Changeset 134 for branches/samba-3.0/docs/htmldocs/Samba3-ByExample
- Timestamp:
- May 23, 2008, 6:56:41 AM (17 years ago)
- Location:
- branches/samba-3.0/docs/htmldocs/Samba3-ByExample
- Files:
-
- 26 edited
-
2000users.html (modified) (59 diffs)
-
Big500users.html (modified) (49 diffs)
-
DMSMig.html (modified) (2 diffs)
-
DomApps.html (modified) (36 diffs)
-
ExNetworks.html (modified) (2 diffs)
-
HA.html (modified) (28 diffs)
-
RefSection.html (modified) (1 diff)
-
appendix.html (modified) (36 diffs)
-
ch14.html (modified) (6 diffs)
-
go01.html (modified) (8 diffs)
-
happy.html (modified) (137 diffs)
-
index.html (modified) (1 diff)
-
ix01.html (modified) (1 diff)
-
kerberos.html (modified) (70 diffs)
-
ntmigration.html (modified) (44 diffs)
-
nw4migration.html (modified) (30 diffs)
-
pr01.html (modified) (1 diff)
-
pr02.html (modified) (1 diff)
-
pr03.html (modified) (1 diff)
-
preface.html (modified) (9 diffs)
-
primer.html (modified) (32 diffs)
-
secure.html (modified) (87 diffs)
-
simple.html (modified) (58 diffs)
-
small.html (modified) (47 diffs)
-
unixclients.html (modified) (91 diffs)
-
upgrades.html (modified) (52 diffs)
Legend:
- Unmodified
- Added
- Removed
-
branches/samba-3.0/docs/htmldocs/Samba3-ByExample/2000users.html
r44 r134 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 6. A Distributed 2000-User Network</title><link rel="stylesheet" href=" samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="happy.html" title="Chapter 5. Making Happy Users"><link rel="next" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 6. A Distributed 2000-User Network</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="happy.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="DMSMig.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="2000users"></a>Chapter 6. A Distributed 2000-User Network</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="2000users.html#id347742">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id347767">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id347824">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id348070">Technical Issues</a></span></dt><dt><span class="sect2"><a href="2000users.html#id348898">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id348912">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id352072">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id352211">Questions and Answers</a></span></dt></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 6. A Distributed 2000-User Network</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="happy.html" title="Chapter 5. Making Happy Users"><link rel="next" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 6. A Distributed 2000-User Network</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="happy.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="DMSMig.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="2000users"></a>Chapter 6. A Distributed 2000-User Network</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="2000users.html#id370394">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id370419">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id370476">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id370722">Technical Issues</a></span></dt><dt><span class="sect2"><a href="2000users.html#id371541">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id371556">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id374570">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id374709">Questions and Answers</a></span></dt></dl></div><p> 2 2 There is something indeed mystical about things that are 3 3 big. Large networks exhibit a certain magnetism and exude a sense of … … 31 31 specifics of implementing LDAP changes, Samba changes, and approach and 32 32 design of the solution and its deployment. 33 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 47742"></a>Introduction</h2></div></div></div><p>33 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id370394"></a>Introduction</h2></div></div></div><p> 34 34 Abmas is a miracle company. Most businesses would have collapsed under 35 35 the weight of rapid expansion that this company has experienced. Samba … … 40 40 Samba server just to change the way your network should function. 41 41 </p><p> 42 <a class="indexterm" name="id3 47757"></a>42 <a class="indexterm" name="id370409"></a> 43 43 Network growth is common to all organizations. In this exercise, 44 44 your preoccupation is with the mechanics of implementing Samba and 45 45 LDAP so that network users on each network segment can work 46 46 without impediment. 47 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 47767"></a>Assignment Tasks</h3></div></div></div><p>47 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id370419"></a>Assignment Tasks</h3></div></div></div><p> 48 48 Starting with the configuration files for the server called 49 <code class="constant">MASSIVE</code> in <a href="happy.html" title="Chapter 5. Making Happy Users">???</a>, you now deal with the49 <code class="constant">MASSIVE</code> in <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>, you now deal with the 50 50 issues that are particular to large distributed networks. Your task 51 51 is simple identify the challenges, consider the 52 52 alternatives, and then design and implement a solution. 53 53 </p><p> 54 <a class="indexterm" name="id3 47792"></a>54 <a class="indexterm" name="id370444"></a> 55 55 Remember, you have users based in London (UK), Los Angeles, 56 56 Washington. DC, and, three buildings in New York. A significant portion … … 73 73 DirectPointe. Your concern is server maintenance and third-level 74 74 support. Build a plan and show what must be done. 75 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 47824"></a>Dissection and Discussion</h2></div></div></div><p>76 <a class="indexterm" name="id3 47832"></a>77 <a class="indexterm" name="id3 47838"></a>78 In <a href="happy.html" title="Chapter 5. Making Happy Users">???</a>, you implemented an LDAP server that provided the75 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id370476"></a>Dissection and Discussion</h2></div></div></div><p> 76 <a class="indexterm" name="id370483"></a> 77 <a class="indexterm" name="id370490"></a> 78 In <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>, you implemented an LDAP server that provided the 79 79 <em class="parameter"><code>passdb backend</code></em> for the Samba servers. You 80 80 explored ways to accelerate Windows desktop profile handling and you 81 81 took control of network performance. 82 82 </p><p> 83 <a class="indexterm" name="id3 47861"></a>84 <a class="indexterm" name="id3 47868"></a>85 <a class="indexterm" name="id3 47875"></a>86 <a class="indexterm" name="id3 47882"></a>83 <a class="indexterm" name="id370513"></a> 84 <a class="indexterm" name="id370520"></a> 85 <a class="indexterm" name="id370527"></a> 86 <a class="indexterm" name="id370534"></a> 87 87 The implementation of an LDAP-based passdb backend (known as 88 88 <span class="emphasis"><em>ldapsam</em></span> in Samba parlance), or some form of database … … 97 97 managers. 98 98 </p><p> 99 <a class="indexterm" name="id3 47917"></a>100 <a class="indexterm" name="id3 47923"></a>99 <a class="indexterm" name="id370569"></a> 100 <a class="indexterm" name="id370575"></a> 101 101 The new <span class="emphasis"><em>tdbsam</em></span> facility supports functionality 102 102 that is similar to an <span class="emphasis"><em>ldapsam</em></span>, but the lack of … … 106 106 backend? Is support for these tools broken? Answers to these 107 107 questions require a bit of background.</p><p> 108 <a class="indexterm" name="id3 47944"></a>109 <a class="indexterm" name="id3 47951"></a>110 <a class="indexterm" name="id3 47958"></a>111 <a class="indexterm" name="id3 47964"></a>108 <a class="indexterm" name="id370596"></a> 109 <a class="indexterm" name="id370603"></a> 110 <a class="indexterm" name="id370609"></a> 111 <a class="indexterm" name="id370616"></a> 112 112 <span class="emphasis"><em>What is a directory?</em></span> A directory is a 113 113 collection of information regarding objects that can be accessed to … … 117 117 information is organized to facilitate read access rather than to 118 118 support transaction processing.</p><p> 119 <a class="indexterm" name="id3 47981"></a>120 <a class="indexterm" name="id3 47990"></a>121 <a class="indexterm" name="id3 47997"></a>122 <a class="indexterm" name="id3 48004"></a>119 <a class="indexterm" name="id370633"></a> 120 <a class="indexterm" name="id370642"></a> 121 <a class="indexterm" name="id370649"></a> 122 <a class="indexterm" name="id370656"></a> 123 123 The Lightweight Directory Access Protocol (LDAP) differs 124 124 considerably from a traditional database. It has a simple search … … 127 127 the data repository and for keeping all copies (slaves) in sync with 128 128 the master repository.</p><p> 129 <a class="indexterm" name="id3 48017"></a>130 <a class="indexterm" name="id3 48024"></a>131 <a class="indexterm" name="id3 48031"></a>129 <a class="indexterm" name="id370669"></a> 130 <a class="indexterm" name="id370676"></a> 131 <a class="indexterm" name="id370683"></a> 132 132 Samba is a flexible and powerful file and print sharing 133 133 technology. It can use many external authentication sources and can be … … 137 137 avoid the proprietary implications of Microsoft Active Directory 138 138 naturally gravitate toward OpenLDAP.</p><p> 139 <a class="indexterm" name="id3 48044"></a>140 In <a href="happy.html" title="Chapter 5. Making Happy Users">???</a>, you had to deal with a locally routed139 <a class="indexterm" name="id370696"></a> 140 In <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>, you had to deal with a locally routed 141 141 network. All deployment concerns focused around making users happy, 142 142 and that simply means taking control over all network practices and … … 148 148 access information globally. And you must make the network robust 149 149 enough so that it can sustain partial breakdown without causing loss of 150 productivity.</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 48070"></a>Technical Issues</h3></div></div></div><p>150 productivity.</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id370722"></a>Technical Issues</h3></div></div></div><p> 151 151 There are at least three areas that need to be addressed as you 152 152 approach the challenge of designing a network solution for the newly 153 153 expanded business: 154 </p><div class="itemizedlist"><ul type="disc"><li><p><a class="indexterm" name="id3 48084"></a>155 User needs such as mobility and data access</p></li><li><p>The nature of Windows networking protocols</p></li><li><p>Identity management infrastructure needs</p></li></ul></div><p>Let's look at each in turn.</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 48107"></a>User Needs</h4></div></div></div><p>154 </p><div class="itemizedlist"><ul type="disc"><li><p><a class="indexterm" name="id370736"></a> 155 User needs such as mobility and data access</p></li><li><p>The nature of Windows networking protocols</p></li><li><p>Identity management infrastructure needs</p></li></ul></div><p>Let's look at each in turn.</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id370759"></a>User Needs</h4></div></div></div><p> 156 156 The new company has three divisions. Staff for each division are spread across 157 157 the company. Some staff are office-bound and some are mobile users. Mobile … … 164 164 off for reasons outside the scope of this discussion. 165 165 </p><p> 166 <a class="indexterm" name="id3 48126"></a>166 <a class="indexterm" name="id370778"></a> 167 167 Decisions must be made regarding where data is to be stored, how it will be 168 168 replicated (if at all), and what the network bandwidth implications are. For … … 175 175 to the network. 176 176 </p><p> 177 <a class="indexterm" name="id3 48147"></a>178 <a class="indexterm" name="id3 48157"></a>177 <a class="indexterm" name="id370799"></a> 178 <a class="indexterm" name="id370808"></a> 179 179 No matter which way you look at this, the bandwidth requirements 180 180 for acceptable performance are substantial even if only 10 percent of … … 189 189 server to and from the client. 190 190 </p><p> 191 <a class="indexterm" name="id3 48172"></a>191 <a class="indexterm" name="id370824"></a> 192 192 Obviously then, user needs and wide-area practicalities dictate the economic and 193 193 technical aspects of your network design as well as for standard operating procedures. 194 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 48183"></a>The Nature of Windows Networking Protocols</h4></div></div></div><p>195 <a class="indexterm" name="id3 48191"></a>194 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id370835"></a>The Nature of Windows Networking Protocols</h4></div></div></div><p> 195 <a class="indexterm" name="id370843"></a> 196 196 Network logons that include roaming profile handling requires from 140 KB to 2 MB. 197 197 The inclusion of support for a minimal set of common desktop applications can push … … 201 201 part of a total service-level assurance program that might be implemented. 202 202 </p><p> 203 <a class="indexterm" name="id3 48207"></a>204 <a class="indexterm" name="id3 48214"></a>203 <a class="indexterm" name="id370859"></a> 204 <a class="indexterm" name="id370866"></a> 205 205 One way to reduce the network bandwidth impact of user logon 206 traffic is through folder redirection. In <a href="happy.html" title="Chapter 5. Making Happy Users">???</a>, you206 traffic is through folder redirection. In <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>, you 207 207 implemented this in the new Windows XP Professional standard 208 208 desktop configuration. When desktop folders such as <span class="guimenu">My … … 211 211 logon or logout. Redirected folders are analogous to network drive 212 212 connections. 213 </p><p><a class="indexterm" name="id3 48238"></a>213 </p><p><a class="indexterm" name="id370890"></a> 214 214 Of course, network applications should only be run off 215 215 local application servers. As a general rule, even with 2 Mb/sec … … 218 218 server that is located in New York. 219 219 </p><p> 220 <a class="indexterm" name="id3 48251"></a>220 <a class="indexterm" name="id370903"></a> 221 221 When network bandwidth becomes a precious commodity (that is most 222 222 of the time), there is a significant demand to understand network … … 227 227 the network, several important things must happen. 228 228 </p><div class="itemizedlist"><ul type="disc"><li><p> 229 <a class="indexterm" name="id3 48270"></a>229 <a class="indexterm" name="id370922"></a> 230 230 The client obtains an IP address via DHCP. (DHCP is 231 231 necessary so that users can roam between offices.) 232 232 </p></li><li><p> 233 <a class="indexterm" name="id3 48282"></a>234 <a class="indexterm" name="id3 48289"></a>233 <a class="indexterm" name="id370934"></a> 234 <a class="indexterm" name="id370941"></a> 235 235 The client must register itself with the WINS and/or DNS server. 236 236 </p></li><li><p> 237 <a class="indexterm" name="id3 48301"></a>237 <a class="indexterm" name="id370952"></a> 238 238 The client must locate the closest domain controller. 239 239 </p></li><li><p> … … 257 257 at the WINS server. 258 258 </p><p> 259 <a class="indexterm" name="id3 48339"></a>260 <a class="indexterm" name="id3 48345"></a><a class="indexterm" name="id348355"></a>259 <a class="indexterm" name="id370990"></a> 260 <a class="indexterm" name="id370997"></a><a class="indexterm" name="id371006"></a> 261 261 Given that the client is already a domain member, it then sends 262 262 a directed (Unicast) request to the WINS server seeking the list of 263 263 IP addresses for domain controllers (NetBIOS name type 0x1C). The 264 264 WINS server replies with the information requested.</p><p> 265 <a class="indexterm" name="id3 48367"></a>266 <a class="indexterm" name="id3 48376"></a>267 <a class="indexterm" name="id3 48383"></a>265 <a class="indexterm" name="id371019"></a> 266 <a class="indexterm" name="id371028"></a> 267 <a class="indexterm" name="id371035"></a> 268 268 The client sends two netlogon mailslot broadcast requests 269 269 to the local network and to each of the IP addresses returned by … … 275 275 domain controllers. 276 276 </p><p> 277 <a class="indexterm" name="id3 48397"></a>278 <a class="indexterm" name="id3 48406"></a>279 <a class="indexterm" name="id3 48413"></a>277 <a class="indexterm" name="id371053"></a> 278 <a class="indexterm" name="id371062"></a> 279 <a class="indexterm" name="id371069"></a> 280 280 The logon process begins with negotiation of the SMB/CIFS 281 281 protocols that are to be used; this is followed by an exchange of … … 288 288 local domain controllers fail or break? 289 289 </p><p> 290 <a class="indexterm" name="id3 48428"></a>291 <a class="indexterm" name="id3 48435"></a>292 <a class="indexterm" name="id3 48441"></a>293 <a class="indexterm" name="id3 48448"></a>290 <a class="indexterm" name="id371084"></a> 291 <a class="indexterm" name="id371090"></a> 292 <a class="indexterm" name="id371097"></a> 293 <a class="indexterm" name="id371104"></a> 294 294 Under most circumstances, the nearest domain controller 295 295 responds to the netlogon mailslot broadcast. The exception to this … … 300 300 domain controllers are by definition BDCs. 301 301 </p><p> 302 <a class="indexterm" name="id3 48461"></a>303 <a class="indexterm" name="id3 48468"></a>302 <a class="indexterm" name="id371117"></a> 303 <a class="indexterm" name="id371124"></a> 304 304 The provision of sufficient servers that are BDCs is an 305 305 important design factor. The second important design factor … … 307 307 data. That is the subject of the next section, which involves key 308 308 decisions regarding Identity Management facilities. 309 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 48480"></a>Identity Management Needs</h4></div></div></div><p>310 <a class="indexterm" name="id3 48488"></a>311 <a class="indexterm" name="id3 48494"></a>312 <a class="indexterm" name="id3 48501"></a>313 <a class="indexterm" name="id3 48508"></a>309 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id371136"></a>Identity Management Needs</h4></div></div></div><p> 310 <a class="indexterm" name="id371144"></a> 311 <a class="indexterm" name="id371150"></a> 312 <a class="indexterm" name="id371157"></a> 313 <a class="indexterm" name="id371164"></a> 314 314 Network managers recognize that in large organizations users 315 315 generally need to be given resource access based on needs, while … … 320 320 rights and privileges are allocated. 321 321 </p><p> 322 <a class="indexterm" name="id3 48522"></a>323 <a class="indexterm" name="id3 48529"></a>324 <a class="indexterm" name="id3 48535"></a>322 <a class="indexterm" name="id371178"></a> 323 <a class="indexterm" name="id371184"></a> 324 <a class="indexterm" name="id371191"></a> 325 325 Unfortunately, network resources tend to have their own Identity 326 326 Management facilities, the quality and manageability of which varies … … 334 334 as <code class="constant">Network Information System</code> (NIS). 335 335 </p><p> 336 <a class="indexterm" name="id3 48561"></a>336 <a class="indexterm" name="id371217"></a> 337 337 NIS gained a strong following throughout the UNIX/VMS space in a short 338 338 period of time and retained that appeal and use for over a decade. … … 344 344 other information systems is catching on. 345 345 </p><p> 346 <a class="indexterm" name="id3 48580"></a>347 <a class="indexterm" name="id3 48587"></a>348 <a class="indexterm" name="id3 48593"></a>346 <a class="indexterm" name="id371232"></a> 347 <a class="indexterm" name="id371238"></a> 348 <a class="indexterm" name="id371245"></a> 349 349 Nevertheless, both NIS and NIS+ continue to hold ground in 350 350 business areas where UNIX still has major sway. Examples of … … 354 354 focus. 355 355 </p><p> 356 <a class="indexterm" name="id3 48606"></a>357 <a class="indexterm" name="id3 48613"></a>356 <a class="indexterm" name="id371258"></a> 357 <a class="indexterm" name="id371264"></a> 358 358 Today's networking world needs a scalable, distributed Identity 359 359 Management infrastructure, commonly called a directory. The most … … 361 361 and a number of LDAP implementations. 362 362 </p><p> 363 <a class="indexterm" name="id3 48625"></a>363 <a class="indexterm" name="id371277"></a> 364 364 The problem of managing multiple directories has become a focal 365 365 point over the past decade, creating a large market for … … 370 370 having to remember and deal with fewer login identities and 371 371 passwords.</p><p> 372 <a class="indexterm" name="id3 48639"></a>372 <a class="indexterm" name="id371290"></a> 373 373 The challenge of every large network is to find the optimum 374 374 balance of internal systems and facilities for Identity … … 376 376 implemented has potentially significant impact on network bandwidth 377 377 and systems response needs.</p><p> 378 <a class="indexterm" name="id3 48654"></a>379 <a class="indexterm" name="id3 48661"></a>380 <a class="indexterm" name="id3 48670"></a>381 In <a href="happy.html" title="Chapter 5. Making Happy Users">???</a>, you implemented a single LDAP server for the378 <a class="indexterm" name="id371305"></a> 379 <a class="indexterm" name="id371312"></a> 380 <a class="indexterm" name="id371321"></a> 381 In <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>, you implemented a single LDAP server for the 382 382 entire network. This may work for smaller networks, but almost 383 383 certainly fails to meet the needs of large and complex networks. The … … 387 387 servers within the context of a distributed 2,000-user network is a 388 388 question that remains to be answered.</p><p> 389 <a class="indexterm" name="id3 48695"></a>390 <a class="indexterm" name="id3 48702"></a>389 <a class="indexterm" name="id371347"></a> 390 <a class="indexterm" name="id371353"></a> 391 391 One possibility that has great appeal is to create a single, 392 392 large distributed domain. The practical implications of this 393 design (see <a href="2000users.html#chap7net" title="Figure 6.6. Network Topology 2000 User Complex Design A">???</a>) demands the placement of393 design (see <a class="link" href="2000users.html#chap7net" title="Figure 6.6. Network Topology 2000 User Complex Design A">“Network Topology 2000 User Complex Design A”</a>) demands the placement of 394 394 sufficient BDCs in each location. Additionally, network 395 395 administrators must make sure that profiles are not transferred … … 399 399 maintenance. 400 400 </p><p> 401 <a class="indexterm" name="id3 48723"></a>402 The network design in <a href="2000users.html#chap7net2" title="Figure 6.7. Network Topology 2000 User Complex Design B">???</a> takes the approach401 <a class="indexterm" name="id371374"></a> 402 The network design in <a class="link" href="2000users.html#chap7net2" title="Figure 6.7. Network Topology 2000 User Complex Design B">“Network Topology 2000 User Complex Design B”</a> takes the approach 403 403 that management of networks that are too remote to be managed 404 404 effectively from New York ought to be given a certain degree of … … 410 410 in how they may access global resources. 411 411 </p><p> 412 <a class="indexterm" name="id3 48748"></a>412 <a class="indexterm" name="id371395"></a> 413 413 Desk-bound users need not be negatively affected by this design, since 414 414 the use of interdomain trusts can be used to satisfy the need for global 415 415 data sharing. 416 416 </p><p> 417 <a class="indexterm" name="id3 48759"></a>418 <a class="indexterm" name="id3 48766"></a>419 <a class="indexterm" name="id3 48775"></a>417 <a class="indexterm" name="id371406"></a> 418 <a class="indexterm" name="id371413"></a> 419 <a class="indexterm" name="id371422"></a> 420 420 When Samba-3 is configured to use an LDAP backend, it stores the domain 421 421 account information in a directory entry. This account entry contains the … … 423 423 possible to operate with more than one PDC on a distributed network. 424 424 </p><p> 425 <a class="indexterm" name="id3 48788"></a>426 <a class="indexterm" name="id3 48795"></a>427 <a class="indexterm" name="id3 48801"></a>425 <a class="indexterm" name="id371435"></a> 426 <a class="indexterm" name="id371441"></a> 427 <a class="indexterm" name="id371448"></a> 428 428 How might this peculiar feature be exploited? The answer is simple. It is 429 429 imperative that each network segment have its own WINS server. Major … … 435 435 single LDAP backend, users have unfettered ability to roam. 436 436 </p><p> 437 <a class="indexterm" name="id3 48822"></a>438 <a class="indexterm" name="id3 48831"></a>437 <a class="indexterm" name="id371468"></a> 438 <a class="indexterm" name="id371478"></a> 439 439 This concept has not been exhaustively validated, though we can see no reason 440 440 why this should not work. The important facets are the following: The name of … … 447 447 that are in fact slave LDAP servers on the local segments. 448 448 </p><p> 449 <a class="indexterm" name="id3 48847"></a>450 <a class="indexterm" name="id3 48856"></a>451 <a class="indexterm" name="id3 48863"></a>452 <a class="indexterm" name="id3 48872"></a>449 <a class="indexterm" name="id371494"></a> 450 <a class="indexterm" name="id371503"></a> 451 <a class="indexterm" name="id371510"></a> 452 <a class="indexterm" name="id371519"></a> 453 453 With a single master LDAP server, all network updates are effected on a single 454 454 server. In the event that this should become excessively fragile or network … … 464 464 procedures for managing the directory, because retroactive correction of 465 465 inconsistent directory information can be exceedingly difficult. 466 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 48898"></a>Political Issues</h3></div></div></div><p>466 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id371541"></a>Political Issues</h3></div></div></div><p> 467 467 As organizations grow, the number of points of control increases 468 468 also. In a large distributed organization, it is important that the … … 472 472 minutes rather than days (the old limitation of highly manual 473 473 systems). 474 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 48912"></a>Implementation</h2></div></div></div><p>475 <a class="indexterm" name="id3 48920"></a>476 <a class="indexterm" name="id3 48927"></a>477 <a class="indexterm" name="id3 48934"></a>478 <a class="indexterm" name="id3 48940"></a>474 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id371556"></a>Implementation</h2></div></div></div><p> 475 <a class="indexterm" name="id371563"></a> 476 <a class="indexterm" name="id371570"></a> 477 <a class="indexterm" name="id371577"></a> 478 <a class="indexterm" name="id371583"></a> 479 479 Samba-3 has the ability to use multiple password (authentication and 480 identity resolution) backends. The diagram in <a href="2000users.html#chap7idres" title="Figure 6.1. Samba and Authentication Backend Search Pathways">???</a>480 identity resolution) backends. The diagram in <a class="link" href="2000users.html#chap7idres" title="Figure 6.1. Samba and Authentication Backend Search Pathways">“Samba and Authentication Backend Search Pathways”</a> 481 481 demonstrates how Samba uses winbind, LDAP, and NIS, the traditional system 482 482 password database. The diagram only documents the mechanisms for … … 484 484 using the specific systems shown. 485 485 </p><div class="figure"><a name="chap7idres"></a><p class="title"><b>Figure 6.1. Samba and Authentication Backend Search Pathways</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap7-idresol.png" width="297" alt="Samba and Authentication Backend Search Pathways"></div></div></div><br class="figure-break"><p> 486 <a class="indexterm" name="id3 49000"></a>487 <a class="indexterm" name="id3 49006"></a>488 <a class="indexterm" name="id3 49013"></a>489 <a class="indexterm" name="id3 49020"></a>490 <a class="indexterm" name="id3 49027"></a>491 <a class="indexterm" name="id3 49034"></a>492 <a class="indexterm" name="id3 49040"></a>486 <a class="indexterm" name="id371643"></a> 487 <a class="indexterm" name="id371650"></a> 488 <a class="indexterm" name="id371656"></a> 489 <a class="indexterm" name="id371663"></a> 490 <a class="indexterm" name="id371670"></a> 491 <a class="indexterm" name="id371677"></a> 492 <a class="indexterm" name="id371684"></a> 493 493 Samba is capable of using the <code class="constant">smbpasswd</code>, 494 494 <code class="constant">tdbsam</code>, <code class="constant">xmlsam</code>, … … 498 498 operations. 499 499 </p><p> 500 <a class="indexterm" name="id3 49066"></a>500 <a class="indexterm" name="id371710"></a> 501 501 Additionally, it is possible to use multiple passdb backends 502 502 concurrently as well as have multiple LDAP backends. As a result, you … … 508 508 ... 509 509 </pre><p> 510 This configuration tells Samba to use a single LDAP server, as shown in <a href="2000users.html#ch7singleLDAP" title="Figure 6.2. Samba Configuration to Use a Single LDAP Server">???</a>.510 This configuration tells Samba to use a single LDAP server, as shown in <a class="link" href="2000users.html#ch7singleLDAP" title="Figure 6.2. Samba Configuration to Use a Single LDAP Server">“Samba Configuration to Use a Single LDAP Server”</a>. 511 511 </p><div class="figure"><a name="ch7singleLDAP"></a><p class="title"><b>Figure 6.2. Samba Configuration to Use a Single LDAP Server</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/ch7-singleLDAP.png" width="351" alt="Samba Configuration to Use a Single LDAP Server"></div></div></div><p><br class="figure-break"> 512 <a class="indexterm" name="id3 49134"></a>513 <a class="indexterm" name="id3 49144"></a>512 <a class="indexterm" name="id371778"></a> 513 <a class="indexterm" name="id371787"></a> 514 514 The addition of a failover LDAP server can simply be done by adding a 515 515 second entry for the failover server to the single <em class="parameter"><code>ldapsam</code></em> … … 522 522 </pre><p> 523 523 This configuration tells Samba to use a master LDAP server, with failover to a slave server if necessary, 524 as shown in <a href="2000users.html#ch7dualLDAP" title="Figure 6.3. Samba Configuration to Use a Dual (Fail-over) LDAP Server">???</a>.524 as shown in <a class="link" href="2000users.html#ch7dualLDAP" title="Figure 6.3. Samba Configuration to Use a Dual (Fail-over) LDAP Server">“Samba Configuration to Use a Dual (Fail-over) LDAP Server”</a>. 525 525 </p><div class="figure"><a name="ch7dualLDAP"></a><p class="title"><b>Figure 6.3. Samba Configuration to Use a Dual (Fail-over) LDAP Server</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/ch7-fail-overLDAP.png" width="351" alt="Samba Configuration to Use a Dual (Fail-over) LDAP Server"></div></div></div><p><br class="figure-break"> 526 526 </p><p> … … 533 533 ... 534 534 </pre><p> 535 <a class="indexterm" name="id3 49224"></a>535 <a class="indexterm" name="id371867"></a> 536 536 The effect of this style of entry is that Samba lists the users 537 537 that are in both LDAP databases. If both contain the same information, 538 538 it results in each record being shown twice. This is, of course, not the 539 539 solution desired for a failover implementation. The net effect of this 540 configuration is shown in <a href="2000users.html#ch7dualadd" title="Figure 6.4. Samba Configuration to Use Dual LDAP Databases - Broken - Do Not Use!">???</a>540 configuration is shown in <a class="link" href="2000users.html#ch7dualadd" title="Figure 6.4. Samba Configuration to Use Dual LDAP Databases - Broken - Do Not Use!">“Samba Configuration to Use Dual LDAP Databases - Broken - Do Not Use!”</a> 541 541 </p><div class="figure"><a name="ch7dualadd"></a><p class="title"><b>Figure 6.4. Samba Configuration to Use Dual LDAP Databases - Broken - Do Not Use!</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/ch7-dual-additive-LDAP.png" width="297" alt="Samba Configuration to Use Dual LDAP Databases - Broken - Do Not Use!"></div></div></div><br class="figure-break"><p> 542 542 If, however, each LDAP database contains unique information, this may 543 543 well be an advantageous way to effectively integrate multiple LDAP databases 544 544 into one seemingly contiguous directory. Only the first database will be updated. 545 An example of this configuration is shown in <a href="2000users.html#ch7dualok" title="Figure 6.5. Samba Configuration to Use Two LDAP Databases - The result is additive.">???</a>.545 An example of this configuration is shown in <a class="link" href="2000users.html#ch7dualok" title="Figure 6.5. Samba Configuration to Use Two LDAP Databases - The result is additive.">“Samba Configuration to Use Two LDAP Databases - The result is additive.”</a>. 546 546 </p><div class="figure"><a name="ch7dualok"></a><p class="title"><b>Figure 6.5. Samba Configuration to Use Two LDAP Databases - The result is additive.</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/ch7-dual-additive-LDAP-Ok.png" width="297" alt="Samba Configuration to Use Two LDAP Databases - The result is additive."></div></div></div><br class="figure-break"><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 547 547 When the use of ldapsam is specified twice, as shown here, it is imperative … … 552 552 </p></div><p> 553 553 It is assumed that the network you are working with follows in a 554 pattern similar to what was covered in <a href="happy.html" title="Chapter 5. Making Happy Users">???</a>. The following steps554 pattern similar to what was covered in <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>. The following steps 555 555 permit the operation of a master/slave OpenLDAP arrangement. 556 </p><div class="procedure"><a name="id3 49353"></a><p class="title"><b>Procedure 6.1. Implementation Steps for an LDAP Slave Server</b></p><ol type="1"><li><p>557 <a class="indexterm" name="id3 49364"></a>558 <a class="indexterm" name="id3 49371"></a>556 </p><div class="procedure"><a name="id371997"></a><p class="title"><b>Procedure 6.1. Implementation Steps for an LDAP Slave Server</b></p><ol type="1"><li><p> 557 <a class="indexterm" name="id372008"></a> 558 <a class="indexterm" name="id372014"></a> 559 559 Log onto the master LDAP server as <code class="constant">root</code>. 560 560 You are about to change the configuration of the LDAP server, so it … … 569 569 </pre><p> 570 570 </p></li><li><p> 571 <a class="indexterm" name="id3 49414"></a>571 <a class="indexterm" name="id372057"></a> 572 572 Edit the <code class="filename">/etc/openldap/slapd.conf</code> file so it 573 matches the content of <a href="2000users.html#ch7-LDAP-master" title="Example 6.1. LDAP Master Server Configuration File /etc/openldap/slapd.conf">???</a>.573 matches the content of <a class="link" href="2000users.html#ch7-LDAP-master" title="Example 6.1. LDAP Master Server Configuration File /etc/openldap/slapd.conf">“LDAP Master Server Configuration File /etc/openldap/slapd.conf”</a>. 574 574 </p></li><li><p> 575 575 Create a file called <code class="filename">admin-accts.ldif</code> with the following contents: … … 593 593 </pre><p> 594 594 </p></li><li><p> 595 <a class="indexterm" name="id3 49483"></a>596 <a class="indexterm" name="id3 49490"></a>595 <a class="indexterm" name="id372126"></a> 596 <a class="indexterm" name="id372133"></a> 597 597 Change directory to a suitable place to dump the contents of the 598 598 LDAP server. The dump file (and LDIF file) is used to preload … … 603 603 Each record is written to the file. 604 604 </p></li><li><p> 605 <a class="indexterm" name="id3 49520"></a>605 <a class="indexterm" name="id372163"></a> 606 606 Copy the file <code class="filename">LDAP-transfer-LDIF.txt</code> to the intended 607 607 slave LDAP server. A good location could be in the directory … … 610 610 Log onto the slave LDAP server as <code class="constant">root</code>. You can 611 611 now configure this server so the <code class="filename">/etc/openldap/slapd.conf</code> 612 file matches the content of <a href="2000users.html#ch7-LDAP-slave" title="Example 6.2. LDAP Slave Configuration File /etc/openldap/slapd.conf">???</a>.612 file matches the content of <a class="link" href="2000users.html#ch7-LDAP-slave" title="Example 6.2. LDAP Slave Configuration File /etc/openldap/slapd.conf">“LDAP Slave Configuration File /etc/openldap/slapd.conf”</a>. 613 613 </p></li><li><p> 614 614 Change directory to the location in which you stored the … … 653 653 </pre><p> 654 654 </p></li><li><p> 655 <a class="indexterm" name="id3 49658"></a>656 <a class="indexterm" name="id3 49665"></a>657 <a class="indexterm" name="id3 49672"></a>655 <a class="indexterm" name="id372310"></a> 656 <a class="indexterm" name="id372317"></a> 657 <a class="indexterm" name="id372324"></a> 658 658 Go back to the master LDAP server. Execute the following to start LDAP as well 659 659 as <code class="literal">slurpd</code>, the synchronization daemon, as shown here: … … 664 664 <code class="prompt">root# </code> chkconfig slurpd on 665 665 </pre><p> 666 <a class="indexterm" name="id3 49715"></a>666 <a class="indexterm" name="id372367"></a> 667 667 On Red Hat Linux, check the equivalent command to start <code class="literal">slurpd</code>. 668 668 </p></li><li><p> 669 <a class="indexterm" name="id3 49735"></a>669 <a class="indexterm" name="id372387"></a> 670 670 On the master LDAP server you may now add an account to validate that replication 671 is working. Assuming the configuration shown in <a href="happy.html" title="Chapter 5. Making Happy Users">???</a>, execute:671 is working. Assuming the configuration shown in <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>, execute: 672 672 </p><pre class="screen"> 673 673 <code class="prompt">root# </code> /var/lib/samba/sbin/smbldap-useradd -a fruitloop … … 702 702 </p></li><li><p> 703 703 On each machine (PDC and BDCs) after the respective <code class="filename">smb.conf</code> files have been created as shown in 704 <a href="2000users.html#ch7-massmbconfA" title="Example 6.3. Primary Domain Controller smb.conf File Part A">Primary Domain Controller <code class="filename">smb.conf</code> File Part A + B + C</a> and705 on BDCs the <a href="2000users.html#ch7-slvsmbocnfA" title="Example 6.6. Backup Domain Controller smb.conf File Part A">Backup Domain Controller <code class="filename">smb.conf</code> File Part A704 <a class="link" href="2000users.html#ch7-massmbconfA" title="Example 6.3. Primary Domain Controller smb.conf File Part A">Primary Domain Controller <code class="filename">smb.conf</code> File Part A + B + C</a> and 705 on BDCs the <a class="link" href="2000users.html#ch7-slvsmbocnfA" title="Example 6.6. Backup Domain Controller smb.conf File Part A">Backup Domain Controller <code class="filename">smb.conf</code> File Part A 706 706 + B + C</a> execute the following: 707 707 </p><pre class="screen"> … … 792 792 index sambaDomainName eq 793 793 index default sub 794 </pre></div></div><br class="example-break"><div class="example"><a name="ch7-massmbconfA"></a><p class="title"><b>Example 6.3. Primary Domain Controller <code class="filename">smb.conf</code> File Part A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id3 49965"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id349978"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id349990"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id350003"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id350016"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id350028"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id350041"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id350054"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id350066"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id350079"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id350091"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id350104"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id350116"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id350129"></a><em class="parameter"><code>delete user script = /opt/IDEALX/sbin/smbldap-userdel '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id350142"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd -p '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id350155"></a><em class="parameter"><code>delete group script = /opt/IDEALX/sbin/smbldap-groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id350168"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/smbldap-groupmod -m '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id350181"></a><em class="parameter"><code>delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id350194"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id350208"></a><em class="parameter"><code>add machine script = /opt/IDEALX/sbin/smbldap-useradd -w '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id350221"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id350233"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id350246"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id350259"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id350272"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id350284"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id350297"></a><em class="parameter"><code>domain master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id350309"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id350322"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id350334"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id350347"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id350360"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id350372"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id350385"></a><em class="parameter"><code>ldap admin dn = cn=sambaadmin,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id350398"></a><em class="parameter"><code>idmap backend = ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id350411"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id350423"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id350436"></a><em class="parameter"><code>printer admin = root</code></em></td></tr><tr><td><a class="indexterm" name="id350448"></a><em class="parameter"><code>printing = cups</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-massmbconfB"></a><p class="title"><b>Example 6.4. Primary Domain Controller <code class="filename">smb.conf</code> File Part B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[IPC$]</code></em></td></tr><tr><td><a class="indexterm" name="id350494"></a><em class="parameter"><code>path = /tmp</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id350515"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id350528"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id350540"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id350562"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id350575"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id350587"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id350609"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id350621"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id350634"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id350655"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id350668"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id350680"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id350693"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id350714"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id350727"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id350740"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id350752"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id350765"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-massmbconfC"></a><p class="title"><b>Example 6.5. Primary Domain Controller <code class="filename">smb.conf</code> File Part C</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id350811"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id350823"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id350836"></a><em class="parameter"><code>admin users = bjones</code></em></td></tr><tr><td><a class="indexterm" name="id350848"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id350870"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id350882"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id350895"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id350908"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id350920"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id350942"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id350954"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id350967"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id350980"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id351001"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id351014"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id351026"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id351039"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id351060"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id351073"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id351086"></a><em class="parameter"><code>write list = root</code></em></td></tr><tr><td><a class="indexterm" name="id351098"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-slvsmbocnfA"></a><p class="title"><b>Example 6.6. Backup Domain Controller <code class="filename">smb.conf</code> File Part A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># # Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id351147"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id351160"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id351172"></a><em class="parameter"><code>netbios name = BLDG1</code></em></td></tr><tr><td><a class="indexterm" name="id351185"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://lapdc.