| 1 | <?xml version="1.0" encoding="iso-8859-1"?>
|
|---|
| 2 | <!DOCTYPE refentry PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
|
|---|
| 3 | <refentry id="winbindd.8">
|
|---|
| 4 |
|
|---|
| 5 | <refmeta>
|
|---|
| 6 | <refentrytitle>winbindd</refentrytitle>
|
|---|
| 7 | <manvolnum>8</manvolnum>
|
|---|
| 8 | <refmiscinfo class="source">Samba</refmiscinfo>
|
|---|
| 9 | <refmiscinfo class="manual">System Administration tools</refmiscinfo>
|
|---|
| 10 | <refmiscinfo class="version">4.4</refmiscinfo>
|
|---|
| 11 | </refmeta>
|
|---|
| 12 |
|
|---|
| 13 |
|
|---|
| 14 | <refnamediv>
|
|---|
| 15 | <refname>winbindd</refname>
|
|---|
| 16 | <refpurpose>Name Service Switch daemon for resolving names
|
|---|
| 17 | from NT servers</refpurpose>
|
|---|
| 18 | </refnamediv>
|
|---|
| 19 |
|
|---|
| 20 | <refsynopsisdiv>
|
|---|
| 21 | <cmdsynopsis>
|
|---|
| 22 | <command>winbindd</command>
|
|---|
| 23 | <arg choice="opt">-D|--daemon</arg>
|
|---|
| 24 | <arg choice="opt">-F|--foreground</arg>
|
|---|
| 25 | <arg choice="opt">-S|--stdout</arg>
|
|---|
| 26 | <arg choice="opt">-i|--interactive</arg>
|
|---|
| 27 | <arg choice="opt">-d <debug level></arg>
|
|---|
| 28 | <arg choice="opt">-s <smb config file></arg>
|
|---|
| 29 | <arg choice="opt">-n|--no-caching</arg>
|
|---|
| 30 | <arg choice="opt">--no-process-group</arg>
|
|---|
| 31 | </cmdsynopsis>
|
|---|
| 32 | </refsynopsisdiv>
|
|---|
| 33 |
|
|---|
| 34 | <refsect1>
|
|---|
| 35 | <title>DESCRIPTION</title>
|
|---|
| 36 |
|
|---|
| 37 | <para>This program is part of the <citerefentry><refentrytitle>samba</refentrytitle>
|
|---|
| 38 | <manvolnum>7</manvolnum></citerefentry> suite.</para>
|
|---|
| 39 |
|
|---|
| 40 | <para><command>winbindd</command> is a daemon that provides
|
|---|
| 41 | a number of services to the Name Service Switch capability found
|
|---|
| 42 | in most modern C libraries, to arbitrary applications via PAM
|
|---|
| 43 | and <command>ntlm_auth</command> and to Samba itself.</para>
|
|---|
| 44 |
|
|---|
| 45 | <para>Even if winbind is not used for nsswitch, it still provides a
|
|---|
| 46 | service to <command>smbd</command>, <command>ntlm_auth</command>
|
|---|
| 47 | and the <command>pam_winbind.so</command> PAM module, by managing connections to
|
|---|
| 48 | domain controllers. In this configuration the
|
|---|
| 49 | <smbconfoption name="idmap config * : range"/>
|
|---|
| 50 | parameter is not required. (This is known as `netlogon proxy only mode'.)</para>
|
|---|
| 51 |
|
|---|
| 52 | <para> The Name Service Switch allows user
|
|---|
| 53 | and system information to be obtained from different databases
|
|---|
| 54 | services such as NIS or DNS. The exact behaviour can be configured
|
|---|
| 55 | through the <filename>/etc/nsswitch.conf</filename> file.
