /lib/security/pam_winbind.so
|
|---|
| 302 | </command></para>
|
|---|
| 303 |
|
|---|
| 304 | <para>The next step is to join the domain. To do that use the
|
|---|
| 305 | <command>net</command> program like this: </para>
|
|---|
| 306 |
|
|---|
| 307 | <para><command>net join -S PDC -U Administrator</command></para>
|
|---|
| 308 |
|
|---|
| 309 | <para>The username after the <parameter>-U</parameter> can be any
|
|---|
| 310 | Domain user that has administrator privileges on the machine.
|
|---|
| 311 | Substitute the name or IP of your PDC for "PDC".</para>
|
|---|
| 312 |
|
|---|
| 313 | <para>Next copy <filename>libnss_winbind.so</filename> to
|
|---|
| 314 | <filename>/lib</filename> and <filename>pam_winbind.so
|
|---|
| 315 | </filename> to <filename>/lib/security</filename>. A symbolic link needs to be
|
|---|
| 316 | made from <filename>/lib/libnss_winbind.so</filename> to
|
|---|
| 317 | <filename>/lib/libnss_winbind.so.2</filename>. If you are using an
|
|---|
| 318 | older version of glibc then the target of the link should be
|
|---|
| 319 | <filename>/lib/libnss_winbind.so.1</filename>.</para>
|
|---|
| 320 |
|
|---|
| 321 | <para>Finally, setup a <citerefentry><refentrytitle>smb.conf</refentrytitle>
|
|---|
| 322 | <manvolnum>5</manvolnum></citerefentry> containing directives like the
|
|---|
| 323 | following:
|
|---|
| 324 | <programlisting>
|
|---|
| 325 | [global]
|
|---|
| 326 | winbind separator = +
|
|---|
| 327 | winbind cache time = 10
|
|---|
| 328 | template shell = /bin/bash
|
|---|
| 329 | template homedir = /home/%D/%U
|
|---|
| 330 | idmap config * : range = 10000-20000
|
|---|
| 331 | workgroup = DOMAIN
|
|---|
| 332 | security = domain
|
|---|
| 333 | password server = *
|
|---|
| 334 | </programlisting></para>
|
|---|
| 335 |
|
|---|
| 336 |
|
|---|
| 337 | <para>Now start winbindd and you should find that your user and
|
|---|
| 338 | group database is expanded to include your NT users and groups,
|
|---|
| 339 | and that you can login to your unix box as a domain user, using
|
|---|
| 340 | the DOMAIN+user syntax for the username. You may wish to use the
|
|---|
| 341 | commands <command>getent passwd</command> and <command>getent group
|
|---|
| 342 | </command> to confirm the correct operation of winbindd.</para>
|
|---|
| 343 | </refsect1>
|
|---|
| 344 |
|
|---|
| 345 |
|
|---|
| 346 | <refsect1>
|
|---|
| 347 | <title>NOTES</title>
|
|---|
| 348 |
|
|---|
| 349 | <para>The following notes are useful when configuring and
|
|---|
| 350 | running <command>winbindd</command>: </para>
|
|---|
| 351 |
|
|---|
| 352 | <para><citerefentry><refentrytitle>nmbd</refentrytitle>
|
|---|
| 353 | <manvolnum>8</manvolnum></citerefentry> must be running on the local machine
|
|---|
| 354 | for <command>winbindd</command> to work. </para>
|
|---|
| 355 |
|
|---|
| 356 | <para>PAM is really easy to misconfigure. Make sure you know what
|
|---|
| 357 | you are doing when modifying PAM configuration files. It is possible
|
|---|
| 358 | to set up PAM such that you can no longer log into your system. </para>
|
|---|
| 359 |
|
|---|
| 360 | <para>If more than one UNIX machine is running <command>winbindd</command>,
|
|---|
| 361 | then in general the user and groups ids allocated by winbindd will not
|
|---|