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id351198"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id351210"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id351223"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id351236"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id351248"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id351261"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id351273"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id351286"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id351298"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id351311"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id351324"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id351336"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id351349"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id351362"></a><em class="parameter"><code>os level = 63</code></em></td></tr><tr><td><a class="indexterm" name="id351374"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id351387"></a><em class="parameter"><code>wins server = 192.168.2.1</code></em></td></tr><tr><td><a class="indexterm" name="id351399"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id351412"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id351425"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id351437"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id351450"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id351463"></a><em class="parameter"><code>ldap admin dn = cn=sambaadmin,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id351475"></a><em class="parameter"><code>utmp = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id351488"></a><em class="parameter"><code>idmap backend = ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id351501"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id351513"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id351526"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id351547"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id351560"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id351572"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id351594"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id351607"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id351619"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-slvsmbocnfB"></a><p class="title"><b>Example 6.7. Backup Domain Controller <code class="filename">smb.conf</code> File Part B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id351665"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id351678"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id351690"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id351712"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id351724"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id351737"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id351749"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id351771"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id351784"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id351796"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id351809"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id351821"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id351843"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id351855"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id351868"></a><em class="parameter"><code>admin users = bjones</code></em></td></tr><tr><td><a class="indexterm" name="id351880"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id351902"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id351914"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id351927"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id351940"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id351961"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id351974"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id351986"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id351999"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id352020"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id352033"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id352046"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id352058"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id352072"></a>Key Points Learned</h3></div></div></div><div class="itemizedlist"><ul type="disc"><li><p>795 <a class="indexterm" name="id3 52083"></a><a class="indexterm" name="id352088"></a>794 </pre></div></div><br class="example-break"><div class="example"><a name="ch7-massmbconfA"></a><p class="title"><b>Example 6.3. Primary Domain Controller <code class="filename">smb.conf</code> File Part A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id372617"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id372629"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id372640"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id372652"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id372663"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id372675"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id372686"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id372698"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id372709"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id372721"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id372732"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id372744"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id372755"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id372767"></a><em class="parameter"><code>delete user script = /opt/IDEALX/sbin/smbldap-userdel '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id372779"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd -p '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id372791"></a><em class="parameter"><code>delete group script = /opt/IDEALX/sbin/smbldap-groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id372803"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/smbldap-groupmod -m '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id372815"></a><em class="parameter"><code>delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id372827"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id372839"></a><em class="parameter"><code>add machine script = /opt/IDEALX/sbin/smbldap-useradd -w '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id372851"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id372863"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id372875"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id372886"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id372898"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id372909"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id372921"></a><em class="parameter"><code>domain master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id372932"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id372944"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id372955"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id372967"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id372978"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id372990"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id373002"></a><em class="parameter"><code>ldap admin dn = cn=sambaadmin,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id373013"></a><em class="parameter"><code>idmap backend = ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id373025"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id373037"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id373048"></a><em class="parameter"><code>printer admin = root</code></em></td></tr><tr><td><a class="indexterm" name="id373060"></a><em class="parameter"><code>printing = cups</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-massmbconfB"></a><p class="title"><b>Example 6.4. Primary Domain Controller <code class="filename">smb.conf</code> File Part B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[IPC$]</code></em></td></tr><tr><td><a class="indexterm" name="id373104"></a><em class="parameter"><code>path = /tmp</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id373124"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id373136"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id373148"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id373168"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id373180"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id373191"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id373211"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id373223"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id373234"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id373255"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id373266"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id373278"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id373289"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id373310"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id373321"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id373333"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id373344"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id373356"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-massmbconfC"></a><p class="title"><b>Example 6.5. Primary Domain Controller <code class="filename">smb.conf</code> File Part C</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id373401"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id373412"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id373424"></a><em class="parameter"><code>admin users = bjones</code></em></td></tr><tr><td><a class="indexterm" name="id373435"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id373456"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id373467"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id373479"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id373490"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id373502"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id373522"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id373534"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id373545"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id373557"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id373577"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id373589"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id373600"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id373612"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id373632"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id373644"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id373655"></a><em class="parameter"><code>write list = root</code></em></td></tr><tr><td><a class="indexterm" name="id373667"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-slvsmbocnfA"></a><p class="title"><b>Example 6.6. Backup Domain Controller <code class="filename">smb.conf</code> File Part A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># # Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id373715"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id373726"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id373738"></a><em class="parameter"><code>netbios name = BLDG1</code></em></td></tr><tr><td><a class="indexterm" name="id373749"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://lapdc.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id373761"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id373773"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id373784"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id373796"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id373807"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id373819"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id373830"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id373842"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id373853"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id373865"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id373876"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id373888"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id373900"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id373911"></a><em class="parameter"><code>os level = 63</code></em></td></tr><tr><td><a class="indexterm" name="id373922"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id373934"></a><em class="parameter"><code>wins server = 192.168.2.1</code></em></td></tr><tr><td><a class="indexterm" name="id373946"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id373957"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id373969"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id373980"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id373992"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id374004"></a><em class="parameter"><code>ldap admin dn = cn=sambaadmin,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id374015"></a><em class="parameter"><code>utmp = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id374027"></a><em class="parameter"><code>idmap backend = ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id374038"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id374050"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id374061"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id374082"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id374093"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id374105"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id374125"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id374137"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id374148"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-slvsmbocnfB"></a><p class="title"><b>Example 6.7. Backup Domain Controller <code class="filename">smb.conf</code> File Part B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id374193"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id374205"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id374216"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id374237"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id374248"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id374260"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id374271"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id374292"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id374303"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id374315"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id374326"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id374338"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id374358"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id374370"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id374381"></a><em class="parameter"><code>admin users = bjones</code></em></td></tr><tr><td><a class="indexterm" name="id374392"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id374413"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id374424"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id374436"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id374448"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id374468"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id374479"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id374491"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id374502"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id374523"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id374534"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id374546"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id374558"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id374570"></a>Key Points Learned</h3></div></div></div><div class="itemizedlist"><ul type="disc"><li><p> 795 <a class="indexterm" name="id374581"></a><a class="indexterm" name="id374587"></a> 796 796 Where Samba-3 is used as a domain controller, the use of LDAP is an 797 797 essential component to permit the use of BDCs. 798 798 </p></li><li><p> 799 <a class="indexterm" name="id3 52100"></a>799 <a class="indexterm" name="id374599"></a> 800 800 Replication of the LDAP master server to create a network of BDCs 801 801 is an important mechanism for limiting WAN traffic. … … 809 809 departure from this may clog wide-area arteries and slow legitimate network 810 810 traffic to a crawl. 811 </p></li></ul></div></div><div class="figure"><a name="chap7net"></a><p class="title"><b>Figure 6.6. Network Topology 2000 User Complex Design A</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap7-net-Ar.png" width="432" alt="Network Topology 2000 User Complex Design A"></div></div></div><br class="figure-break"><div class="figure"><a name="chap7net2"></a><p class="title"><b>Figure 6.7. Network Topology 2000 User Complex Design B</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap7-net2-Br.png" width="432" alt="Network Topology 2000 User Complex Design B"></div></div></div><br class="figure-break"></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 52211"></a>Questions and Answers</h2></div></div></div><p>811 </p></li></ul></div></div><div class="figure"><a name="chap7net"></a><p class="title"><b>Figure 6.6. Network Topology 2000 User Complex Design A</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap7-net-Ar.png" width="432" alt="Network Topology 2000 User Complex Design A"></div></div></div><br class="figure-break"><div class="figure"><a name="chap7net2"></a><p class="title"><b>Figure 6.7. Network Topology 2000 User Complex Design B</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap7-net2-Br.png" width="432" alt="Network Topology 2000 User Complex Design B"></div></div></div><br class="figure-break"></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id374709"></a>Questions and Answers</h2></div></div></div><p> 812 812 There is much rumor and misinformation regarding the use of MS Windows networking protocols. 813 813 These questions are just a few of those frequently asked. 814 </p><div class="qandaset"><dl><dt> <a href="2000users.html#id3 52228">814 </p><div class="qandaset"><dl><dt> <a href="2000users.html#id374726"> 815 815 816 816 817 817 Is it true that DHCP uses lots of WAN bandwidth? 818 </a></dt><dt> <a href="2000users.html#id3 52348">818 </a></dt><dt> <a href="2000users.html#id374847"> 819 819 820 820 821 821 How much background communication takes place between a master LDAP server and its slave LDAP servers? 822 </a></dt><dt> <a href="2000users.html#id3 52405">822 </a></dt><dt> <a href="2000users.html#id374904"> 823 823 LDAP has a database. Is LDAP not just a fancy database front end? 824 </a></dt><dt> <a href="2000users.html#id3 52462">824 </a></dt><dt> <a href="2000users.html#id374960"> 825 825 826 826 Can Active Directory obtain account information from an OpenLDAP server? 827 </a></dt><dt> <a href="2000users.html#id3 52494">827 </a></dt><dt> <a href="2000users.html#id374993"> 828 828 What are the parts of a roaming profile? How large is each part? 829 </a></dt><dt> <a href="2000users.html#id3 52635">829 </a></dt><dt> <a href="2000users.html#id375134"> 830 830 Can the My Documents folder be stored on a network drive? 831 </a></dt><dt> <a href="2000users.html#id3 52680">831 </a></dt><dt> <a href="2000users.html#id375178"> 832 832 833 833 834 834 835 835 How much WAN bandwidth does WINS consume? 836 </a></dt><dt> <a href="2000users.html#id3 52756">836 </a></dt><dt> <a href="2000users.html#id375255"> 837 837 How many BDCs should I have? What is the right number of Windows clients per server? 838 </a></dt><dt> <a href="2000users.html#id3 52784">838 </a></dt><dt> <a href="2000users.html#id375283"> 839 839 840 840 I've heard that you can store NIS accounts in LDAP. Is LDAP not just a smarter way to 841 841 run an NIS server? 842 </a></dt><dt> <a href="2000users.html#id3 52815">842 </a></dt><dt> <a href="2000users.html#id375313"> 843 843 Can I use NIS in place of LDAP? 844 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id3 52228"></a><a name="id352230"></a></td><td align="left" valign="top"><p>845 <a class="indexterm" name="id3 52234"></a>846 <a class="indexterm" name="id3 52241"></a>844 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id374726"></a><a name="id374728"></a></td><td align="left" valign="top"><p> 845 <a class="indexterm" name="id374732"></a> 846 <a class="indexterm" name="id374739"></a> 847 847 Is it true that DHCP uses lots of WAN bandwidth? 848 848 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 849 <a class="indexterm" name="id3 52257"></a>850 <a class="indexterm" name="id3 52266"></a>851 <a class="indexterm" name="id3 52273"></a>849 <a class="indexterm" name="id374755"></a> 850 <a class="indexterm" name="id374764"></a> 851 <a class="indexterm" name="id374771"></a> 852 852 It is a smart practice to localize DHCP servers on each network segment. As a 853 853 rule, there should be two DHCP servers per network segment. This means that if … … 856 856 routers. This makes it possible to run fewer DHCP servers. 857 857 </p><p> 858 <a class="indexterm" name="id3 52289"></a>859 <a class="indexterm" name="id3 52298"></a>858 <a class="indexterm" name="id374787"></a> 859 <a class="indexterm" name="id374796"></a> 860 860 A DHCP network address request and confirmation usually results in about six UDP packets. 861 861 The packets are from 60 to 568 bytes in length. Let us consider a site that has 300 DHCP … … 875 875 From this can be seen that the traffic impact would be minimal. 876 876 </p><p> 877 <a class="indexterm" name="id3 52327"></a>878 <a class="indexterm" name="id3 52336"></a>877 <a class="indexterm" name="id374826"></a> 878 <a class="indexterm" name="id374835"></a> 879 879 Even when DHCP is configured to do DNS update (dynamic DNS) over a wide-area link, 880 880 the impact of the update is no more than the DHCP IP address renewal traffic and thus 881 881 still insignificant for most practical purposes. 882 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 52348"></a><a name="id352350"></a></td><td align="left" valign="top"><p>883 <a class="indexterm" name="id3 52355"></a>884 <a class="indexterm" name="id3 52362"></a>882 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id374847"></a><a name="id374849"></a></td><td align="left" valign="top"><p> 883 <a class="indexterm" name="id374853"></a> 884 <a class="indexterm" name="id374860"></a> 885 885 How much background communication takes place between a master LDAP server and its slave LDAP servers? 886 886 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 887 <a class="indexterm" name="id3 52381"></a>887 <a class="indexterm" name="id374879"></a> 888 888 The process that controls the replication of data from the master LDAP server to the slave LDAP 889 889 servers is called <code class="literal">slurpd</code>. The <code class="literal">slurpd</code> remains nascent (quiet) 890 890 until an update must be propagated. The propagation traffic per LDAP slave to update (add/modify/delete) 891 891 two user accounts requires less than 10KB traffic. 892 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 52405"></a><a name="id352408"></a></td><td align="left" valign="top"><p>892 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id374904"></a><a name="id374906"></a></td><td align="left" valign="top"><p> 893 893 LDAP has a database. Is LDAP not just a fancy database front end? 894 894 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 895 <a class="indexterm" name="id3 52419"></a>896 <a class="indexterm" name="id3 52426"></a>897 <a class="indexterm" name="id3 52435"></a>898 <a class="indexterm" name="id3 52441"></a>895 <a class="indexterm" name="id374917"></a> 896 <a class="indexterm" name="id374924"></a> 897 <a class="indexterm" name="id374933"></a> 898 <a class="indexterm" name="id374940"></a> 899 899 LDAP does store its data in a database of sorts. In fact, the LDAP backend is an application-specific 900 900 data storage system. This type of database is indexed so that records can be rapidly located, but the … … 905 905 An LDAP front end is a purpose-built tool that has a search orientation that is designed around specific 906 906 simple queries. The term <code class="constant">database</code> is heavily overloaded and thus much misunderstood. 907 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 52462"></a><a name="id352464"></a></td><td align="left" valign="top"><p>908 <a class="indexterm" name="id3 52468"></a>907 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id374960"></a><a name="id374962"></a></td><td align="left" valign="top"><p> 908 <a class="indexterm" name="id374966"></a> 909 909 Can Active Directory obtain account information from an OpenLDAP server? 910 910 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 911 <a class="indexterm" name="id3 52482"></a>911 <a class="indexterm" name="id374980"></a> 912 912 No, at least not directly. It is possible to provision Active Directory from and/or to an OpenLDAP 913 913 database through use of a metadirectory server. Microsoft MMS (now called MIIS) can interface 914 914 to OpenLDAP using standard LDAP queries and updates. 915 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 52494"></a><a name="id352497"></a></td><td align="left" valign="top"><p>915 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id374993"></a><a name="id374995"></a></td><td align="left" valign="top"><p> 916 916 What are the parts of a roaming profile? How large is each part? 917 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id3 52507"></a>917 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id375005"></a> 918 918 A roaming profile consists of 919 919 </p><div class="itemizedlist"><ul type="disc"><li><p> … … 921 921 <code class="constant">My Pictures</code>, <code class="constant">My Music</code>, <code class="constant">Internet Files</code>, 922 922 <code class="constant">Cookies</code>, <code class="constant">Application Data</code>, 923 <code class="constant">Local Settings,</code> and more. See <a href="happy.html" title="Chapter 5. Making Happy Users">???</a>, <a href="happy.html#XP-screen001" title="Figure 5.3. Windows XP Professional User Shared Folders">???</a>.923 <code class="constant">Local Settings,</code> and more. See <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>, <a class="link" href="happy.html#XP-screen001" title="Figure 5.3. Windows XP Professional User Shared Folders">“Windows XP Professional User Shared Folders”</a>. 924 924 </p><p> 925 <a class="indexterm" name="id3 52566"></a>925 <a class="indexterm" name="id375064"></a> 926 926 Each of these can be anywhere from a few bytes to gigabytes in capacity. Fortunately, all 927 such folders can be redirected to network drive resources. See <a href="happy.html#redirfold" title="Configuration of Default Profile with Folder Redirection">???</a>927 such folders can be redirected to network drive resources. See <a class="link" href="happy.html#redirfold" title="Configuration of Default Profile with Folder Redirection">“Configuration of Default Profile with Folder Redirection”</a> 928 928 for more information regarding folder redirection. 929 929 </p></li><li><p> 930 930 A static or rewritable portion that is typically only a few files (2-5 KB of information). 931 931 </p></li><li><p> 932 <a class="indexterm" name="id3 52590"></a>933 <a class="indexterm" name="id3 52596"></a>932 <a class="indexterm" name="id375088"></a> 933 <a class="indexterm" name="id375095"></a> 934 934 The registry load file that modifies the <code class="constant">HKEY_LOCAL_USER</code> hive. This is 935 935 the <code class="filename">NTUSER.DAT</code> file. It can be from 0.4 to 1.5 MB. 936 936 </p></li></ul></div><p> 937 <a class="indexterm" name="id3 52618"></a>937 <a class="indexterm" name="id375116"></a> 938 938 Microsoft Outlook PST files may be stored in the <code class="constant">Local Settings\Application Data</code> 939 939 folder. It can be up to 2 GB in size per PST file. 940 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 52635"></a><a name="id352637"></a></td><td align="left" valign="top"><p>940 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id375134"></a><a name="id375136"></a></td><td align="left" valign="top"><p> 941 941 Can the <code class="constant">My Documents</code> folder be stored on a network drive? 942 942 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 943 <a class="indexterm" name="id3 52652"></a>944 <a class="indexterm" name="id3 52659"></a>943 <a class="indexterm" name="id375151"></a> 944 <a class="indexterm" name="id375157"></a> 945 945 Yes. More correctly, such folders can be redirected to network shares. No specific network drive 946 946 connection is required. Registry settings permit this to be redirected directly to a UNC (Universal 947 947 Naming Convention) resource, though it is possible to specify a network drive letter instead of a 948 UNC name. See <a href="happy.html#redirfold" title="Configuration of Default Profile with Folder Redirection">???</a>.949 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 52680"></a><a name="id352682"></a></td><td align="left" valign="top"><p>950 <a class="indexterm" name="id3 52686"></a>951 <a class="indexterm" name="id3 52693"></a>952 <a class="indexterm" name="id3 52702"></a>948 UNC name. See <a class="link" href="happy.html#redirfold" title="Configuration of Default Profile with Folder Redirection">“Configuration of Default Profile with Folder Redirection”</a>. 949 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id375178"></a><a name="id375180"></a></td><td align="left" valign="top"><p> 950 <a class="indexterm" name="id375185"></a> 951 <a class="indexterm" name="id375192"></a> 952 <a class="indexterm" name="id375201"></a> 953 953 How much WAN bandwidth does WINS consume? 954 954 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 955 <a class="indexterm" name="id3 52716"></a>956 <a class="indexterm" name="id3 52725"></a>957 <a class="indexterm" name="id3 52732"></a>955 <a class="indexterm" name="id375214"></a> 956 <a class="indexterm" name="id375224"></a> 957 <a class="indexterm" name="id375230"></a> 958 958 MS Windows clients cache information obtained from WINS lookups in a local NetBIOS name cache. 959 959 This keeps WINS lookups to a minimum. On a network with 3500 MS Windows clients and a central WINS … … 967 967 In conclusion, the total load afforded through WINS traffic is again marginal to total operational 968 968 usage as it should be. 969 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 52756"></a><a name="id352759"></a></td><td align="left" valign="top"><p>969 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id375255"></a><a name="id375257"></a></td><td align="left" valign="top"><p> 970 970 How many BDCs should I have? What is the right number of Windows clients per server? 971 971 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 981 981 As unsatisfactory as the answer might sound, it all depends on network and server load 982 982 characteristics. 983 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 52784"></a><a name="id352786"></a></td><td align="left" valign="top"><p>984 <a class="indexterm" name="id3 52791"></a><a class="indexterm" name="id352796"></a>983 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id375283"></a><a name="id375285"></a></td><td align="left" valign="top"><p> 984 <a class="indexterm" name="id375289"></a><a class="indexterm" name="id375294"></a> 985 985 I've heard that you can store NIS accounts in LDAP. Is LDAP not just a smarter way to 986 986 run an NIS server? … … 989 989 a configurable schema that can store far more information for many more purposes than 990 990 just NIS. 991 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 52815"></a><a name="id352817"></a></td><td align="left" valign="top"><p>991 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id375313"></a><a name="id375316"></a></td><td align="left" valign="top"><p> 992 992 Can I use NIS in place of LDAP? 993 993 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 994 <a class="indexterm" name="id3 52828"></a>995 <a class="indexterm" name="id3 52835"></a>994 <a class="indexterm" name="id375327"></a> 995 <a class="indexterm" name="id375333"></a> 996 996 No. The NIS database does not have provision to store Microsoft encrypted passwords and does not deal 997 997 with the types of data necessary for interoperability with Microsoft Windows networking. The use -
branches/samba-3.0/docs/htmldocs/Samba3-ByExample/Big500users.html
r44 r134 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 4. The 500-User Office</title><link rel="stylesheet" href=" samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="secure.html" title="Chapter 3. Secure Office Networking"><link rel="next" href="happy.html" title="Chapter 5. Making Happy Users"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 4. The 500-User Office</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="secure.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="happy.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="Big500users"></a>Chapter 4. The 500-User Office</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="Big500users.html#id330645">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id330675">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id330756">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id330784">Technical Issues</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id330961">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id330980">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#ch5-dnshcp-setup">Installation of DHCP, DNS, and Samba Control Files</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id331694">Server Preparation: All Servers</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id332210">Server-Specific Preparation</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5-procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id335273">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id335326">Questions and Answers</a></span></dt></dl></div><p>2 The Samba-3 networking you explored in <a href="secure.html" title="Chapter 3. Secure Office Networking">???</a> covers the finer points of1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 4. The 500-User Office</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="secure.html" title="Chapter 3. Secure Office Networking"><link rel="next" href="happy.html" title="Chapter 5. Making Happy Users"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 4. The 500-User Office</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="secure.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="happy.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="Big500users"></a>Chapter 4. The 500-User Office</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="Big500users.html#id353553">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id353583">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id353662">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id353690">Technical Issues</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id353866">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id353886">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#ch5-dnshcp-setup">Installation of DHCP, DNS, and Samba Control Files</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id354601">Server Preparation: All Servers</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id355116">Server-Specific Preparation</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5-procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id358090">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id358142">Questions and Answers</a></span></dt></dl></div><p> 2 The Samba-3 networking you explored in <a class="link" href="secure.html" title="Chapter 3. Secure Office Networking">“Secure Office Networking”</a> covers the finer points of 3 3 configuration of peripheral services such as DHCP and DNS, and WINS. You experienced 4 4 implementation of a simple configuration of the services that are important adjuncts … … 15 15 so far in this book have focused on implementation of the simplest printing processes 16 16 involving no print job processing intelligence. In this chapter, you maintain 17 that same approach to printing, but <a href="happy.html" title="Chapter 5. Making Happy Users">???</a> presents an opportunity17 that same approach to printing, but <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a> presents an opportunity 18 18 to make printing more complex for the administrator while making it easier for the user. 19 19 </p><p> 20 <a class="indexterm" name="id3 30592"></a>21 <a class="indexterm" name="id3 30598"></a>22 <a class="indexterm" name="id3 30605"></a>23 <a href="secure.html" title="Chapter 3. Secure Office Networking">???</a> demonstrates operation of a DHCP server and a DNS server20 <a class="indexterm" name="id353500"></a> 21 <a class="indexterm" name="id353506"></a> 22 <a class="indexterm" name="id353513"></a> 23 <a class="link" href="secure.html" title="Chapter 3. Secure Office Networking">“Secure Office Networking”</a> demonstrates operation of a DHCP server and a DNS server 24 24 as well as a central WINS server. You validated the operation of these services and 25 25 saw an effective implementation of a Samba domain controller using the … … 42 42 You should take the opportunity to innovate and expand on the methods presented 43 43 here and explore them to the fullest. 44 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 30645"></a>Introduction</h2></div></div></div><p>44 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id353553"></a>Introduction</h2></div></div></div><p> 45 45 Business continues to go well for Abmas. Mr. Meany is driving your success and the 46 46 network continues to grow thanks to the hard work Christine has done. You recently … … 67 67 it is rolled out. Your strategy is to complete the new network so that it 68 68 is ready for operation when the old office moves into the new premises. 69 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 30675"></a>Assignment Tasks</h3></div></div></div><p>69 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id353583"></a>Assignment Tasks</h3></div></div></div><p> 70 70 The acquired business had 280 network users. The old Abmas building housed 71 71 220 network users in unbelievably cramped conditions. The network that … … 108 108 every four months. They automatically roll that out to each desktop system. 109 109 You must keep DirectPointe informed of all changes. 110 </p><p><a class="indexterm" name="id3 30732"></a>110 </p><p><a class="indexterm" name="id353637"></a> 111 111 The new network has a single Samba Primary Domain Controller (PDC) located in the 112 112 Network Operation Center (NOC). Buildings 1 and 2 each have a local server … … 116 116 Printing is based on raw pass-through facilities just as it has been used so far. 117 117 All printer drivers are installed on the desktop and notebook computers. 118 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 30756"></a>Dissection and Discussion</h2></div></div></div><p>119 <a class="indexterm" name="id3 30764"></a>118 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id353662"></a>Dissection and Discussion</h2></div></div></div><p> 119 <a class="indexterm" name="id353670"></a> 120 120 The example you are building in this chapter is of a network design that works, but this 121 121 does not make it a design that is recommended. As a general rule, there should be at least … … 127 127 responsiveness. This network will have 500 clients serviced by one central domain 128 128 controller. This is not a good omen for user satisfaction. You, of course, address this 129 very soon (see <a href="happy.html" title="Chapter 5. Making Happy Users">???</a>).130 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 30784"></a>Technical Issues</h3></div></div></div><p>129 very soon (see <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>). 130 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id353690"></a>Technical Issues</h3></div></div></div><p> 131 131 Stan has talked you into a horrible compromise, but it is addressed. Just make 132 132 certain that the performance of this network is well validated before going live. … … 134 134 Design decisions made in this design include the following: 135 135 </p><div class="itemizedlist"><ul type="disc"><li><p> 136 <a class="indexterm" name="id3 30804"></a>137 <a class="indexterm" name="id3 30811"></a>138 <a class="indexterm" name="id3 30817"></a>136 <a class="indexterm" name="id353710"></a> 137 <a class="indexterm" name="id353716"></a> 138 <a class="indexterm" name="id353723"></a> 139 139 A single PDC is being implemented. This limitation is based on the choice not to 140 140 use LDAP. Many network administrators fear using LDAP because of the perceived … … 142 142 identity management as well as to store network access credentials. 143 143 </p></li><li><p> 144 <a class="indexterm" name="id3 30831"></a>145 <a class="indexterm" name="id3 30838"></a>144 <a class="indexterm" name="id353737"></a> 145 <a class="indexterm" name="id353744"></a> 146 146 Because of the refusal to use an LDAP (ldapsam) passdb backend at this time, the 147 147 only choice that makes sense with 500 users is to use the tdbsam passwd backend. … … 157 157 integrity of operations considerations. 158 158 </p></li><li><p> 159 <a class="indexterm" name="id3 30872"></a>159 <a class="indexterm" name="id353778"></a> 160 160 A single central WINS server is being used. The PDC is also the WINS server. 161 161 Any attempt to operate a routed network without a WINS server while using NetBIOS … … 168 168 why a single WINS server is being implemented. This should work without a problem. 169 169 </p></li><li><p> 170 <a class="indexterm" name="id3 30904"></a>170 <a class="indexterm" name="id353810"></a> 171 171 BDCs make use of <code class="literal">winbindd</code> to provide 172 172 access to domain security credentials for file system access and object storage. 173 173 </p></li><li><p> 174 <a class="indexterm" name="id3 30922"></a>175 <a class="indexterm" name="id3 30931"></a>174 <a class="indexterm" name="id353828"></a> 175 <a class="indexterm" name="id353837"></a> 176 176 Configuration of Windows XP Professional clients is achieved using DHCP. Each 177 177 subnet has its own DHCP server. Backup DHCP serving is provided by one … … 189 189 each subnet. If in the future more addresses are required, it would make sense 190 190 to add further subnets rather than change addressing. 191 </p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 30961"></a>Political Issues</h3></div></div></div><p>191 </p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id353866"></a>Political Issues</h3></div></div></div><p> 192 192 This case gets close to the real world. You and I know the right way to implement 193 193 domain control. Politically, we have to navigate a minefield. In this case, the need is to 194 194 get the PDC rolled out in compliance with expectations and also to be ready to save the day 195 195 by having the real solution ready before it is needed. That real solution is presented in 196 <a href="happy.html" title="Chapter 5. Making Happy Users">???</a>.197 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 30980"></a>Implementation</h2></div></div></div><p>196 <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>. 197 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id353886"></a>Implementation</h2></div></div></div><p> 198 198 The following configuration process begins following installation of Red Hat Fedora Core2 on the 199 three servers shown in the network topology diagram in <a href="Big500users.html#chap05net" title="Figure 4.1. Network Topology 500 User Network Using tdbsam passdb backend.">???</a>. You have199 three servers shown in the network topology diagram in <a class="link" href="Big500users.html#chap05net" title="Figure 4.1. Network Topology 500 User Network Using tdbsam passdb backend.">“Network Topology 500 User Network Using tdbsam passdb backend.”</a>. You have 200 200 selected hardware that is appropriate to the task. 201 201 </p><div class="figure"><a name="chap05net"></a><p class="title"><b>Figure 4.1. Network Topology 500 User Network Using tdbsam passdb backend.</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap5-net.png" width="270" alt="Network Topology 500 User Network Using tdbsam passdb backend."></div></div></div><br class="figure-break"><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch5-dnshcp-setup"></a>Installation of DHCP, DNS, and Samba Control Files</h3></div></div></div><p> 202 202 Carefully install the configuration files into the correct locations as shown in 203 <a href="Big500users.html#ch5-filelocations" title="Table 4.1. Domain: MEGANET, File Locations for Servers">???</a>. You should validate that the full file path is203 <a class="link" href="Big500users.html#ch5-filelocations" title="Table 4.1. Domain: MEGANET, File Locations for Servers">“Domain: MEGANET, File Locations for Servers”</a>. You should validate that the full file path is 204 204 correct as shown. 205 205 </p><p> 206 206 The abbreviation shown in this table as <code class="constant">{VLN}</code> refers to 207 207 the directory location beginning with <code class="filename">/var/lib/named</code>. 208 </p><div class="table"><a name="ch5-filelocations"></a><p class="title"><b>Table 4.1. Domain: <code class="constant">MEGANET</code>, File Locations for Servers</b></p><div class="table-contents"><table summary="Domain: MEGANET, File Locations for Servers" border="1"><colgroup><col align="left"><col align="left"><col align="center"><col align="center"><col align="center"></colgroup><thead><tr><th colspan="2" align="center">File Information</th><th colspan="3" align="center">Server Name</th></tr><tr><th align="center">Source</th><th align="center">Target Location</th><th align="center">MASSIVE</th><th align="center">BLDG1</th><th align="center">BLDG2</th></tr></thead><tbody><tr><td align="left"><a href="Big500users.html#ch5-massivesmb" title="Example 4.1. Server: MASSIVE (PDC), File: /etc/samba/smb.conf">???</a></td><td align="left"><code class="filename">/etc/samba/smb.conf</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a href="Big500users.html#ch5-dc-common" title="Example 4.2. Server: MASSIVE (PDC), File: /etc/samba/dc-common.conf">???</a></td><td align="left"><code class="filename">/etc/samba/dc-common.conf</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a href="Big500users.html#ch5-commonsmb" title="Example 4.3. Common Samba Configuration File: /etc/samba/common.conf">???</a></td><td align="left"><code class="filename">/etc/samba/common.conf</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a href="Big500users.html#ch5-bldg1-smb" title="Example 4.4. Server: BLDG1 (Member), File: smb.conf">???</a></td><td align="left"><code class="filename">/etc/samba/smb.conf</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">No</td></tr><tr><td align="left"><a href="Big500users.html#ch5-bldg2-smb" title="Example 4.5. Server: BLDG2 (Member), File: smb.conf">???</a></td><td align="left"><code class="filename">/etc/samba/smb.conf</code></td><td align="center">No</td><td align="center">No</td><td align="center">Yes</td></tr><tr><td align="left"><a href="Big500users.html#ch5-dommem-smb" title="Example 4.6. Common Domain Member Include File: dom-mem.conf">???</a></td><td align="left"><code class="filename">/etc/samba/dommem.conf</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a href="Big500users.html#massive-dhcp" title="Example 4.7. Server: MASSIVE, File: dhcpd.conf">???