|
|---|
| 56 | Users and groups are allocated as they are resolved to a range
|
|---|
| 57 | of user and group ids specified by the administrator of the
|
|---|
| 58 | Samba system.</para>
|
|---|
| 59 |
|
|---|
| 60 | <para>The service provided by <command>winbindd</command> is called `winbind' and
|
|---|
| 61 | can be used to resolve user and group information from a
|
|---|
| 62 | Windows NT server. The service can also provide authentication
|
|---|
| 63 | services via an associated PAM module. </para>
|
|---|
| 64 |
|
|---|
| 65 | <para>
|
|---|
| 66 | The <filename>pam_winbind</filename> module supports the
|
|---|
| 67 | <parameter>auth</parameter>, <parameter>account</parameter>
|
|---|
| 68 | and <parameter>password</parameter>
|
|---|
| 69 | module-types. It should be noted that the
|
|---|
| 70 | <parameter>account</parameter> module simply performs a getpwnam() to verify that
|
|---|
| 71 | the system can obtain a uid for the user, as the domain
|
|---|
| 72 | controller has already performed access control. If the
|
|---|
| 73 | <filename>libnss_winbind</filename> library has been correctly
|
|---|
| 74 | installed, or an alternate source of names configured, this should always succeed.
|
|---|
| 75 | </para>
|
|---|
| 76 |
|
|---|
| 77 | <para>The following nsswitch databases are implemented by
|
|---|
| 78 | the winbindd service: </para>
|
|---|
| 79 |
|
|---|
| 80 | <variablelist>
|
|---|
| 81 | <varlistentry>
|
|---|
| 82 | <term>hosts</term>
|
|---|
| 83 | <listitem><para>This feature is only available on IRIX.
|
|---|
| 84 | User information traditionally stored in
|
|---|
| 85 | the <filename>hosts(5)</filename> file and used by
|
|---|
| 86 | <command>gethostbyname(3)</command> functions. Names are
|
|---|
| 87 | resolved through the WINS server or by broadcast.
|
|---|
| 88 | </para></listitem>
|
|---|
| 89 | </varlistentry>
|
|---|
| 90 |
|
|---|
| 91 | <varlistentry>
|
|---|
| 92 | <term>passwd</term>
|
|---|
| 93 | <listitem><para>User information traditionally stored in
|
|---|
| 94 | the <filename>passwd(5)</filename> file and used by
|
|---|
| 95 | <command>getpwent(3)</command> functions. </para></listitem>
|
|---|
| 96 | </varlistentry>
|
|---|
| 97 |
|
|---|
| 98 | <varlistentry>
|
|---|
| 99 | <term>group</term>
|
|---|
| 100 | <listitem><para>Group information traditionally stored in
|
|---|
| 101 | the <filename>group(5)</filename> file and used by
|
|---|
| 102 | <command>getgrent(3)</command> functions. </para></listitem>
|
|---|
| 103 | </varlistentry>
|
|---|
| 104 | </variablelist>
|
|---|
| 105 |
|
|---|
| 106 | <para>For example, the following simple configuration in the
|
|---|
| 107 | <filename>/etc/nsswitch.conf</filename> file can be used to initially
|
|---|
| 108 | resolve user and group information from <filename>/etc/passwd
|
|---|
| 109 | </filename> and <filename>/etc/group</filename> and then from the
|
|---|
| 110 | Windows NT server.