| 362 | be the same. The user and group ids will only be valid for the local
|
|---|
| 363 | machine, unless a shared <smbconfoption name="idmap config * : backend"/> is configured.</para>
|
|---|
| 364 |
|
|---|
| 365 | <para>If the the Windows NT SID to UNIX user and group id mapping
|
|---|
| 366 | file is damaged or destroyed then the mappings will be lost. </para>
|
|---|
| 367 | </refsect1>
|
|---|
| 368 |
|
|---|
| 369 |
|
|---|
| 370 | <refsect1>
|
|---|
| 371 | <title>SIGNALS</title>
|
|---|
| 372 |
|
|---|
| 373 | <para>The following signals can be used to manipulate the
|
|---|
| 374 | <command>winbindd</command> daemon. </para>
|
|---|
| 375 |
|
|---|
| 376 | <variablelist>
|
|---|
| 377 | <varlistentry>
|
|---|
| 378 | <term>SIGHUP</term>
|
|---|
| 379 | <listitem><para>Reload the <citerefentry><refentrytitle>smb.conf</refentrytitle>
|
|---|
| 380 | <manvolnum>5</manvolnum></citerefentry> file and
|
|---|
| 381 | apply any parameter changes to the running
|
|---|
| 382 | version of winbindd. This signal also clears any cached
|
|---|
| 383 | user and group information. The list of other domains trusted
|
|---|
| 384 | by winbindd is also reloaded. </para></listitem>
|
|---|
| 385 | </varlistentry>
|
|---|
| 386 |
|
|---|
| 387 | <varlistentry>
|
|---|
| 388 | <term>SIGUSR2</term>
|
|---|
| 389 | <listitem><para>The SIGUSR2 signal will cause <command>
|
|---|
| 390 | winbindd</command> to write status information to the winbind
|
|---|
| 391 | log file.</para>
|
|---|
| 392 |
|
|---|
| 393 | <para>Log files are stored in the filename specified by the
|
|---|
| 394 | log file parameter.</para></listitem>
|
|---|
| 395 | </varlistentry>
|
|---|
| 396 | </variablelist>
|
|---|
| 397 | </refsect1>
|
|---|
| 398 |
|
|---|
| 399 | <refsect1>
|
|---|
| 400 | <title>FILES</title>
|
|---|
| 401 |
|
|---|
| 402 | <variablelist>
|
|---|
| 403 | <varlistentry>
|
|---|
| 404 | <term><filename>/etc/nsswitch.conf(5)</filename></term>
|
|---|
| 405 | <listitem><para>Name service switch configuration file.</para>
|
|---|
| 406 | </listitem>
|
|---|
| 407 | </varlistentry>
|
|---|
| 408 |
|
|---|
| 409 | <varlistentry>
|
|---|
| 410 | <term>/tmp/.winbindd/pipe</term>
|
|---|
| 411 | <listitem><para>The UNIX pipe over which clients communicate with
|
|---|
| 412 | the <command>winbindd</command> program. For security reasons, the
|
|---|
| 413 | winbind client will only attempt to connect to the winbindd daemon
|
|---|
| 414 | if both the <filename>/tmp/.winbindd</filename> directory
|
|---|
| 415 | and <filename>/tmp/.winbindd/pipe</filename> file are owned by
|
|---|
| 416 | root. </para></listitem>
|
|---|
| 417 | </varlistentry>
|
|---|
| 418 |
|
|---|
| 419 | <varlistentry>
|
|---|
| 420 | <term>$LOCKDIR/winbindd_privileged/pipe</term>
|
|---|
| 421 | <listitem><para>The UNIX pipe over which 'privileged' clients
|
|---|
| 422 | communicate with the <command>winbindd</command> program. For security
|
|---|
| 423 | reasons, access to some winbindd functions - like those needed by
|
|---|
| 424 | the <command>ntlm_auth</command> utility - is restricted. By default,
|
|---|
| 425 | only users in the 'root' group will get this access, however the administrator
|
|---|
| 426 | may change the group permissions on $LOCKDIR/winbindd_privileged to allow
|
|---|
| 427 | programs like 'squid' to use ntlm_auth.