</a></td><td align="left"><code class="filename">/etc/dhcpd.conf</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a href="Big500users.html#bldg1dhcp" title="Example 4.8. Server: BLDG1, File: dhcpd.conf">???</a></td><td align="left"><code class="filename">/etc/dhcpd.conf</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">No</td></tr><tr><td align="left"><a href="Big500users.html#bldg2dhcp" title="Example 4.9. Server: BLDG2, File: dhcpd.conf">???</a></td><td align="left"><code class="filename">/etc/dhcpd.conf</code></td><td align="center">No</td><td align="center">No</td><td align="center">Yes</td></tr><tr><td align="left"><a href="Big500users.html#massive-nameda" title="Example 4.10. Server: MASSIVE, File: named.conf, Part: A">???</a></td><td align="left"><code class="filename">/etc/named.conf (part A)</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a href="Big500users.html#massive-namedb" title="Example 4.11. Server: MASSIVE, File: named.conf, Part: B">???</a></td><td align="left"><code class="filename">/etc/named.conf (part B)</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a href="Big500users.html#massive-namedc" title="Example 4.12. Server: MASSIVE, File: named.conf, Part: C">???</a></td><td align="left"><code class="filename">/etc/named.conf (part C)</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a href="Big500users.html#abmasbizdns" title="Example 4.13. Forward Zone File: abmas.biz.hosts">???</a></td><td align="left"><code class="filename">{VLN}/master/abmas.biz.hosts</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a href="Big500users.html#abmasusdns" title="Example 4.14. Forward Zone File: abmas.biz.hosts">???</a></td><td align="left"><code class="filename">{VLN}/master/abmas.us.hosts</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a href="Big500users.html#bldg12nameda" title="Example 4.15. Servers: BLDG1/BLDG2, File: named.conf, Part: A">???</a></td><td align="left"><code class="filename">/etc/named.conf (part A)</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a href="Big500users.html#bldg12namedb" title="Example 4.16. Servers: BLDG1/BLDG2, File: named.conf, Part: B">???</a></td><td align="left"><code class="filename">/etc/named.conf (part B)</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a href="appendix.html#loopback" title="Example 15.3. DNS Localhost Forward Zone File: /var/lib/named/localhost.zone">???</a></td><td align="left"><code class="filename">{VLN}/localhost.zone</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a href="appendix.html#dnsloopy" title="Example 15.4. DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone">???</a></td><td align="left"><code class="filename">{VLN}/127.0.0.zone</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a href="appendix.html#roothint" title="Example 15.5. DNS Root Name Server Hint File: /var/lib/named/root.hint">???</a></td><td align="left"><code class="filename">{VLN}/root.hint</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr></tbody></table></div></div><br class="table-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id331694"></a>Server Preparation: All Servers</h3></div></div></div><p>208 </p><div class="table"><a name="ch5-filelocations"></a><p class="title"><b>Table 4.1. Domain: <code class="constant">MEGANET</code>, File Locations for Servers</b></p><div class="table-contents"><table summary="Domain: MEGANET, File Locations for Servers" border="1"><colgroup><col align="left"><col align="left"><col align="center"><col align="center"><col align="center"></colgroup><thead><tr><th colspan="2" align="center">File Information</th><th colspan="3" align="center">Server Name</th></tr><tr><th align="center">Source</th><th align="center">Target Location</th><th align="center">MASSIVE</th><th align="center">BLDG1</th><th align="center">BLDG2</th></tr></thead><tbody><tr><td align="left"><a class="link" href="Big500users.html#ch5-massivesmb" title="Example 4.1. Server: MASSIVE (PDC), File: /etc/samba/smb.conf">“Server: MASSIVE (PDC), File: /etc/samba/smb.conf”</a></td><td align="left"><code class="filename">/etc/samba/smb.conf</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-dc-common" title="Example 4.2. Server: MASSIVE (PDC), File: /etc/samba/dc-common.conf">“Server: MASSIVE (PDC), File: /etc/samba/dc-common.conf”</a></td><td align="left"><code class="filename">/etc/samba/dc-common.conf</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-commonsmb" title="Example 4.3. Common Samba Configuration File: /etc/samba/common.conf">“Common Samba Configuration File: /etc/samba/common.conf”</a></td><td align="left"><code class="filename">/etc/samba/common.conf</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-bldg1-smb" title="Example 4.4. Server: BLDG1 (Member), File: smb.conf">“Server: BLDG1 (Member), File: smb.conf”</a></td><td align="left"><code class="filename">/etc/samba/smb.conf</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-bldg2-smb" title="Example 4.5. Server: BLDG2 (Member), File: smb.conf">“Server: BLDG2 (Member), File: smb.conf”</a></td><td align="left"><code class="filename">/etc/samba/smb.conf</code></td><td align="center">No</td><td align="center">No</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-dommem-smb" title="Example 4.6. Common Domain Member Include File: dom-mem.conf">“Common Domain Member Include File: dom-mem.conf”</a></td><td align="left"><code class="filename">/etc/samba/dommem.conf</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#massive-dhcp" title="Example 4.7. Server: MASSIVE, File: dhcpd.conf">“Server: MASSIVE, File: dhcpd.conf”</a></td><td align="left"><code class="filename">/etc/dhcpd.conf</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#bldg1dhcp" title="Example 4.8. Server: BLDG1, File: dhcpd.conf">“Server: BLDG1, File: dhcpd.conf”</a></td><td align="left"><code class="filename">/etc/dhcpd.conf</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#bldg2dhcp" title="Example 4.9. Server: BLDG2, File: dhcpd.conf">“Server: BLDG2, File: dhcpd.conf”</a></td><td align="left"><code class="filename">/etc/dhcpd.conf</code></td><td align="center">No</td><td align="center">No</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#massive-nameda" title="Example 4.10. Server: MASSIVE, File: named.conf, Part: A">“Server: MASSIVE, File: named.conf, Part: A”</a></td><td align="left"><code class="filename">/etc/named.conf (part A)</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#massive-namedb" title="Example 4.11. Server: MASSIVE, File: named.conf, Part: B">“Server: MASSIVE, File: named.conf, Part: B”</a></td><td align="left"><code class="filename">/etc/named.conf (part B)</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#massive-namedc" title="Example 4.12. Server: MASSIVE, File: named.conf, Part: C">“Server: MASSIVE, File: named.conf, Part: C”</a></td><td align="left"><code class="filename">/etc/named.conf (part C)</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#abmasbizdns" title="Example 4.13. Forward Zone File: abmas.biz.hosts">“Forward Zone File: abmas.biz.hosts”</a></td><td align="left"><code class="filename">{VLN}/master/abmas.biz.hosts</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#abmasusdns" title="Example 4.14. Forward Zone File: abmas.biz.hosts">“Forward Zone File: abmas.biz.hosts”</a></td><td align="left"><code class="filename">{VLN}/master/abmas.us.hosts</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#bldg12nameda" title="Example 4.15. Servers: BLDG1/BLDG2, File: named.conf, Part: A">“Servers: BLDG1/BLDG2, File: named.conf, Part: A”</a></td><td align="left"><code class="filename">/etc/named.conf (part A)</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#bldg12namedb" title="Example 4.16. Servers: BLDG1/BLDG2, File: named.conf, Part: B">“Servers: BLDG1/BLDG2, File: named.conf, Part: B”</a></td><td align="left"><code class="filename">/etc/named.conf (part B)</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="appendix.html#loopback" title="Example 15.3. DNS Localhost Forward Zone File: /var/lib/named/localhost.zone">“DNS Localhost Forward Zone File: /var/lib/named/localhost.zone”</a></td><td align="left"><code class="filename">{VLN}/localhost.zone</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="appendix.html#dnsloopy" title="Example 15.4. DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone">“DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone”</a></td><td align="left"><code class="filename">{VLN}/127.0.0.zone</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="appendix.html#roothint" title="Example 15.5. DNS Root Name Server Hint File: /var/lib/named/root.hint">“DNS Root Name Server Hint File: /var/lib/named/root.hint”</a></td><td align="left"><code class="filename">{VLN}/root.hint</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr></tbody></table></div></div><br class="table-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id354601"></a>Server Preparation: All Servers</h3></div></div></div><p> 209 209 The following steps apply to all servers. Follow each step carefully. 210 </p><div class="procedure"><a name="id3 31704"></a><p class="title"><b>Procedure 4.1. Server Preparation Steps</b></p><ol type="1"><li><p>210 </p><div class="procedure"><a name="id354610"></a><p class="title"><b>Procedure 4.1. Server Preparation Steps</b></p><ol type="1"><li><p> 211 211 Using the UNIX/Linux system tools, set the name of the server as shown in the network 212 topology diagram in <a href="Big500users.html#chap05net" title="Figure 4.1. Network Topology 500 User Network Using tdbsam passdb backend.">???</a>. For SUSE Linux products, the tool212 topology diagram in <a class="link" href="Big500users.html#chap05net" title="Figure 4.1. Network Topology 500 User Network Using tdbsam passdb backend.">“Network Topology 500 User Network Using tdbsam passdb backend.”</a>. For SUSE Linux products, the tool 213 213 that permits this is called <code class="literal">yast2</code>; for Red Hat Linux products, 214 214 you can use the <code class="literal">netcfg</code> tool. … … 222 222 </pre><p> 223 223 </p></li><li><p> 224 <a class="indexterm" name="id3 31765"></a>225 <a class="indexterm" name="id3 31772"></a>224 <a class="indexterm" name="id354671"></a> 225 <a class="indexterm" name="id354678"></a> 226 226 Edit your <code class="filename">/etc/hosts</code> file to include the primary names and addresses 227 227 of all network interfaces that are on the host server. This is necessary so that during … … 231 231 should also include an entry for the printers in the <code class="filename">/etc/hosts</code> file. 232 232 </p></li><li><p> 233 <a class="indexterm" name="id3 31807"></a>233 <a class="indexterm" name="id354713"></a> 234 234 All DNS name resolution should be handled locally. To ensure that the server is configured 235 235 correctly to handle this, edit <code class="filename">/etc/resolv.conf</code> so it has the following … … 242 242 that is running locally to resolve names to addresses. 243 243 </p></li><li><p> 244 <a class="indexterm" name="id3 31835"></a>245 <a class="indexterm" name="id3 31842"></a>244 <a class="indexterm" name="id354741"></a> 245 <a class="indexterm" name="id354748"></a> 246 246 Add the <code class="constant">root</code> user to the password backend: 247 247 </p><pre class="screen"> … … 256 256 without considerable trouble. 257 257 </p></li><li><p> 258 <a class="indexterm" name="id3 31883"></a>259 <a class="indexterm" name="id3 31890"></a>258 <a class="indexterm" name="id354790"></a> 259 <a class="indexterm" name="id354796"></a> 260 260 Create the username map file to permit the <code class="constant">root</code> account to be called 261 261 <code class="constant">Administrator</code> from the Windows network environment. To do this, create … … 289 289 in both the forward lookup database for the zone <code class="constant">abmas.biz.hosts</code> 290 290 and in the reverse lookup database for the network segment that the printer is 291 located in. Example configuration files for similar zones were presented in <a href="secure.html" title="Chapter 3. Secure Office Networking">???</a>,292 <a href="secure.html#abmasbiz" title="Example 3.14. DNS Abmas.biz Forward Zone File">???</a> and <a href="secure.html#eth2zone" title="Example 3.13. DNS 192.168.2 Reverse Zone File">???</a>.291 located in. Example configuration files for similar zones were presented in <a class="link" href="secure.html" title="Chapter 3. Secure Office Networking">“Secure Office Networking”</a>, 292 <a class="link" href="secure.html#abmasbiz" title="Example 3.14. DNS Abmas.biz Forward Zone File">“DNS Abmas.biz Forward Zone File”</a> and <a class="link" href="secure.html#eth2zone" title="Example 3.13. DNS 192.168.2 Reverse Zone File">“DNS 192.168.2 Reverse Zone File”</a>. 293 293 </p></li><li><p> 294 294 Follow the instructions in the printer manufacturer's manuals to permit printing 295 295 to port 9100. Use any other port the manufacturer specifies for direct mode, 296 296 raw printing. This allows the CUPS spooler to print using raw mode protocols. 297 <a class="indexterm" name="id3 31970"></a>298 <a class="indexterm" name="id3 31977"></a>299 </p></li><li><p> 300 <a class="indexterm" name="id3 31990"></a>297 <a class="indexterm" name="id354876"></a> 298 <a class="indexterm" name="id354883"></a> 299 </p></li><li><p> 300 <a class="indexterm" name="id354896"></a> 301 301 Only on the server to which the printer is attached configure the CUPS Print 302 302 Queues as follows: … … 304 304 <code class="prompt">root# </code> lpadmin -p <em class="parameter"><code>printque</code></em> -v socket://<em class="parameter"><code>printer-name</code></em>.abmas.biz:9100 -E 305 305 </pre><p> 306 <a class="indexterm" name="id3 32024"></a>306 <a class="indexterm" name="id354930"></a> 307 307 This step creates the necessary print queue to use no assigned print filter. This 308 308 is ideal for raw printing, that is, printing without use of filters. … … 324 324 </pre><p> 325 325 </p></li><li><p> 326 <a class="indexterm" name="id3 32097"></a>327 <a class="indexterm" name="id3 32103"></a>328 <a class="indexterm" name="id3 32110"></a>326 <a class="indexterm" name="id355003"></a> 327 <a class="indexterm" name="id355010"></a> 328 <a class="indexterm" name="id355016"></a> 329 329 This step, as well as the next one, may be omitted where CUPS version 1.1.18 330 330 or later is in use. Although it does no harm to follow it anyway, and may … … 337 337 </pre><p> 338 338 </p></li><li><p> 339 <a class="indexterm" name="id3 32142"></a>339 <a class="indexterm" name="id355049"></a> 340 340 Edit the file <code class="filename">/etc/cups/mime.types</code> to uncomment the line: 341 341 </p><pre class="screen"> … … 353 353 replicated using a tool such as <code class="literal">rsync</code>. Refer to the man 354 354 page for <code class="literal">rsync</code> for details regarding use. The notes in 355 <a href="secure.html#ch4appscfg" title="Application Share Configuration">???</a> may help in your decisions to use an application355 <a class="link" href="secure.html#ch4appscfg" title="Application Share Configuration">“Application Share Configuration”</a> may help in your decisions to use an application 356 356 server facility. 357 357 </p></li></ol></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> … … 360 360 is considerably more difficult when a single PDC is used on a routed network. It can be done, but not 361 361 as elegantly as you see in the next chapter. 362 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 32210"></a>Server-Specific Preparation</h3></div></div></div><p>362 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id355116"></a>Server-Specific Preparation</h3></div></div></div><p> 363 363 There are some steps that apply to particular server functionality only. Each step is critical 364 364 to correct server operation. The following step-by-step installation guidance will assist you 365 365 in working through the process of configuring the PDC and then both BDC's. 366 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 32221"></a>Configuration for Server: <code class="constant">MASSIVE</code></h4></div></div></div><p>366 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id355127"></a>Configuration for Server: <code class="constant">MASSIVE</code></h4></div></div></div><p> 367 367 The steps presented here attempt to implement Samba installation in a generic manner. While 368 368 some steps are clearly specific to Linux, it should not be too difficult to apply them to 369 369 your platform of choice. 370 </p><div class="procedure"><a name="id3 32234"></a><p class="title"><b>Procedure 4.2. Primary Domain Controller Preparation</b></p><ol type="1"><li><p>371 <a class="indexterm" name="id3 32245"></a>372 <a class="indexterm" name="id3 32252"></a>370 </p><div class="procedure"><a name="id355140"></a><p class="title"><b>Procedure 4.2. Primary Domain Controller Preparation</b></p><ol type="1"><li><p> 371 <a class="indexterm" name="id355152"></a> 372 <a class="indexterm" name="id355158"></a> 373 373 The host server acts as a router between the two internal network segments as well 374 374 as for all Internet access. This necessitates that IP forwarding be enabled. This can be … … 398 398 <code class="filename">/etc/rc.d/init.d/rc.local</code>. 399 399 </p></li><li><p> 400 <a class="indexterm" name="id3 32330"></a>400 <a class="indexterm" name="id355236"></a> 401 401 The final step that must be completed is to edit the <code class="filename">/etc/nsswitch.conf</code> file. 402 402 This file controls the operation of the various resolver libraries that are part of the Linux … … 406 406 </pre><p> 407 407 </p></li><li><p> 408 <a class="indexterm" name="id3 32357"></a>408 <a class="indexterm" name="id355264"></a> 409 409 Create and map Windows domain groups to UNIX groups. A sample script is provided in 410 <a href="Big500users.html#ch5-initgrps" title="Example 4.17. Initialize Groups Script, File: /etc/samba/initGrps.sh">???</a>. Create a file containing this script. You called yours410 <a class="link" href="Big500users.html#ch5-initgrps" title="Example 4.17. Initialize Groups Script, File: /etc/samba/initGrps.sh">“Initialize Groups Script, File: /etc/samba/initGrps.sh”</a>. Create a file containing this script. You called yours 411 411 <code class="filename">/etc/samba/initGrps.sh</code>. Set this file so it can be executed 412 412 and then execute the script. An example of the execution of this script as well as its 413 413 validation are shown in Section 4.3.2, Step 5. 414 414 </p></li><li><p> 415 <a class="indexterm" name="id3 32386"></a>416 <a class="indexterm" name="id3 32392"></a>417 <a class="indexterm" name="id3 32402"></a>415 <a class="indexterm" name="id355292"></a> 416 <a class="indexterm" name="id355299"></a> 417 <a class="indexterm" name="id355308"></a> 418 418 For each user who needs to be given a Windows domain account, make an entry in the 419 419 <code class="filename">/etc/passwd</code> file as well as in the Samba password backend. … … 421 421 <code class="literal">smbpasswd</code> to create a domain user account. 422 422 </p><p> 423 <a class="indexterm" name="id3 32426"></a>424 <a class="indexterm" name="id3 32433"></a>425 <a class="indexterm" name="id3 32439"></a>423 <a class="indexterm" name="id355332"></a> 424 <a class="indexterm" name="id355339"></a> 425 <a class="indexterm" name="id355346"></a> 426 426 There are a number of tools for user management under UNIX, such as 427 427 <code class="literal">useradd</code>, <code class="literal">adduser</code>, as well as a plethora of custom … … 436 436 file system partition using appropriate system tools. 437 437 </p></li><li><p> 438 <a class="indexterm" name="id3 32498"></a>438 <a class="indexterm" name="id355404"></a> 439 439 Create the top-level file storage directories for data and applications as follows: 440 440 </p><pre class="screen"> … … 476 476 </pre><p> 477 477 </p></li><li><p> 478 <a class="indexterm" name="id3 32690"></a>479 <a class="indexterm" name="id3 32697"></a>478 <a class="indexterm" name="id355597"></a> 479 <a class="indexterm" name="id355604"></a> 480 480 Create a logon script. It is important that each line is correctly terminated with 481 481 a carriage return and line-feed combination (i.e., DOS encoding). The following procedure … … 510 510 You do, of course, use a valid user login ID in place of <em class="parameter"><code>username</code></em>. 511 511 </p></li><li><p> 512 Follow the processes shown in <a href="Big500users.html#ch5-procstart" title="Process Startup Configuration">???</a> to start all services.512 Follow the processes shown in <a class="link" href="Big500users.html#ch5-procstart" title="Process Startup Configuration">“Process Startup Configuration”</a> to start all services. 513 513 </p></li><li><p> 514 514 Your server is ready for validation testing. Do not proceed with the steps in 515 <a href="Big500users.html#ch5-domsvrspec" title="Configuration Specific to Domain Member Servers: BLDG1, BLDG2">???</a> until after the operation of the server has been516 validated following the same methods as outlined in <a href="secure.html" title="Chapter 3. Secure Office Networking">???</a>, <a href="secure.html#ch4valid" title="Validation">???</a>.515 <a class="link" href="Big500users.html#ch5-domsvrspec" title="Configuration Specific to Domain Member Servers: BLDG1, BLDG2">“Configuration Specific to Domain Member Servers: BLDG1, BLDG2”</a> until after the operation of the server has been 516 validated following the same methods as outlined in <a class="link" href="secure.html" title="Chapter 3. Secure Office Networking">“Secure Office Networking”</a>, <a class="link" href="secure.html#ch4valid" title="Validation">“Validation”</a>. 517 517 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="ch5-domsvrspec"></a>Configuration Specific to Domain Member Servers: <code class="constant">BLDG1, BLDG2</code></h4></div></div></div><p> 518 518 The following steps will guide you through the nuances of implementing BDCs for the broadcast 519 519 isolated network segments. Remember that if the target installation platform is not Linux, it may 520 520 be necessary to adapt some commands to the equivalent on the target platform. 521 </p><div class="procedure"><a name="id3 32869"></a><p class="title"><b>Procedure 4.3. Backup Domain Controller Configuration Steps</b></p><ol type="1"><li><p>522 <a class="indexterm" name="id3 32880"></a>521 </p><div class="procedure"><a name="id355775"></a><p class="title"><b>Procedure 4.3. Backup Domain Controller Configuration Steps</b></p><ol type="1"><li><p> 522 <a class="indexterm" name="id355786"></a> 523 523 The final step that must be completed is to edit the <code class="filename">/etc/nsswitch.conf</code> file. 524 524 This file controls the operation of the various resolver libraries that are part of the Linux … … 530 530 </pre><p> 531 531 </p></li><li><p> 532 Follow the steps outlined in <a href="Big500users.html#ch5-procstart" title="Process Startup Configuration">???</a> to start all services. Do not532 Follow the steps outlined in <a class="link" href="Big500users.html#ch5-procstart" title="Process Startup Configuration">“Process Startup Configuration”</a> to start all services. Do not 533 533 start Samba at this time. Samba is controlled by the process called <code class="literal">smb</code>. 534 534 </p></li><li><p> 535 <a class="indexterm" name="id3 32927"></a>535 <a class="indexterm" name="id355833"></a> 536 536 You must now attempt to join the domain member servers to the domain. The following 537 537 instructions should be executed to effect this: … … 540 540 </pre><p> 541 541 </p></li><li><p> 542 <a class="indexterm" name="id3 32958"></a>542 <a class="indexterm" name="id355864"></a> 543 543 You now start the Samba services by executing: 544 544 </p><pre class="screen"> … … 547 547 </p></li><li><p> 548 548 Your server is ready for validation testing. Do not proceed with the steps in 549 <a href="Big500users.html#ch5-domsvrspec" title="Configuration Specific to Domain Member Servers: BLDG1, BLDG2">???</a> until after the operation of the server has been550 validated following the same methods as outlined in <a href="secure.html#ch4valid" title="Validation">???</a>.551 </p></li></ol></div></div></div><div class="example"><a name="ch5-massivesmb"></a><p class="title"><b>Example 4.1. Server: MASSIVE (PDC), File: <code class="filename">/etc/samba/smb.conf</code></b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id3 33040"></a><em class="parameter"><code>workgroup = MEGANET</code></em></td></tr><tr><td><a class="indexterm" name="id333052"></a><em class="parameter"><code>netbios name = MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id333065"></a><em class="parameter"><code>interfaces = eth1, lo</code></em></td></tr><tr><td><a class="indexterm" name="id333077"></a><em class="parameter"><code>bind interfaces only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id333090"></a><em class="parameter"><code>passdb backend = tdbsam</code></em></td></tr><tr><td><a class="indexterm" name="id333102"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id333115"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id333128"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id333140"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id333153"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id333166"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -G '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id333179"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id333192"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id333205"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id333217"></a><em class="parameter"><code>include = /etc/samba/dc-common.conf</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id333239"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id333252"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id333264"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id333286"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id333298"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id333311"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id333332"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id333345"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id333357"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-dc-common"></a><p class="title"><b>Example 4.2. Server: MASSIVE (PDC), File: <code class="filename">/etc/samba/dc-common.conf</code></b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id333405"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id333418"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id333431"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id333443"></a><em class="parameter"><code>logon path = \%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id333456"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id333469"></a><em class="parameter"><code>logon home = \%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id333481"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id333494"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id333506"></a><em class="parameter"><code>include = /etc/samba/common.conf</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id333528"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id333540"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id333553"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id333566"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id333587"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id333600"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id333612"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id333625"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id333646"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id333659"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id333672"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id333684"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-commonsmb"></a><p class="title"><b>Example 4.3. Common Samba Configuration File: <code class="filename">/etc/samba/common.conf</code></b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id333728"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id333741"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id333753"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id333766"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id333779"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id333791"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id333804"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id333816"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id333829"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id333841"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id333854"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id333867"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id333880"></a><em class="parameter"><code>utmp = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id333892"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id333905"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id333917"></a><em class="parameter"><code>veto files = /*.eml/*.nws/*.{*}/</code></em></td></tr><tr><td><a class="indexterm" name="id333930"></a><em class="parameter"><code>veto oplock files = /*.doc/*.xls/*.mdb/</code></em></td></tr><tr><td><a class="indexterm" name="id333943"></a><em class="parameter"><code>include = </code></em></td></tr><tr><td># Share and Service Definitions are common to all servers</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id333968"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id333981"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id333993"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id334006"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id334018"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id334031"></a><em class="parameter"><code>default devmode = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id334043"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id334065"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id334077"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id334090"></a><em class="parameter"><code>admin users = bjordan</code></em></td></tr><tr><td><a class="indexterm" name="id334102"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-bldg1-smb"></a><p class="title"><b>Example 4.4. Server: BLDG1 (Member), File: smb.conf</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id334145"></a><em class="parameter"><code>workgroup = MEGANET</code></em></td></tr><tr><td><a class="indexterm" name="id334158"></a><em class="parameter"><code>netbios name = BLDG1</code></em></td></tr><tr><td><a class="indexterm" name="id334170"></a><em class="parameter"><code>include = /etc/samba/dom-mem.conf</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-bldg2-smb"></a><p class="title"><b>Example 4.5. Server: BLDG2 (Member), File: smb.conf</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id334214"></a><em class="parameter"><code>workgroup = MEGANET</code></em></td></tr><tr><td><a class="indexterm" name="id334226"></a><em class="parameter"><code>netbios name = BLDG2</code></em></td></tr><tr><td><a class="indexterm" name="id334239"></a><em class="parameter"><code>include = /etc/samba/dom-mem.conf</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-dommem-smb"></a><p class="title"><b>Example 4.6. Common Domain Member Include File: dom-mem.conf</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id334282"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id334295"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id334307"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id334320"></a><em class="parameter"><code>wins server = 172.16.0.1</code></em></td></tr><tr><td><a class="indexterm" name="id334333"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id334345"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id334358"></a><em class="parameter"><code>include = /etc/samba/common.conf</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="massive-dhcp"></a><p class="title"><b>Example 4.7. Server: MASSIVE, File: dhcpd.conf</b></p><div class="example-contents"><pre class="screen">549 <a class="link" href="Big500users.html#ch5-domsvrspec" title="Configuration Specific to Domain Member Servers: BLDG1, BLDG2">“Configuration Specific to Domain Member Servers: BLDG1, BLDG2”</a> until after the operation of the server has been 550 validated following the same methods as outlined in <a class="link" href="secure.html#ch4valid" title="Validation">“Validation”</a>. 551 </p></li></ol></div></div></div><div class="example"><a name="ch5-massivesmb"></a><p class="title"><b>Example 4.1. Server: MASSIVE (PDC), File: <code class="filename">/etc/samba/smb.conf</code></b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id355946"></a><em class="parameter"><code>workgroup = MEGANET</code></em></td></tr><tr><td><a class="indexterm" name="id355957"></a><em class="parameter"><code>netbios name = MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id355969"></a><em class="parameter"><code>interfaces = eth1, lo</code></em></td></tr><tr><td><a class="indexterm" name="id355980"></a><em class="parameter"><code>bind interfaces only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id355992"></a><em class="parameter"><code>passdb backend = tdbsam</code></em></td></tr><tr><td><a class="indexterm" name="id356003"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id356015"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id356026"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id356038"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id356050"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id356062"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -G '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id356074"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id356086"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id356097"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id356109"></a><em class="parameter"><code>include = /etc/samba/dc-common.conf</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id356129"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id356141"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id356152"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id356173"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id356184"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id356196"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id356216"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id356228"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id356239"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-dc-common"></a><p class="title"><b>Example 4.2. Server: MASSIVE (PDC), File: <code class="filename">/etc/samba/dc-common.conf</code></b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id356286"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id356298"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id356309"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id356321"></a><em class="parameter"><code>logon path = \%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id356332"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id356344"></a><em class="parameter"><code>logon home = \%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id356355"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id356367"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id356378"></a><em class="parameter"><code>include = /etc/samba/common.conf</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id356399"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id356410"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id356422"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id356433"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id356454"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id356465"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id356477"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id356488"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id356509"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id356520"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id356532"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id356543"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-commonsmb"></a><p class="title"><b>Example 4.3. Common Samba Configuration File: <code class="filename">/etc/samba/common.conf</code></b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id356586"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id356598"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id356610"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id356621"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id356633"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id356644"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id356656"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id356667"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id356679"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id356690"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id356702"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id356713"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id356725"></a><em class="parameter"><code>utmp = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id356737"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id356748"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id356760"></a><em class="parameter"><code>veto files = /*.eml/*.nws/*.{*}/</code></em></td></tr><tr><td><a class="indexterm" name="id356771"></a><em class="parameter"><code>veto oplock files = /*.doc/*.xls/*.mdb/</code></em></td></tr><tr><td><a class="indexterm" name="id356783"></a><em class="parameter"><code>include = </code></em></td></tr><tr><td># Share and Service Definitions are common to all servers</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id356807"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id356819"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id356830"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id356842"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id356853"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id356864"></a><em class="parameter"><code>default devmode = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id356876"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id356896"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id356908"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id356919"></a><em class="parameter"><code>admin users = bjordan</code></em></td></tr><tr><td><a class="indexterm" name="id356931"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-bldg1-smb"></a><p class="title"><b>Example 4.4. Server: BLDG1 (Member), File: smb.conf</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id356973"></a><em class="parameter"><code>workgroup = MEGANET</code></em></td></tr><tr><td><a class="indexterm" name="id356984"></a><em class="parameter"><code>netbios name = BLDG1</code></em></td></tr><tr><td><a class="indexterm" name="id356996"></a><em class="parameter"><code>include = /etc/samba/dom-mem.conf</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-bldg2-smb"></a><p class="title"><b>Example 4.5. Server: BLDG2 (Member), File: smb.conf</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id357038"></a><em class="parameter"><code>workgroup = MEGANET</code></em></td></tr><tr><td><a class="indexterm" name="id357049"></a><em class="parameter"><code>netbios name = BLDG2</code></em></td></tr><tr><td><a class="indexterm" name="id357061"></a><em class="parameter"><code>include = /etc/samba/dom-mem.conf</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-dommem-smb"></a><p class="title"><b>Example 4.6. Common Domain Member Include File: dom-mem.conf</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id357103"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id357114"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id357126"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id357138"></a><em class="parameter"><code>wins server = 172.16.0.1</code></em></td></tr><tr><td><a class="indexterm" name="id357149"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id357161"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id357172"></a><em class="parameter"><code>include = /etc/samba/common.conf</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="massive-dhcp"></a><p class="title"><b>Example 4.7. Server: MASSIVE, File: dhcpd.conf</b></p><div class="example-contents"><pre class="screen"> 552 552 # Abmas Accounting Inc. 553 553 … … 899 899 net groupmap add ntgroup="Insurance Group" unixgroup=piops type=d 900 900 </pre></div></div><br class="example-break"><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch5-procstart"></a>Process Startup Configuration</h3></div></div></div><p> 901 <a class="indexterm" name="id3 34644"></a>902 <a class="indexterm" name="id3 34650"></a>901 <a class="indexterm" name="id357460"></a> 902 <a class="indexterm" name="id357467"></a> 903 903 There are two essential steps to process startup configuration. A process 904 904 must be configured so that it is automatically restarted each time the server … … 909 909 necessary start or kill script is run. 910 910 </p><p> 911 <a class="indexterm" name="id3 34682"></a>911 <a class="indexterm" name="id357499"></a> 912 912 In the event that a service is provided not as a daemon but via the internetworking 913 913 super daemon (<code class="literal">inetd</code> or <code class="literal">xinetd</code>), then the <code class="literal">chkconfig</code> … … 919 919 are for a Red Hat Linux system, please adapt them to suit the target OS platform on which you 920 920 are installing Samba. 921 </p><div class="procedure"><a name="id3 34722"></a><p class="title"><b>Procedure 4.4. Process Startup Configuration Steps</b></p><ol type="1"><li><p>921 </p><div class="procedure"><a name="id357538"></a><p class="title"><b>Procedure 4.4. Process Startup Configuration Steps</b></p><ol type="1"><li><p> 922 922 Use the standard system tool to configure each service to restart 923 923 automatically at every system reboot. For example, 924 <a class="indexterm" name="id3 34734"></a>924 <a class="indexterm" name="id357551"></a> 925 925 </p><pre class="screen"> 926 926 <code class="prompt">root# </code> chkconfig dhpc on … … 931 931 </pre><p> 932 932 </p></li><li><p> 933 <a class="indexterm" name="id3 34783"></a>934 <a class="indexterm" name="id3 34790"></a>935 <a class="indexterm" name="id3 34797"></a>933 <a class="indexterm" name="id357600"></a> 934 <a class="indexterm" name="id357607"></a> 935 <a class="indexterm" name="id357613"></a> 936 936 Now start each service to permit the system to be validated. 937 937 Execute each of the following in the sequence shown: … … 947 947 The procedure for desktop client configuration for the network in this chapter is similar to 948 948 that used for the previous one. There are a few subtle changes that should be noted. 949 </p><div class="procedure"><a name="id3 34858"></a><p class="title"><b>Procedure 4.5. Windows Client Configuration Steps</b></p><ol type="1"><li><p>949 </p><div class="procedure"><a name="id357674"></a><p class="title"><b>Procedure 4.5. Windows Client Configuration Steps</b></p><ol type="1"><li><p> 950 950 Install MS Windows XP Professional. During installation, configure the client to use DHCP for 951 951 TCP/IP protocol configuration. 952 <a class="indexterm" name="id3 34870"></a>953 <a class="indexterm" name="id3 34877"></a>952 <a class="indexterm" name="id357686"></a> 953 <a class="indexterm" name="id357693"></a> 954 954 DHCP configures all Windows clients to use the WINS Server address that has been defined 955 955 for the local subnet. … … 958 958 username <code class="constant">root</code> and the SMB password you assigned to this account. 959 959 A detailed step-by-step procedure for joining a Windows 200x/XP Professional client to 960 a Windows domain is given in <a href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">???</a>, <a href="appendix.html#domjoin" title="Joining a Domain: Windows 200x/XP Professional">???</a>.960 a Windows domain is given in <a class="link" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">“A Collection of Useful Tidbits”</a>, <a class="link" href="appendix.html#domjoin" title="Joining a Domain: Windows 200x/XP Professional">“Joining a Domain: Windows 200x/XP Professional”</a>. 961 961 Reboot the machine as prompted and then log on using the domain administrator account 962 962 (<code class="constant">root</code>). … … 986 986 Install printers on each machine using the following steps: 987 987 988 </p><div class="procedure"><a name="id3 34992"></a><p class="title"><b>Procedure 4.6. Steps to Install Printer Drivers on Windows Clients</b></p><ol type="1"><li><p>988 </p><div class="procedure"><a name="id357809"></a><p class="title"><b>Procedure 4.6. Steps to Install Printer Drivers on Windows Clients</b></p><ol type="1"><li><p> 989 989 Click <span class="guimenu">Start</span> → <span class="guimenuitem">Settings</span> → <span class="guimenuitem">Printers</span>+<span class="guiicon">Add Printer</span>+<span class="guibutton">Next</span>. Do not click <span class="guimenuitem">Network printer</span>. 990 990 Ensure that <span class="guimenuitem">Local printer</span> is selected. … … 1033 1033 </p></li><li><p> 1034 1034 Log onto the machine as the local Administrator (the only option), and join the machine to 1035 the domain following the procedure set out in <a href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">???</a>, <a href="appendix.html#domjoin" title="Joining a Domain: Windows 200x/XP Professional">???</a>. You must now set the1035 the domain following the procedure set out in <a class="link" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">“A Collection of Useful Tidbits”</a>, <a class="link" href="appendix.html#domjoin" title="Joining a Domain: Windows 200x/XP Professional">“Joining a Domain: Windows 200x/XP Professional”</a>. You must now set the 1036 1036 persistent drive mapping to the applications server that the user is to use. The system is now 1037 1037 ready for the user to log on, provided you have created a network logon account for that … … 1039 1039 </p></li><li><p> 1040 1040 Instruct all users to log onto the workstation using their assigned username and password. 