|
|---|
| 111 | </para>
|
|---|
| 112 |
|
|---|
| 113 | <programlisting>
|
|---|
| 114 | passwd: files winbind
|
|---|
| 115 | group: files winbind
|
|---|
| 116 | ## only available on IRIX: use winbind to resolve hosts:
|
|---|
| 117 | # hosts: files dns winbind
|
|---|
| 118 | ## All other NSS enabled systems should use libnss_wins.so like this:
|
|---|
| 119 | hosts: files dns wins
|
|---|
| 120 |
|
|---|
| 121 | </programlisting>
|
|---|
| 122 |
|
|---|
| 123 | <para>The following simple configuration in the
|
|---|
| 124 | <filename>/etc/nsswitch.conf</filename> file can be used to initially
|
|---|
| 125 | resolve hostnames from <filename>/etc/hosts</filename> and then from the
|
|---|
| 126 | WINS server.</para>
|
|---|
| 127 | <programlisting>
|
|---|
| 128 | hosts: files wins
|
|---|
| 129 | </programlisting>
|
|---|
| 130 |
|
|---|
| 131 | </refsect1>
|
|---|
| 132 |
|
|---|
| 133 |
|
|---|
| 134 | <refsect1>
|
|---|
| 135 | <title>OPTIONS</title>
|
|---|
| 136 |
|
|---|
| 137 | <variablelist>
|
|---|
| 138 | <varlistentry>
|
|---|
| 139 | <term>-D|--daemon</term>
|
|---|
| 140 | <listitem><para>If specified, this parameter causes
|
|---|
| 141 | the server to operate as a daemon. That is, it detaches
|
|---|
| 142 | itself and runs in the background on the appropriate port.
|
|---|
| 143 | This switch is assumed if <command>winbindd</command> is
|
|---|
| 144 | executed on the command line of a shell.
|
|---|
| 145 | </para></listitem>
|
|---|
| 146 | </varlistentry>
|
|---|
| 147 |
|
|---|
| 148 | <varlistentry>
|
|---|
| 149 | <term>-F|--foreground</term>
|
|---|
| 150 | <listitem><para>If specified, this parameter causes
|
|---|
| 151 | the main <command>winbindd</command> process to not daemonize,
|
|---|
| 152 | i.e. double-fork and disassociate with the terminal.
|
|---|
| 153 | Child processes are still created as normal to service
|
|---|
| 154 | each connection request, but the main process does not
|
|---|
| 155 | exit. This operation mode is suitable for running
|
|---|
| 156 | <command>winbindd</command> under process supervisors such
|
|---|
| 157 | as <command>supervise</command> and <command>svscan</command>
|
|---|
| 158 | from Daniel J. Bernstein's <command>daemontools</command>
|
|---|
| 159 | package, or the AIX process monitor.
|
|---|
| 160 | </para></listitem>
|
|---|
| 161 | </varlistentry>
|
|---|
| 162 |
|
|---|
| 163 | <varlistentry>
|
|---|
| 164 | <term>-S|--stdout</term>
|
|---|
| 165 | <listitem><para>If specified, this parameter causes
|
|---|
| 166 | <command>winbindd</command> to log to standard output rather
|
|---|
| 167 | than a file.</para></listitem>
|
|---|
| 168 | </varlistentry>
|
|---|
| 169 |
|
|---|
| 170 | &stdarg.server.debug;
|
|---|
| 171 | &popt.common.samba;
|
|---|
| 172 | &popt.autohelp;
|
|---|
| 173 |
|
|---|
| 174 | <varlistentry>
|
|---|
| 175 | <term>-i|--interactive</term>
|
|---|
| 176 | <listitem><para>Tells <command>winbindd</command> to not
|
|---|
| 177 | become a daemon and detach from the current terminal. This
|
|---|
| 178 | option is used by developers when interactive debugging
|
|---|
| 179 | of <command>winbindd</command> is required.
|
|---|
| 180 | <command>winbindd</command> also logs to standard output,
|
|---|
| 181 | as if the <command>-S</command> parameter had been given.
|
|---|
| 182 | </para></listitem>
|
|---|
| 183 | </varlistentry>
|
|---|
| 184 |
|
|---|
| 185 | <varlistentry>
|
|---|
| 186 | <term>-n|--no-caching</term>
|
|---|
| 187 | <listitem><para>Disable some caching. This means winbindd will
|
|---|
| 188 | often have to wait for a response from the domain controller
|
|---|
| 189 | before it can respond to a client and this thus makes things
|
|---|
| 190 | slower. The results will however be more accurate, since
|
|---|
| 191 | results from the cache might not be up-to-date. This
|
|---|
| 192 | might also temporarily hang winbindd if the DC doesn't respond.