|
|---|
| 428 | Note that the winbind client will only attempt to connect to the winbindd daemon
|
|---|
| 429 | if both the <filename>$LOCKDIR/winbindd_privileged</filename> directory
|
|---|
| 430 | and <filename>$LOCKDIR/winbindd_privileged/pipe</filename> file are owned by
|
|---|
| 431 | root. </para></listitem>
|
|---|
| 432 | </varlistentry>
|
|---|
| 433 |
|
|---|
| 434 | <varlistentry>
|
|---|
| 435 | <term>/lib/libnss_winbind.so.X</term>
|
|---|
| 436 | <listitem><para>Implementation of name service switch library.
|
|---|
| 437 | </para></listitem>
|
|---|
| 438 | </varlistentry>
|
|---|
| 439 |
|
|---|
| 440 | <varlistentry>
|
|---|
| 441 | <term>$LOCKDIR/winbindd_idmap.tdb</term>
|
|---|
| 442 | <listitem><para>Storage for the Windows NT rid to UNIX user/group
|
|---|
| 443 | id mapping. The lock directory is specified when Samba is initially
|
|---|
| 444 | compiled using the <parameter>--with-lockdir</parameter> option.
|
|---|
| 445 | This directory is by default <filename>/usr/local/samba/var/locks
|
|---|
| 446 | </filename>. </para></listitem>
|
|---|
| 447 | </varlistentry>
|
|---|
| 448 |
|
|---|
| 449 | <varlistentry>
|
|---|
| 450 | <term>$LOCKDIR/winbindd_cache.tdb</term>
|
|---|
| 451 | <listitem><para>Storage for cached user and group information.
|
|---|
| 452 | </para></listitem>
|
|---|
| 453 | </varlistentry>
|
|---|
| 454 | </variablelist>
|
|---|
| 455 | </refsect1>
|
|---|
| 456 |
|
|---|
| 457 |
|
|---|
| 458 | <refsect1>
|
|---|
| 459 | <title>VERSION</title>
|
|---|
| 460 |
|
|---|
| 461 | <para>This man page is correct for version 3 of
|
|---|
| 462 | the Samba suite.</para>
|
|---|
| 463 | </refsect1>
|
|---|
| 464 |
|
|---|
| 465 | <refsect1>
|
|---|
| 466 | <title>SEE ALSO</title>
|
|---|
| 467 |
|
|---|
| 468 | <para><filename>nsswitch.conf(5)</filename>, <citerefentry>
|
|---|
| 469 | <refentrytitle>samba</refentrytitle>
|
|---|
| 470 | <manvolnum>7</manvolnum></citerefentry>, <citerefentry>
|
|---|
| 471 | <refentrytitle>wbinfo</refentrytitle>
|
|---|
| 472 | <manvolnum>1</manvolnum></citerefentry>, <citerefentry>
|
|---|
| 473 | <refentrytitle>ntlm_auth</refentrytitle>
|
|---|
| 474 | <manvolnum>8</manvolnum></citerefentry>, <citerefentry>
|
|---|
| 475 | <refentrytitle>smb.conf</refentrytitle>
|
|---|
| 476 | <manvolnum>5</manvolnum></citerefentry>, <citerefentry>
|
|---|
| 477 | <refentrytitle>pam_winbind</refentrytitle>
|
|---|
| 478 | <manvolnum>8</manvolnum></citerefentry></para>
|
|---|
| 479 | </refsect1>
|
|---|
| 480 |
|
|---|
| 481 | <refsect1>
|
|---|
| 482 | <title>AUTHOR</title>
|
|---|
| 483 |
|
|---|
| 484 | <para>The original Samba software and related utilities
|
|---|
| 485 | were created by Andrew Tridgell. Samba is now developed
|
|---|
| 486 | by the Samba Team as an Open Source project similar
|
|---|
| 487 | to the way the Linux kernel is developed.</para>
|
|---|
| 488 |
|
|---|
| 489 | <para><command>wbinfo</command> and <command>winbindd</command> were
|
|---|
| 490 | written by Tim Potter.</para>
|
|---|
| 491 |
|
|---|
| 492 | <para>The conversion to DocBook for Samba 2.2 was done
|
|---|
| 493 | by Gerald Carter. The conversion to DocBook XML 4.2 for
|
|---|
| 494 | Samba 3.0 was done by Alexander Bokovoy.</para>
|
|---|
| 495 | </refsect1>
|
|---|
| 496 |
|
|---|
| 497 | </refentry>
|
|---|