1041 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 35273"></a>Key Points Learned</h3></div></div></div><p>1041 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id358090"></a>Key Points Learned</h3></div></div></div><p> 1042 1042 The network you have just deployed has been a valuable exercise in forced constraint. 1043 1043 You have deployed a network that works well, although you may soon start to see 1044 performance problems, at which time the modifications demonstrated in <a href="happy.html" title="Chapter 5. Making Happy Users">???</a>1044 performance problems, at which time the modifications demonstrated in <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a> 1045 1045 bring the network to life. The following key learning points were experienced: 1046 1046 </p><div class="itemizedlist"><ul type="disc"><li><p> … … 1055 1055 </p></li><li><p> 1056 1056 The introduction of roaming profiles 1057 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 35326"></a>Questions and Answers</h2></div></div></div><p>1058 </p><div class="qandaset"><dl><dt> <a href="Big500users.html#id3 35341">1057 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id358142"></a>Questions and Answers</h2></div></div></div><p> 1058 </p><div class="qandaset"><dl><dt> <a href="Big500users.html#id358158"> 1059 1059 The example smb.conf files in this chapter make use of the include facility. 1060 1060 How may I get to see what the actual working smb.conf settings are? 1061 </a></dt><dt> <a href="Big500users.html#id3 35388">1061 </a></dt><dt> <a href="Big500users.html#id358205"> 1062 1062 Why does the include file common.conf have an empty include statement? 1063 </a></dt><dt> <a href="Big500users.html#id3 35445">1063 </a></dt><dt> <a href="Big500users.html#id358262"> 1064 1064 I accept that the simplest configuration necessary to do the job is the best. The use of tdbsam 1065 1065 passdb backend is much simpler than having to manage an LDAP-based ldapsam passdb backend. 1066 1066 I tried using rsync to replicate the passdb.tdb, and it seems to work fine! 1067 1067 So what is the problem? 1068 </a></dt><dt> <a href="Big500users.html#id3 35495">1068 </a></dt><dt> <a href="Big500users.html#id358312"> 1069 1069 You are using DHCP Relay enabled on the routers as well as a local DHCP server. Will this cause a clash? 1070 </a></dt><dt> <a href="Big500users.html#id3 35520">1070 </a></dt><dt> <a href="Big500users.html#id358337"> 1071 1071 How does the Windows client find the PDC? 1072 </a></dt><dt> <a href="Big500users.html#id3 35540">1072 </a></dt><dt> <a href="Big500users.html#id358356"> 1073 1073 Why did you enable IP forwarding (routing) only on the server called MASSIVE? 1074 </a></dt><dt> <a href="Big500users.html#id3 35567">1074 </a></dt><dt> <a href="Big500users.html#id358383"> 1075 1075 You did nothing special to implement roaming profiles. Why? 1076 </a></dt><dt> <a href="Big500users.html#id3 35585">1076 </a></dt><dt> <a href="Big500users.html#id358401"> 1077 1077 On the domain member computers, you configured winbind in the /etc/nsswitch.conf file. 1078 1078 You did not configure any PAM settings. Is this an omission? 1079 </a></dt><dt> <a href="Big500users.html#id3 35612">1079 </a></dt><dt> <a href="Big500users.html#id358428"> 1080 1080 You are starting SWAT up on this example but have not discussed that anywhere. Why did you do this? 1081 </a></dt><dt> <a href="Big500users.html#id3 35648">1081 </a></dt><dt> <a href="Big500users.html#id358465"> 1082 1082 The domain controller has an auto-shutdown script. Isn't that dangerous? 1083 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id3 35341"></a><a name="id335343"></a></td><td align="left" valign="top"><p>1083 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id358158"></a><a name="id358160"></a></td><td align="left" valign="top"><p> 1084 1084 The example <code class="filename">smb.conf</code> files in this chapter make use of the <em class="parameter"><code>include</code></em> facility. 1085 1085 How may I get to see what the actual working <code class="filename">smb.conf</code> settings are? … … 1089 1089 <code class="prompt">root# </code> testparm -s | less 1090 1090 </pre><p> 1091 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 35388"></a><a name="id335390"></a></td><td align="left" valign="top"><p>1091 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id358205"></a><a name="id358207"></a></td><td align="left" valign="top"><p> 1092 1092 Why does the include file <code class="filename">common.conf</code> have an empty include statement? 1093 1093 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1102 1102 the include in place, even though the file it points to has already been included. This is a bug 1103 1103 that will be fixed at a future date. 1104 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 35445"></a><a name="id335447"></a></td><td align="left" valign="top"><p>1104 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id358262"></a><a name="id358264"></a></td><td align="left" valign="top"><p> 1105 1105 I accept that the simplest configuration necessary to do the job is the best. The use of <em class="parameter"><code>tdbsam</code></em> 1106 1106 passdb backend is much simpler than having to manage an LDAP-based <em class="parameter"><code>ldapsam</code></em> passdb backend. … … 1112 1112 to log onto the network following a reboot and may have to rejoin the domain to recover network 1113 1113 access capability. 1114 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 35495"></a><a name="id335497"></a></td><td align="left" valign="top"><p>1114 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id358312"></a><a name="id358314"></a></td><td align="left" valign="top"><p> 1115 1115 You are using DHCP Relay enabled on the routers as well as a local DHCP server. Will this cause a clash? 1116 1116 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1121 1121 The only exception to this rule is when the client makes a directed request from a specific DHCP server 1122 1122 for renewal of the lease it has. This means that under normal circumstances there is no risk of a clash. 1123 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 35520"></a><a name="id335522"></a></td><td align="left" valign="top"><p>1123 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id358337"></a><a name="id358339"></a></td><td align="left" valign="top"><p> 1124 1124 How does the Windows client find the PDC? 1125 1125 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1128 1128 to register itself with the WINS server and to obtain enumeration of vital network information to 1129 1129 enable it to operate successfully. 1130 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 35540"></a><a name="id335542"></a></td><td align="left" valign="top"><p>1130 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id358356"></a><a name="id358358"></a></td><td align="left" valign="top"><p> 1131 1131 Why did you enable IP forwarding (routing) only on the server called <code class="constant">MASSIVE</code>? 1132 1132 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1135 1135 Route table entries are needed to direct MASSIVE to send all traffic intended for the remote network 1136 1136 segments to the router that is its gateway to them. 1137 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 35567"></a><a name="id335569"></a></td><td align="left" valign="top"><p>1137 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id358383"></a><a name="id358386"></a></td><td align="left" valign="top"><p> 1138 1138 You did nothing special to implement roaming profiles. Why? 1139 1139 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 1140 1140 Unless configured to do otherwise, the default behavior with Samba-3 and Windows XP Professional 1141 1141 clients is to use roaming profiles. 1142 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 35585"></a><a name="id335587"></a></td><td align="left" valign="top"><p>1142 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id358401"></a><a name="id358404"></a></td><td align="left" valign="top"><p> 1143 1143 On the domain member computers, you configured winbind in the <code class="filename">/etc/nsswitch.conf</code> file. 1144 1144 You did not configure any PAM settings. Is this an omission? … … 1149 1149 to enable the use of winbind. Samba makes use only of the identity resolution facilities of the name 1150 1150 service switch (NSS). 1151 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 35612"></a><a name="id335614"></a></td><td align="left" valign="top"><p>1151 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id358428"></a><a name="id358431"></a></td><td align="left" valign="top"><p> 1152 1152 You are starting SWAT up on this example but have not discussed that anywhere. Why did you do this? 1153 1153 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1158 1158 file but leaves in place a broken reference to the top-layer include file. SWAT was not designed to 1159 1159 handle this functionality gracefully. 1160 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 35648"></a><a name="id335650"></a></td><td align="left" valign="top"><p>1160 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id358465"></a><a name="id358467"></a></td><td align="left" valign="top"><p> 1161 1161 The domain controller has an auto-shutdown script. Isn't that dangerous? 1162 1162 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> -
branches/samba-3.0/docs/htmldocs/Samba3-ByExample/DMSMig.html
r44 r134 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Part II. Domain Members, Updating Samba and Migration</title><link rel="stylesheet" href=" samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="2000users.html" title="Chapter 6. A Distributed 2000-User Network"><link rel="next" href="unixclients.html" title="Chapter 7. Adding Domain Member Servers and Clients"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Part II. Domain Members, Updating Samba and Migration</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="2000users.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="unixclients.html">Next</a></td></tr></table><hr></div><div class="part" lang="en"><div class="titlepage"><div><div><h1 class="title"><a name="DMSMig"></a>Part II. Domain Members, Updating Samba and Migration</h1></div></div></div><div class="partintro" lang="en"><div><div><div><h1 class="title"><a name="id352865"></a>Domain Members, Updating Samba and Migration</h1></div></div></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Part II. Domain Members, Updating Samba and Migration</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="2000users.html" title="Chapter 6. A Distributed 2000-User Network"><link rel="next" href="unixclients.html" title="Chapter 7. Adding Domain Member Servers and Clients"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Part II. Domain Members, Updating Samba and Migration</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="2000users.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="unixclients.html">Next</a></td></tr></table><hr></div><div class="part" lang="en"><div class="titlepage"><div><div><h1 class="title"><a name="DMSMig"></a>Part II. Domain Members, Updating Samba and Migration</h1></div></div></div><div class="partintro" lang="en"><div><div><div><h1 class="title"><a name="id375363"></a>Domain Members, Updating Samba and Migration</h1></div></div></div><p> 2 2 This section <span class="emphasis"><em>Samba-3 by Example</em></span> covers two main topics: How to add 3 3 Samba Domain Member Servers and Samba Domain Member Clients to a Samba domain, the other … … 8 8 to a Samba or a Windows networking domain may also benefit by referring to the book 9 9 <span class="emphasis"><em>The Official Samba-3 HOWTO and Reference Guide.</em></span> 10 </p><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="chapter"><a href="unixclients.html">7. Adding Domain Member Servers and Clients</a></span></dt><dd><dl><dt><span class="sect1"><a href="unixclients.html#id3 52990">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id353039">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id353067">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id353091">Technical Issues</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id353679">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id353760">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></span></dt><dt><span class="sect2"><a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></span></dt><dt><span class="sect2"><a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a></span></dt><dt><span class="sect2"><a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id359708">UNIX/Linux Client Domain Member</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id360196">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id360240">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="upgrades.html">8. Updating Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="upgrades.html#id361313">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id361397">Cautions and Notes</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id362605">Upgrading from Samba 1.x and 2.x to Samba-3</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id362947">Applicable to All Samba 2.x to Samba-3 Upgrades</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id363269">Samba-2.x with LDAP Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id363384">Updating a Samba-3 Installation</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id363478">Samba-3 to Samba-3 Updates on the Same Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id363662">Migrating Samba-3 to a New Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id364040">Migration of Samba Accounts to Active Directory</a></span></dt></dl></dd></dl></dd><dt><span class="chapter"><a href="ntmigration.html">9. Migrating NT4 Domain to Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="ntmigration.html#id364185">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id364261">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id364312">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id364468">Technical Issues</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id364771">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id364791">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id367204">NT4 Migration Using tdbsam Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id367537">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id367572">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="nw4migration.html">10. Migrating NetWare Server to Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="nw4migration.html#id368455">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id368561">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id368660">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id368732">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id368903">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id368911">NetWare Migration Using LDAP Backend</a></span></dt></dl></dd></dl></dd></dl></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="2000users.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="unixclients.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 6. A Distributed 2000-User Network </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 7. Adding Domain Member Servers and Clients</td></tr></table></div></body></html>10 </p><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="chapter"><a href="unixclients.html">7. Adding Domain Member Servers and Clients</a></span></dt><dd><dl><dt><span class="sect1"><a href="unixclients.html#id375489">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id375537">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id375566">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id375589">Technical Issues</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id376189">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id376274">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></span></dt><dt><span class="sect2"><a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></span></dt><dt><span class="sect2"><a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a></span></dt><dt><span class="sect2"><a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id382025">UNIX/Linux Client Domain Member</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id382521">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id382565">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="upgrades.html">8. Updating Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="upgrades.html#id383639">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id383722">Cautions and Notes</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id384934">Upgrading from Samba 1.x and 2.x to Samba-3</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id385275">Applicable to All Samba 2.x to Samba-3 Upgrades</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id385597">Samba-2.x with LDAP Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id385712">Updating a Samba-3 Installation</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id385807">Samba-3 to Samba-3 Updates on the Same Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id385991">Migrating Samba-3 to a New Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id386368">Migration of Samba Accounts to Active Directory</a></span></dt></dl></dd></dl></dd><dt><span class="chapter"><a href="ntmigration.html">9. Migrating NT4 Domain to Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="ntmigration.html#id386514">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id386589">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id386640">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id386802">Technical Issues</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id387105">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id387125">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id387250">NT4 Migration Using LDAP Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id389442">NT4 Migration Using tdbsam Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id389787">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id389822">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="nw4migration.html">10. Migrating NetWare Server to Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="nw4migration.html#id390707">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id390814">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id390913">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id390984">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id391152">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id391161">NetWare Migration Using LDAP Backend</a></span></dt></dl></dd></dl></dd></dl></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="2000users.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="unixclients.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 6. A Distributed 2000-User Network </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 7. Adding Domain Member Servers and Clients</td></tr></table></div></body></html> -
branches/samba-3.0/docs/htmldocs/Samba3-ByExample/DomApps.html
r44 r134 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 12. Integrating Additional Services</title><link rel="stylesheet" href=" samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="kerberos.html" title="Chapter 11. Active Directory, Kerberos, and Security"><link rel="next" href="HA.html" title="Chapter 13. Performance, Reliability, and Availability"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 12. Integrating Additional Services</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="kerberos.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="HA.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="DomApps"></a>Chapter 12. Integrating Additional Services</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="DomApps.html#id377711">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id377734">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id377820">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id377849">Technical Issues</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id377995">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id378010">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id379772">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id379827">Questions and Answers</a></span></dt></dl></div><p>2 <a class="indexterm" name="id3 77668"></a>3 <a class="indexterm" name="id3 77674"></a>4 <a class="indexterm" name="id3 77681"></a>5 <a class="indexterm" name="id3 77688"></a>6 <a class="indexterm" name="id3 77694"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 12. Integrating Additional Services</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="kerberos.html" title="Chapter 11. Active Directory, Kerberos, and Security"><link rel="next" href="HA.html" title="Chapter 13. Performance, Reliability, and Availability"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 12. Integrating Additional Services</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="kerberos.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="HA.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="DomApps"></a>Chapter 12. Integrating Additional Services</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="DomApps.html#id399839">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id399862">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id399948">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id399977">Technical Issues</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id400123">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id400137">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id401888">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id401943">Questions and Answers</a></span></dt></dl></div><p> 2 <a class="indexterm" name="id399795"></a> 3 <a class="indexterm" name="id399802"></a> 4 <a class="indexterm" name="id399809"></a> 5 <a class="indexterm" name="id399815"></a> 6 <a class="indexterm" name="id399822"></a> 7 7 You've come a long way now. You have pretty much mastered Samba-3 for 8 8 most uses it can be put to. Up until now, you have cast Samba-3 in the leading … … 15 15 the latest Windows authentication technologies. Let's get started this is 16 16 leading edge. 17 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 77711"></a>Introduction</h2></div></div></div><p>17 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id399839"></a>Introduction</h2></div></div></div><p> 18 18 Abmas has continued its miraculous growth; indeed, nothing seems to be able 19 19 to stop its diversification into multiple (and seemingly unrelated) fields. … … 31 31 gradually, taking over key services and easing the way to a full migration and, 32 32 therefore, integration into Abmas's existing business later. 33 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 77734"></a>Assignment Tasks</h3></div></div></div><p>34 <a class="indexterm" name="id3 77742"></a>35 <a class="indexterm" name="id3 77750"></a>33 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id399862"></a>Assignment Tasks</h3></div></div></div><p> 34 <a class="indexterm" name="id399869"></a> 35 <a class="indexterm" name="id399878"></a> 36 36 You've promised the skeptical Abmas Snack Foods management team 37 37 that you can show them how Samba can ease itself and other Open Source … … 40 40 acquisition). You have chosen Web proxying and caching as your proving ground. 41 41 </p><p> 42 <a class="indexterm" name="id3 77766"></a>43 <a class="indexterm" name="id3 77773"></a>42 <a class="indexterm" name="id399894"></a> 43 <a class="indexterm" name="id399900"></a> 44 44 Abmas Snack Foods has several thousand users housed at its head office 45 45 and multiple regional offices, plants, and warehouses. A high proportion of … … 51 51 the earliest commercial users of Microsoft ISA. 52 52 </p><p> 53 <a class="indexterm" name="id3 77788"></a>54 <a class="indexterm" name="id3 77795"></a>55 <a class="indexterm" name="id3 77802"></a>53 <a class="indexterm" name="id399916"></a> 54 <a class="indexterm" name="id399922"></a> 55 <a class="indexterm" name="id399929"></a> 56 56 The team is not happy with ISA. Because it never lived up to its marketing promises, 57 57 it underperformed and had reliability problems. You have pounced on the opportunity … … 64 64 This is a hands-on exercise. You build software applications so 65 65 that you obtain the functionality Abmas needs. 66 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 77820"></a>Dissection and Discussion</h2></div></div></div><p>66 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id399948"></a>Dissection and Discussion</h2></div></div></div><p> 67 67 The key requirements in this business example are straightforward. You are not required 68 68 to do anything new, just to replicate an existing system, not lose any existing features, … … 74 74 </p></li><li><p> 75 75 Seamless and transparent interoperability with the existing Active Directory domain 76 </p></li></ul></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 77849"></a>Technical Issues</h3></div></div></div><p>77 <a class="indexterm" name="id3 77857"></a>78 <a class="indexterm" name="id3 77864"></a>79 <a class="indexterm" name="id3 77871"></a>80 <a class="indexterm" name="id 377878"></a>81 <a class="indexterm" name="id 377884"></a>82 <a class="indexterm" name="id 377891"></a>83 <a class="indexterm" name="id 377898"></a>84 <a class="indexterm" name="id 377905"></a>85 <a class="indexterm" name="id 377912"></a>86 <a class="indexterm" name="id 377918"></a>87 <a class="indexterm" name="id 377925"></a>88 <a class="indexterm" name="id 377932"></a>89 <a class="indexterm" name="id 377941"></a><a class="indexterm" name="id377947"></a>76 </p></li></ul></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id399977"></a>Technical Issues</h3></div></div></div><p> 77 <a class="indexterm" name="id399985"></a> 78 <a class="indexterm" name="id399992"></a> 79 <a class="indexterm" name="id399998"></a> 80 <a class="indexterm" name="id400005"></a> 81 <a class="indexterm" name="id400012"></a> 82 <a class="indexterm" name="id400019"></a> 83 <a class="indexterm" name="id400026"></a> 84 <a class="indexterm" name="id400032"></a> 85 <a class="indexterm" name="id400039"></a> 86 <a class="indexterm" name="id400046"></a> 87 <a class="indexterm" name="id400053"></a> 88 <a class="indexterm" name="id400060"></a> 89 <a class="indexterm" name="id400069"></a><a class="indexterm" name="id400075"></a> 90 90 Functionally, the user's Internet Explorer requests a browsing session with the 91 91 Squid proxy, for which it offers its AD authentication token. Squid hands off … … 108 108 </p></li><li><p> 109 109 Tying it all together 110 </p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 377995"></a>Political Issues</h3></div></div></div><p>110 </p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id400123"></a>Political Issues</h3></div></div></div><p> 111 111 You are a stranger in a strange land, and all eyes are upon you. Some would even like to see 112 112 you fail. For you to gain the trust of your newly acquired IT people, it is essential that your … … 114 114 will the entrenched positions consider taking up your new way of doing things on a 115 115 wider scale. 116 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id 378010"></a>Implementation</h2></div></div></div><p>117 <a class="indexterm" name="id 378017"></a>116 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id400137"></a>Implementation</h2></div></div></div><p> 117 <a class="indexterm" name="id400145"></a> 118 118 First, your system needs to be prepared and in a known good state to proceed. This consists 119 119 of making sure that everything the system depends on is present and that everything that could … … 122 122 they must be removed. 123 123 </p><p> 124 <a class="indexterm" name="id 378031"></a>124 <a class="indexterm" name="id400159"></a> 125 125 The following packages should be available on your Red Hat Linux system: 126 126 </p><div class="itemizedlist"><ul type="disc"><li><p> 127 <a class="indexterm" name="id 378045"></a>128 <a class="indexterm" name="id 378052"></a>127 <a class="indexterm" name="id400173"></a> 128 <a class="indexterm" name="id400179"></a> 129 129 krb5-libs 130 130 </p></li><li><p> … … 137 137 pam_krb5 138 138 </p></li></ul></div><p> 139 <a class="indexterm" name="id 378081"></a>139 <a class="indexterm" name="id400209"></a> 140 140 In the case of SUSE Linux, these packages are called: 141 141 </p><div class="itemizedlist"><ul type="disc"><li><p> … … 144 144 heimdal-devel 145 145 </p></li><li><p> 146 <a class="indexterm" name="id 378105"></a>146 <a class="indexterm" name="id400232"></a> 147 147 heimdal 148 148 </p></li><li><p> … … 153 153 for your Linux system to ensure that the packages are correctly updated. 154 154 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 155 <a class="indexterm" name="id 378127"></a>156 <a class="indexterm" name="id 378134"></a>157 <a class="indexterm" name="id 378141"></a>155 <a class="indexterm" name="id400255"></a> 156 <a class="indexterm" name="id400262"></a> 157 <a class="indexterm" name="id400269"></a> 158 158 If the requirement is for interoperation with MS Windows Server 2003, it 159 159 will be necessary to ensure that you are using MIT Kerberos version 1.3.1 … … 161 161 updating. 162 162 </p><p> 163 <a class="indexterm" name="id 378153"></a>164 <a class="indexterm" name="id 378160"></a>163 <a class="indexterm" name="id400280"></a> 164 <a class="indexterm" name="id400287"></a> 165 165 Heimdal 0.6 or later is required in the case of SUSE Linux. SUSE Enterprise 166 166 Linux Server 8 ships with Heimdal 0.4. SUSE 9 ships with the necessary version. 167 167 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch10-one"></a>Removal of Pre-Existing Conflicting RPMs</h3></div></div></div><p> 168 <a class="indexterm" name="id 378180"></a>168 <a class="indexterm" name="id400308"></a> 169 169 If Samba and/or Squid RPMs are installed, they should be updated. You can 170 170 build both from source. 171 171 </p><p> 172 <a class="indexterm" name="id 378191"></a>173 <a class="indexterm" name="id 378198"></a>174 <a class="indexterm" name="id 378204"></a>172 <a class="indexterm" name="id400319"></a> 173 <a class="indexterm" name="id400325"></a> 174 <a class="indexterm" name="id400332"></a> 175 175 Locating the packages to be un-installed can be achieved by running: 176 176 </p><pre class="screen"> … … 182 182 <code class="prompt">root# </code> rpm -e samba-common 183 183 </pre><p> 184 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 378243"></a>Kerberos Configuration</h3></div></div></div><p>185 <a class="indexterm" name="id 378250"></a>186 <a class="indexterm" name="id 378257"></a>187 <a class="indexterm" name="id 378266"></a>188 <a class="indexterm" name="id 378273"></a>184 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id400370"></a>Kerberos Configuration</h3></div></div></div><p> 185 <a class="indexterm" name="id400378"></a> 186 <a class="indexterm" name="id400385"></a> 187 <a class="indexterm" name="id400394"></a> 188 <a class="indexterm" name="id400401"></a> 189 189 The systems Kerberos installation must be configured to communicate with 190 190 your primary Active Directory server (ADS KDC). … … 194 194 unless you are using Windows 2003 servers. 195 195 </p><p> 196 <a class="indexterm" name="id 378289"></a>197 <a class="indexterm" name="id 378296"></a>198 <a class="indexterm" name="id 378302"></a>199 <a class="indexterm" name="id 378309"></a>200 <a class="indexterm" name="id 378316"></a>201 <a class="indexterm" name="id 378325"></a>202 <a class="indexterm" name="id 378332"></a>196 <a class="indexterm" name="id400417"></a> 197 <a class="indexterm" name="id400423"></a> 198 <a class="indexterm" name="id400430"></a> 199 <a class="indexterm" name="id400437"></a> 200 <a class="indexterm" name="id400444"></a> 201 <a class="indexterm" name="id400453"></a> 202 <a class="indexterm" name="id400459"></a> 203 203 Officially, neither MIT (1.3.4) nor Heimdal (0.63) Kerberos needs an <code class="filename">/etc/krb5.conf</code> 204 204 file in order to work correctly. All ADS domains automatically create SRV records in the … … 208 208 specifying only a single KDC, even if there is more than one. Using the DNS lookup 209 209 allows the KRB5 libraries to use whichever KDCs are available. 210 </p><div class="procedure"><a name="id 378361"></a><p class="title"><b>Procedure 12.1. Kerberos Configuration Steps</b></p><ol type="1"><li><p>211 <a class="indexterm" name="id 378372"></a>210 </p><div class="procedure"><a name="id400489"></a><p class="title"><b>Procedure 12.1. Kerberos Configuration Steps</b></p><ol type="1"><li><p> 211 <a class="indexterm" name="id400500"></a> 212 212 If you find the need to manually configure the <code class="filename">krb5.conf</code>, you should edit it 213 to have the contents shown in <a href="DomApps.html#ch10-krb5conf" title="Example 12.1. Kerberos Configuration File: /etc/krb5.conf">???</a>. The final fully qualified path for this file213 to have the contents shown in <a class="link" href="DomApps.html#ch10-krb5conf" title="Example 12.1. Kerberos Configuration File: /etc/krb5.conf">“Kerberos Configuration File: /etc/krb5.conf”</a>. The final fully qualified path for this file 214 214 should be <code class="filename">/etc/krb5.conf</code>. 215 215 </p></li><li><p> 216 <a class="indexterm" name="id 378405"></a>217 <a class="indexterm" name="id 378412"></a>218 <a class="indexterm" name="id 378419"></a>219 <a class="indexterm" name="id 378426"></a>220 <a class="indexterm" name="id 378432"></a>221 <a class="indexterm" name="id 378439"></a>222 <a class="indexterm" name="id 378446"></a>223 <a class="indexterm" name="id 378452"></a>224 <a class="indexterm" name="id 378459"></a>225 <a class="indexterm" name="id 378468"></a>226 <a class="indexterm" name="id 378475"></a>227 <a class="indexterm" name="id 378482"></a>228 <a class="indexterm" name="id 378488"></a>216 <a class="indexterm" name="id400533"></a> 217 <a class="indexterm" name="id400540"></a> 218 <a class="indexterm" name="id400546"></a> 219 <a class="indexterm" name="id400553"></a> 220 <a class="indexterm" name="id400560"></a> 221 <a class="indexterm" name="id400567"></a> 222 <a class="indexterm" name="id400573"></a> 223 <a class="indexterm" name="id400580"></a> 224 <a class="indexterm" name="id400587"></a> 225 <a class="indexterm" name="id400596"></a> 226 <a class="indexterm" name="id400602"></a> 227 <a class="indexterm" name="id400609"></a> 228 <a class="indexterm" name="id400616"></a> 229 229 The following gotchas often catch people out. Kerberos is case sensitive. Your realm must 230 230 be in UPPERCASE, or you will get an error: “<span class="quote">Cannot find KDC for requested realm while getting … … 242 242 when you try to join the realm. 243 243 </p></li><li><p> 244 <a class="indexterm" name="id 378524"></a>244 <a class="indexterm" name="id400651"></a> 245 245 You are now ready to test your installation by issuing the command: 246 246 </p><pre class="screen"> … … 262 262 kdc = w2k3s.london.abmas.biz 263 263 } 264 </pre></div></div><br class="example-break"><p><a class="indexterm" name="id 378583"></a>264 </pre></div></div><br class="example-break"><p><a class="indexterm" name="id400711"></a> 265 265 The command 266 266 </p><pre class="screen"> … … 268 268 </pre><p> 269 269 shows the Kerberos tickets cached by the system. 270 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id 378606"></a>Samba Configuration</h4></div></div></div><p>271 <a class="indexterm" name="id 378613"></a>270 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id400733"></a>Samba Configuration</h4></div></div></div><p> 271 <a class="indexterm" name="id400741"></a> 272 272 Samba must be configured to correctly use Active Directory. Samba-3 must be used, since it 273 273 has the necessary components to interface with Active Directory. 274 </p><div class="procedure"><a name="id 378623"></a><p class="title"><b>Procedure 12.2. Securing Samba-3 With ADS Support Steps</b></p><ol type="1"><li><p>275 <a class="indexterm" name="id 378634"></a>276 <a class="indexterm" name="id 378641"></a>277 <a class="indexterm" name="id 378648"></a>278 <a class="indexterm" name="id 378654"></a>279 <a class="indexterm" name="id 378661"></a>274 </p><div class="procedure"><a name="id400750"></a><p class="title"><b>Procedure 12.2. Securing Samba-3 With ADS Support Steps</b></p><ol type="1"><li><p> 275 <a class="indexterm" name="id400762"></a> 276 <a class="indexterm" name="id400768"></a> 277 <a class="indexterm" name="id400775"></a> 278 <a class="indexterm" name="id400782"></a> 279 <a class="indexterm" name="id400789"></a> 280 280 Download the latest stable Samba-3 for Red Hat Linux from the official Samba Team 281 <a href="http://ftp.samba.org" target="_top">FTP site.</a> The official Samba Team281 <a class="ulink" href="http://ftp.samba.org" target="_top">FTP site.</a> The official Samba Team 282 282 RPMs for Red Hat Fedora Linux contain the <code class="literal">ntlm_auth</code> tool 283 283 needed, and are linked against MIT KRB5 version 1.3.1 and therefore are ready for use. 284 284 </p><p> 285 <a class="indexterm" name="id 378685"></a>286 <a class="indexterm" name="id 378692"></a>285 <a class="indexterm" name="id400813"></a> 286 <a class="indexterm" name="id400820"></a> 287 287 The necessary, validated RPM packages for SUSE Linux may be obtained from 288 the <a href="ftp://ftp.sernet.de/pub/samba" target="_top">SerNet</a> FTP site that288 the <a class="ulink" href="ftp://ftp.sernet.de/pub/samba" target="_top">SerNet</a> FTP site that 289 289 is located in Germany. All SerNet RPMs are validated, have the necessary 290 290 <code class="literal">ntlm_auth</code> tool, and are statically linked … … 292 292 </p></li><li><p> 293 293 Using your favorite editor, change the <code class="filename">/etc/samba/smb.conf</code> 294 file so it has contents similar to the example shown in <a href="DomApps.html#ch10-smbconf" title="Example 12.2. Samba Configuration File: /etc/samba/smb.conf">???</a>.295 </p></li><li><p> 296 <a class="indexterm" name="id 378739"></a>297 <a class="indexterm" name="id 378746"></a>298 <a class="indexterm" name="id 378753"></a>i299 <a class="indexterm" name="id 378764"></a>300 <a class="indexterm" name="id 378771"></a>294 file so it has contents similar to the example shown in <a class="link" href="DomApps.html#ch10-smbconf" title="Example 12.2. Samba Configuration File: /etc/samba/smb.conf">“Samba Configuration File: /etc/samba/smb.conf”</a>. 295 </p></li><li><p> 296 <a class="indexterm" name="id400867"></a> 297 <a class="indexterm" name="id400874"></a> 298 <a class="indexterm" name="id400880"></a>i 299 <a class="indexterm" name="id400892"></a> 300 <a class="indexterm" name="id400899"></a> 301 301 Next you need to create a computer account in the Active Directory. 302 302 This sets up the trust relationship needed for other clients to … … 308 308 </pre><p> 309 309 </p></li><li><p> 310 <a class="indexterm" name="id 378802"></a>311 <a class="indexterm" name="id 378809"></a>312 <a class="indexterm" name="id 378816"></a>313 <a class="indexterm" name="id 378822"></a>314 <a class="indexterm" name="id 378829"></a>310 <a class="indexterm" name="id400930"></a> 311 <a class="indexterm" name="id400937"></a> 312 <a class="indexterm" name="id400943"></a> 313 <a class="indexterm" name="id400950"></a> 314 <a class="indexterm" name="id400957"></a> 315 315 Your new Samba binaries must be started in the standard manner as is applicable 316 316 to the platform you are running on. Alternatively, start your Active Directory-enabled Samba with the following commands: … … 321 321 </pre><p> 322 322 </p></li><li><p> 323 <a class="indexterm" name="id 378868"></a>324 <a class="indexterm" name="id 378875"></a>325 <a class="indexterm" name="id 378884"></a>326 <a class="indexterm" name="id 378891"></a>327 <a class="indexterm" name="id 378898"></a>323 <a class="indexterm" name="id400996"></a> 324 <a class="indexterm" name="id401002"></a> 325 <a class="indexterm" name="id401012"></a> 326 <a class="indexterm" name="id401018"></a> 327 <a class="indexterm" name="id401025"></a> 328 328 We now need to test that Samba is communicating with the Active 329 329 Directory domain; most specifically, we want to see whether winbind … … 358 358 This enumerates all the groups in your Active Directory tree. 359 359 </p></li><li><p> 360 <a class="indexterm" name="id 378954"></a>361 <a class="indexterm" name="id 378961"></a>360 <a class="indexterm" name="id401082"></a> 361 <a class="indexterm" name="id401089"></a> 362 362 Squid uses the <code class="literal">ntlm_auth</code> helper build with Samba-3. 363 363 You may test <code class="literal">ntlm_auth</code> with the command: … … 371 371 </pre><p> 372 372 </p></li><li><p> 373 <a class="indexterm" name="id 379011"></a>374 <a class="indexterm" name="id 379018"></a>375 <a class="indexterm" name="id 379025"></a>376 <a class="indexterm" name="id 379032"></a>377 <a class="indexterm" name="id 379038"></a>378 <a class="indexterm" name="id 379045"></a>379 <a class="indexterm" name="id 379052"></a>380 <a class="indexterm" name="id 379059"></a>373 <a class="indexterm" name="id401139"></a> 374 <a class="indexterm" name="id401146"></a> 375 <a class="indexterm" name="id401153"></a> 376 <a class="indexterm" name="id401159"></a> 377 <a class="indexterm" name="id401166"></a> 378 <a class="indexterm" name="id401173"></a> 379 <a class="indexterm" name="id401180"></a> 380 <a class="indexterm" name="id401187"></a> 381 381 The <code class="literal">ntlm_auth</code> helper, when run from a command line as the user 382 382 “<span class="quote">root</span>”, authenticates against your Active Directory domain (with … … 396 396 <code class="prompt">root# </code> chmod 750 /var/lib/samba/winbindd_privileged 397 397 </pre><p> 398 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id 379127"></a>NSS Configuration</h4></div></div></div><p>399 <a class="indexterm" name="id 379135"></a>400 <a class="indexterm" name="id 379141"></a>401 <a class="indexterm" name="id 379148"></a>398 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id401255"></a>NSS Configuration</h4></div></div></div><p> 399 <a class="indexterm" name="id401262"></a> 400 <a class="indexterm" name="id401269"></a> 401 <a class="indexterm" name="id401276"></a> 402 402 For Squid to benefit from Samba-3, NSS must be updated to allow winbind as a valid route to user authentication. 403 403 </p><p> 404 404 Edit your <code class="filename">/etc/nsswitch.conf</code> file so it has the parameters shown 405 in <a href="DomApps.html#ch10-etcnsscfg" title="Example 12.3. NSS Configuration File Extract File: /etc/nsswitch.conf">???</a>.406 </p><div class="example"><a name="ch10-smbconf"></a><p class="title"><b>Example 12.2. Samba Configuration File: <code class="filename">/etc/samba/smb.conf</code></b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id 379204"></a><em class="parameter"><code>workgroup = LONDON</code></em></td></tr><tr><td><a class="indexterm" name="id379217"></a><em class="parameter"><code>netbios name = W2K3S</code></em></td></tr><tr><td><a class="indexterm" name="id379230"></a><em class="parameter"><code>realm = LONDON.ABMAS.BIZ</code></em></td></tr><tr><td><a class="indexterm" name="id379242"></a><em class="parameter"><code>security = ads</code></em></td></tr><tr><td><a class="indexterm" name="id379255"></a><em class="parameter"><code>encrypt passwords = yes</code></em></td></tr><tr><td><a class="indexterm" name="id379267"></a><em class="parameter"><code>password server = w2k3s.london.abmas.biz</code></em></td></tr><tr><td># separate domain and username with '/', like DOMAIN/username</td></tr><tr><td><a class="indexterm" name="id379284"></a><em class="parameter"><code>winbind separator = /</code></em></td></tr><tr><td># use UIDs from 10000 to 20000 for domain users</td></tr><tr><td><a class="indexterm" name="id379300"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td># use GIDs from 10000 to 20000 for domain groups</td></tr><tr><td><a class="indexterm" name="id379316"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td># allow enumeration of winbind users and groups</td></tr><tr><td><a class="indexterm" name="id379333"></a><em class="parameter"><code>winbind enum users = yes</code></em></td></tr><tr><td><a class="indexterm" name="id379345"></a><em class="parameter"><code>winbind enum groups = yes</code></em></td></tr><tr><td><a class="indexterm" name="id379358"></a><em class="parameter"><code>winbind user default domain = yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch10-etcnsscfg"></a><p class="title"><b>Example 12.3. NSS Configuration File Extract File: <code class="filename">/etc/nsswitch.conf</code></b></p><div class="example-contents"><pre class="screen">405 in <a class="link" href="DomApps.html#ch10-etcnsscfg" title="Example 12.3. NSS Configuration File Extract File: /etc/nsswitch.conf">“NSS Configuration File Extract File: /etc/nsswitch.conf”</a>. 406 </p><div class="example"><a name="ch10-smbconf"></a><p class="title"><b>Example 12.2. Samba Configuration File: <code class="filename">/etc/samba/smb.conf</code></b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id401332"></a><em class="parameter"><code>workgroup = LONDON</code></em></td></tr><tr><td><a class="indexterm" name="id401344"></a><em class="parameter"><code>netbios name = W2K3S</code></em></td></tr><tr><td><a class="indexterm" name="id401355"></a><em class="parameter"><code>realm = LONDON.ABMAS.BIZ</code></em></td></tr><tr><td><a class="indexterm" name="id401367"></a><em class="parameter"><code>security = ads</code></em></td></tr><tr><td><a class="indexterm" name="id401378"></a><em class="parameter"><code>encrypt passwords = yes</code></em></td></tr><tr><td><a class="indexterm" name="id401390"></a><em class="parameter"><code>password server = w2k3s.london.abmas.biz</code></em></td></tr><tr><td># separate domain and username with '/', like DOMAIN/username</td></tr><tr><td><a class="indexterm" name="id401405"></a><em class="parameter"><code>winbind separator = /</code></em></td></tr><tr><td># use UIDs from 10000 to 20000 for domain users</td></tr><tr><td><a class="indexterm" name="id401420"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td># use GIDs from 10000 to 20000 for domain groups</td></tr><tr><td><a class="indexterm" name="id401436"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td># allow enumeration of winbind users and groups</td></tr><tr><td><a class="indexterm" name="id401451"></a><em class="parameter"><code>winbind enum users = yes</code></em></td></tr><tr><td><a class="indexterm" name="id401462"></a><em class="parameter"><code>winbind enum groups = yes</code></em></td></tr><tr><td><a class="indexterm" name="id401474"></a><em class="parameter"><code>winbind user default domain = yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch10-etcnsscfg"></a><p class="title"><b>Example 12.3. NSS Configuration File Extract File: <code class="filename">/etc/nsswitch.conf</code></b></p><div class="example-contents"><pre class="screen"> 407 407 passwd: files winbind 408 408 shadow: files 409 409 group: files winbind 410 </pre></div></div><br class="example-break"></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id 379397"></a>Squid Configuration</h4></div></div></div><p>411 <a class="indexterm" name="id 379405"></a>412 <a class="indexterm" name="id 379412"></a>410 </pre></div></div><br class="example-break"></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id401512"></a>Squid Configuration</h4></div></div></div><p> 411 <a class="indexterm" name="id401520"></a> 412 <a class="indexterm" name="id401526"></a> 413 413 Squid must be configured correctly to interact with the Samba-3 414 414 components that handle Active Directory authentication. 