|
|---|
| 193 | This does not disable the samlogon cache, which is required for
|
|---|
| 194 | group membership tracking in trusted environments.
|
|---|
| 195 | </para></listitem>
|
|---|
| 196 | </varlistentry>
|
|---|
| 197 |
|
|---|
| 198 | <varlistentry>
|
|---|
| 199 | <term>--no-process-group</term>
|
|---|
| 200 | <listitem><para>Do not create a new process group for winbindd.
|
|---|
| 201 | </para></listitem>
|
|---|
| 202 | </varlistentry>
|
|---|
| 203 |
|
|---|
| 204 | </variablelist>
|
|---|
| 205 | </refsect1>
|
|---|
| 206 |
|
|---|
| 207 |
|
|---|
| 208 | <refsect1>
|
|---|
| 209 | <title>NAME AND ID RESOLUTION</title>
|
|---|
| 210 |
|
|---|
| 211 | <para>Users and groups on a Windows NT server are assigned
|
|---|
| 212 | a security id (SID) which is globally unique when the
|
|---|
| 213 | user or group is created. To convert the Windows NT user or group
|
|---|
| 214 | into a unix user or group, a mapping between SIDs and unix user
|
|---|
| 215 | and group ids is required. This is one of the jobs that <command>
|
|---|
| 216 | winbindd</command> performs. </para>
|
|---|
| 217 |
|
|---|
| 218 | <para>As winbindd users and groups are resolved from a server, user
|
|---|
| 219 | and group ids are allocated from a specified range. This
|
|---|
| 220 | is done on a first come, first served basis, although all existing
|
|---|
| 221 | users and groups will be mapped as soon as a client performs a user
|
|---|
| 222 | or group enumeration command. The allocated unix ids are stored
|
|---|
| 223 | in a database and will be remembered. </para>
|
|---|
| 224 |
|
|---|
| 225 | <para>WARNING: The SID to unix id database is the only location
|
|---|
| 226 | where the user and group mappings are stored by winbindd. If this
|
|---|
| 227 | store is deleted or corrupted, there is no way for winbindd to
|
|---|
| 228 | determine which user and group ids correspond to Windows NT user
|
|---|
| 229 | and group rids. </para>
|
|---|
| 230 |
|
|---|
| 231 | </refsect1>
|
|---|
| 232 |
|
|---|
| 233 |
|
|---|
| 234 | <refsect1>
|
|---|
| 235 | <title>CONFIGURATION</title>
|
|---|
| 236 |
|
|---|
| 237 | <para>Configuration of the <command>winbindd</command> daemon
|
|---|
| 238 | is done through configuration parameters in the <citerefentry>
|
|---|
| 239 | <refentrytitle>smb.conf</refentrytitle><manvolnum>5</manvolnum>
|
|---|
| 240 | </citerefentry> file. All parameters should be specified in the
|
|---|
| 241 | [global] section of smb.conf. </para>
|
|---|
| 242 |
|
|---|
| 243 | <itemizedlist>
|
|---|
| 244 | <listitem><para>
|
|---|
| 245 | <smbconfoption name="winbind separator"/></para></listitem>
|
|---|
| 246 | <listitem><para>
|
|---|
| 247 | <smbconfoption name="idmap config * : range"/></para></listitem>
|
|---|
| 248 | <listitem><para>
|
|---|
| 249 | <smbconfoption name="idmap config * : backend"/></para></listitem>
|
|---|
| 250 | <listitem><para>
|
|---|
| 251 | <smbconfoption name="winbind cache time"/></para></listitem>
|
|---|
| 252 | <listitem><para>
|
|---|
| 253 | <smbconfoption name="winbind enum users"/></para></listitem>
|
|---|
| 254 | <listitem><para>
|
|---|
| 255 | <smbconfoption name="winbind enum groups"/></para></listitem>
|
|---|
| 256 | <listitem><para>
|
|---|
| 257 | <smbconfoption name="template homedir"/></para></listitem>
|
|---|
| 258 | <listitem><para>
|
|---|
| 259 | <smbconfoption name="template shell"/></para></listitem>
|
|---|
| 260 | <listitem><para>
|
|---|
| 261 | <smbconfoption name="winbind use default domain"/></para></listitem>
|
|---|
| 262 | <listitem><para>
|
|---|
| 263 | <smbconfoption name="winbind: rpc only"/>
|
|---|
| 264 | Setting this parameter forces winbindd to use RPC
|
|---|
| 265 | instead of LDAP to retrieve information from Domain
|
|---|
| 266 | Controllers.