415 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 379425"></a>Configuration</h3></div></div></div></div><div class="procedure"><a name="id379431"></a><p class="title"><b>Procedure 12.3. Squid Configuration Steps</b></p><ol type="1"><li><p>416 <a class="indexterm" name="id 379442"></a>417 <a class="indexterm" name="id 379449"></a>418 <a class="indexterm" name="id 379457"></a>415 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id401540"></a>Configuration</h3></div></div></div></div><div class="procedure"><a name="id401546"></a><p class="title"><b>Procedure 12.3. Squid Configuration Steps</b></p><ol type="1"><li><p> 416 <a class="indexterm" name="id401557"></a> 417 <a class="indexterm" name="id401564"></a> 418 <a class="indexterm" name="id401572"></a> 419 419 If your Linux distribution is SUSE Linux 9, the version of Squid 420 420 supplied is already enabled to use the winbind helper agent. You … … 422 422 programs. 423 423 </p></li><li><p> 424 <a class="indexterm" name="id 379472"></a>425 <a class="indexterm" name="id 379479"></a>426 <a class="indexterm" name="id 379485"></a>427 <a class="indexterm" name="id 379492"></a>428 <a class="indexterm" name="id 379499"></a>424 <a class="indexterm" name="id401587"></a> 425 <a class="indexterm" name="id401594"></a> 426 <a class="indexterm" name="id401600"></a> 427 <a class="indexterm" name="id401607"></a> 428 <a class="indexterm" name="id401614"></a> 429 429 Squid, by default, runs as the user <code class="constant">nobody</code>. You need to 430 430 add a system user <code class="constant">squid</code> and a system group … … 434 434 and a <code class="constant">squid</code> group in <code class="filename">/etc/group</code> if these aren't there already. 435 435 </p></li><li><p> 436 <a class="indexterm" name="id 379544"></a>437 <a class="indexterm" name="id 379551"></a>436 <a class="indexterm" name="id401659"></a> 437 <a class="indexterm" name="id401666"></a> 438 438 You now need to change the permissions on Squid's <code class="constant">var</code> 439 439 directory. Enter the following command: … … 442 442 </pre><p> 443 443 </p></li><li><p> 444 <a class="indexterm" name="id 379581"></a>445 <a class="indexterm" name="id 379588"></a>444 <a class="indexterm" name="id401696"></a> 445 <a class="indexterm" name="id401702"></a> 446 446 Squid must also have control over its logging. Enter the following commands: 447 447 </p><pre class="screen"> … … 457 457 </pre><p> 458 458 </p></li><li><p> 459 <a class="indexterm" name="id 379645"></a>459 <a class="indexterm" name="id401760"></a> 460 460 The <code class="filename">/etc/squid/squid.conf</code> file must be edited to include the lines from 461 <a href="DomApps.html#etcsquidcfg" title="Example 12.4. Squid Configuration File Extract /etc/squid.conf [ADMINISTRATIVE PARAMETERS Section]">???</a> and <a href="DomApps.html#etcsquid2" title="Example 12.5. Squid Configuration File extract File: /etc/squid.conf [AUTHENTICATION PARAMETERS Section]">???</a>.462 </p></li><li><p> 463 <a class="indexterm" name="id 379678"></a>461 <a class="link" href="DomApps.html#etcsquidcfg" title="Example 12.4. Squid Configuration File Extract /etc/squid.conf [ADMINISTRATIVE PARAMETERS Section]">“Squid Configuration File Extract /etc/squid.conf [ADMINISTRATIVE PARAMETERS Section]”</a> and <a class="link" href="DomApps.html#etcsquid2" title="Example 12.5. Squid Configuration File extract File: /etc/squid.conf [AUTHENTICATION PARAMETERS Section]">“Squid Configuration File extract File: /etc/squid.conf [AUTHENTICATION PARAMETERS Section]”</a>. 462 </p></li><li><p> 463 <a class="indexterm" name="id401793"></a> 464 464 You must create Squid's cache directories before it may be run. Enter the following command: 465 465 </p><pre class="screen"> … … 488 488 acl AuthorizedUsers proxy_auth REQUIRED 489 489 http_access allow all AuthorizedUsers 490 </pre></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 379772"></a>Key Points Learned</h3></div></div></div><p>491 <a class="indexterm" name="id 379780"></a>492 <a class="indexterm" name="id 379787"></a>493 <a class="indexterm" name="id 379794"></a>494 <a class="indexterm" name="id 379801"></a>495 <a class="indexterm" name="id 379812"></a>490 </pre></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id401888"></a>Key Points Learned</h3></div></div></div><p> 491 <a class="indexterm" name="id401896"></a> 492 <a class="indexterm" name="id401902"></a> 493 <a class="indexterm" name="id401909"></a> 494 <a class="indexterm" name="id401916"></a> 495 <a class="indexterm" name="id401928"></a> 496 496 Microsoft Windows networking protocols permeate the spectrum of technologies that Microsoft 497 497 Windows clients use, even when accessing traditional services such as Web browsers. Depending … … 500 500 the cookie-based authentication regime used by all competing browsers. It is Samba's implementation 501 501 of NTLMSSP that makes it attractive to implement the solution that has been demonstrated in this chapter. 502 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id 379827"></a>Questions and Answers</h2></div></div></div><p>503 <a class="indexterm" name="id 379835"></a>504 <a class="indexterm" name="id 379842"></a>505 <a class="indexterm" name="id 379849"></a>506 <a class="indexterm" name="id 379855"></a>502 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id401943"></a>Questions and Answers</h2></div></div></div><p> 503 <a class="indexterm" name="id401950"></a> 504 <a class="indexterm" name="id401957"></a> 505 <a class="indexterm" name="id401964"></a> 506 <a class="indexterm" name="id401971"></a> 507 507 The development of the <code class="literal">ntlm_auth</code> module was first discussed in many Open Source circles 508 508 in 2002. At the SambaXP conference in Goettingen, Germany, Mr. Francesco Chemolli demonstrated the use of … … 523 523 Make certain that your Squid proxy server is equipped with sufficient memory to permit all proxy operations to run 524 524 out of memory without invoking the overheads involved in the use of memory that has to be swapped to disk. 525 </p><div class="qandaset"><dl><dt> <a href="DomApps.html#id 379921">525 </p><div class="qandaset"><dl><dt> <a href="DomApps.html#id402036"> 526 526 What does Samba have to do with Web proxy serving? 527 </a></dt><dt> <a href="DomApps.html#id 380080">527 </a></dt><dt> <a href="DomApps.html#id402192"> 528 528 What other services does Samba provide? 529 </a></dt><dt> <a href="DomApps.html#id 380216">529 </a></dt><dt> <a href="DomApps.html#id402327"> 530 530 Does use of Samba (ntlm_auth) improve the performance of Squid? 531 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id 379921"></a><a name="id379923"></a></td><td align="left" valign="top"><p>531 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id402036"></a><a name="id402038"></a></td><td align="left" valign="top"><p> 532 532 What does Samba have to do with Web proxy serving? 533 533 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 534 <a class="indexterm" name="id 379934"></a>535 <a class="indexterm" name="id 379941"></a>536 <a class="indexterm" name="id 379948"></a>537 <a class="indexterm" name="id 379957"></a>538 <a class="indexterm" name="id 379964"></a>534 <a class="indexterm" name="id402050"></a> 535 <a class="indexterm" name="id402057"></a> 536 <a class="indexterm" name="id402063"></a> 537 <a class="indexterm" name="id402073"></a> 538 <a class="indexterm" name="id402079"></a> 539 539 To provide transparent interoperability between Windows clients and the network services 540 540 that are used from them, Samba had to develop tools and facilities that deliver that feature. The benefit … … 542 542 module is basically a wrapper around authentication code from the core of the Samba project. 543 543 </p><p> 544 <a class="indexterm" name="id 379983"></a>545 <a class="indexterm" name="id 379990"></a>546 <a class="indexterm" name="id 379999"></a>547 <a class="indexterm" name="id 380008"></a>548 <a class="indexterm" name="id 380017"></a>549 <a class="indexterm" name="id 380024"></a>550 <a class="indexterm" name="id 380030"></a>551 <a class="indexterm" name="id 380037"></a>552 <a class="indexterm" name="id 380044"></a>544 <a class="indexterm" name="id402098"></a> 545 <a class="indexterm" name="id402105"></a> 546 <a class="indexterm" name="id402114"></a> 547 <a class="indexterm" name="id402123"></a> 548 <a class="indexterm" name="id402132"></a> 549 <a class="indexterm" name="id402139"></a> 550 <a class="indexterm" name="id402146"></a> 551 <a class="indexterm" name="id402153"></a> 552 <a class="indexterm" name="id402160"></a> 553 553 The <code class="literal">ntlm_auth</code> module supports basic plain-text authentication and NTLMSSP 554 554 protocols. This module makes it possible for Web and FTP proxy requests to be authenticated without … … 558 558 also. 559 559 </p><p> 560 <a class="indexterm" name="id 380068"></a>560 <a class="indexterm" name="id402180"></a> 561 561 The short answer is that by adding a wrapper around key authentication components of Samba, other 562 562 projects (like Squid) can benefit from the labors expended in meeting user interoperability needs. 563 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 380080"></a><a name="id380082"></a></td><td align="left" valign="top"><p>563 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id402192"></a><a name="id402194"></a></td><td align="left" valign="top"><p> 564 564 What other services does Samba provide? 565 565 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 566 <a class="indexterm" name="id 380094"></a>567 <a class="indexterm" name="id 380100"></a>568 <a class="indexterm" name="id 380107"></a>569 <a class="indexterm" name="id 380114"></a>570 <a class="indexterm" name="id 380121"></a>566 <a class="indexterm" name="id402205"></a> 567 <a class="indexterm" name="id402212"></a> 568 <a class="indexterm" name="id402219"></a> 569 <a class="indexterm" name="id402225"></a> 570 <a class="indexterm" name="id402232"></a> 571 571 Samba-3 is a file and print server. The core components that provide this functionality are <code class="literal">smbd</code>, 572 572 <code class="literal">nmbd</code>, and the identity resolver daemon, <code class="literal">winbindd</code>. 573 573 </p><p> 574 <a class="indexterm" name="id 380150"></a>575 <a class="indexterm" name="id 380157"></a>574 <a class="indexterm" name="id402261"></a> 575 <a class="indexterm" name="id402268"></a> 576 576 Samba-3 is an SMB/CIFS client. The core component that provides this is called <code class="literal">smbclient</code>. 577 577 </p><p> 578 <a class="indexterm" name="id 380174"></a>579 <a class="indexterm" name="id 380180"></a>580 <a class="indexterm" name="id 380187"></a>581 <a class="indexterm" name="id 380194"></a>582 <a class="indexterm" name="id 380201"></a>578 <a class="indexterm" name="id402285"></a> 579 <a class="indexterm" name="id402292"></a> 580 <a class="indexterm" name="id402298"></a> 581 <a class="indexterm" name="id402305"></a> 582 <a class="indexterm" name="id402312"></a> 583 583 Samba-3 includes a number of helper tools, plug-in modules, utilities, and test and validation facilities. 584 584 Samba-3 includes glue modules that help provide interoperability between MS Windows clients and UNIX/Linux … … 587 587 to permit identity resolution via SMB/CIFS servers (Windows NT4/200x, Samba, and a host of other commercial 588 588 server products). 589 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 380216"></a><a name="id380218"></a></td><td align="left" valign="top"><p>589 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id402327"></a><a name="id402329"></a></td><td align="left" valign="top"><p> 590 590 Does use of Samba (<code class="literal">ntlm_auth</code>) improve the performance of Squid? 591 591 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> -
branches/samba-3.0/docs/htmldocs/Samba3-ByExample/ExNetworks.html
r44 r134 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Part I. Example Network Configurations</title><link rel="stylesheet" href=" samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="preface.html" title="Preface"><link rel="next" href="simple.html" title="Chapter 1. No-Frills Samba Servers"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Part I. Example Network Configurations</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="preface.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="simple.html">Next</a></td></tr></table><hr></div><div class="part" lang="en"><div class="titlepage"><div><div><h1 class="title"><a name="ExNetworks"></a>Part I. Example Network Configurations</h1></div></div></div><div class="partintro" lang="en"><div><div><div><h1 class="title"><a name="id316466"></a>Example Network Configurations</h1></div></div></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Part I. Example Network Configurations</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="preface.html" title="Preface"><link rel="next" href="simple.html" title="Chapter 1. No-Frills Samba Servers"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Part I. Example Network Configurations</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="preface.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="simple.html">Next</a></td></tr></table><hr></div><div class="part" lang="en"><div class="titlepage"><div><div><h1 class="title"><a name="ExNetworks"></a>Part I. Example Network Configurations</h1></div></div></div><div class="partintro" lang="en"><div><div><div><h1 class="title"><a name="id340602"></a>Example Network Configurations</h1></div></div></div><p> 2 2 This section of <span class="emphasis"><em>Samba-3 by Example</em></span> provides example network 3 3 configurations that can be copied, or modified as needed, and deployed as-is. … … 19 19 option to purchase commercial, professional, Samba support. Information regarding 20 20 commercial support options may be obtained from the commercial 21 <a href="http://www.samba.org/samba/support/" target="_top">support</a> pages from21 <a class="ulink" href="http://www.samba.org/samba/support/" target="_top">support</a> pages from 22 22 the Samba web site. 23 </p><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="chapter"><a href="simple.html">1. No-Frills Samba Servers</a></span></dt><dd><dl><dt><span class="sect1"><a href="simple.html#id3 16528">Introduction</a></span></dt><dt><span class="sect1"><a href="simple.html#id316559">Assignment Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="simple.html#id316598">Drafting Office</a></span></dt><dt><span class="sect2"><a href="simple.html#id317306">Charity Administration Office</a></span></dt><dt><span class="sect2"><a href="simple.html#AccountingOffice">Accounting Office</a></span></dt></dl></dd><dt><span class="sect1"><a href="simple.html#id320818">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="small.html">2. Small Office Networking</a></span></dt><dd><dl><dt><span class="sect1"><a href="small.html#id321229">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id321247">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id321293">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id321342">Technical Issues</a></span></dt><dt><span class="sect2"><a href="small.html#id321528">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id321546">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id323199">Validation</a></span></dt><dt><span class="sect2"><a href="small.html#id323822">Notebook Computers: A Special Case</a></span></dt><dt><span class="sect2"><a href="small.html#id323841">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id323907">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="secure.html">3. Secure Office Networking</a></span></dt><dd><dl><dt><span class="sect1"><a href="secure.html#id324364">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id324404">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id324626">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id324638">Technical Issues</a></span></dt><dt><span class="sect2"><a href="secure.html#id325007">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id325041">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#ch4bsc">Basic System Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id325866">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4ptrcfg">Printer Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4valid">Validation</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4appscfg">Application Share Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id330151">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id330204">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="Big500users.html">4. The 500-User Office</a></span></dt><dd><dl><dt><span class="sect1"><a href="Big500users.html#id330645">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id330675">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id330756">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id330784">Technical Issues</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id330961">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id330980">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#ch5-dnshcp-setup">Installation of DHCP, DNS, and Samba Control Files</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id331694">Server Preparation: All Servers</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id332210">Server-Specific Preparation</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5-procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id335273">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id335326">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="happy.html">5. Making Happy Users</a></span></dt><dd><dl><dt><span class="sect1"><a href="happy.html#id336072">Regarding LDAP Directories and Windows Computer Accounts</a></span></dt><dt><span class="sect1"><a href="happy.html#id336196">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id336272">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id336400">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id336802">Technical Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id338453">Political Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id338466">Installation Checklist</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id338636">Samba Server Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbeidealx">Install and Configure Idealx smbldap-tools Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id341324">LDAP Initialization and Creation of User and Group Accounts</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-ptrcfg">Printer Configuration</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a></span></dt><dt><span class="sect1"><a href="happy.html#id345079">Miscellaneous Server Preparation Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id345095">Configuring Directory Share Point Roots</a></span></dt><dt><span class="sect2"><a href="happy.html#id345184">Configuring Profile Directories</a></span></dt><dt><span class="sect2"><a href="happy.html#id345412">Preparation of Logon Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id345510">Assigning User Rights and Privileges</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id345624">Windows Client Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></span></dt><dt><span class="sect2"><a href="happy.html#id346340">Configuration of MS Outlook to Relocate PST File</a></span></dt><dt><span class="sect2"><a href="happy.html#id346624">Configure Delete Cached Profiles on Logout</a></span></dt><dt><span class="sect2"><a href="happy.html#id346795">Uploading Printer Drivers to Samba Servers</a></span></dt><dt><span class="sect2"><a href="happy.html#id347264">Software Installation</a></span></dt><dt><span class="sect2"><a href="happy.html#id347290">Roll-out Image Creation</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id347320">Key Points Learned</a></span></dt><dt><span class="sect1"><a href="happy.html#id347408">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="2000users.html">6. A Distributed 2000-User Network</a></span></dt><dd><dl><dt><span class="sect1"><a href="2000users.html#id347742">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id347767">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id347824">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id348070">Technical Issues</a></span></dt><dt><span class="sect2"><a href="2000users.html#id348898">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id348912">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id352072">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id352211">Questions and Answers</a></span></dt></dl></dd></dl></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="preface.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="simple.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Preface </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 1. No-Frills Samba Servers</td></tr></table></div></body></html>23 </p><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="chapter"><a href="simple.html">1. No-Frills Samba Servers</a></span></dt><dd><dl><dt><span class="sect1"><a href="simple.html#id340660">Introduction</a></span></dt><dt><span class="sect1"><a href="simple.html#id340690">Assignment Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="simple.html#id340728">Drafting Office</a></span></dt><dt><span class="sect2"><a href="simple.html#id341373">Charity Administration Office</a></span></dt><dt><span class="sect2"><a href="simple.html#AccountingOffice">Accounting Office</a></span></dt></dl></dd><dt><span class="sect1"><a href="simple.html#id344496">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="small.html">2. Small Office Networking</a></span></dt><dd><dl><dt><span class="sect1"><a href="small.html#id344880">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id344898">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id344943">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id344988">Technical Issues</a></span></dt><dt><span class="sect2"><a href="small.html#id345160">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id345178">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id346626">Validation</a></span></dt><dt><span class="sect2"><a href="small.html#id347201">Notebook Computers: A Special Case</a></span></dt><dt><span class="sect2"><a href="small.html#id347221">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id347285">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="secure.html">3. Secure Office Networking</a></span></dt><dd><dl><dt><span class="sect1"><a href="secure.html#id347711">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id347745">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id347954">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id347966">Technical Issues</a></span></dt><dt><span class="sect2"><a href="secure.html#id348311">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id348344">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#ch4bsc">Basic System Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id349099">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4ptrcfg">Printer Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4valid">Validation</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4appscfg">Application Share Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id353060">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id353113">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="Big500users.html">4. The 500-User Office</a></span></dt><dd><dl><dt><span class="sect1"><a href="Big500users.html#id353553">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id353583">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id353662">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id353690">Technical Issues</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id353866">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id353886">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#ch5-dnshcp-setup">Installation of DHCP, DNS, and Samba Control Files</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id354601">Server Preparation: All Servers</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id355116">Server-Specific Preparation</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5-procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id358090">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id358142">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="happy.html">5. Making Happy Users</a></span></dt><dd><dl><dt><span class="sect1"><a href="happy.html#id358884">Regarding LDAP Directories and Windows Computer Accounts</a></span></dt><dt><span class="sect1"><a href="happy.html#id359008">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id359084">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id359212">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id359614">Technical Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id361271">Political Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id361283">Installation Checklist</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id361454">Samba Server Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbeidealx">Install and Configure Idealx smbldap-tools Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id364093">LDAP Initialization and Creation of User and Group Accounts</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-ptrcfg">Printer Configuration</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a></span></dt><dt><span class="sect1"><a href="happy.html#id367724">Miscellaneous Server Preparation Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id367740">Configuring Directory Share Point Roots</a></span></dt><dt><span class="sect2"><a href="happy.html#id367829">Configuring Profile Directories</a></span></dt><dt><span class="sect2"><a href="happy.html#id368057">Preparation of Logon Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id368155">Assigning User Rights and Privileges</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id368268">Windows Client Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></span></dt><dt><span class="sect2"><a href="happy.html#id368985">Configuration of MS Outlook to Relocate PST File</a></span></dt><dt><span class="sect2"><a href="happy.html#id369268">Configure Delete Cached Profiles on Logout</a></span></dt><dt><span class="sect2"><a href="happy.html#id369439">Uploading Printer Drivers to Samba Servers</a></span></dt><dt><span class="sect2"><a href="happy.html#id369909">Software Installation</a></span></dt><dt><span class="sect2"><a href="happy.html#id369934">Roll-out Image Creation</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id369964">Key Points Learned</a></span></dt><dt><span class="sect1"><a href="happy.html#id370057">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="2000users.html">6. A Distributed 2000-User Network</a></span></dt><dd><dl><dt><span class="sect1"><a href="2000users.html#id370394">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id370419">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id370476">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id370722">Technical Issues</a></span></dt><dt><span class="sect2"><a href="2000users.html#id371541">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id371556">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id374570">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id374709">Questions and Answers</a></span></dt></dl></dd></dl></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="preface.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="simple.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Preface </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 1. No-Frills Samba Servers</td></tr></table></div></body></html> -
branches/samba-3.0/docs/htmldocs/Samba3-ByExample/HA.html
r44 r134 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 13. Performance, Reliability, and Availability</title><link rel="stylesheet" href=" samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="DomApps.html" title="Chapter 12. Integrating Additional Services"><link rel="next" href="ch14.html" title="Chapter 14. Samba Support"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 13. Performance, Reliability, and Availability</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="DomApps.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="ch14.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="HA"></a>Chapter 13. Performance, Reliability, and Availability</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="HA.html#id380314">Introduction</a></span></dt><dt><span class="sect1"><a href="HA.html#id380391">Dissection and Discussion</a></span></dt><dt><span class="sect1"><a href="HA.html#id380842">Guidelines for Reliable Samba Operation</a></span></dt><dd><dl><dt><span class="sect2"><a href="HA.html#id380866">Name Resolution</a></span></dt><dt><span class="sect2"><a href="HA.html#id381308">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="HA.html#id381603">Use and Location of BDCs</a></span></dt><dt><span class="sect2"><a href="HA.html#id381671">Use One Consistent Version of MS Windows Client</a></span></dt><dt><span class="sect2"><a href="HA.html#id381688">For Scalability, Use SAN-Based Storage on Samba Servers</a></span></dt><dt><span class="sect2"><a href="HA.html#id381733">Distribute Network Load with MSDFS</a></span></dt><dt><span class="sect2"><a href="HA.html#id381784">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></span></dt><dt><span class="sect2"><a href="HA.html#id381824">Hardware Problems</a></span></dt><dt><span class="sect2"><a href="HA.html#id381957">Large Directories</a></span></dt></dl></dd><dt><span class="sect1"><a href="HA.html#id382035">Key Points Learned</a></span></dt></dl></div><p>2 <a class="indexterm" name="id 380277"></a>3 <a class="indexterm" name="id 380283"></a>4 <a class="indexterm" name="id 380290"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 13. Performance, Reliability, and Availability</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="DomApps.html" title="Chapter 12. Integrating Additional Services"><link rel="next" href="ch14.html" title="Chapter 14. Samba Support"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 13. Performance, Reliability, and Availability</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="DomApps.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="ch14.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="HA"></a>Chapter 13. Performance, Reliability, and Availability</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="HA.html#id402421">Introduction</a></span></dt><dt><span class="sect1"><a href="HA.html#id402498">Dissection and Discussion</a></span></dt><dt><span class="sect1"><a href="HA.html#id402949">Guidelines for Reliable Samba Operation</a></span></dt><dd><dl><dt><span class="sect2"><a href="HA.html#id402973">Name Resolution</a></span></dt><dt><span class="sect2"><a href="HA.html#id403415">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="HA.html#id403710">Use and Location of BDCs</a></span></dt><dt><span class="sect2"><a href="HA.html#id403778">Use One Consistent Version of MS Windows Client</a></span></dt><dt><span class="sect2"><a href="HA.html#id403795">For Scalability, Use SAN-Based Storage on Samba Servers</a></span></dt><dt><span class="sect2"><a href="HA.html#id403840">Distribute Network Load with MSDFS</a></span></dt><dt><span class="sect2"><a href="HA.html#id403891">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></span></dt><dt><span class="sect2"><a href="HA.html#id403932">Hardware Problems</a></span></dt><dt><span class="sect2"><a href="HA.html#id404070">Large Directories</a></span></dt></dl></dd><dt><span class="sect1"><a href="HA.html#id404151">Key Points Learned</a></span></dt></dl></div><p> 2 <a class="indexterm" name="id402388"></a> 3 <a class="indexterm" name="id402394"></a> 4 <a class="indexterm" name="id402401"></a> 5 5 Well, you have reached one of the last chapters of this book. It is customary to attempt 6 6 to wrap up the theme and contents of a book in what is generally regarded as the … … 11 11 </p><div class="blockquote"><table border="0" width="100%" cellspacing="0" cellpadding="0" class="blockquote" summary="Block quote"><tr><td width="10%" valign="top"> </td><td width="80%" valign="top"><p> 12 12 In a world so full of noise, how can the sparrow be heard? 13 </p></td><td width="10%" valign="top"> </td></tr><tr><td width="10%" valign="top"> </td><td colspan="2" align="right" valign="top">--<span class="attribution">Anonymous</span></td></tr></table></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id 380314"></a>Introduction</h2></div></div></div><p>14 <a class="indexterm" name="id 380322"></a>13 </p></td><td width="10%" valign="top"> </td></tr><tr><td width="10%" valign="top"> </td><td colspan="2" align="right" valign="top">--<span class="attribution">Anonymous</span></td></tr></table></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id402421"></a>Introduction</h2></div></div></div><p> 14 <a class="indexterm" name="id402429"></a> 15 15 The sparrow is a small bird whose sounds are drowned out by the noise of the busy 16 16 world it lives in. Likewise, the simple steps that can be taken to improve the … … 21 21 custom tools and methods. Only passing comments are offered concerning these methods. 22 22 </p><p> 23 <a class="indexterm" name="id 380337"></a>24 <a class="indexterm" name="id 380343"></a>25 <a class="indexterm" name="id 380350"></a>26 <a href="http://www.google.com/search?hl=en&lr=&ie=ISO-8859-1&q=samba+cluster&btnG=Google+Search" target="_top">A search</a>23 <a class="indexterm" name="id402444"></a> 24 <a class="indexterm" name="id402450"></a> 25 <a class="indexterm" name="id402457"></a> 26 <a class="ulink" href="http://www.google.com/search?hl=en&lr=&ie=ISO-8859-1&q=samba+cluster&btnG=Google+Search" target="_top">A search</a> 27 27 for “<span class="quote">samba cluster</span>” produced 71,600 hits. And a search for “<span class="quote">highly available samba</span>” 28 28 and “<span class="quote">highly available windows</span>” produced an amazing number of references. … … 30 30 availability, reliability, and scalability are of vital interest to corporate network users. 31 31 </p><p> 32 <a class="indexterm" name="id 380380"></a>32 <a class="indexterm" name="id402487"></a> 33 33 So without further background, you can review a checklist of simple steps that 34 34 can be taken to ensure acceptable network performance while keeping costs of ownership 35 35 well under control. 36 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id 380391"></a>Dissection and Discussion</h2></div></div></div><p>37 <a class="indexterm" name="id 380399"></a>38 <a class="indexterm" name="id 380406"></a>36 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id402498"></a>Dissection and Discussion</h2></div></div></div><p> 37 <a class="indexterm" name="id402506"></a> 38 <a class="indexterm" name="id402513"></a> 39 39 If it is your purpose to get the best mileage out of your Samba servers, there is one rule that 40 40 must be obeyed. If you want the best, keep your implementation as simple as possible. You may … … 45 45 complex ones. 46 46 </p><p> 47 <a class="indexterm" name="id 380423"></a>48 <a class="indexterm" name="id 380430"></a>47 <a class="indexterm" name="id402530"></a> 48 <a class="indexterm" name="id402537"></a> 49 49 Problems reported by users fall into three categories: configurations that do not work, those 50 50 that have broken behavior, and poor performance. The term <span class="emphasis"><em>broken behavior</em></span> … … 55 55 and at other times not listing them even though the machines are in use on the network. 56 56 </p><p> 57 <a class="indexterm" name="id 380452"></a>58 <a class="indexterm" name="id 380459"></a>59 <a class="indexterm" name="id 380466"></a>60 <a class="indexterm" name="id 380472"></a>61 <a class="indexterm" name="id 380479"></a>62 <a class="indexterm" name="id 380486"></a>57 <a class="indexterm" name="id402559"></a> 58 <a class="indexterm" name="id402566"></a> 59 <a class="indexterm" name="id402573"></a> 60 <a class="indexterm" name="id402580"></a> 61 <a class="indexterm" name="id402586"></a> 62 <a class="indexterm" name="id402593"></a> 63 63 A significant number of reports concern problems with the <code class="literal">smbfs</code> file system 64 64 driver that is part of the Linux kernel, not part of Samba. Users continue to interpret that … … 71 71 Samba and are really foreign to it. 72 72 </p><p> 73 <a class="indexterm" name="id 380542"></a>73 <a class="indexterm" name="id402649"></a> 74 74 The new project, <code class="literal">cifsfs</code>, is destined to replace <code class="literal">smbfs</code>. 75 75 It, too, is not part of Samba, even though one of the Samba Team members is a prime mover in … … 78 78 Table 13.1 lists typical causes of: 79 79 </p><div class="itemizedlist"><ul type="disc"><li><p>Not Working (NW)</p></li><li><p>Broken Behavior (BB)</p></li><li><p>Poor Performance (PP)</p></li></ul></div><div class="table"><a name="ProbList"></a><p class="title"><b>Table 13.1. Effect of Common Problems</b></p><div class="table-contents"><table summary="Effect of Common Problems" border="1"><colgroup><col align="left"><col align="center"><col align="center"><col align="center"></colgroup><thead><tr><th align="left"><p>Problem</p></th><th align="center"><p>NW</p></th><th align="center"><p>BB</p></th><th align="center"><p>PP</p></th></tr></thead><tbody><tr><td align="left"><p>File locking</p></td><td align="center"><p>-</p></td><td align="center"><p>X</p></td><td align="center"><p>-</p></td></tr><tr><td align="left"><p>Hardware problems</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td></tr><tr><td align="left"><p>Incorrect authentication</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td><td align="center"><p>-</p></td></tr><tr><td align="left"><p>Incorrect configuration</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td></tr><tr><td align="left"><p>LDAP problems</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td><td align="center"><p>-</p></td></tr><tr><td align="left"><p>Name resolution</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td></tr><tr><td align="left"><p>Printing problems</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td><td align="center"><p>-</p></td></tr><tr><td align="left"><p>Slow file transfer</p></td><td align="center"><p>-</p></td><td align="center"><p>-</p></td><td align="center"><p>X</p></td></tr><tr><td align="left"><p>Winbind problems</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td><td align="center"><p>-</p></td></tr></tbody></table></div></div><br class="table-break"><p> 80 <a class="indexterm" name="id 380831"></a>80 <a class="indexterm" name="id402938"></a> 81 81 It is obvious to all that the first requirement (as a matter of network hygiene) is to eliminate 82 82 problems that affect basic network operation. This book has provided sufficient working examples 83 83 to help you to avoid all these problems. 84 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id 380842"></a>Guidelines for Reliable Samba Operation</h2></div></div></div><p>85 <a class="indexterm" name="id 380850"></a>86 <a class="indexterm" name="id 380856"></a>84 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id402949"></a>Guidelines for Reliable Samba Operation</h2></div></div></div><p> 85 <a class="indexterm" name="id402957"></a> 86 <a class="indexterm" name="id402963"></a> 87 87 Your objective is to provide a network that works correctly, can grow at all times, is resilient 88 88 at times of extreme demand, and can scale to meet future needs. The following subject areas provide 89 89 pointers that can help you today. 90 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 380866"></a>Name Resolution</h3></div></div></div><p>90 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id402973"></a>Name Resolution</h3></div></div></div><p> 91 91 There are three basic current problem areas: bad hostnames, routed networks, and network collisions. 92 92 These are covered in the following discussion. 93 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id 380877"></a>Bad Hostnames</h4></div></div></div><p>94 <a class="indexterm" name="id 380884"></a>95 <a class="indexterm" name="id 380894"></a>96 <a class="indexterm" name="id 380900"></a>97 <a class="indexterm" name="id 380907"></a>98 <a class="indexterm" name="id 380914"></a>93 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id402984"></a>Bad Hostnames</h4></div></div></div><p> 94 <a class="indexterm" name="id402991"></a> 95 <a class="indexterm" name="id403001"></a> 96 <a class="indexterm" name="id403007"></a> 97 <a class="indexterm" name="id403014"></a> 98 <a class="indexterm" name="id403021"></a> 99 99 When configured as a DHCP client, a number of Linux distributions set the system hostname 100 100 to <code class="constant">localhost</code>. If the parameter <em class="parameter"><code>netbios name</code></em> is not … … 108 108 correctly. 109 109 </p><p> 110 <a class="indexterm" name="id 380963"></a>110 <a class="indexterm" name="id403070"></a> 111 111 A few sites have tried to name Windows clients and Samba servers with a name that begins 112 112 with the digits 1-9. This does not work either because it may result in the client or 113 113 server attempting to use that name as an IP address. 114 114 </p><p> 115 <a class="indexterm" name="id 380975"></a>116 <a class="indexterm" name="id 380984"></a>115 <a class="indexterm" name="id403082"></a> 116 <a class="indexterm" name="id403091"></a> 117 117 A Samba server called <code class="constant">FRED</code> in a NetBIOS domain called <code class="constant">COLLISION</code> 118 118 in a network environment that is part of the fully-qualified Internet domain namespace known … … 123 123 fails given that you probably do not have this in your DNS namespace. 124 124 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 125 <a class="indexterm" name="id 381024"></a>126 <a class="indexterm" name="id 381033"></a>127 <a class="indexterm" name="id 381040"></a>125 <a class="indexterm" name="id403131"></a> 126 <a class="indexterm" name="id403140"></a> 127 <a class="indexterm" name="id403147"></a> 128 128 An Active Directory realm called <code class="constant">collision.parrots.com</code> is perfectly okay, 129 129 although it too must be capable of being resolved via DNS, something that functions correctly 130 130 if Windows 200x ADS has been properly installed and configured. 131 </p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id 381054"></a>Routed Networks</h4></div></div></div><p>132 <a class="indexterm" name="id 381062"></a>133 <a class="indexterm" name="id 381069"></a>134 <a class="indexterm" name="id 381078"></a>131 </p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id403161"></a>Routed Networks</h4></div></div></div><p> 132 <a class="indexterm" name="id403169"></a> 133 <a class="indexterm" name="id403176"></a> 134 <a class="indexterm" name="id403185"></a> 135 135 NetBIOS networks (Windows networking with NetBIOS over TCP/IP enabled) makes extensive use 136 of UDP-based broadcast traffic, as you saw during the exercises in <a href="primer.html" title="Chapter 16. Networking Primer">???</a>.136 of UDP-based broadcast traffic, as you saw during the exercises in <a class="link" href="primer.html" title="Chapter 16. Networking Primer">“Networking Primer”</a>. 137 137 </p><p> 138 <a class="indexterm" name="id 381096"></a>139 <a class="indexterm" name="id 381103"></a>140 <a class="indexterm" name="id 381110"></a>138 <a class="indexterm" name="id403203"></a> 139 <a class="indexterm" name="id403210"></a> 140 <a class="indexterm" name="id403217"></a> 141 141 UDP broadcast traffic is not forwarded by routers. This means that NetBIOS broadcast-based 142 142 networking cannot function across routed networks (i.e., multi-subnet networks) unless 143 143 special provisions are made: 144 144 </p><div class="itemizedlist"><ul type="disc"><li><p> 145 <a class="indexterm" name="id 381125"></a>146 <a class="indexterm" name="id 381132"></a>147 <a class="indexterm" name="id 381139"></a>145 <a class="indexterm" name="id403232"></a> 146 <a class="indexterm" name="id403239"></a> 147 <a class="indexterm" name="id403246"></a> 148 148 Either install on every Windows client an LMHOSTS file (located in the directory 149 149 <code class="filename">C:\windows\system32\drivers\etc</code>). It is also necessary to … … 152 152 manual page for the <code class="filename">smb.conf</code> file. 153 153 </p></li><li><p> 154 <a class="indexterm" name="id 381182"></a>154 <a class="indexterm" name="id403289"></a> 155 155 Or configure Samba as a WINS server, and configure all network clients to use that 156 156 WINS server in their TCP/IP configuration. 157 157 </p></li></ul></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 158 <a class="indexterm" name="id 381197"></a>159 <a class="indexterm" name="id 381207"></a>158 <a class="indexterm" name="id403304"></a> 159 <a class="indexterm" name="id403314"></a> 160 160 The use of DNS is not an acceptable substitute for WINS. DNS does not store specific 161 161 information regarding NetBIOS networking particulars that get stored in the WINS 162 162 name resolution database and that Windows clients require and depend on. 163 </p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id 381218"></a>Network Collisions</h4></div></div></div><p>164 <a class="indexterm" name="id 381225"></a>165 <a class="indexterm" name="id 381234"></a>166 <a class="indexterm" name="id 381244"></a>167 <a class="indexterm" name="id 381250"></a>163 </p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id403325"></a>Network Collisions</h4></div></div></div><p> 164 <a class="indexterm" name="id403332"></a> 165 <a class="indexterm" name="id403342"></a> 166 <a class="indexterm" name="id403351"></a> 167 <a class="indexterm" name="id403358"></a> 168 168 Excessive network activity causes NetBIOS network timeouts. Timeouts may result in 169 169 blue screen of death (BSOD) experiences. High collision rates may be caused by excessive … … 172 172 </p><p> 173 173 The use of WINS is highly recommended to reduce network broadcast traffic, as outlined 174 in <a href="primer.html" title="Chapter 16. Networking Primer">???</a>.174 in <a class="link" href="primer.html" title="Chapter 16. Networking Primer">“Networking Primer”</a>. 175 175 </p><p> 176 <a class="indexterm" name="id 381276"></a>177 <a class="indexterm" name="id 381282"></a>178 <a class="indexterm" name="id 381289"></a>176 <a class="indexterm" name="id403383"></a> 177 <a class="indexterm" name="id403389"></a> 178 <a class="indexterm" name="id403396"></a> 179 179 Under no circumstances should the facility be supported by many routers, known as <code class="constant">NetBIOS 180 180 forwarding</code>, unless you know exactly what you are doing. Inappropriate use of this … … 184 184 less than 15 KB/sec. After the NetBIOS forwarding was turned off, file transfer performance 185 185 immediately returned to 11 MB/sec. 186 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 381308"></a>Samba Configuration</h3></div></div></div><p>186 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id403415"></a>Samba Configuration</h3></div></div></div><p> 187 187 As a general rule, the contents of the <code class="filename">smb.conf</code> file should be kept as simple as possible. 188 188 No parameter should be specified unless you know it is essential to operation. 189 189 </p><p> 190 <a class="indexterm" name="id 381326"></a>191 <a class="indexterm" name="id 381333"></a>192 <a class="indexterm" name="id 381340"></a>190 <a class="indexterm" name="id403433"></a> 191 <a class="indexterm" name="id403440"></a> 192 <a class="indexterm" name="id403447"></a> 193 193 Many UNIX administrators like to fully document the settings in the <code class="filename">smb.conf</code> file. This is a 194 194 bad idea because it adds content to the file. The <code class="filename">smb.conf</code> file is re-read by every <code class="literal">smbd</code> … … 198 198 It is recommended to keep a fully documented <code class="filename">smb.conf</code> file on hand, and then to operate Samba only 199 199 with an optimized file. 200 </p><p><a class="indexterm" name="id 381386"></a>200 </p><p><a class="indexterm" name="id403493"></a> 201 201 The preferred way to maintain a documented file is to call it something like <code class="filename">smb.conf.master</code>. 202 202 You can generate the optimized file by executing: … … 224 224 Press enter to see a dump of your service definitions 225 225 </pre><p> 226 <a class="indexterm" name="id 381437"></a>226 <a class="indexterm" name="id403544"></a> 227 227 You now, of course, press the enter key to complete the command, or else abort it by pressing Ctrl-C. 228 228 The important thing to note is the noted Server role, as well as warning messages. Noted configuration … … 234 234 </pre><p> 235 235 </p><p> 236 <a class="indexterm" name="id 381458"></a>237 <a class="indexterm" name="id 381465"></a>238 <a class="indexterm" name="id 381472"></a>236 <a class="indexterm" name="id403565"></a> 237 <a class="indexterm" name="id403572"></a> 238 <a class="indexterm" name="id403579"></a> 239 239 There are two parameters that can cause severe network performance degradation: <em class="parameter"><code>socket options</code></em> 240 240 and <em class="parameter"><code>socket address</code></em>. The <em class="parameter"><code>socket options</code></em> parameter was often necessary … … 242 242 this parameter being set. Do not use either parameter unless it has been proven necessary to use them. 243 243 </p><p> 244 <a class="indexterm" name="id 381503"></a>245 <a class="indexterm" name="id 381510"></a>246 <a class="indexterm" name="id 381516"></a>247 <a class="indexterm" name="id 381523"></a>244 <a class="indexterm" name="id403610"></a> 245 <a class="indexterm" name="id403617"></a> 246 <a class="indexterm" name="id403623"></a> 247 <a class="indexterm" name="id403630"></a> 248 248 Another <code class="filename">smb.conf</code> parameter that may cause severe network performance degradation is the 249 249 <em class="parameter"><code>strict sync</code></em> parameter. Do not use this at all. There is no good reason … … 252 252 degrade network performance, so do not set it; if you must, do so with caution. 253 253 </p><p> 254 <a class="indexterm" name="id 381562"></a>255 <a class="indexterm" name="id 381569"></a>256 <a class="indexterm" name="id 381576"></a>257 <a class="indexterm" name="id 381582"></a>254 <a class="indexterm" name="id403669"></a> 255 <a class="indexterm" name="id403676"></a> 256 <a class="indexterm" name="id403683"></a> 257 <a class="indexterm" name="id403690"></a> 258 258 Finally, many network administrators deliberately disable opportunistic locking support. While this 259 259 does not degrade Samba performance, it significantly degrades Windows client performance because … … 261 261 invoke a network read or write call. If for any reason you must disable oplocks (opportunistic locking) 262 262 support, do so only on the share on which it is required. That way, all other shares can provide 263 oplock support for operations that are tolerant of it. See <a href="appendix.html#ch12dblck" title="Shared Data Integrity">???</a> for more263 oplock support for operations that are tolerant of it. See <a class="link" href="appendix.html#ch12dblck" title="Shared Data Integrity">“Shared Data Integrity”</a> for more 264 264 information. 265 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 381603"></a>Use and Location of BDCs</h3></div></div></div><p>266 <a class="indexterm" name="id 381611"></a>267 <a class="indexterm" name="id 381617"></a>268 <a class="indexterm" name="id 381624"></a>269 <a class="indexterm" name="id 381631"></a>270 <a class="indexterm" name="id 381638"></a>265 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id403710"></a>Use and Location of BDCs</h3></div></div></div><p> 266 <a class="indexterm" name="id403718"></a> 267 <a class="indexterm" name="id403724"></a> 268 <a class="indexterm" name="id403731"></a> 269 <a class="indexterm" name="id403738"></a> 270 <a class="indexterm" name="id403745"></a> 271 271 On a network segment where there is a PDC and a BDC, the BDC carries the bulk of the network logon 272 272 processing. If the BDC is a heavily loaded server, the PDC carries a greater proportion of … … 276 276 and is undesirable. 277 277 </p><p> 278 <a class="indexterm" name="id 381652"></a>279 <a class="indexterm" name="id 381659"></a>278 <a class="indexterm" name="id403759"></a> 279 <a class="indexterm" name="id403766"></a> 280 280 As a general guide, instead of adding domain member servers to a network, you would be better advised 281 281 to add BDCs until there are fewer than 30 Windows clients per BDC. Beyond that ratio, you should add 282 282 domain member servers. This practice ensures that there are always sufficient domain controllers 283 283 to handle logon requests and authentication traffic. 284 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 381671"></a>Use One Consistent Version of MS Windows Client</h3></div></div></div><p>284 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id403778"></a>Use One Consistent Version of MS Windows Client</h3></div></div></div><p> 285 285 Every network client has its own peculiarities. From a management perspective, it is easier to deal 286 286 with one version of MS Windows that is maintained to a consistent update level than it is to deal … … 290 290 have necessitated special handling from the Samba server end. If you want to remain sane, keep you 291 291 client workstation configurations consistent. 292 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 381688"></a>For Scalability, Use SAN-Based Storage on Samba Servers</h3></div></div></div><p>293 <a class="indexterm" name="id 381696"></a>294 <a class="indexterm" name="id 381703"></a>292 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id403795"></a>For Scalability, Use SAN-Based Storage on Samba Servers</h3></div></div></div><p> 293 <a class="indexterm" name="id403803"></a> 294 <a class="indexterm" name="id403810"></a> 295 295 Many SAN-based storage systems permit more than one server to share a common data store. 296 296 Use of a shared SAN data store means that you do not need to use time- and resource-hungry data 297 297 synchronization techniques. 298 298 </p><p> 299 <a class="indexterm" name="id 381715"></a>300 <a class="indexterm" name="id 381722"></a>299 <a class="indexterm" name="id403822"></a> 300 <a class="indexterm" name="id403829"></a> 301 301 The use of a collection of relatively low-cost front-end Samba servers that are coupled to 302 302 a shared backend SAN data store permits load distribution while containing costs below that 303 303 of installing and managing a complex clustering facility. 304 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 381733"></a>Distribute Network Load with MSDFS</h3></div></div></div><p>305 <a class="indexterm" name="id 381741"></a>306 <a class="indexterm" name="id 381748"></a>304 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id403840"></a>Distribute Network Load with MSDFS</h3></div></div></div><p> 305 <a class="indexterm" name="id403848"></a> 306 <a class="indexterm" name="id403855"></a> 307 307 Microsoft DFS (distributed file system) technology has been implemented in Samba. MSDFS permits 308 308 data to be accessed from a single share and yet to actually be distributed across multiple actual … … 310 310 implementation of an MSDFS installation. 311 311 </p><p> 312 <a class="indexterm" name="id 381764"></a>313 <a class="indexterm" name="id 381773"></a>312 <a class="indexterm" name="id403871"></a> 313 <a class="indexterm" name="id403880"></a> 314 314 The combination of multiple backend servers together with a front-end server and use of MSDFS 315 315 can achieve almost the same as you would obtain with a clustered Samba server. 316 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 381784"></a>Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</h3></div></div></div><p>317 <a class="indexterm" name="id 381792"></a>318 <a class="indexterm" name="id 381798"></a>319 <a class="indexterm" name="id 381805"></a>316 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id403891"></a>Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</h3></div></div></div><p> 317 <a class="indexterm" name="id403899"></a> 318 <a class="indexterm" name="id403906"></a> 319 <a class="indexterm" name="id403912"></a> 320 320 Consider using <code class="literal">rsync</code> to replicate data across the WAN during times 321 321 of low utilization. Users can then access the replicated data store rather than needing to do so … … 324 324 implementation if you choose to permit modification and return replication of the modified file; 325 325 otherwise, you may inadvertently overwrite important data. 326 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 381824"></a>Hardware Problems</h3></div></div></div><p>327 <a class="indexterm" name="id 381832"></a>328 <a class="indexterm" name="id 381839"></a>329 <a class="indexterm" name="id 381846"></a>330 <a class="indexterm" name="id 381853"></a>331 <a class="indexterm" name="id 381862"></a>332 <a class="indexterm" name="id 381871"></a>326 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id403932"></a>Hardware Problems</h3></div></div></div><p> 327 <a class="indexterm" name="id403939"></a> 328 <a class="indexterm" name="id403946"></a> 329 <a class="indexterm" name="id403953"></a> 330 <a class="indexterm" name="id403960"></a> 331 <a class="indexterm" name="id403969"></a> 332 <a class="indexterm" name="id403978"></a> 333 333 Networking hardware prices have fallen sharply over the past 5 years. A surprising number 334 334 of Samba networking problems over this time have been traced to defective network interface 335 335 cards (NICs) or defective HUBs, switches, and cables. 336 336 </p><p> 337 <a class="indexterm" name="id 381886"></a>337 <a class="indexterm" name="id403993"></a> 338 338 Not surprising is the fact that network administrators do not like to be shown to have made 339 339 a bad decision. Money saved in buying low-cost hardware may result in high costs incurred 340 340 in corrective action. 341 341 </p><p> 342 <a class="indexterm" name="id 381897"></a>343 <a class="indexterm" name="id 381904"></a>344 <a class="indexterm" name="id 381911"></a>345 <a class="indexterm" name="id 381918"></a>346 <a class="indexterm" name="id 381925"></a>342 <a class="indexterm" name="id404004"></a> 343 <a class="indexterm" name="id404011"></a> 344 <a class="indexterm" name="id404018"></a> 345 <a class="indexterm" name="id404025"></a> 346 <a class="indexterm" name="id404032"></a> 347 347 Defective NICs, HUBs, and switches may appear as intermittent network access problems, intermittent 348 348 or persistent data corruption, slow network throughput, low performance, or even as BSOD … … 353 353 Defective hardware problems may take patience and persistence before the real cause can be discovered. 354 354 </p><p> 355 <a class="indexterm" name="id 381943"></a>355 <a class="indexterm" name="id404050"></a> 356 356 Networking hardware defects can significantly impact perceived Samba performance, but defective 357 357 RAID controllers as well as SCSI and IDE hard disk controllers have also been known to impair Samba server … … 360 360 administrator until the entire server was replaced. While you may well think that this would never 361 361 happen to you, experience shows that given the right (unfortunate) circumstances, this can happen to anyone. 362 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 381957"></a>Large Directories</h3></div></div></div><p>362 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id404070"></a>Large Directories</h3></div></div></div><p> 363 363 There exist applications that create or manage directories containing many thousands of files. Such 364 364 applications typically generate many small files (less than 100 KB). At the best of times, under UNIX, … … 380 380 </p><p> 381 381 Samba-3.0.12 and later, includes new code that radically improves Samba perfomance. The secret to this is 382 really in the <a class=" indexterm" name="id381988"></a>case sensitive = Trueline. This tells smbd never to scan382 really in the <a class="link" href="smb.conf.5.html#CASESENSITIVE">case sensitive = True</a> line. This tells smbd never to scan 383 383 for case-insensitive versions of names. So if an application asks for a file called <code class="filename">FOO</code>, 384 384 and it can not be found by a simple stat call, then smbd will return "file not found" immediately without … … 400 400 as specified in the <code class="filename">smb.conf</code> stanza. This means that smbd will not be able to find lower case 401 401 filenames with these settings. Note, this is done on a per-share basis. 402 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id 382035"></a>Key Points Learned</h2></div></div></div><p>402 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id404151"></a>Key Points Learned</h2></div></div></div><p> 403 403 This chapter has touched in broad sweeps on a number of simple steps that can be taken 404 404 to ensure that your Samba network is resilient, scalable, and reliable, and that it … … 409 409 her an even break. 410 410 </p><p> 411 <a class="indexterm" name="id 382053"></a>411 <a class="indexterm" name="id404169"></a> 412 412 Last, but not least, you should not only keep the network design simple, but also be sure it is 413 413 well documented. This book may serve as your pattern for documenting every -
branches/samba-3.0/docs/htmldocs/Samba3-ByExample/RefSection.html
r44 r134 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Part III. Reference Section</title><link rel="stylesheet" href=" samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="nw4migration.html" title="Chapter 10. Migrating NetWare Server to Samba-3"><link rel="next" href="kerberos.html" title="Chapter 11. Active Directory, Kerberos, and Security"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Part III. Reference Section</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="nw4migration.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="kerberos.html">Next</a></td></tr></table><hr></div><div class="part" lang="en"><div class="titlepage"><div><div><h1 class="title"><a name="RefSection"></a>Part III. Reference Section</h1></div></div></div><div class="partintro" lang="en"><div><div><div><h1 class="title"><a name="id372526"></a>Reference Section</h1></div></div></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Part III. Reference Section</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="nw4migration.html" title="Chapter 10. Migrating NetWare Server to Samba-3"><link rel="next" href="kerberos.html" title="Chapter 11. Active Directory, Kerberos, and Security"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Part III. Reference Section</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="nw4migration.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="kerberos.html">Next</a></td></tr></table><hr></div><div class="part" lang="en"><div class="titlepage"><div><div><h1 class="title"><a name="RefSection"></a>Part III. Reference Section</h1></div></div></div><div class="partintro" lang="en"><div><div><div><h1 class="title"><a name="id394649"></a>Reference Section</h1></div></div></div><p> 2 2 This section <span class="emphasis"><em>Samba-3 by Example</em></span> provides important reference material 3 3 that may help you to solve network performance issues, to answer some of the critiques 4 4 published regarding Samba, or just to gain a more broad understanding of how Samba can 5 5 play in a Windows networking world. 6 </p><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="chapter"><a href="kerberos.html">11. Active Directory, Kerberos, and Security</a></span></dt><dd><dl><dt><span class="sect1"><a href="kerberos.html#id372607">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id373189">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id373203">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id373574">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#ch10expl">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id375060">Share Access Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id375395">Share Definition Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id375952">Share Point Directory and File Permissions</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id376321">Managing Windows 200x ACLs</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id377005">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id377127">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="DomApps.html">12. Integrating Additional Services</a></span></dt><dd><dl><dt><span class="sect1"><a href="DomApps.html#id377711">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id377734">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id377820">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id377849">Technical Issues</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id377995">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id378010">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id379772">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id379827">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="HA.html">13. Performance, Reliability, and Availability</a></span></dt><dd><dl><dt><span class="sect1"><a href="HA.html#id380314">Introduction</a></span></dt><dt><span class="sect1"><a href="HA.html#id380391">Dissection and Discussion</a></span></dt><dt><span class="sect1"><a href="HA.html#id380842">Guidelines for Reliable Samba Operation</a></span></dt><dd><dl><dt><span class="sect2"><a href="HA.html#id380866">Name Resolution</a></span></dt><dt><span class="sect2"><a href="HA.html#id381308">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="HA.html#id381603">Use and Location of BDCs</a></span></dt><dt><span class="sect2"><a href="HA.html#id381671">Use One Consistent Version of MS Windows Client</a></span></dt><dt><span class="sect2"><a href="HA.html#id381688">For Scalability, Use SAN-Based Storage on Samba Servers</a></span></dt><dt><span class="sect2"><a href="HA.html#id381733">Distribute Network Load with MSDFS</a></span></dt><dt><span class="sect2"><a href="HA.html#id381784">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></span></dt><dt><span class="sect2"><a href="HA.html#id381824">Hardware Problems</a></span></dt><dt><span class="sect2"><a href="HA.html#id381957">Large Directories</a></span></dt></dl></dd><dt><span class="sect1"><a href="HA.html#id382035">Key Points Learned</a></span></dt></dl></dd><dt><span class="chapter"><a href="ch14.html">14. Samba Support</a></span></dt><dd><dl><dt><span class="sect1"><a href="ch14.html#id382184">Free Support</a></span></dt><dt><span class="sect1"><a href="ch14.html#id382382">Commercial Support</a></span></dt></dl></dd><dt><span class="chapter"><a href="appendix.html">15. A Collection of Useful Tidbits</a></span></dt><dd><dl><dt><span class="sect1"><a href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></span></dt><dt><span class="sect1"><a href="appendix.html#id383041">Samba System File Location</a></span></dt><dt><span class="sect1"><a href="appendix.html#id383432">Starting Samba</a></span></dt><dt><span class="sect1"><a href="appendix.html#id383730">DNS Configuration Files</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id383740">The Forward Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id383783">The Reverse Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id383865">DNS Root Server Hint File</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id383921">Initialization of the LDAP Database</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#id384378">The LDAP Account Manager</a></span></dt><dt><span class="sect1"><a href="appendix.html#id385293">IDEALX Management Console</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12dblck">Shared Data Integrity</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id385724">Microsoft Access</a></span></dt><dt><span class="sect2"><a href="appendix.html#id385863">Act! Database Sharing</a></span></dt><dt><span class="sect2"><a href="appendix.html#id385938">Opportunistic Locking Controls</a></span></dt></dl></dd></dl></dd><dt><span class="chapter"><a href="primer.html">16. Networking Primer</a></span></dt><dd><dl><dt><span class="sect1"><a href="primer.html#id386080">Requirements and Notes</a></span></dt><dt><span class="sect1"><a href="primer.html#id386216">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id386266">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#id386373">Exercises</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id386486">Single-Machine Broadcast Activity</a></span></dt><dt><span class="sect2"><a href="primer.html#secondmachine">Second Machine Startup Broadcast Interaction</a></span></dt><dt><span class="sect2"><a href="primer.html#id387580">Simple Windows Client Connection Characteristics</a></span></dt><dt><span class="sect2"><a href="primer.html#id388041">Windows 200x/XP Client Interaction with Samba-3</a></span></dt><dt><span class="sect2"><a href="primer.html#id388566">Conclusions to Exercises</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01conc">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id388668">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01qa">Questions and Answers</a></span></dt></dl></dd><dt><span class="appendix"><a href="gpl.html">A. GNU General Public License</a></span></dt><dd><dl><dt><span class="sect1"><a href="gpl.html#gpl-1">Preamble</a></span></dt><dt><span class="sect1"><a href="gpl.html#gpl-2">TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION</a></span></dt><dd><dl><dt><span class="sect2"><a href="gpl.html#gpl-2-0">Section 0</a></span></dt><dt><span class="sect2"><a href="gpl.html#gpl-2-1">Section 1</a></span></dt><dt><span class="sect2"><a href="gpl.html#gpl-2-2">Section 2</a></span></dt><dt><span class="sect2"><a href="gpl.html#gpl-2-3">Section 3 7 </a></span></dt><dt><span class="sect2"><a href="gpl.html#gpl-2-4">Section 4 8 </a></span></dt><dt><span class="sect2"><a href="gpl.html#gpl-2-5">Section 5 9 </a></span></dt><dt><span class="sect2"><a href="gpl.html#gpl-2-6">Section 6 10 </a></span></dt><dt><span class="sect2"><a href="gpl.html#gpl-2-7">Section 7 11 </a></span></dt><dt><span class="sect2"><a href="gpl.html#gpl-2-8">Section 8 12 </a></span></dt><dt><span class="sect2"><a href="gpl.html#gpl-2-9">Section 9 13 </a></span></dt><dt><span class="sect2"><a href="gpl.html#gpl-2-10">Section 10 14 </a></span></dt><dt><span class="sect2"><a href="gpl.html#gpl-2-11">NO WARRANTY Section 11 15 </a></span></dt><dt><span class="sect2"><a href="gpl.html#gpl-2-12">Section 12 16 </a></span></dt></dl></dd><dt><span class="sect1"><a href="gpl.html#gpl-3">How to Apply These Terms to Your New Programs 17 </a></span></dt></dl></dd></dl></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="nw4migration.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="kerberos.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 10. Migrating NetWare Server to Samba-3 </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 11. Active Directory, Kerberos, and Security</td></tr></table></div></body></html> 6 </p><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="chapter"><a href="kerberos.html">11. Active Directory, Kerberos, and Security</a></span></dt><dd><dl><dt><span class="sect1"><a href="kerberos.html#id394729">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id395316">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id395330">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id395699">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#ch10expl">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id397184">Share Access Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id397519">Share Definition Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id398076">Share Point Directory and File Permissions</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id398445">Managing Windows 200x ACLs</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id399129">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id399251">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="DomApps.html">12. Integrating Additional Services</a></span></dt><dd><dl><dt><span class="sect1"><a href="DomApps.html#id399839">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id399862">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id399948">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id399977">Technical Issues</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id400123">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id400137">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id401888">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id401943">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="HA.html">13. Performance, Reliability, and Availability</a></span></dt><dd><dl><dt><span class="sect1"><a href="HA.html#id402421">Introduction</a></span></dt><dt><span class="sect1"><a href="HA.html#id402498">Dissection and Discussion</a></span></dt><dt><span class="sect1"><a href="HA.html#id402949">Guidelines for Reliable Samba Operation</a></span></dt><dd><dl><dt><span class="sect2"><a href="HA.html#id402973">Name Resolution</a></span></dt><dt><span class="sect2"><a href="HA.html#id403415">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="HA.html#id403710">Use and Location of BDCs</a></span></dt><dt><span class="sect2"><a href="HA.html#id403778">Use One Consistent Version of MS Windows Client</a></span></dt><dt><span class="sect2"><a href="HA.html#id403795">For Scalability, Use SAN-Based Storage on Samba Servers</a></span></dt><dt><span class="sect2"><a href="HA.html#id403840">Distribute Network Load with MSDFS</a></span></dt><dt><span class="sect2"><a href="HA.html#id403891">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></span></dt><dt><span class="sect2"><a href="HA.html#id403932">Hardware Problems</a></span></dt><dt><span class="sect2"><a href="HA.html#id404070">Large Directories</a></span></dt></dl></dd><dt><span class="sect1"><a href="HA.html#id404151">Key Points Learned</a></span></dt></dl></dd><dt><span class="chapter"><a href="ch14.html">14. Samba Support</a></span></dt><dd><dl><dt><span class="sect1"><a href="ch14.html#id404300">Free Support</a></span></dt><dt><span class="sect1"><a href="ch14.html#id404499">Commercial Support</a></span></dt></dl></dd><dt><span class="chapter"><a href="appendix.html">15. A Collection of Useful Tidbits</a></span></dt><dd><dl><dt><span class="sect1"><a href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></span></dt><dt><span class="sect1"><a href="appendix.html#id405157">Samba System File Location</a></span></dt><dt><span class="sect1"><a href="appendix.html#id405549">Starting Samba</a></span></dt><dt><span class="sect1"><a href="appendix.html#id405844">DNS Configuration Files</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id405854">The Forward Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id405898">The Reverse Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id405998">DNS Root Server Hint File</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id406053">Initialization of the LDAP Database</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#id406519">The LDAP Account Manager</a></span></dt><dt><span class="sect1"><a href="appendix.html#id407438">IDEALX Management Console</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12dblck">Shared Data Integrity</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id407872">Microsoft Access</a></span></dt><dt><span class="sect2"><a href="appendix.html#id408011">Act! Database Sharing</a></span></dt><dt><span class="sect2"><a href="appendix.html#id408086">Opportunistic Locking Controls</a></span></dt></dl></dd></dl></dd><dt><span class="chapter"><a href="primer.html">16. Networking Primer</a></span></dt><dd><dl><dt><span class="sect1"><a href="primer.html#id408228">Requirements and Notes</a></span></dt><dt><span class="sect1"><a href="primer.html#id408364">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id408414">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#id408521">Exercises</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id408634">Single-Machine Broadcast Activity</a></span></dt><dt><span class="sect2"><a href="primer.html#secondmachine">Second Machine Startup Broadcast Interaction</a></span></dt><dt><span class="sect2"><a href="primer.html#id409728">Simple Windows Client Connection Characteristics</a></span></dt><dt><span class="sect2"><a href="primer.html#id410194">Windows 200x/XP Client Interaction with Samba-3</a></span></dt><dt><span class="sect2"><a href="primer.html#id410719">Conclusions to Exercises</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01conc">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id410820">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01qa">Questions and Answers</a></span></dt></dl></dd><dt><span class="appendix"><a href="apa.html">A. 7 <acronym class="acronym">GNU</acronym> General Public License version 3 8 </a></span></dt><dd><dl><dt><span class="bridgehead"><a href="apa.html#id411425">A. 9 Preamble 10 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id411534">A. 11 TERMS AND CONDITIONS 12 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id411537">A. 13 0. Definitions. 14 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id411601">A. 15 1. Source Code. 16 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id411663">A. 17 2. Basic Permissions. 18 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id411691">A. 19 3. Protecting Users’ Legal Rights From Anti-Circumvention Law. 20 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id411717">A. 21 4. Conveying Verbatim Copies. 22 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id411737">A. 23 5. Conveying Modified Source Versions. 24 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id411809">A. 25 6. Conveying Non-Source Forms. 26 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id411941">A. 27 7. Additional Terms. 28 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id412046">A. 29 8. Termination. 30 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id412078">A. 31 9. Acceptance Not Required for Having Copies. 32 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id412092">A. 33 10. Automatic Licensing of Downstream Recipients. 34 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id412126">A. 35 11. Patents. 36 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id412210">A. 37 12. No Surrender of Others’ Freedom. 38 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id412225">A. 39 13. Use with the ???TITLE??? Affero General Public License. 40 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id412249">A. 41 14. Revised Versions of this License. 42 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id412296">A. 43 15. Disclaimer of Warranty. 44 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id412314">A. 45 16. Limitation of Liability. 46 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id412328">A. 47 17. Interpretation of Sections 15 and 16. 48 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id412341">A. 49 END OF TERMS AND CONDITIONS 50 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id412344">A. 51 How to Apply These Terms to Your New Programs 52 </a></span></dt></dl></dd></dl></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="nw4migration.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="kerberos.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 10. Migrating NetWare Server to Samba-3 </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 11. Active Directory, Kerberos, and Security</td></tr></table></div></body></html> -
branches/samba-3.0/docs/htmldocs/Samba3-ByExample/appendix.html
r44 r134 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 15. A Collection of Useful Tidbits</title><link rel="stylesheet" href=" samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="ch14.html" title="Chapter 14. Samba Support"><link rel="next" href="primer.html" title="Chapter 16. Networking Primer"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 15. A Collection of Useful Tidbits</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="ch14.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="primer.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="appendix"></a>Chapter 15. A Collection of Useful Tidbits</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></span></dt><dt><span class="sect1"><a href="appendix.html#id383041">Samba System File Location</a></span></dt><dt><span class="sect1"><a href="appendix.html#id383432">Starting Samba</a></span></dt><dt><span class="sect1"><a href="appendix.html#id383730">DNS Configuration Files</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id383740">The Forward Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id383783">The Reverse Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id383865">DNS Root Server Hint File</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id383921">Initialization of the LDAP Database</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#id384378">The LDAP Account Manager</a></span></dt><dt><span class="sect1"><a href="appendix.html#id385293">IDEALX Management Console</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12dblck">Shared Data Integrity</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id385724">Microsoft Access</a></span></dt><dt><span class="sect2"><a href="appendix.html#id385863">Act! Database Sharing</a></span></dt><dt><span class="sect2"><a href="appendix.html#id385938">Opportunistic Locking Controls</a></span></dt></dl></dd></dl></div><p>2 <a class="indexterm" name="id 382496"></a>3 <a class="indexterm" name="id 382502"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 15. A Collection of Useful Tidbits</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="ch14.html" title="Chapter 14. Samba Support"><link rel="next" href="primer.html" title="Chapter 16. Networking Primer"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 15. A Collection of Useful Tidbits</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="ch14.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="primer.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="appendix"></a>Chapter 15. A Collection of Useful Tidbits</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></span></dt><dt><span class="sect1"><a href="appendix.html#id405157">Samba System File Location</a></span></dt><dt><span class="sect1"><a href="appendix.html#id405549">Starting Samba</a></span></dt><dt><span class="sect1"><a href="appendix.html#id405844">DNS Configuration Files</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id405854">The Forward Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id405898">The Reverse Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id405998">DNS Root Server Hint File</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id406053">Initialization of the LDAP Database</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#id406519">The LDAP Account Manager</a></span></dt><dt><span class="sect1"><a href="appendix.html#id407438">IDEALX Management Console</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12dblck">Shared Data Integrity</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id407872">Microsoft Access</a></span></dt><dt><span class="sect2"><a href="appendix.html#id408011">Act! Database Sharing</a></span></dt><dt><span class="sect2"><a href="appendix.html#id408086">Opportunistic Locking Controls</a></span></dt></dl></dd></dl></div><p> 2 <a class="indexterm" name="id404612"></a> 3 <a class="indexterm" name="id404619"></a> 4 4 Information presented here is considered to be either basic or well-known material that is informative 5 5 yet helpful. Over the years, I have observed an interesting behavior. There is an expectation that … … 8 8 as shown in the example given below. 9 9 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="domjoin"></a>Joining a Domain: Windows 200x/XP Professional</h2></div></div></div><p> 10 <a class="indexterm" name="id 382529"></a>10 <a class="indexterm" name="id404645"></a> 11 11 Microsoft Windows NT/200x/XP Professional platforms can participate in Domain Security. 12 12 This section steps through the process for making a Windows 200x/XP Professional machine a 13 13 member of a Domain Security environment. It should be noted that this process is identical 14 14 when joining a domain that is controlled by Windows NT4/200x as well as a Samba PDC. 15 </p><div class="procedure"><a name="id 382539"></a><p class="title"><b>Procedure 15.1. Steps to Join a Domain</b></p><ol type="1"><li><p>15 </p><div class="procedure"><a name="id404656"></a><p class="title"><b>Procedure 15.1. Steps to Join a Domain</b></p><ol type="1"><li><p> 16 16 Click <span class="guimenu">Start</span>. 17 17 </p></li><li><p> … … 19 19 </p></li><li><p> 20 20 The opening panel is the same one that can be reached by clicking <span class="guimenu">System</span> on the Control Panel. 21 See <a href="appendix.html#swxpp001" title="Figure 15.1. The General Panel.">???</a>.21 See <a class="link" href="appendix.html#swxpp001" title="Figure 15.1. The General Panel.">“The General Panel.”</a>. 22 22 </p><div class="figure"><a name="swxpp001"></a><p class="title"><b>Figure 15.1. The General Panel.</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/wxpp001.png" alt="The General Panel."></div></div></div><p><br class="figure-break"> 23 23 </p></li><li><p> … … 28 28 Clicking the <span class="guimenu">Network ID</span> button launches the configuration wizard. Do not use this with 29 29 Samba-3. If you wish to change the computer name, or join or leave the domain, click the <span class="guimenu">Change</span> button. 30 See <a href="appendix.html#swxpp004" title="Figure 15.2. The Computer Name Panel.">???</a>.30 See <a class="link" href="appendix.html#swxpp004" title="Figure 15.2. The Computer Name Panel.">“The Computer Name Panel.”</a>. 31 31 </p><div class="figure"><a name="swxpp004"></a><p class="title"><b>Figure 15.2. The Computer Name Panel.</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/wxpp004.png" alt="The Computer Name Panel."></div></div></div><p><br class="figure-break"> 32 32 </p></li><li><p> 33 33 Click on <span class="guimenu">Change</span>. This panel shows that our example machine (TEMPTATION) is in a workgroup called WORKGROUP. 34 We join the domain called MIDEARTH. See <a href="appendix.html#swxpp006" title="Figure 15.3. The Computer Name Changes Panel">???</a>.34 We join the domain called MIDEARTH. See <a class="link" href="appendix.html#swxpp006" title="Figure 15.3. The Computer Name Changes Panel">“The Computer Name Changes Panel”</a>. 35 35 </p><div class="figure"><a name="swxpp006"></a><p class="title"><b>Figure 15.3. The Computer Name Changes Panel</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/wxpp006.png" alt="The Computer Name Changes Panel"></div></div></div><p><br class="figure-break"> 36 36 </p></li><li><p> 37 37 Enter the name <span class="guimenu">MIDEARTH</span> in the field below the Domain radio button. 38 38 </p><p> 39 This panel shows that our example machine (TEMPTATION) is set to join the domain called MIDEARTH. See <a href="appendix.html#swxpp007" title="Figure 15.4. The Computer Name Changes Panel Domain MIDEARTH">???</a>.39 This panel shows that our example machine (TEMPTATION) is set to join the domain called MIDEARTH. See <a class="link" href="appendix.html#swxpp007" title="Figure 15.4. The Computer Name Changes Panel Domain MIDEARTH">“The Computer Name Changes Panel Domain MIDEARTH”</a>. 40 40 </p><div class="figure"><a name="swxpp007"></a><p class="title"><b>Figure 15.4. The Computer Name Changes Panel Domain MIDEARTH</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/wxpp007.png" alt="The Computer Name Changes Panel Domain MIDEARTH"></div></div></div><p><br class="figure-break"> 41 41 </p></li><li><p> … … 43 43 of a domain administrative account that has the rights to add machines to the domain. 44 44 </p><p> 45 Enter the name “<span class="quote">root</span>” and the root password from your Samba-3 server. See <a href="appendix.html#swxpp008" title="Figure 15.5. Computer Name Changes User name and Password Panel">???</a>.45 Enter the name “<span class="quote">root</span>” and the root password from your Samba-3 server. See <a class="link" href="appendix.html#swxpp008" title="Figure 15.5. Computer Name Changes User name and Password Panel">“Computer Name Changes User name and Password Panel”</a>. 46 46 </p><div class="figure"><a name="swxpp008"></a><p class="title"><b>Figure 15.5. Computer Name Changes User name and Password Panel</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/wxpp008.png" alt="Computer Name Changes User name and Password Panel"></div></div></div><p><br class="figure-break"> 47 47 </p></li><li><p> … … 51 51 Joining the domain is now complete. 52 52 </p></li></ol></div><p> 53 <a class="indexterm" name="id 382944"></a>54 <a class="indexterm" name="id 382951"></a>55 The screen capture shown in <a href="appendix.html#swxpp007" title="Figure 15.4. The Computer Name Changes Panel Domain MIDEARTH">???</a> has a button labeled <span class="guimenu">More...</span>. This button opens a53 <a class="indexterm" name="id405060"></a> 54 <a class="indexterm" name="id405067"></a> 55 The screen capture shown in <a class="link" href="appendix.html#swxpp007" title="Figure 15.4. The Computer Name Changes Panel Domain MIDEARTH">“The Computer Name Changes Panel Domain MIDEARTH”</a> has a button labeled <span class="guimenu">More...</span>. This button opens a 56 56 panel in which you can set (or change) the Primary DNS suffix of the computer. This is a parameter that mainly affects members 57 57 of Microsoft Active Directory. Active Directory is heavily oriented around the DNS namespace. 58 58 </p><p> 59 <a class="indexterm" name="id 382974"></a>60 <a class="indexterm" name="id 382981"></a>59 <a class="indexterm" name="id405090"></a> 60 <a class="indexterm" name="id405097"></a> 61 61 Where NetBIOS technology uses WINS as well as UDP broadcast as key mechanisms for name resolution, Active Directory servers 62 62 register their services with the Microsoft Dynamic DNS server. Windows clients must be able to query the correct DNS server 63 63 to find the services (like which machines are domain controllers or which machines have the Netlogon service running). 64 64 </p><p> 65 <a class="indexterm" name="id 382996"></a>65 <a class="indexterm" name="id405112"></a> 66 66 The default setting of the Primary DNS suffix is the Active Directory domain name. When you change the Primary DNS suffix, 67 67 this does not affect domain membership, but it can break network browsing and the ability to resolve your computer name to … … 71 71 Where the client is a member of a Samba domain, it is preferable to leave this field blank. 72 72 </p><p> 73 <a class="indexterm" name="id 383016"></a>73 <a class="indexterm" name="id405132"></a> 74 74 According to Microsoft documentation, “<span class="quote">If this computer belongs to a group with <code class="constant">Group Policy</code> 75 75 enabled on <code class="literal">Primary DNS suffice of this computer</code>, the string specified in the Group Policy is used 76 76 as the primary DNS suffix and you might need to restart your computer to view the correct setting. The local setting is 77 77 used only if Group Policy is disabled or unspecified.</span>” 78 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id 383041"></a>Samba System File Location</h2></div></div></div><p><a class="indexterm" name="id383048"></a><a class="indexterm" name="id383056"></a><a class="indexterm" name="id383063"></a>78 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id405157"></a>Samba System File Location</h2></div></div></div><p><a class="indexterm" name="id405164"></a><a class="indexterm" name="id405172"></a><a class="indexterm" name="id405180"></a> 79 79 One of the frustrations expressed by subscribers to the Samba mailing lists revolves around the choice of where the default Samba Team 80 80 build and installation process locates its Samba files. The location, chosen in the early 1990s, for the default installation is … … 84 84 Several UNIX vendors, and Linux vendors in particular, elected to locate the Samba files in a location other than the Samba Team 85 85 default. 