|
|---|
| 267 | </para></listitem>
|
|---|
| 268 | </itemizedlist>
|
|---|
| 269 | </refsect1>
|
|---|
| 270 |
|
|---|
| 271 |
|
|---|
| 272 | <refsect1>
|
|---|
| 273 | <title>EXAMPLE SETUP</title>
|
|---|
| 274 |
|
|---|
| 275 | <para>
|
|---|
| 276 | To setup winbindd for user and group lookups plus
|
|---|
| 277 | authentication from a domain controller use something like the
|
|---|
| 278 | following setup. This was tested on an early Red Hat Linux box.
|
|---|
| 279 | </para>
|
|---|
| 280 |
|
|---|
| 281 | <para>In <filename>/etc/nsswitch.conf</filename> put the
|
|---|
| 282 | following:
|
|---|
| 283 | <programlisting>
|
|---|
| 284 | passwd: files winbind
|
|---|
| 285 | group: files winbind
|
|---|
| 286 | </programlisting>
|
|---|
| 287 | </para>
|
|---|
| 288 |
|
|---|
| 289 | <para>In <filename>/etc/pam.d/*</filename> replace the <parameter>
|
|---|
| 290 | auth</parameter> lines with something like this:
|
|---|
| 291 | <programlisting>
|
|---|
| 292 | auth required /lib/security/pam_securetty.so
|
|---|
| 293 | auth required /lib/security/pam_nologin.so
|
|---|
| 294 | auth sufficient /lib/security/pam_winbind.so
|
|---|
| 295 | auth required /lib/security/pam_unix.so \
|
|---|
| 296 | use_first_pass shadow nullok
|
|---|
| 297 | </programlisting>
|
|---|
| 298 | </para>
|
|---|
| 299 |
|
|---|
| 300 | <note><para>
|
|---|
| 301 | The PAM module pam_unix has recently replaced the module pam_pwdb.
|
|---|
| 302 | Some Linux systems use the module pam_unix2 in place of pam_unix.
|
|---|
| 303 | </para></note>
|
|---|
| 304 |
|
|---|
| 305 | <para>Note in particular the use of the <parameter>sufficient
|
|---|
| 306 | </parameter> keyword and the <parameter>use_first_pass</parameter> keyword. </para>
|
|---|
| 307 |
|
|---|
| 308 | <para>Now replace the account lines with this: </para>
|
|---|
| 309 |
|
|---|
| 310 | <para><command>account required /lib/security/pam_winbind.so
|
|---|
| 311 | </command></para>
|
|---|
| 312 |
|
|---|
| 313 | <para>The next step is to join the domain. To do that use the
|
|---|
| 314 | <command>net</command> program like this: </para>
|
|---|
| 315 |
|
|---|
| 316 | <para><command>net join -S PDC -U Administrator</command></para>
|
|---|
| 317 |
|
|---|
| 318 | <para>The username after the <parameter>-U</parameter> can be any
|
|---|
| 319 | Domain user that has administrator privileges on the machine.