86 </p><p><a class="indexterm" name="id 383094"></a><a class="indexterm" name="id383105"></a><a class="indexterm" name="id383113"></a><a class="indexterm" name="id383124"></a><a class="indexterm" name="id383132"></a><a class="indexterm" name="id383143"></a><a class="indexterm" name="id383150"></a><a class="indexterm" name="id383158"></a><a class="indexterm" name="id383166"></a><a class="indexterm" name="id383174"></a><a class="indexterm" name="id383182"></a><a class="indexterm" name="id383190"></a><a class="indexterm" name="id383198"></a><a class="indexterm" name="id383205"></a><a class="indexterm" name="id383213"></a><a class="indexterm" name="id383221"></a>86 </p><p><a class="indexterm" name="id405210"></a><a class="indexterm" name="id405222"></a><a class="indexterm" name="id405229"></a><a class="indexterm" name="id405240"></a><a class="indexterm" name="id405248"></a><a class="indexterm" name="id405259"></a><a class="indexterm" name="id405266"></a><a class="indexterm" name="id405274"></a><a class="indexterm" name="id405282"></a><a class="indexterm" name="id405290"></a><a class="indexterm" name="id405298"></a><a class="indexterm" name="id405306"></a><a class="indexterm" name="id405314"></a><a class="indexterm" name="id405322"></a><a class="indexterm" name="id405329"></a><a class="indexterm" name="id405337"></a> 87 87 Linux vendors, working in conjunction with the Free Standards Group (FSG), Linux Standards Base (LSB), and File Hierarchy 88 88 System (FHS), have elected to locate the configuration files under the <code class="filename">/etc/samba</code> directory, common binary … … 93 93 <code class="filename">/usr/lib/samba</code> directory tree. The files located there include the dynamically loadable modules for the 94 94 passdb backend as well as for the VFS modules. 95 </p><p><a class="indexterm" name="id 383285"></a><a class="indexterm" name="id383292"></a><a class="indexterm" name="id383300"></a>95 </p><p><a class="indexterm" name="id405401"></a><a class="indexterm" name="id405409"></a><a class="indexterm" name="id405416"></a> 96 96 Samba creates runtime control files and generates log files. The runtime control files (tdb and dat files) are stored in 97 97 the <code class="filename">/var/lib/samba</code> directory. Log files are created in <code class="filename">/var/log/samba.</code> … … 99 99 When Samba is built and installed using the default Samba Team process, all files are located under the 100 100 <code class="filename">/usr/local/samba</code> directory tree. This makes it simple to find the files that Samba owns. 101 </p><p><a class="indexterm" name="id 383335"></a>101 </p><p><a class="indexterm" name="id405451"></a> 102 102 One way to find the Samba files that are installed on your UNIX/Linux system is to search for the location 103 103 of all files called <code class="literal">smbd</code>. Here is an example: … … 132 132 Many people have been caught by installation of Samba using the default Samba Team process when it was already installed 133 133 by the platform vendor's method. If your platform uses RPM format packages, you can check to see if Samba is installed by 134 executing:<a class="indexterm" name="id 383400"></a>134 executing:<a class="indexterm" name="id405516"></a> 135 135 </p><pre class="screen"> 136 136 <code class="prompt">root# </code> rpm -qa | grep samba … … 144 144 samba3-client-3.0.20-1 145 145 samba3-cifsmount-3.0.20-1 146 </pre><p><a class="indexterm" name="id 383420"></a>146 </pre><p><a class="indexterm" name="id405536"></a> 147 147 The package names, of course, vary according to how the vendor, or the binary package builder, prepared them. 148 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id 383432"></a>Starting Samba</h2></div></div></div><p><a class="indexterm" name="id383439"></a>148 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id405549"></a>Starting Samba</h2></div></div></div><p><a class="indexterm" name="id405555"></a> 149 149 Samba essentially consists of two or three daemons. A daemon is a UNIX application that runs in the background and provides services. 150 150 An example of a service is the Apache Web server for which the daemon is called <code class="literal">httpd</code>. In the case of Samba, there … … 187 187 exit 0 188 188 </pre></div></div><br class="example-break"><div class="variablelist"><dl><dt><span class="term">nmbd</span></dt><dd><p> 189 <a class="indexterm" name="id 383493"></a>190 <a class="indexterm" name="id 383500"></a>189 <a class="indexterm" name="id405609"></a> 190 <a class="indexterm" name="id405616"></a> 191 191 This daemon handles all name registration and resolution requests. It is the primary vehicle involved 192 192 in network browsing. It handles all UDP-based protocols. The <code class="literal">nmbd</code> daemon should 193 193 be the first command started as part of the Samba startup process. 194 194 </p></dd><dt><span class="term">smbd</span></dt><dd><p> 195 <a class="indexterm" name="id 383527"></a>196 <a class="indexterm" name="id 383534"></a>195 <a class="indexterm" name="id405643"></a> 196 <a class="indexterm" name="id405650"></a> 197 197 This daemon handles all TCP/IP-based connection services for file- and print-based operations. It also 198 198 manages local authentication. It should be started immediately following the startup of <code class="literal">nmbd</code>. 199 199 </p></dd><dt><span class="term">winbindd</span></dt><dd><p> 200 <a class="indexterm" name="id 383560"></a>201 <a class="indexterm" name="id 383567"></a>200 <a class="indexterm" name="id405677"></a> 201 <a class="indexterm" name="id405683"></a> 202 202 This daemon should be started when Samba is a member of a Windows NT4 or ADS domain. It is also needed when 203 203 Samba has trust relationships with another domain. The <code class="literal">winbindd</code> daemon will check the … … 253 253 exit 1 254 254 esac 255 </pre></div></div><br class="example-break"><p><a class="indexterm" name="id 383659"></a>255 </pre></div></div><br class="example-break"><p><a class="indexterm" name="id405774"></a> 256 256 SUSE Linux implements individual control over each Samba daemon. A Samba control script that can be conveniently 257 executed from the command line is shown in <a href="appendix.html#ch12SL" title="Example 15.1. A Useful Samba Control Script for SUSE Linux">???</a>. This can be located in the directory257 executed from the command line is shown in <a class="link" href="appendix.html#ch12SL" title="Example 15.1. A Useful Samba Control Script for SUSE Linux">“A Useful Samba Control Script for SUSE Linux”</a>. This can be located in the directory 258 258 <code class="filename">/sbin</code> in a file called <code class="filename">samba</code>. This type of control script should be 259 259 owned by user root and group root, and set so that only root can execute it. 260 </p><p><a class="indexterm" name="id 383691"></a>261 A sample startup script for a Red Hat Linux system is shown in <a href="appendix.html#ch12RHscript" title="Example 15.2. A Sample Samba Control Script for Red Hat Linux">???</a>.260 </p><p><a class="indexterm" name="id405805"></a> 261 A sample startup script for a Red Hat Linux system is shown in <a class="link" href="appendix.html#ch12RHscript" title="Example 15.2. A Sample Samba Control Script for Red Hat Linux">“A Sample Samba Control Script for Red Hat Linux”</a>. 262 262 This file could be located in the directory <code class="filename">/etc/rc.d</code> and can be called 263 263 <code class="filename">samba</code>. A similar startup script is required to control <code class="literal">winbind</code>. … … 265 265 the Samba source code distribution tarball. The packaging files for each platform include a 266 266 startup control file. 267 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id 383730"></a>DNS Configuration Files</h2></div></div></div><p>267 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id405844"></a>DNS Configuration Files</h2></div></div></div><p> 268 268 The following files are common to all DNS server configurations. Rather than repeat them multiple times, they 269 269 are presented here for general reference. 270 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 383740"></a>The Forward Zone File for the Loopback Adaptor</h3></div></div></div><p>270 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id405854"></a>The Forward Zone File for the Loopback Adaptor</h3></div></div></div><p> 271 271 The forward zone file for the loopback address never changes. An example file is shown 272 in <a href="appendix.html#loopback" title="Example 15.3. DNS Localhost Forward Zone File: /var/lib/named/localhost.zone">???</a>. All traffic destined for an IP address that is hosted on a272 in <a class="link" href="appendix.html#loopback" title="Example 15.3. DNS Localhost Forward Zone File: /var/lib/named/localhost.zone">“DNS Localhost Forward Zone File: /var/lib/named/localhost.zone”</a>. All traffic destined for an IP address that is hosted on a 273 273 physical interface on the machine itself is routed to the loopback adaptor. This is 274 274 a fundamental design feature of the TCP/IP protocol implementation. The loopback adaptor … … 285 285 IN NS @ 286 286 IN A 127.0.0.1 287 </pre></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 383783"></a>The Reverse Zone File for the Loopback Adaptor</h3></div></div></div><p>288 The reverse zone file for the loopback address as shown in <a href="appendix.html#dnsloopy" title="Example 15.4. DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone">???</a>287 </pre></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id405898"></a>The Reverse Zone File for the Loopback Adaptor</h3></div></div></div><p> 288 The reverse zone file for the loopback address as shown in <a class="link" href="appendix.html#dnsloopy" title="Example 15.4. DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone">“DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone”</a> 289 289 is necessary so that references to the address <code class="constant">127.0.0.1</code> can be 290 290 resolved to the correct name of the interface. … … 345 345 M.ROOT-SERVERS.NET. 3600000 A 202.12.27.33 346 346 ; End of File 347 </pre></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 383865"></a>DNS Root Server Hint File</h3></div></div></div><p>348 The content of the root hints file as shown in <a href="appendix.html#roothint" title="Example 15.5. DNS Root Name Server Hint File: /var/lib/named/root.hint">???</a> changes slowly over time.347 </pre></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id405998"></a>DNS Root Server Hint File</h3></div></div></div><p> 348 The content of the root hints file as shown in <a class="link" href="appendix.html#roothint" title="Example 15.5. DNS Root Name Server Hint File: /var/lib/named/root.hint">“DNS Root Name Server Hint File: /var/lib/named/root.hint”</a> changes slowly over time. 349 349 Periodically this file should be updated from the source shown. Because 350 350 of its size, this file is located at the end of this chapter. 351 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="altldapcfg"></a>Alternative LDAP Database Initialization</h2></div></div></div><p><a class="indexterm" name="id 383894"></a><a class="indexterm" name="id383906"></a>351 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="altldapcfg"></a>Alternative LDAP Database Initialization</h2></div></div></div><p><a class="indexterm" name="id406027"></a><a class="indexterm" name="id406038"></a> 352 352 The following procedure may be used as an alternative means of configuring 353 353 the initial LDAP database. Many administrators prefer to have greater control 354 354 over how system files get configured. 355 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 383921"></a>Initialization of the LDAP Database</h3></div></div></div><p><a class="indexterm" name="id383928"></a><a class="indexterm" name="id383935"></a><a class="indexterm" name="id383947"></a>355 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id406053"></a>Initialization of the LDAP Database</h3></div></div></div><p><a class="indexterm" name="id406060"></a><a class="indexterm" name="id406068"></a><a class="indexterm" name="id406079"></a> 356 356 The first step to get the LDAP server ready for action is to create the LDIF file from 357 357 which the LDAP database will be preloaded. This is necessary to create the containers … … 368 368 </pre><p> 369 369 </p></li><li><p> 370 Install the files shown in <a href="appendix.html#sbehap-ldapreconfa" title="Example 15.6. LDAP Pre-configuration Script: SMBLDAP-ldif-preconfig.sh Part A">???</a>, <a href="appendix.html#sbehap-ldapreconfb" title="Example 15.7. LDAP Pre-configuration Script: SMBLDAP-ldif-preconfig.sh Part B">???</a>,371 and <a href="appendix.html#sbehap-ldapreconfc" title="Example 15.8. LDAP Pre-configuration Script: SMBLDAP-ldif-preconfig.sh Part C">???</a> into the directory370 Install the files shown in <a class="link" href="appendix.html#sbehap-ldapreconfa" title="Example 15.6. LDAP Pre-configuration Script: SMBLDAP-ldif-preconfig.sh Part A">“LDAP Pre-configuration Script: SMBLDAP-ldif-preconfig.sh Part A”</a>, <a class="link" href="appendix.html#sbehap-ldapreconfb" title="Example 15.7. LDAP Pre-configuration Script: SMBLDAP-ldif-preconfig.sh Part B">“LDAP Pre-configuration Script: SMBLDAP-ldif-preconfig.sh Part B”</a>, 371 and <a class="link" href="appendix.html#sbehap-ldapreconfc" title="Example 15.8. LDAP Pre-configuration Script: SMBLDAP-ldif-preconfig.sh Part C">“LDAP Pre-configuration Script: SMBLDAP-ldif-preconfig.sh Part C”</a> into the directory 372 372 <code class="filename">/etc/openldap/SambaInit/SMBLDAP-ldif-preconfig.sh.</code> These three files are, 373 373 respectively, parts A, B, and C of the <code class="filename">SMBLDAP-ldif-preconfig.sh</code> file. 374 374 </p></li><li><p> 375 Install the files shown in <a href="appendix.html#sbehap-ldifpata" title="Example 15.9. LDIF Pattern File Used to Pre-configure LDAP Part A">???</a> and <a href="appendix.html#sbehap-ldifpatb" title="Example 15.10. LDIF Pattern File Used to Pre-configure LDAP Part B">???</a> into the directory375 Install the files shown in <a class="link" href="appendix.html#sbehap-ldifpata" title="Example 15.9. LDIF Pattern File Used to Pre-configure LDAP Part A">“LDIF Pattern File Used to Pre-configure LDAP Part A”</a> and <a class="link" href="appendix.html#sbehap-ldifpatb" title="Example 15.10. LDIF Pattern File Used to Pre-configure LDAP Part B">“LDIF Pattern File Used to Pre-configure LDAP Part B”</a> into the directory 376 376 <code class="filename">/etc/openldap/SambaInit/.</code> These two files are 377 377 parts A and B, respectively, of the <code class="filename">init-ldif.pat</code> file. … … 596 596 sed "s/DOMSID/${DOMSID}/g" < $file.tmp2 > $file.tmp1 597 597 </pre></div></div><br class="example-break"><div class="example"><a name="sbehap-ldapreconfc"></a><p class="title"><b>Example 15.8. LDAP Pre-configuration Script: <code class="filename">SMBLDAP-ldif-preconfig.sh</code> Part C</b></p><div class="example-contents"><pre class="screen"> 598 cat & gt;>EOL598 cat <<EOL 599 599 The name of your Internet domain is now needed in a special format 600 600 as follows, if your domain name is mydomain.org, what we need is … … 706 706 displayName: Domain Users 707 707 description: Domain Users 708 </pre></div></div><br class="example-break"></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id 384378"></a>The LDAP Account Manager</h2></div></div></div><p>709 <a class="indexterm" name="id 384386"></a>710 <a class="indexterm" name="id 384392"></a>711 <a class="indexterm" name="id 384401"></a>712 <a class="indexterm" name="id 384408"></a>713 <a class="indexterm" name="id 384414"></a>714 <a class="indexterm" name="id 384421"></a>715 <a class="indexterm" name="id 384428"></a>708 </pre></div></div><br class="example-break"></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id406519"></a>The LDAP Account Manager</h2></div></div></div><p> 709 <a class="indexterm" name="id406527"></a> 710 <a class="indexterm" name="id406533"></a> 711 <a class="indexterm" name="id406542"></a> 712 <a class="indexterm" name="id406548"></a> 713 <a class="indexterm" name="id406555"></a> 714 <a class="indexterm" name="id406562"></a> 715 <a class="indexterm" name="id406569"></a> 716 716 The LDAP Account Manager (LAM) is an application suite that has been written in PHP. 717 717 LAM can be used with any Web server that has PHP4 support. It connects to the LDAP … … 720 720 (hosts). 721 721 </p><p> 722 LAM is available from the <a href="http://sourceforge.net/projects/lam/" target="_top">LAM</a>722 LAM is available from the <a class="ulink" href="http://sourceforge.net/projects/lam/" target="_top">LAM</a> 723 723 home page and from its mirror sites. LAM has been released under the GNU GPL version 2. 724 724 The current version of LAM is 0.4.9. Release of version 0.5 is expected in the third quarter 725 725 of 2005. 726 726 </p><p> 727 <a class="indexterm" name="id 384454"></a>728 <a class="indexterm" name="id 384461"></a>729 <a class="indexterm" name="id 384468"></a>727 <a class="indexterm" name="id406595"></a> 728 <a class="indexterm" name="id406602"></a> 729 <a class="indexterm" name="id406609"></a> 730 730 Requirements: 731 </p><div class="itemizedlist"><ul type="disc"><li><p>A web server that will work with PHP4.</p></li><li><p>PHP4 (available from the <a href="http://www.php.net/" target="_top">PHP</a> home page.)</p></li><li><p>OpenLDAP 2.0 or later.</p></li><li><p>A Web browser that supports CSS.</p></li><li><p>Perl.</p></li><li><p>The gettext package.</p></li><li><p>mcrypt + mhash (optional).</p></li><li><p>It is also a good idea to install SSL support.</p></li></ul></div><p>731 </p><div class="itemizedlist"><ul type="disc"><li><p>A web server that will work with PHP4.</p></li><li><p>PHP4 (available from the <a class="ulink" href="http://www.php.net/" target="_top">PHP</a> home page.)</p></li><li><p>OpenLDAP 2.0 or later.</p></li><li><p>A Web browser that supports CSS.</p></li><li><p>Perl.</p></li><li><p>The gettext package.</p></li><li><p>mcrypt + mhash (optional).</p></li><li><p>It is also a good idea to install SSL support.</p></li></ul></div><p> 732 732 LAM is a useful tool that provides a simple Web-based device that can be used to 733 733 manage the contents of the LDAP directory to: 734 <a class="indexterm" name="id 384525"></a>735 <a class="indexterm" name="id 384532"></a>736 <a class="indexterm" name="id 384539"></a>734 <a class="indexterm" name="id406666"></a> 735 <a class="indexterm" name="id406673"></a> 736 <a class="indexterm" name="id406680"></a> 737 737 </p><div class="itemizedlist"><ul type="disc"><li><p>Display user/group/host and Domain entries.</p></li><li><p>Manage entries (Add/Delete/Edit).</p></li><li><p>Filter and sort entries.</p></li><li><p>Store and use multiple operating profiles.</p></li><li><p>Edit organizational units (OUs).</p></li><li><p>Upload accounts from a file.</p></li><li><p>Is compatible with Samba-2.2.x and Samba-3.</p></li></ul></div><p> 738 738 When correctly configured, LAM allows convenient management of UNIX (Posix) and Samba 739 739 user, group, and windows domain member machine accounts. 740 740 </p><p> 741 <a class="indexterm" name="id 384590"></a>742 <a class="indexterm" name="id 384596"></a>743 <a class="indexterm" name="id 384603"></a>744 <a class="indexterm" name="id 384610"></a>741 <a class="indexterm" name="id406730"></a> 742 <a class="indexterm" name="id406737"></a> 743 <a class="indexterm" name="id406744"></a> 744 <a class="indexterm" name="id406751"></a> 745 745 The default password is “<span class="quote">lam.</span>” It is highly recommended that you use only 746 746 an SSL connection to your Web server for all remote operations involving LAM. If you … … 761 761 <code class="filename">/srv/www/htdocs</code> directory. 762 762 </p></li><li><p> 763 <a class="indexterm" name="id 384683"></a>763 <a class="indexterm" name="id406824"></a> 764 764 Set file permissions using the following commands: 765 765 </p><pre class="screen"> … … 771 771 </pre><p> 772 772 </p></li><li><p> 773 <a class="indexterm" name="id 384733"></a>773 <a class="indexterm" name="id406874"></a> 774 774 Using your favorite editor create the following <code class="filename">config.cfg</code> 775 775 LAM configuration file: … … 779 779 <code class="prompt">root# </code> vi config.cfg 780 780 </pre><p> 781 <a class="indexterm" name="id 384773"></a>782 <a class="indexterm" name="id 384782"></a>783 An example file is shown in <a href="appendix.html#lamcfg" title="Example 15.11. Example LAM Configuration File config.cfg">???</a>.781 <a class="indexterm" name="id406914"></a> 782 <a class="indexterm" name="id406923"></a> 783 An example file is shown in <a class="link" href="appendix.html#lamcfg" title="Example 15.11. Example LAM Configuration File config.cfg">“Example LAM Configuration File config.cfg”</a>. 784 784 This is the minimum configuration that must be completed. The LAM profile 785 785 file can be created using a convenient wizard that is part of the LAM … … 787 787 </p></li><li><p> 788 788 Start your Web server then, using your Web browser, connect to 789 <a href="http://localhost/lam" target="_top">LAM</a> URL. Click on the789 <a class="ulink" href="http://localhost/lam" target="_top">LAM</a> URL. Click on the 790 790 the <em class="parameter"><code>Configuration Login</code></em> link then click on the 791 791 Configuration Wizard link to begin creation of the default profile so that … … 795 795 change the settings to match local site needs. 796 796 </p></li></ol></div><p> 797 <a class="indexterm" name="id 384837"></a>798 An example of a working file is shown here in <a href="appendix.html#lamconf" title="Example 15.12. LAM Profile Control File lam.conf">???</a>.797 <a class="indexterm" name="id406977"></a> 798 An example of a working file is shown here in <a class="link" href="appendix.html#lamconf" title="Example 15.12. LAM Profile Control File lam.conf">“LAM Profile Control File lam.conf”</a>. 799 799 This file has been stripped of comments to keep the size small. The comments 800 800 and help information provided in the profile file that the wizard creates … … 803 803 are preferred at your site. 804 804 </p><p> 805 <a class="indexterm" name="id 384857"></a>805 <a class="indexterm" name="id406998"></a> 806 806 It is important that your LDAP server is running at the time that LAM is 807 807 being configured. This permits you to validate correct operation. 808 An example of the LAM login screen is provided in <a href="appendix.html#lam-login" title="Figure 15.6. The LDAP Account Manager Login Screen">???</a>.808 An example of the LAM login screen is provided in <a class="link" href="appendix.html#lam-login" title="Figure 15.6. The LDAP Account Manager Login Screen">“The LDAP Account Manager Login Screen”</a>. 809 809 </p><div class="figure"><a name="lam-login"></a><p class="title"><b>Figure 15.6. The LDAP Account Manager Login Screen</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/lam-login.png" width="270" alt="The LDAP Account Manager Login Screen"></div></div></div><br class="figure-break"><p> 810 <a class="indexterm" name="id 384917"></a>810 <a class="indexterm" name="id407057"></a> 811 811 The LAM configuration editor has a number of options that must be managed correctly. 812 An example of use of the LAM configuration editor is shown in <a href="appendix.html#lam-config" title="Figure 15.7. The LDAP Account Manager Configuration Screen">???</a>.812 An example of use of the LAM configuration editor is shown in <a class="link" href="appendix.html#lam-config" title="Figure 15.7. The LDAP Account Manager Configuration Screen">“The LDAP Account Manager Configuration Screen”</a>. 813 813 It is important that you correctly set the minimum and maximum UID/GID values that are 814 814 permitted for use at your site. The default values may not be compatible with a need to … … 818 818 using LAM to add additional users and groups. 819 819 </p><div class="figure"><a name="lam-config"></a><p class="title"><b>Figure 15.7. The LDAP Account Manager Configuration Screen</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/lam-config.png" width="270" alt="The LDAP Account Manager Configuration Screen"></div></div></div><br class="figure-break"><p> 820 <a class="indexterm" name="id 384982"></a>820 <a class="indexterm" name="id407122"></a> 821 821 LAM has some nice, but unusual features. For example, one unexpected feature in most application 822 822 screens permits the generation of a PDF file that lists configuration information. This is a well … … 824 824 space. 825 825 </p><p> 826 <a class="indexterm" name="id 384994"></a>826 <a class="indexterm" name="id407135"></a> 827 827 When you log onto LAM the opening screen drops you right into the user manager as shown in 828 <a href="appendix.html#lam-user" title="Figure 15.8. The LDAP Account Manager User Edit Screen">???</a>. This is a logical action as it permits the most-needed facility828 <a class="link" href="appendix.html#lam-user" title="Figure 15.8. The LDAP Account Manager User Edit Screen">“The LDAP Account Manager User Edit Screen”</a>. This is a logical action as it permits the most-needed facility 829 829 to be used immediately. The editing of an existing user, as with the addition of a new user, 830 830 is easy to follow and very clear in both layout and intent. It is a simple matter to edit … … 833 833 finished editing simply press the <span class="guimenu">Final</span> button. 834 834 </p><div class="figure"><a name="lam-user"></a><p class="title"><b>Figure 15.8. The LDAP Account Manager User Edit Screen</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/lam-users.png" width="270" alt="The LDAP Account Manager User Edit Screen"></div></div></div><br class="figure-break"><p> 835 The edit screen for groups is shown in <a href="appendix.html#lam-group" title="Figure 15.9. The LDAP Account Manager Group Edit Screen">???</a>. As with the edit screen836 for user accounts, group accounts may be rapidly dealt with. <a href="appendix.html#lam-group-mem" title="Figure 15.10. The LDAP Account Manager Group Membership Edit Screen">???</a>835 The edit screen for groups is shown in <a class="link" href="appendix.html#lam-group" title="Figure 15.9. The LDAP Account Manager Group Edit Screen">“The LDAP Account Manager Group Edit Screen”</a>. As with the edit screen 836 for user accounts, group accounts may be rapidly dealt with. <a class="link" href="appendix.html#lam-group-mem" title="Figure 15.10. The LDAP Account Manager Group Membership Edit Screen">“The LDAP Account Manager Group Membership Edit Screen”</a> 837 837 shows a sub-screen from the group editor that permits users to be assigned secondary group 838 838 memberships. 839 839 </p><div class="figure"><a name="lam-group"></a><p class="title"><b>Figure 15.9. The LDAP Account Manager Group Edit Screen</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/lam-groups.png" width="270" alt="The LDAP Account Manager Group Edit Screen"></div></div></div><br class="figure-break"><div class="figure"><a name="lam-group-mem"></a><p class="title"><b>Figure 15.10. The LDAP Account Manager Group Membership Edit Screen</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/lam-group-members.png" width="270" alt="The LDAP Account Manager Group Membership Edit Screen"></div></div></div><br class="figure-break"><p> 840 <a class="indexterm" name="id 385162"></a><a class="indexterm" name="id385168"></a>840 <a class="indexterm" name="id407303"></a><a class="indexterm" name="id407309"></a> 841 841 The final screen presented here is one that you should not normally need to use. Host accounts will 842 be automatically managed using the smbldap-tools scripts. This means that the screen <a href="appendix.html#lam-host" title="Figure 15.11. The LDAP Account Manager Host Edit Screen">???</a>842 be automatically managed using the smbldap-tools scripts. This means that the screen <a class="link" href="appendix.html#lam-host" title="Figure 15.11. The LDAP Account Manager Host Edit Screen">“The LDAP Account Manager Host Edit Screen”</a> 843 843 will, in most cases, not be used. 844 844 </p><div class="figure"><a name="lam-host"></a><p class="title"><b>Figure 15.11. The LDAP Account Manager Host Edit Screen</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/lam-hosts.png" width="270" alt="The LDAP Account Manager Host Edit Screen"></div></div></div><br class="figure-break"><p> … … 884 884 cachetimeout: 5 885 885 pwdhash: SSHA 886 </pre></div></div><br class="example-break"></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id 385293"></a>IDEALX Management Console</h2></div></div></div><p>886 </pre></div></div><br class="example-break"></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id407438"></a>IDEALX Management Console</h2></div></div></div><p> 887 887 IMC (the IDEALX Mamagement Console) is a tool that can be used as the basis for a comprehensive 888 888 web-based management interface for UNIX and Linux systems. … … 891 891 interface for managing a Samba domain controler. The goal is to give Linux administrators who 892 892 need to manage production Samba servers an effective, intuitive and consistent management 893 experience. An IMC screenshot of the user management tool is shown in <a href="appendix.html#imcidealx" title="Figure 15.12. The IMC Samba User Account Screen">???</a>.893 experience. An IMC screenshot of the user management tool is shown in <a class="link" href="appendix.html#imcidealx" title="Figure 15.12. The IMC Samba User Account Screen">“The IMC Samba User Account Screen”</a>. 894 894 </p><div class="figure"><a name="imcidealx"></a><p class="title"><b>Figure 15.12. The IMC Samba User Account Screen</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/imc-usermanager2.png" width="216" alt="The IMC Samba User Account Screen"></div></div></div><br class="figure-break"><p> 895 895 IMC is built on a set of Perl modules. Most modules are standard CPAN modules. Some are bundled with IMC, 896 896 but will soon to be hosted on the CPAN independently, like Struts4P, a port of Struts to the Perl language. 897 897 </p><p> 898 For further information regarding IMC refer to the web <a href="http://imc.sourceforge.net/" target="_top">site.</a>899 Prebuilt RPM packages are also <a href="http://imc.sourceforge.net/download.html" target="_top">available.</a>900 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="ch12-SUIDSGID"></a>Effect of Setting File and Directory SUID/SGID Permissions Explained</h2></div></div></div><a class="indexterm" name="id 385390"></a><a class="indexterm" name="id385396"></a><p>898 For further information regarding IMC refer to the web <a class="ulink" href="http://imc.sourceforge.net/" target="_top">site.</a> 899 Prebuilt RPM packages are also <a class="ulink" href="http://imc.sourceforge.net/download.html" target="_top">available.</a> 900 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="ch12-SUIDSGID"></a>Effect of Setting File and Directory SUID/SGID Permissions Explained</h2></div></div></div><a class="indexterm" name="id407535"></a><a class="indexterm" name="id407541"></a><p> 901 901 The setting of the SUID/SGID bits on the file or directory permissions flag has particular 902 902 consequences. If the file is executable and the SUID bit is set, it executes with the privilege … … 968 968 drw-rw-r-- 2 bobj Domain Users 12346 Dec 18 18:11 maryvfile.txt 969 969 </pre><p> 970 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="ch12dblck"></a>Shared Data Integrity</h2></div></div></div><p><a class="indexterm" name="id 385602"></a><a class="indexterm" name="id385610"></a>970 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="ch12dblck"></a>Shared Data Integrity</h2></div></div></div><p><a class="indexterm" name="id407747"></a><a class="indexterm" name="id407755"></a> 971 971 The integrity of shared data is often viewed as a particularly emotional issue, especially where 972 972 there are concurrent problems with multiuser data access. Contrary to the assertions of some who have … … 974 974 </p><p> 975 975 The solution to concurrent multiuser data access problems must consider three separate areas 976 from which the problem may stem:<a class="indexterm" name="id 385629"></a><a class="indexterm" name="id385640"></a><a class="indexterm" name="id385652"></a>977 </p><div class="itemizedlist"><ul type="disc"><li><p>application-level locking controls</p></li><li><p>client-side locking controls</p></li><li><p>server-side locking controls</p></li></ul></div><p><a class="indexterm" name="id 385684"></a><a class="indexterm" name="id385691"></a>976 from which the problem may stem:<a class="indexterm" name="id407777"></a><a class="indexterm" name="id407788"></a><a class="indexterm" name="id407800"></a> 977 </p><div class="itemizedlist"><ul type="disc"><li><p>application-level locking controls</p></li><li><p>client-side locking controls</p></li><li><p>server-side locking controls</p></li></ul></div><p><a class="indexterm" name="id407831"></a><a class="indexterm" name="id407839"></a> 978 978 Many database applications use some form of application-level access control. An example of one 979 979 well-known application that uses application-level locking is Microsoft Access. Detailed guidance 980 980 is provided here because this is the most common application for which problems have been reported. 981 </p><p><a class="indexterm" name="id 385705"></a><a class="indexterm" name="id385713"></a>981 </p><p><a class="indexterm" name="id407853"></a><a class="indexterm" name="id407861"></a> 982 982 Common applications that are affected by client- and server-side locking controls include MS 983 983 Excel and Act!. Important locking guidance is provided here. 984 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 385724"></a>Microsoft Access</h3></div></div></div><p>984 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id407872"></a>Microsoft Access</h3></div></div></div><p> 985 985 The best advice that can be given is to carefully read the Microsoft knowledgebase articles that 986 986 cover this area. Examples of relevant documents include: 987 </p><div class="itemizedlist"><ul type="disc"><li><p>http://support.microsoft.com/default.aspx?scid=kb;en-us;208778</p></li><li><p>http://support.microsoft.com/default.aspx?scid=kb;en-us;299373</p></li></ul></div><p><a class="indexterm" name="id 385749"></a><a class="indexterm" name="id385760"></a>987 </p><div class="itemizedlist"><ul type="disc"><li><p>http://support.microsoft.com/default.aspx?scid=kb;en-us;208778</p></li><li><p>http://support.microsoft.com/default.aspx?scid=kb;en-us;299373</p></li></ul></div><p><a class="indexterm" name="id407897"></a><a class="indexterm" name="id407908"></a> 988 988 Make sure that your MS Access database file is configured for multiuser access (not set for 989 989 exclusive open). Open MS Access on each client workstation, then set the following: <span class="guimenu">(Menu bar) Tools</span>+<span class="guimenu">Options</span>+<span class="guimenu">[tab] General</span>. Set network path to Default database folder: <code class="filename">\\server\share\folder</code>. 990 990 </p><p> 991 991 You can configure MS Access file sharing behavior as follows: click <span class="guimenu">[tab] Advanced</span>. 992 Set:<a class="indexterm" name="id 385808"></a>993 </p><div class="itemizedlist"><ul type="disc"><li><p>Default open mode: Shared</p></li><li><p>Default Record Locking: Edited Record</p></li><li><p>Open databases using record_level locking</p></li></ul></div><p><a class="indexterm" name="id 385836"></a>992 Set:<a class="indexterm" name="id407955"></a> 993 </p><div class="itemizedlist"><ul type="disc"><li><p>Default open mode: Shared</p></li><li><p>Default Record Locking: Edited Record</p></li><li><p>Open databases using record_level locking</p></li></ul></div><p><a class="indexterm" name="id407984"></a> 994 994 You must now commit the changes so that they will take effect. To do so, click 995 995 <span class="guimenu">Apply</span><span class="guimenu">Ok</span>. At this point, you should exit MS Access, restart 996 996 it, and then validate that these settings have not changed. 997 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 385863"></a>Act! Database Sharing</h3></div></div></div><p><a class="indexterm" name="id385870"></a><a class="indexterm" name="id385877"></a>997 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id408011"></a>Act! Database Sharing</h3></div></div></div><p><a class="indexterm" name="id408017"></a><a class="indexterm" name="id408025"></a> 998 998 Where the server sharing the ACT! database(s) is running Samba,or Windows NT, 200x, or XP, you 999 999 must disable opportunistic locking on the server and all workstations. Failure to do so 1000 1000 results in data corruption. This information is available from the Act! Web site 1001 1001 knowledgebase articles 1002 <a href="http://itdomino.saleslogix.com/act.nsf/docid/1998223162925" target="_top">1998223162925</a>1002 <a class="ulink" href="http://itdomino.saleslogix.com/act.nsf/docid/1998223162925" target="_top">1998223162925</a> 1003 1003 as well as from article 1004 <a href="http://itdomino.saleslogix.com/act.nsf/docid/200110485036" target="_top">200110485036</a>.1005 </p><p><a class="indexterm" name="id 385904"></a><a class="indexterm" name="id385912"></a>1004 <a class="ulink" href="http://itdomino.saleslogix.com/act.nsf/docid/200110485036" target="_top">200110485036</a>. 1005 </p><p><a class="indexterm" name="id408051"></a><a class="indexterm" name="id408059"></a> 1006 1006 These documents clearly state that opportunistic locking must be disabled on both 1007 1007 the server (Samba in the case we are interested in here), as well as on every workstation … … 1010 1010 registry settings that may otherwise interfere with the operation of Act! 1011 1011 Registered Act! users may download this utility from the Act! Web 1012 <a href="http://www.act.com/support/updates/index.cfm" target="_top">site.</a>1013 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 385938"></a>Opportunistic Locking Controls</h3></div></div></div><p><a class="indexterm" name="id385945"></a>1012 <a class="ulink" href="http://www.act.com/support/updates/index.cfm" target="_top">site.</a> 1013 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id408086"></a>Opportunistic Locking Controls</h3></div></div></div><p><a class="indexterm" name="id408093"></a> 1014 1014 Third-party Windows applications may not be compatible with the use of opportunistic file 1015 and record locking. For applications that are known not to be compatible,<sup>[<a name="id 385956" href="#ftn.id385956">14</a>]</sup> oplock1015 and record locking. For applications that are known not to be compatible,<sup>[<a name="id408103" href="#ftn.id408103" class="footnote">14</a>]</sup> oplock 1016 1016 support may need to be disabled both on the Samba server and on the Windows workstations. 1017 </p><p><a class="indexterm" name="id 385966"></a><a class="indexterm" name="id385973"></a><a class="indexterm" name="id385981"></a>1017 </p><p><a class="indexterm" name="id408113"></a><a class="indexterm" name="id408121"></a><a class="indexterm" name="id408129"></a> 1018 1018 Oplocks enable a Windows client to cache parts of a file that are being 1019 1019 edited. Another windows client may then request to open the file with the … … 1022 1022 doing so, that workstation must flush the file from cache memory to the 1023 1023 disk or network drive. 1024 </p><p><a class="indexterm" name="id 385999"></a>1024 </p><p><a class="indexterm" name="id408147"></a> 1025 1025 Disabling of Oplocks usage may require server and client changes. 1026 1026 Oplocks may be disabled by file, by file pattern, on the share, or on the -
branches/samba-3.0/docs/htmldocs/Samba3-ByExample/ch14.html
r44 r134 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 14. Samba Support</title><link rel="stylesheet" href=" samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="HA.html" title="Chapter 13. Performance, Reliability, and Availability"><link rel="next" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 14. Samba Support</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="HA.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="appendix.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en-US"><div class="titlepage"><div><div><h2 class="title"><a name="id382069"></a>Chapter 14. Samba Support</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ch14.html#id382184">Free Support</a></span></dt><dt><span class="sect1"><a href="ch14.html#id382382">Commercial Support</a></span></dt></dl></div><p>2 <a class="indexterm" name="id 382078"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 14. Samba Support</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="HA.html" title="Chapter 13. Performance, Reliability, and Availability"><link rel="next" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 14. Samba Support</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="HA.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="appendix.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en-US"><div class="titlepage"><div><div><h2 class="title"><a name="id404185"></a>Chapter 14. Samba Support</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ch14.html#id404300">Free Support</a></span></dt><dt><span class="sect1"><a href="ch14.html#id404499">Commercial Support</a></span></dt></dl></div><p> 2 <a class="indexterm" name="id404194"></a> 3 3 One of the most difficult to answer questions in the information technology industry is, “<span class="quote">What is 4 4 support?</span>”. That question irritates some folks, as much as common answers may annoy others. 5 5 </p><p> 6 <a class="indexterm" name="id 382093"></a>6 <a class="indexterm" name="id404209"></a> 7 7 The most aggravating situation pertaining to support is typified when, as a Linux user, a call is made to 8 8 an Internet service provider who, instead of listening to the problem to find a solution, blandly replies: … … 16 16 inconvenience, loss of productivity, disorientation, uncertainty, and real or perceived risk. 17 17 </p><p> 18 <a class="indexterm" name="id 382117"></a>19 <a class="indexterm" name="id 382123"></a>20 <a class="indexterm" name="id 382130"></a>18 <a class="indexterm" name="id404233"></a> 19 <a class="indexterm" name="id404240"></a> 20 <a class="indexterm" name="id404246"></a> 21 21 One of the forces that has become a driving force for the adoption of open source software is the fact that 22 22 many IT businesses have provided services that have perhaps failed to deliver what the customer expected, or 23 23 that have been found wanting for other reasons. 24 24 </p><p> 25 <a class="indexterm" name="id 382143"></a>26 <a class="indexterm" name="id 382149"></a>25 <a class="indexterm" name="id404259"></a> 26 <a class="indexterm" name="id404266"></a> 27 27 In recognition of the need for needs satisfaction as the primary experience an information technology user or 28 28 consumer expects, the information provided in this chapter may help someone to avoid an unpleasant experience 29 29 in respect of problem resolution. 30 30 </p><p> 31 <a class="indexterm" name="id 382162"></a>32 <a class="indexterm" name="id 382168"></a>33 <a class="indexterm" name="id 382175"></a>31 <a class="indexterm" name="id404278"></a> 32 <a class="indexterm" name="id404285"></a> 33 <a class="indexterm" name="id404291"></a> 34 34 In the open source software arena there are two support options: free support and paid-for (commercial) 35 35 support. 36 </p><div class="sect1" lang="en-US"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id 382184"></a>Free Support</h2></div></div></div><p>37 <a class="indexterm" name="id 382192"></a>38 <a class="indexterm" name="id 382199"></a>39 <a class="indexterm" name="id 382206"></a>40 <a class="indexterm" name="id 382212"></a>41 <a class="indexterm" name="id 382219"></a>42 <a class="indexterm" name="id 382226"></a>36 </p><div class="sect1" lang="en-US"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id404300"></a>Free Support</h2></div></div></div><p> 37 <a class="indexterm" name="id404308"></a> 38 <a class="indexterm" name="id404315"></a> 39 <a class="indexterm" name="id404322"></a> 40 <a class="indexterm" name="id404328"></a> 41 <a class="indexterm" name="id404335"></a> 42 <a class="indexterm" name="id404342"></a> 43 43 Free support may be obtained from friends, colleagues, user groups, mailing lists, and interactive help 44 44 facilities. An example of an interactive dacility is the Internet relay chat (IRC) channels that host user 45 45 supported mutual assistance. 46 46 </p><p> 47 <a class="indexterm" name="id 382238"></a>48 <a class="indexterm" name="id 382245"></a>49 <a class="indexterm" name="id 382252"></a>50 <a class="indexterm" name="id 382258"></a>51 <a class="indexterm" name="id 382265"></a>47 <a class="indexterm" name="id404354"></a> 48 <a class="indexterm" name="id404361"></a> 49 <a class="indexterm" name="id404368"></a> 50 <a class="indexterm" name="id404375"></a> 51 <a class="indexterm" name="id404381"></a> 52 52 The Samba project maintains a mailing list that is commonly used to discuss solutions to Samba deployments. 53 Information regarding subscription to the Samba mailing list can be found on the Samba <a href="https://lists.samba.org/mailman/" target="_top">web</a> site. The public mailing list that can be used to obtain53 Information regarding subscription to the Samba mailing list can be found on the Samba <a class="ulink" href="https://lists.samba.org/mailman/" target="_top">web</a> site. The public mailing list that can be used to obtain 54 54 free, user contributed, support is called the <code class="literal">samba</code> list. The email address for this list 55 55 is at <code class="literal">mail:samba@samba.org</code>. Information regarding the Samba IRC channels may be found on 56 the Samba <a href="http://www.samba.org/samba.irc.html" target="_top">IRC</a> web page.56 the Samba <a class="ulink" href="http://www.samba.org/samba.irc.html" target="_top">IRC</a> web page. 57 57 </p><p> 58 <a class="indexterm" name="id 382302"></a>59 <a class="indexterm" name="id 382309"></a>60 <a class="indexterm" name="id 382316"></a>61 <a class="indexterm" name="id 382322"></a>58 <a class="indexterm" name="id404418"></a> 59 <a class="indexterm" name="id404425"></a> 60 <a class="indexterm" name="id404432"></a> 61 <a class="indexterm" name="id404439"></a> 62 62 As a general rule, it is considered poor net behavior to contact a Samba Team member directly 63 63 for free support. Most active members of the Samba Team work exceptionally long hours to assist … … 67 67 to show appropriate discretion and reservation in all direct contact. 68 68 </p><p> 69 <a class="indexterm" name="id 382337"></a>70 <a class="indexterm" name="id 382344"></a>71 <a class="indexterm" name="id 382351"></a>69 <a class="indexterm" name="id404453"></a> 70 <a class="indexterm" name="id404460"></a> 71 <a class="indexterm" name="id404467"></a> 72 72 When you stumble across a Samba bug, often the quickest way to get it resolved is by posting 73 a bug <a href="https://bugzilla.samba.org/" target="_top">report</a>. All such reports are mailed to73 a bug <a class="ulink" href="https://bugzilla.samba.org/" target="_top">report</a>. All such reports are mailed to 74 74 the responsible code maintainer for action. The better the report, and the more serious it is, 75 75 the sooner it will be dealt with. On the other hand, if the responsible person can not duplicate … … 77 77 that will permit the problem to be reproduced. 78 78 </p><p> 79 <a class="indexterm" name="id 382371"></a>79 <a class="indexterm" name="id404487"></a> 80 80 We all recognize that sometimes free support does not provide the answer that is sought within 81 81 the time-frame required. At other times the problem is elusive and you may lack the experience 82 82 necessary to isolate the problem and thus to resolve it. This is a situation where is may be 83 83 prudent to purchase paid-for support. 84 </p></div><div class="sect1" lang="en-US"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id 382382"></a>Commercial Support</h2></div></div></div><p>84 </p></div><div class="sect1" lang="en-US"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id404499"></a>Commercial Support</h2></div></div></div><p> 85 85 There are six basic support oriented services that are most commonly sought by Samba sites: 86 86 </p><div class="itemizedlist"><ul type="disc"><li><p>Assistance with network design</p></li><li><p>Staff Training</p></li><li><p>Assistance with Samba network deployment and installation</p></li><li><p>Priority telephone or email Samba configuration assistance</p></li><li><p>Trouble-shooting and diagnostic assistance</p></li><li><p>Provision of quality assured ready-to-install Samba binary packages</p></li></ul></div><p> 87 <a class="indexterm" name="id 382426"></a>88 <a class="indexterm" name="id 382433"></a>87 <a class="indexterm" name="id404542"></a> 88 <a class="indexterm" name="id404549"></a> 89 89 Information regarding companies that provide professional Samba support can be obtained by performing a Google 90 search, as well as by reference to the Samba <a href="http://www.samba.org/samba/support.html" target="_top">Support</a> web page. Companies who notify the Samba Team90 search, as well as by reference to the Samba <a class="ulink" href="http://www.samba.org/samba/support.html" target="_top">Support</a> web page. Companies who notify the Samba Team 91 91 that they provide commercial support are given a free listing that is sorted by the country of origin. 92 92 Multiple listings are permitted, however no guarantee is offered. It is left to you to qualify a support … … 94 94 them. 95 95 </p><p> 96 <a class="indexterm" name="id 382454"></a>96 <a class="indexterm" name="id404570"></a> 97 97 The policy within the Samba Team is to treat all commercial support providers equally and to show no 98 98 preference. As a result, Samba Team members who provide commercial support are lumped in with everyone else. … … 100 100 is pro-community; so do what you can to help a local business to prosper. 101 101 </p><p> 102 <a class="indexterm" name="id 382467"></a>102 <a class="indexterm" name="id404583"></a> 103 103 Open source software support can be found in any quality, at any price and in any place you can 104 104 to obtain it. Over 180 companies around the world provide Samba support, there is no excuse for -