|
|---|
| 320 | Substitute the name or IP of your PDC for "PDC".</para>
|
|---|
| 321 |
|
|---|
| 322 | <para>Next copy <filename>libnss_winbind.so</filename> to
|
|---|
| 323 | <filename>/lib</filename> and <filename>pam_winbind.so
|
|---|
| 324 | </filename> to <filename>/lib/security</filename>. A symbolic link needs to be
|
|---|
| 325 | made from <filename>/lib/libnss_winbind.so</filename> to
|
|---|
| 326 | <filename>/lib/libnss_winbind.so.2</filename>. If you are using an
|
|---|
| 327 | older version of glibc then the target of the link should be
|
|---|
| 328 | <filename>/lib/libnss_winbind.so.1</filename>.</para>
|
|---|
| 329 |
|
|---|
| 330 | <para>Finally, setup a <citerefentry><refentrytitle>smb.conf</refentrytitle>
|
|---|
| 331 | <manvolnum>5</manvolnum></citerefentry> containing directives like the
|
|---|
| 332 | following:
|
|---|
| 333 | <programlisting>
|
|---|
| 334 | [global]
|
|---|
| 335 | winbind separator = +
|
|---|
| 336 | winbind cache time = 10
|
|---|
| 337 | template shell = /bin/bash
|
|---|
| 338 | template homedir = /home/%D/%U
|
|---|
| 339 | idmap config * : range = 10000-20000
|
|---|
| 340 | workgroup = DOMAIN
|
|---|
| 341 | security = domain
|
|---|
| 342 | password server = *
|
|---|
| 343 | </programlisting></para>
|
|---|
| 344 |
|
|---|
| 345 |
|
|---|
| 346 | <para>Now start winbindd and you should find that your user and
|
|---|
| 347 | group database is expanded to include your NT users and groups,
|
|---|
| 348 | and that you can login to your unix box as a domain user, using
|
|---|
| 349 | the DOMAIN+user syntax for the username. You may wish to use the
|
|---|
| 350 | commands <command>getent passwd</command> and <command>getent group
|
|---|
| 351 | </command> to confirm the correct operation of winbindd.</para>
|
|---|
| 352 | </refsect1>
|
|---|
| 353 |
|
|---|
| 354 |
|
|---|
| 355 | <refsect1>
|
|---|
| 356 | <title>NOTES</title>
|
|---|
| 357 |
|
|---|
| 358 | <para>The following notes are useful when configuring and
|
|---|
| 359 | running <command>winbindd</command>: </para>
|
|---|
| 360 |
|
|---|
| 361 | <para><citerefentry><refentrytitle>nmbd</refentrytitle>
|
|---|
| 362 | <manvolnum>8</manvolnum></citerefentry> must be running on the local machine
|
|---|
| 363 | for <command>winbindd</command> to work. </para>
|
|---|
| 364 |
|
|---|
| 365 | <para>PAM is really easy to misconfigure. Make sure you know what
|
|---|
| 366 | you are doing when modifying PAM configuration files. It is possible
|
|---|
| 367 | to set up PAM such that you can no longer log into your system. </para>
|
|---|
| 368 |
|
|---|
| 369 | <para>If more than one UNIX machine is running <command>winbindd</command>,
|
|---|
| 370 | then in general the user and groups ids allocated by winbindd will not
|
|---|
| 371 | be the same. The user and group ids will only be valid for the local
|
|---|
| 372 | machine, unless a shared <smbconfoption name="idmap config * : backend"/> is configured.</para>
|
|---|
| 373 |
|
|---|
| 374 | <para>If the Windows NT SID to UNIX user and group id mapping
|
|---|
| 375 | file is damaged or destroyed then the mappings will be lost. </para>
|
|---|
| 376 | </refsect1>
|
|---|
| 377 |
|
|---|
| 378 |
|
|---|
| 379 | <refsect1>
|
|---|
| 380 | <title>SIGNALS</title>
|
|---|
| 381 |
|
|---|
| 382 | <para>The following signals can be used to manipulate the
|
|---|
| 383 | <command>winbindd</command> daemon. </para>
|
|---|
| 384 |
|
|---|
| 385 | <variablelist>
|
|---|
| 386 | <varlistentry>
|
|---|
| 387 | <term>SIGHUP</term>
|
|---|
| 388 | <listitem><para>Reload the <citerefentry><refentrytitle>smb.conf</refentrytitle>
|
|---|
| 389 | <manvolnum>5</manvolnum></citerefentry> file and
|
|---|
| 390 | apply any parameter changes to the running
|
|---|
| 391 | version of winbindd. This signal also clears any cached
|
|---|
| 392 | user and group information. The list of other domains trusted
|
|---|
| 393 | by winbindd is also reloaded. </para></listitem>
|
|---|
| 394 | </varlistentry>
|
|---|
| 395 |
|
|---|
| 396 | <varlistentry>
|
|---|
| 397 | <term>SIGUSR2</term>
|
|---|
| 398 | <listitem><para>The SIGUSR2 signal will cause <command>
|
|---|
| 399 | winbindd</command> to write status information to the winbind
|
|---|
| 400 | log file.</para>
|
|---|
| 401 |
|
|---|
| 402 | <para>Log files are stored in the filename specified by the
|
|---|
| 403 | log file parameter.</para></listitem>
|
|---|
| 404 | </varlistentry>
|
|---|
| 405 | </variablelist>
|
|---|
| 406 | </refsect1>
|
|---|
| 407 |
|
|---|
| 408 | <refsect1>
|
|---|
| 409 | <title>FILES</title>
|
|---|
| 410 |
|
|---|
| 411 | <variablelist>
|
|---|
| 412 | <varlistentry>
|
|---|
| 413 | <term><filename>/etc/nsswitch.conf(5)</filename></term>
|
|---|
| 414 | <listitem><para>Name service switch configuration file.</para>
|
|---|
| 415 | </listitem>
|
|---|
| 416 | </varlistentry>
|
|---|
| 417 |
|
|---|
| 418 | <varlistentry>
|
|---|
| 419 | <term>/tmp/.winbindd/pipe</term>
|
|---|
| 420 | <listitem><para>The UNIX pipe over which clients communicate with
|
|---|
| 421 | the <command>winbindd</command> program. For security reasons, the
|
|---|
| 422 | winbind client will only attempt to connect to the winbindd daemon
|
|---|
| 423 | if both the <filename>/tmp/.winbindd</filename> directory
|
|---|
| 424 | and <filename>/tmp/.winbindd/pipe</filename> file are owned by
|
|---|
| 425 | root. </para></listitem>
|
|---|
| 426 | </varlistentry>
|
|---|
| 427 |
|
|---|
| 428 | <varlistentry>
|
|---|
| 429 | <term>$LOCKDIR/winbindd_privileged/pipe</term>
|
|---|
| 430 | <listitem><para>The UNIX pipe over which 'privileged' clients
|
|---|
| 431 | communicate with the <command>winbindd</command> program. For security
|
|---|
| 432 | reasons, access to some winbindd functions - like those needed by
|
|---|
| 433 | the <command>ntlm_auth</command> utility - is restricted. By default,
|
|---|
| 434 | only users in the 'root' group will get this access, however the administrator
|
|---|
| 435 | may change the group permissions on $LOCKDIR/winbindd_privileged to allow
|
|---|
| 436 | programs like 'squid' to use ntlm_auth.
|
|---|
| 437 | Note that the winbind client will only attempt to connect to the winbindd daemon
|
|---|
| 438 | if both the <filename>$LOCKDIR/winbindd_privileged</filename> directory
|
|---|
| 439 | and <filename>$LOCKDIR/winbindd_privileged/pipe</filename> file are owned by
|
|---|
| 440 | root. </para></listitem>
|
|---|
| 441 | </varlistentry>
|
|---|
| 442 |
|
|---|
| 443 | <varlistentry>
|
|---|
| 444 | <term>/lib/libnss_winbind.so.X</term>
|
|---|
| 445 | <listitem><para>Implementation of name service switch library.
|
|---|
| 446 | </para></listitem>
|
|---|
| 447 | </varlistentry>
|
|---|
| 448 |
|
|---|
| 449 | <varlistentry>
|
|---|
| 450 | <term>$LOCKDIR/winbindd_idmap.tdb</term>
|
|---|
| 451 | <listitem><para>Storage for the Windows NT rid to UNIX user/group
|
|---|
| 452 | id mapping. The lock directory is specified when Samba is initially
|
|---|
| 453 | compiled using the <parameter>--with-lockdir</parameter> option.
|
|---|
| 454 | This directory is by default <filename>/usr/local/samba/var/locks
|
|---|
| 455 | </filename>. </para></listitem>
|
|---|
| 456 | </varlistentry>
|
|---|
| 457 |
|
|---|
| 458 | <varlistentry>
|
|---|
| 459 | <term>$LOCKDIR/winbindd_cache.tdb</term>
|
|---|
| 460 | <listitem><para>Storage for cached user and group information.
|
|---|
| 461 | </para></listitem>
|
|---|
| 462 | </varlistentry>
|
|---|
| 463 | </variablelist>
|
|---|
| 464 | </refsect1>
|
|---|
| 465 |
|
|---|
| 466 |
|
|---|
| 467 | <refsect1>
|
|---|
| 468 | <title>VERSION</title>
|
|---|
| 469 |
|
|---|
| 470 | <para>This man page is correct for version 3 of
|
|---|
| 471 | the Samba suite.</para>
|
|---|
| 472 | </refsect1>
|
|---|
| 473 |
|
|---|
| 474 | <refsect1>
|
|---|
| 475 | <title>SEE ALSO</title>
|
|---|
| 476 |
|
|---|
| 477 | <para><filename>nsswitch.conf(5)</filename>, <citerefentry>
|
|---|
| 478 | <refentrytitle>samba</refentrytitle>
|
|---|
| 479 | <manvolnum>7</manvolnum></citerefentry>, <citerefentry>
|
|---|
| 480 | <refentrytitle>wbinfo</refentrytitle>
|
|---|
| 481 | <manvolnum>1</manvolnum></citerefentry>, <citerefentry>
|
|---|
| 482 | <refentrytitle>ntlm_auth</refentrytitle>
|
|---|
| 483 | <manvolnum>8</manvolnum></citerefentry>, <citerefentry>
|
|---|
| 484 | <refentrytitle>smb.conf</refentrytitle>
|
|---|
| 485 | <manvolnum>5</manvolnum></citerefentry>, <citerefentry>
|
|---|
| 486 | <refentrytitle>pam_winbind</refentrytitle>
|
|---|
| 487 | <manvolnum>8</manvolnum></citerefentry></para>
|
|---|
| 488 | </refsect1>
|
|---|
| 489 |
|
|---|
| 490 | <refsect1>
|
|---|
| 491 | <title>AUTHOR</title>
|
|---|
| 492 |
|
|---|
| 493 | <para>The original Samba software and related utilities
|
|---|
| 494 | were created by Andrew Tridgell. Samba is now developed
|
|---|
| 495 | by the Samba Team as an Open Source project similar
|
|---|
| 496 | to the way the Linux kernel is developed.</para>
|
|---|
| 497 |
|
|---|
| 498 | <para><command>wbinfo</command> and <command>winbindd</command> were
|
|---|
| 499 | written by Tim Potter.</para>
|
|---|
| 500 |
|
|---|
| 501 | <para>The conversion to DocBook for Samba 2.2 was done
|
|---|
| 502 | by Gerald Carter. The conversion to DocBook XML 4.2 for
|
|---|
| 503 | Samba 3.0 was done by Alexander Bokovoy.</para>
|
|---|
| 504 | </refsect1>
|
|---|
| 505 |
|
|---|
| 506 | </refentry>
|
|---|