branches/samba-3.0/docs/htmldocs/Samba3-ByExample/go01.html
r44 r134 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Glossary</title><link rel="stylesheet" href=" samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="gpl.html" title="Appendix A. GNU General Public License"><link rel="next" href="ix01.html" title="Index"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Glossary</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="gpl.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="ix01.html">Next</a></td></tr></table><hr></div><div class="glossary"><div class="titlepage"><div><div><h2 class="title"><a name="id389920"></a>Glossary</h2></div></div></div><dl><dt>Access Control List</dt><dd><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Glossary</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="apa.html" title="Appendix A. GNU General Public License version 3"><link rel="next" href="ix01.html" title="Index"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Glossary</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="apa.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="ix01.html">Next</a></td></tr></table><hr></div><div class="glossary"><div class="titlepage"><div><div><h2 class="title"><a name="id412504"></a>Glossary</h2></div></div></div><dl><dt>Access Control List</dt><dd><p> 2 2 A detailed list of permissions granted to users or groups with respect to file and network 3 3 resource access. … … 16 16 </p></dd><dt>Common UNIX Printing System</dt><dd><p> 17 17 A recent implementation of a high-capability printing system for UNIX developed by 18 <a href="http://www.easysw.com/" target="_top">Easy Software Inc.</a>. The design objective18 <a class="ulink" href="http://www.easysw.com/" target="_top">Easy Software Inc.</a>. The design objective 19 19 of CUPS was to provide a rich print processing system that has built-in intelligence 20 20 that is capable of correctly rendering (processing) a file that is submitted for 21 21 printing even if it was formatted for an entirely different printer. 22 22 </p></dd><dt>Domain Master Browser</dt><dd><p> 23 The Domain Master Browser maintains a list of all the servers that 23 The Domain Master Browser maintains a list of all the servers that 24 24 have announced their services within a given workgroup or NT domain. 25 25 </p></dd><dt>Domain Name Service</dt><dd><p> … … 33 33 Additionally, DHCP may assign all network configuration settings and may be used to 34 34 register a computer name and its address with a dynamic DNS server. 35 </p></dd><dt>Ethereal</dt><dd><p>36 A network analyzer, also known as a network sniffer or a protocol analyzer. Ethereal is37 freely available for UNIX/Linux and Microsoft Windows systems from38 <a href="http://www.ethereal.com" target="_top">the Ethereal Web site</a>.39 35 </p></dd><dt>Group IDentifier</dt><dd><p> 40 36 The UNIX system group identifier; on older systems, a 32-bit unsigned integer, and on … … 61 57 provide a means for replication of the database to keep slave 62 58 servers up to date with a master. It also has built-in capability to 63 handle external references and deferral. 59 handle external references and deferral. 64 60 </p></dd><dt>Local Master Browser</dt><dd><p> 65 61 The Local Master Browser maintains a list of all servers that have announced themselves … … 78 74 from the external network address. 79 75 </p></dd><dt>Network Basic Input/Output System</dt><dd><p> 80 NetBIOS is a simple application programming interface (API) invented in the 1980s 76 NetBIOS is a simple application programming interface (API) invented in the 1980s 81 77 that allows programs to send data to certain network names. NetBIOS is always run over 82 78 another network protocol such as IPX/SPX, TCP/IP, or Logical Link Control (LLC). … … 84 80 a complete misnomer!). 85 81 </p></dd><dt>NetBT</dt><dd><p> 86 Protocol for transporting NetBIOS frames over TCP/IP. Uses ports 137, 138, and 139. 82 Protocol for transporting NetBIOS frames over TCP/IP. Uses ports 137, 138, and 139. 87 83 NetBT is a fully routable protocol. 88 84 </p></dd><dt>NT/LanManager Security Support Provider</dt><dd><p> … … 93 89 </p></dd><dt>Server Message Block</dt><dd><p> 94 90 SMB was the original name of the protocol spoken by Samba. It was invented in the 1980s 95 by IBM and adopted and extended further by Microsoft. Microsoft renamed the protocol to 91 by IBM and adopted and extended further by Microsoft. Microsoft renamed the protocol to 96 92 CIFS during the Internet hype in the 1990s. 97 93 </p></dd><dt>The Simple and Protected GSS-API Negotiation</dt><dd><p> … … 111 107 </p></dd><dt>Universal Naming Convention</dt><dd><p>A syntax for specifying the location of network resources (such as file shares). 112 108 The UNC syntax was developed in the early days of MS DOS 3.x and is used internally by the SMB protocol. 113 </p></dd></dl></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="gpl.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="ix01.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Appendix A. GNU General Public License </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Index</td></tr></table></div></body></html> 109 </p></dd><dt>Wireshark</dt><dd><p> 110 A network analyzer, also known as a network sniffer or a protocol analyzer. Formerly known as Ethereal, Wireshark is 111 freely available for UNIX/Linux and Microsoft Windows systems from 112 <a class="ulink" href="http://www.wireshark.org" target="_top">the Wireshark Web site</a>. 113 </p></dd></dl></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="apa.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="ix01.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Appendix A. 114 <acronym class="acronym">GNU</acronym> General Public License version 3 115 </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Index</td></tr></table></div></body></html> -
branches/samba-3.0/docs/htmldocs/Samba3-ByExample/happy.html
r44 r134 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 5. Making Happy Users</title><link rel="stylesheet" href=" samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="Big500users.html" title="Chapter 4. The 500-User Office"><link rel="next" href="2000users.html" title="Chapter 6. A Distributed 2000-User Network"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 5. Making Happy Users</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="Big500users.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="2000users.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="happy"></a>Chapter 5. Making Happy Users</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="happy.html#id336072">Regarding LDAP Directories and Windows Computer Accounts</a></span></dt><dt><span class="sect1"><a href="happy.html#id336196">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id336272">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id336400">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id336802">Technical Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id338453">Political Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id338466">Installation Checklist</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id338636">Samba Server Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbeidealx">Install and Configure Idealx smbldap-tools Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id341324">LDAP Initialization and Creation of User and Group Accounts</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-ptrcfg">Printer Configuration</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a></span></dt><dt><span class="sect1"><a href="happy.html#id345079">Miscellaneous Server Preparation Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id345095">Configuring Directory Share Point Roots</a></span></dt><dt><span class="sect2"><a href="happy.html#id345184">Configuring Profile Directories</a></span></dt><dt><span class="sect2"><a href="happy.html#id345412">Preparation of Logon Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id345510">Assigning User Rights and Privileges</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id345624">Windows Client Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></span></dt><dt><span class="sect2"><a href="happy.html#id346340">Configuration of MS Outlook to Relocate PST File</a></span></dt><dt><span class="sect2"><a href="happy.html#id346624">Configure Delete Cached Profiles on Logout</a></span></dt><dt><span class="sect2"><a href="happy.html#id346795">Uploading Printer Drivers to Samba Servers</a></span></dt><dt><span class="sect2"><a href="happy.html#id347264">Software Installation</a></span></dt><dt><span class="sect2"><a href="happy.html#id347290">Roll-out Image Creation</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id347320">Key Points Learned</a></span></dt><dt><span class="sect1"><a href="happy.html#id347408">Questions and Answers</a></span></dt></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 5. Making Happy Users</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="Big500users.html" title="Chapter 4. The 500-User Office"><link rel="next" href="2000users.html" title="Chapter 6. A Distributed 2000-User Network"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 5. Making Happy Users</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="Big500users.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="2000users.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="happy"></a>Chapter 5. Making Happy Users</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="happy.html#id358884">Regarding LDAP Directories and Windows Computer Accounts</a></span></dt><dt><span class="sect1"><a href="happy.html#id359008">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id359084">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id359212">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id359614">Technical Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id361271">Political Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id361283">Installation Checklist</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id361454">Samba Server Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbeidealx">Install and Configure Idealx smbldap-tools Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id364093">LDAP Initialization and Creation of User and Group Accounts</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-ptrcfg">Printer Configuration</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a></span></dt><dt><span class="sect1"><a href="happy.html#id367724">Miscellaneous Server Preparation Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id367740">Configuring Directory Share Point Roots</a></span></dt><dt><span class="sect2"><a href="happy.html#id367829">Configuring Profile Directories</a></span></dt><dt><span class="sect2"><a href="happy.html#id368057">Preparation of Logon Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id368155">Assigning User Rights and Privileges</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id368268">Windows Client Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></span></dt><dt><span class="sect2"><a href="happy.html#id368985">Configuration of MS Outlook to Relocate PST File</a></span></dt><dt><span class="sect2"><a href="happy.html#id369268">Configure Delete Cached Profiles on Logout</a></span></dt><dt><span class="sect2"><a href="happy.html#id369439">Uploading Printer Drivers to Samba Servers</a></span></dt><dt><span class="sect2"><a href="happy.html#id369909">Software Installation</a></span></dt><dt><span class="sect2"><a href="happy.html#id369934">Roll-out Image Creation</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id369964">Key Points Learned</a></span></dt><dt><span class="sect1"><a href="happy.html#id370057">Questions and Answers</a></span></dt></dl></div><p> 2 2 It is said that “<span class="quote">a day that is without troubles is not fulfilling. Rather, give 3 3 me a day of troubles well handled so that I can be content with my achievements.</span>” 4 4 </p><p> 5 5 In the world of computer networks, problems are as varied as the people who create them 6 or experience them. The design of the network implemented in <a href="Big500users.html" title="Chapter 4. The 500-User Office">???</a>6 or experience them. The design of the network implemented in <a class="link" href="Big500users.html" title="Chapter 4. The 500-User Office">“The 500-User Office”</a> 7 7 may create problems for some network users. The following lists some of the problems that 8 8 may occur: 9 </p><a class="indexterm" name="id3 35700"></a><a class="indexterm" name="id335707"></a><a class="indexterm" name="id335716"></a><a class="indexterm" name="id335722"></a><a class="indexterm" name="id335729"></a><div class="caution" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Caution</h3><p>9 </p><a class="indexterm" name="id358517"></a><a class="indexterm" name="id358523"></a><a class="indexterm" name="id358532"></a><a class="indexterm" name="id358539"></a><a class="indexterm" name="id358546"></a><div class="caution" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Caution</h3><p> 10 10 A significant number of network administrators have responded to the guidance given 11 11 here. It should be noted that there are sites that have a single PDC for many hundreds of … … 20 20 clients is conservative and if followed will minimize problems but it is not absolute. 21 21 </p></div><div class="variablelist"><dl><dt><span class="term">Users experiencing difficulty logging onto the network</span></dt><dd><p> 22 <a class="indexterm" name="id3 35766"></a>23 <a class="indexterm" name="id3 35775"></a>22 <a class="indexterm" name="id358582"></a> 23 <a class="indexterm" name="id358592"></a> 24 24 When a Windows client logs onto the network, many data packets are exchanged 25 25 between the client and the server that is providing the network logon services. … … 31 31 characteristics. 32 32 </p><p> 33 <a class="indexterm" name="id3 35790"></a>34 <a class="indexterm" name="id3 35797"></a>35 <a class="indexterm" name="id3 35803"></a>33 <a class="indexterm" name="id358607"></a> 34 <a class="indexterm" name="id358613"></a> 35 <a class="indexterm" name="id358620"></a> 36 36 If the domain controller provides only network logon services 37 37 and all file and print activity is handled by domain member servers, one domain … … 47 47 the Samba server as well as network bandwidth utilization. 48 48 </p></dd><dt><span class="term">Slow logons and log-offs</span></dt><dd><p> 49 <a class="indexterm" name="id3 35837"></a>49 <a class="indexterm" name="id358646"></a> 50 50 Slow logons and log-offs may be caused by many factors that include: 51 51 52 52 </p><div class="itemizedlist"><ul type="disc"><li><p> 53 <a class="indexterm" name="id3 35850"></a>54 <a class="indexterm" name="id3 35861"></a>53 <a class="indexterm" name="id358658"></a> 54 <a class="indexterm" name="id358670"></a> 55 55 Excessive delays in the resolution of a NetBIOS name to its IP 56 56 address. This may be observed when an overloaded domain controller … … 58 58 a WINS server (this assumes that there is a single network segment). 59 59 </p></li><li><p> 60 <a class="indexterm" name="id3 35877"></a>61 <a class="indexterm" name="id3 35884"></a>62 <a class="indexterm" name="id3 35890"></a>60 <a class="indexterm" name="id358686"></a> 61 <a class="indexterm" name="id358693"></a> 62 <a class="indexterm" name="id358699"></a> 63 63 Network traffic collisions due to overloading of the network 64 64 segment. One short-term workaround to this may be to replace 65 65 network HUBs with Ethernet switches. 66 66 </p></li><li><p> 67 <a class="indexterm" name="id3 35903"></a>67 <a class="indexterm" name="id358712"></a> 68 68 Defective networking hardware. Over the past few years, we have seen 69 69 on the Samba mailing list a significant increase in the number of … … 73 73 the cause of the problem. 74 74 </p></li><li><p> 75 <a class="indexterm" name="id3 35920"></a>76 <a class="indexterm" name="id3 35929"></a>75 <a class="indexterm" name="id358729"></a> 76 <a class="indexterm" name="id358738"></a> 77 77 Excessively large roaming profiles. This type of problem is typically 78 78 the result of poor user education as well as poor network management. … … 82 82 on the part of network management. 83 83 </p></li><li><p> 84 <a class="indexterm" name="id3 35946"></a>84 <a class="indexterm" name="id358755"></a> 85 85 You should verify that the Windows XP WebClient service is not running. 86 86 The use of the WebClient service has been implicated in many Windows … … 91 91 of factors, including: 92 92 </p><div class="itemizedlist"><ul type="disc"><li><p> 93 <a class="indexterm" name="id3 35976"></a>93 <a class="indexterm" name="id358785"></a> 94 94 Network overload (typically indicated by a high network collision rate) 95 95 </p></li><li><p> 96 96 Server overload 97 97 </p></li><li><p> 98 <a class="indexterm" name="id3 35995"></a>98 <a class="indexterm" name="id358804"></a> 99 99 Timeout causing the client to close a connection that is in use but has 100 100 been latent (no traffic) for some time (5 minutes or more) 101 101 </p></li><li><p> 102 <a class="indexterm" name="id3 36009"></a>102 <a class="indexterm" name="id358818"></a> 103 103 Defective networking hardware 104 104 </p></li></ul></div><p> 105 <a class="indexterm" name="id3 36023"></a>105 <a class="indexterm" name="id358832"></a> 106 106 No matter what the cause, a sudden loss of access to network resources can 107 107 result in BSOD (blue screen of death) situations that necessitate rebooting of the client … … 110 110 problem, data corruption. 111 111 </p></dd><dt><span class="term">Potential data corruption</span></dt><dd><p> 112 <a class="indexterm" name="id3 36047"></a>112 <a class="indexterm" name="id358859"></a> 113 113 Data corruption is one of the most serious problems. It leads to uncertainty, anger, and 114 114 frustration, and generally precipitates immediate corrective demands. Management response … … 124 124 methods to improve the reliability of your network environment, but be warned that all such steps 125 125 demand the price of complexity. 126 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 36072"></a>Regarding LDAP Directories and Windows Computer Accounts</h2></div></div></div><p>127 <a class="indexterm" name="id3 36080"></a>126 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id358884"></a>Regarding LDAP Directories and Windows Computer Accounts</h2></div></div></div><p> 127 <a class="indexterm" name="id358892"></a> 128 128 Computer (machine) accounts can be placed wherever you like in an LDAP directory subject to some 129 129 constraints that are described in this section. 130 130 </p><p> 131 <a class="indexterm" name="id3 36094"></a>132 <a class="indexterm" name="id3 36100"></a>133 <a class="indexterm" name="id3 36107"></a>134 <a class="indexterm" name="id3 36114"></a>131 <a class="indexterm" name="id358906"></a> 132 <a class="indexterm" name="id358912"></a> 133 <a class="indexterm" name="id358919"></a> 134 <a class="indexterm" name="id358926"></a> 135 135 The POSIX and SambaSAMAccount components of computer (machine) accounts are both used by Samba. 136 136 That is, machine accounts are treated inside Samba in the same way that Windows NT4/200X treats … … 138 138 the machine account ends in a $ character, as do trust accounts. 139 139 </p><p> 140 <a class="indexterm" name="id3 36127"></a>141 <a class="indexterm" name="id3 36134"></a>140 <a class="indexterm" name="id358939"></a> 141 <a class="indexterm" name="id358946"></a> 142 142 The need for Windows user, group, machine, trust, and other such accounts to be tied to a valid UNIX UID 143 143 is a design decision that was made a long way back in the history of Samba development. It is … … 145 145 Samba-3.x series. 146 146 </p><p> 147 <a class="indexterm" name="id3 36146"></a>148 <a class="indexterm" name="id3 36153"></a>147 <a class="indexterm" name="id358959"></a> 148 <a class="indexterm" name="id358965"></a> 149 149 The resolution of a UID from the Windows SID is achieved within Samba through a mechanism that 150 150 must refer back to the host operating system on which Samba is running. The name service … … 159 159 all account entities can be located in an LDAP directory. 160 160 </p><p> 161 <a class="indexterm" name="id3 36184"></a>161 <a class="indexterm" name="id358996"></a> 162 162 For many the weapon of choice is to use the PADL nss_ldap utility. This utility must 163 163 be configured so that computer accounts can be resolved to a POSIX/UNIX account UID. That … … 165 165 in the documentation is directed at providing working examples only. The design 166 166 of an LDAP directory is a complex subject that is beyond the scope of this documentation. 167 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 36196"></a>Introduction</h2></div></div></div><p>167 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id359008"></a>Introduction</h2></div></div></div><p> 168 168 You just opened an email from Christine that reads: 169 169 </p><p> … … 194 194 </p></td><td width="10%" valign="top"> </td></tr><tr><td width="10%" valign="top"> </td><td colspan="2" align="right" valign="top">--<span class="attribution">Christine</span></td></tr></table></div><p> 195 195 </p><p> 196 <a class="indexterm" name="id3 36243"></a>197 <a class="indexterm" name="id3 36250"></a>196 <a class="indexterm" name="id359055"></a> 197 <a class="indexterm" name="id359062"></a> 198 198 Every compromise has consequences. Having a large routed (i.e., multisegment) network with only a 199 199 single domain controller is a poor design that has obvious operational effects that may … … 205 205 Please let Stan know what the estimated cost will be so I can approve the expense. Do not wait 206 206 for approval; I appreciate the urgency. 207 </p></td><td width="10%" valign="top"> </td></tr><tr><td width="10%" valign="top"> </td><td colspan="2" align="right" valign="top">--<span class="attribution">Bob</span></td></tr></table></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 36272"></a>Assignment Tasks</h3></div></div></div><p>207 </p></td><td width="10%" valign="top"> </td></tr><tr><td width="10%" valign="top"> </td><td colspan="2" align="right" valign="top">--<span class="attribution">Bob</span></td></tr></table></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id359084"></a>Assignment Tasks</h3></div></div></div><p> 208 208 The priority of assigned tasks in this chapter is: 209 209 </p><div class="orderedlist"><ol type="1"><li><p> 210 <a class="indexterm" name="id3 36291"></a>211 <a class="indexterm" name="id3 36300"></a>212 <a class="indexterm" name="id3 36307"></a>213 <a class="indexterm" name="id3 36314"></a><a class="indexterm" name="id336319"></a>210 <a class="indexterm" name="id359103"></a> 211 <a class="indexterm" name="id359112"></a> 212 <a class="indexterm" name="id359119"></a> 213 <a class="indexterm" name="id359126"></a><a class="indexterm" name="id359132"></a> 214 214 Implement Backup Domain Controllers (BDCs) in each building. This involves 215 215 a change from a <span class="emphasis"><em>tdbsam</em></span> backend that was used in the previous … … 218 218 You can implement a single central LDAP server for this purpose. 219 219 </p></li><li><p> 220 <a class="indexterm" name="id3 36340"></a>221 <a class="indexterm" name="id3 36346"></a>222 <a class="indexterm" name="id3 36353"></a>223 <a class="indexterm" name="id3 36360"></a>220 <a class="indexterm" name="id359152"></a> 221 <a class="indexterm" name="id359159"></a> 222 <a class="indexterm" name="id359165"></a> 223 <a class="indexterm" name="id359172"></a> 224 224 Rectify the problem of excessive logon times. This involves redirection of 225 225 folders to network shares as well as modification of all user desktops to … … 227 227 create a new default profile that can be used for all new users. 228 228 </p></li></ol></div><p> 229 <a class="indexterm" name="id3 36376"></a>229 <a class="indexterm" name="id359188"></a> 230 230 You configure a new MS Windows XP Professional workstation disk image that you roll out 231 231 to all desktop users. The instructions you have created are followed on a staging machine 232 232 from which all changes can be carefully tested before inflicting them on your network users. 233 233 </p><p> 234 <a class="indexterm" name="id3 36389"></a>234 <a class="indexterm" name="id359201"></a> 235 235 This is the last network example in which specific mention of printing is made. The example 236 236 again makes use of the CUPS printing system. 237 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 36400"></a>Dissection and Discussion</h2></div></div></div><p>238 <a class="indexterm" name="id3 36408"></a>239 <a class="indexterm" name="id3 36414"></a>240 <a class="indexterm" name="id3 36421"></a>237 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id359212"></a>Dissection and Discussion</h2></div></div></div><p> 238 <a class="indexterm" name="id359220"></a> 239 <a class="indexterm" name="id359227"></a> 240 <a class="indexterm" name="id359233"></a> 241 241 The implementation of Samba BDCs necessitates the installation and configuration of LDAP. 242 242 For this site, you use OpenLDAP, the open source software LDAP server platform. Commercial 243 243 LDAP servers in current use with Samba-3 include: 244 244 </p><div class="itemizedlist"><ul type="disc"><li><p> 245 <a class="indexterm" name="id3 36437"></a>246 Novell <a href="http://www.novell.com/products/edirectory/" target="_top">eDirectory</a>245 <a class="indexterm" name="id359249"></a> 246 Novell <a class="ulink" href="http://www.novell.com/products/edirectory/" target="_top">eDirectory</a> 247 247 is being successfully used by some sites. Information on how to use eDirectory can be 248 248 obtained from the Samba mailing lists or from Novell. 249 249 </p></li><li><p> 250 <a class="indexterm" name="id3 36455"></a>251 IBM <a href="http://www-306.ibm.com/software/tivoli/products/directory-server/" target="_top">Tivoli250 <a class="indexterm" name="id359267"></a> 251 IBM <a class="ulink" href="http://www-306.ibm.com/software/tivoli/products/directory-server/" target="_top">Tivoli 252 252 Directory Server</a> can be used to provide the Samba LDAP backend. Example schema 253 253 files are provided in the Samba source code tarball under the directory 254 254 <code class="filename">~samba/example/LDAP.</code> 255 255 </p></li><li><p> 256 <a class="indexterm" name="id3 36480"></a>257 Sun <a href="http://www.sun.com/software/software/products/identity_srvr/home_identity.xml" target="_top">ONE Identity256 <a class="indexterm" name="id359292"></a> 257 Sun <a class="ulink" href="http://www.sun.com/software/software/products/identity_srvr/home_identity.xml" target="_top">ONE Identity 258 258 Server product suite</a> provides an LDAP server that can be used for Samba. 259 259 Example schema files are provided in the Samba source code tarball under the directory … … 265 265 help you to get OpenLDAP and Samba-3 running as required, albeit with some learning curve challenges. 266 266 </p><p> 267 <a class="indexterm" name="id3 36511"></a>267 <a class="indexterm" name="id359323"></a> 268 268 For most sites, the deployment of Microsoft Active Directory from the shrink-wrapped installation is quite 269 269 adequate. If you are migrating from Microsoft Active Directory, be warned that OpenLDAP does not include … … 271 271 requires an understanding of what you are doing, why you are doing it, and the tools that you must use. 272 272 </p><p> 273 <a class="indexterm" name="id3 36525"></a>274 <a class="indexterm" name="id3 36532"></a>275 <a class="indexterm" name="id3 36539"></a>276 <a class="indexterm" name="id3 36548"></a>277 <a class="indexterm" name="id3 36557"></a>278 <a class="indexterm" name="id3 36564"></a>279 <a class="indexterm" name="id3 36573"></a>273 <a class="indexterm" name="id359337"></a> 274 <a class="indexterm" name="id359344"></a> 275 <a class="indexterm" name="id359351"></a> 276 <a class="indexterm" name="id359360"></a> 277 <a class="indexterm" name="id359369"></a> 278 <a class="indexterm" name="id359376"></a> 279 <a class="indexterm" name="id359385"></a> 280 280 When installed and configured, an OpenLDAP Identity Management backend for Samba functions well. 281 281 High availability operation may be obtained through directory replication/synchronization and … … 287 287 with Microsoft Active Directory. 288 288 </p><p> 289 <a class="indexterm" name="id3 36592"></a>290 <a class="indexterm" name="id3 36601"></a>291 <a class="indexterm" name="id3 36608"></a>292 <a class="indexterm" name="id3 36615"></a>289 <a class="indexterm" name="id359404"></a> 290 <a class="indexterm" name="id359413"></a> 291 <a class="indexterm" name="id359420"></a> 292 <a class="indexterm" name="id359427"></a> 293 293 A comparison of OpenLDAP with Microsoft Active Directory does not do justice to either. OpenLDAP is an LDAP directory 294 294 tool-set. Microsoft Active Directory Server is an implementation of an LDAP server that is largely preconfigured … … 297 297 server, Microsoft SQL server, and more. The complexity of OpenLDAP is highly valued by the UNIX administrator 298 298 who wants to build a custom directory solution. Microsoft provides an application called 299 <a href="http://www.microsoft.com/windowsserver2003/adam/default.mspx" target="_top">299 <a class="ulink" href="http://www.microsoft.com/windowsserver2003/adam/default.mspx" target="_top"> 300 300 MS ADAM</a> that provides more generic LDAP services, yet it does not have the vanilla-like services 301 301 of OpenLDAP. 302 302 </p><p> 303 <a class="indexterm" name="id3 36638"></a>304 <a class="indexterm" name="id3 36647"></a>303 <a class="indexterm" name="id359450"></a> 304 <a class="indexterm" name="id359459"></a> 305 305 You may wish to consider outsourcing the development of your OpenLDAP directory to an expert, particularly 306 306 if you find the challenge of learning about LDAP directories, schemas, configuration, and management … … 310 310 that is required for use as a passdb backend. 311 311 </p><p> 312 <a class="indexterm" name="id3 36661"></a>312 <a class="indexterm" name="id359473"></a> 313 313 For those who are willing to brave the process of installing and configuring LDAP and Samba-3 interoperability, 314 314 there are a few nice Web-based tools that may help you to manage your users and groups more effectively. 315 315 The Web-based tools you might like to consider include the 316 <a href="http://lam.sourceforge.net/" target="_top">LDAP Account Manager</a> (LAM) and the Webmin-based317 <a href="http://www.webmin.com" target="_top">Webmin</a> Idealx318 <a href="http://webmin.idealx.org/index.en.html" target="_top">CGI tools</a>.316 <a class="ulink" href="http://lam.sourceforge.net/" target="_top">LDAP Account Manager</a> (LAM) and the Webmin-based 317 <a class="ulink" href="http://www.webmin.com" target="_top">Webmin</a> Idealx 318 <a class="ulink" href="http://webmin.idealx.org/index.en.html" target="_top">CGI tools</a>. 319 319 </p><p> 320 320 Some additional LDAP tools should be mentioned. Every so often a Samba user reports using one of 321 321 these, so it may be useful to them: 322 <a href="http://biot.com/gq" target="_top">GQ</a>, a GTK-based LDAP browser;323 LDAP <a href="http://www.iit.edu/~gawojar/ldap/" target="_top">Browser/Editor</a>324 <a href="http://www.jxplorer.org/" target="_top">; JXplorer</a> (by Computer Associates);325 and <a href="http://phpldapadmin.sourceforge.net/" target="_top">phpLDAPadmin</a>.322 <a class="ulink" href="http://biot.com/gq" target="_top">GQ</a>, a GTK-based LDAP browser; 323 LDAP <a class="ulink" href="http://www.iit.edu/~gawojar/ldap/" target="_top">Browser/Editor</a> 324 <a class="ulink" href="http://www.jxplorer.org/" target="_top">; JXplorer</a> (by Computer Associates); 325 and <a class="ulink" href="http://phpldapadmin.sourceforge.net/" target="_top">phpLDAPadmin</a>. 326 326 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 327 327 The following prescriptive guidance is not an LDAP tutorial. The LDAP implementation expressly uses minimal … … 331 331 </p></div><p> 332 332 Information to help you get started with OpenLDAP is available from the 333 <a href="http://www.openldap.org/pub/" target="_top">OpenLDAP web site</a>. Many people have found the book334 <a href="http://www.oreilly.com/catalog/ldapsa/index.html" target="_top"><span class="emphasis"><em>LDAP System Administration</em></span>,</a>333 <a class="ulink" href="http://www.openldap.org/pub/" target="_top">OpenLDAP web site</a>. Many people have found the book 334 <a class="ulink" href="http://www.oreilly.com/catalog/ldapsa/index.html" target="_top"><span class="emphasis"><em>LDAP System Administration</em></span>,</a> 335 335 by Jerry Carter quite useful. 336 336 </p><p> 337 <a class="indexterm" name="id3 36747"></a>338 <a class="indexterm" name="id3 36753"></a>339 <a class="indexterm" name="id3 36762"></a>340 <a class="indexterm" name="id3 36769"></a>337 <a class="indexterm" name="id359559"></a> 338 <a class="indexterm" name="id359565"></a> 339 <a class="indexterm" name="id359574"></a> 340 <a class="indexterm" name="id359581"></a> 341 341 Mary's problems are due to two factors. First, the absence of a domain controller on the local network is the 342 342 main cause of the errors that result in blue screen crashes. Second, Mary has a large profile that must … … 346 346 staff morale. The following procedures solve this problem. 347 347 </p><p> 348 <a class="indexterm" name="id3 36786"></a>348 <a class="indexterm" name="id359599"></a> 349 349 There is also an opportunity to implement smart printing features. You add this to the Samba configuration 350 350 so that future printer changes can be managed without need to change desktop configurations. … … 353 353 in the default desktop profile. Only one example of printing configuration is given. It is assumed that 354 354 you can extrapolate the principles and use them to install all printers that may be needed. 355 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 36802"></a>Technical Issues</h3></div></div></div><p>356 <a class="indexterm" name="id3 36810"></a>357 <a class="indexterm" name="id3 36819"></a>358 <a class="indexterm" name="id3 36828"></a>355 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id359614"></a>Technical Issues</h3></div></div></div><p> 356 <a class="indexterm" name="id359622"></a> 357 <a class="indexterm" name="id359631"></a> 358 <a class="indexterm" name="id359640"></a> 359 359 The solution provided is a minimal approach to getting OpenLDAP running as an identity management directory 360 360 server for UNIX system accounts as well as for Samba. From the OpenLDAP perspective, UNIX system … … 362 362 attributes Samba needs. Samba-3 can use the LDAP backend to store: 363 363 </p><div class="itemizedlist"><ul type="disc"><li><p>Windows Networking User Accounts</p></li><li><p>Windows NT Group Accounts</p></li><li><p>Mapping Information between UNIX Groups and Windows NT Groups</p></li><li><p>ID Mappings for SIDs to UIDs (also for foreign Domain SIDs)</p></li></ul></div><p> 364 <a class="indexterm" name="id3 36864"></a>365 <a class="indexterm" name="id3 36871"></a>366 <a class="indexterm" name="id3 36878"></a>367 <a class="indexterm" name="id3 36885"></a>368 <a class="indexterm" name="id3 36891"></a>369 <a class="indexterm" name="id3 36898"></a>370 <a class="indexterm" name="id3 36907"></a>371 <a class="indexterm" name="id3 36914"></a>372 <a class="indexterm" name="id3 36920"></a>364 <a class="indexterm" name="id359676"></a> 365 <a class="indexterm" name="id359683"></a> 366 <a class="indexterm" name="id359690"></a> 367 <a class="indexterm" name="id359697"></a> 368 <a class="indexterm" name="id359704"></a> 369 <a class="indexterm" name="id359710"></a> 370 <a class="indexterm" name="id359719"></a> 371 <a class="indexterm" name="id359726"></a> 372 <a class="indexterm" name="id359732"></a> 373 373 The use of LDAP with Samba-3 makes it necessary to store UNIX accounts as well as Windows Networking 374 374 accounts in the LDAP backend. This implies the need to use the 375 <a href="http://www.padl.com/Contents/OpenSourceSoftware.html" target="_top">PADL LDAP tools</a>. The resolution375 <a class="ulink" href="http://www.padl.com/Contents/OpenSourceSoftware.html" target="_top">PADL LDAP tools</a>. The resolution 376 376 of the UNIX group name to its GID must be enabled from either the <code class="filename">/etc/group</code> 377 377 or from the LDAP backend. This requires the use of the PADL <code class="filename">nss_ldap</code> tool-set 378 378 that integrates with the NSS. The same requirements exist for resolution 379 of the UNIX username to the UID. The relationships are demonstrated in <a href="happy.html#sbehap-LDAPdiag" title="Figure 5.1. The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts">???</a>.379 of the UNIX username to the UID. The relationships are demonstrated in <a class="link" href="happy.html#sbehap-LDAPdiag" title="Figure 5.1. The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts">“The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts”</a>. 380 380 </p><div class="figure"><a name="sbehap-LDAPdiag"></a><p class="title"><b>Figure 5.1. The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/UNIX-Samba-and-LDAP.png" width="270" alt="The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts"></div></div></div><br class="figure-break"><p> 381 <a class="indexterm" name="id3 37000"></a>382 <a class="indexterm" name="id3 37007"></a>381 <a class="indexterm" name="id359812"></a> 382 <a class="indexterm" name="id359819"></a> 383 383 You configure OpenLDAP so that it is operational. Before deploying the OpenLDAP, you really 384 384 ought to learn how to configure secure communications over LDAP so that site security is not 385 385 at risk. This is not covered in the following guidance. 386 386 </p><p> 387 <a class="indexterm" name="id3 37021"></a>388 <a class="indexterm" name="id3 37028"></a>389 <a class="indexterm" name="id3 37037"></a>390 <a class="indexterm" name="id3 37044"></a>387 <a class="indexterm" name="id359833"></a> 388 <a class="indexterm" name="id359840"></a> 389 <a class="indexterm" name="id359849"></a> 390 <a class="indexterm" name="id359856"></a> 391 391 When OpenLDAP has been made operative, you configure the PDC called <code class="constant">MASSIVE</code>. 392 392 You initialize the Samba <code class="filename">secrets.tdb<sub></sub></code> file. Then you … … 396 396 that help to manage user and group configuration. 397 397 </p><p> 398 <a class="indexterm" name="id3 37074"></a>399 <a class="indexterm" name="id3 37081"></a>400 <a class="indexterm" name="id3 37088"></a>398 <a class="indexterm" name="id359886"></a> 399 <a class="indexterm" name="id359893"></a> 400 <a class="indexterm" name="id359900"></a> 401 401 In order to effect folder redirection and to add robustness to the implementation, 402 402 create a network default profile. All network users workstations are configured to use … … 404 404 when the user logs off. 405 405 </p><p> 406 <a class="indexterm" name="id3 37100"></a>406 <a class="indexterm" name="id359915"></a> 407 407 The profile is configured so that users cannot change the appearance 408 408 of their desktop. This is known as a mandatory profile. You make certain that users 409 409 are able to use their computers efficiently. 410 410 </p><p> 411 <a class="indexterm" name="id3 37112"></a>411 <a class="indexterm" name="id359927"></a> 412 412 A network logon script is used to deliver flexible but consistent network drive 413 413 connections. 414 414 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="sbehap-ppc"></a>Addition of Machines to the Domain</h4></div></div></div><p> 415 <a class="indexterm" name="id3 37132"></a>416 <a class="indexterm" name="id3 37138"></a>417 <a class="indexterm" name="id3 37143"></a>418 <a class="indexterm" name="id3 37148"></a>415 <a class="indexterm" name="id359947"></a> 416 <a class="indexterm" name="id359952"></a> 417 <a class="indexterm" name="id359958"></a> 418 <a class="indexterm" name="id359963"></a> 419 419 Samba versions prior to 3.0.11 necessitated the use of a domain administrator account 420 420 that maps to the UNIX UID=0. The UNIX operating system permits only the <code class="constant">root</code> … … 426 426 how any user can now be given the ability to add machines to the domain using a normal user account 427 427 that has been given the appropriate privileges. 428 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 37279"></a>Roaming Profile Background</h4></div></div></div><p>428 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id360094"></a>Roaming Profile Background</h4></div></div></div><p> 429 429 As XP roaming profiles grow, so does the amount of time it takes to log in and out. 430 430 </p><p> 431 <a class="indexterm" name="id3 37291"></a>432 <a class="indexterm" name="id3 37298"></a>433 <a class="indexterm" name="id3 37305"></a>434 <a class="indexterm" name="id3 37311"></a>431 <a class="indexterm" name="id360106"></a> 432 <a class="indexterm" name="id360112"></a> 433 <a class="indexterm" name="id360119"></a> 434 <a class="indexterm" name="id360126"></a> 435 435 An XP roaming profile consists of the <code class="constant">HKEY_CURRENT_USER</code> hive file 436 436 <code class="filename">NTUSER.DAT</code> and a number of folders (My Documents, Application Data, … … 454 454 instead of the <code class="filename">My Documents</code> folder for saving documents. 455 455 </p><p> 456 <a class="indexterm" name="id3 37373"></a>456 <a class="indexterm" name="id360190"></a> 457 457 Using a folder other than <code class="filename">My Documents</code> is a nuisance for 458 458 some users, since many applications use it by default. 459 459 </p><p> 460 <a class="indexterm" name="id3 37390"></a>461 <a class="indexterm" name="id3 37396"></a>462 <a class="indexterm" name="id3 37403"></a>460 <a class="indexterm" name="id360207"></a> 461 <a class="indexterm" name="id360214"></a> 462 <a class="indexterm" name="id360221"></a> 463 463 The secret to rapid loading of roaming profiles is to prevent unnecessary data from 464 464 being copied back and forth, without losing any functionality. This is not difficult; … … 466 466 as changing some paths in each user's <code class="filename">NTUSER.DAT</code> hive. 467 467 </p><p> 468 <a class="indexterm" name="id3 37422"></a>469 <a class="indexterm" name="id3 37429"></a>468 <a class="indexterm" name="id360239"></a> 469 <a class="indexterm" name="id360246"></a> 470 470 Every user profile has its own <code class="filename">NTUSER.DAT</code> file. This means 471 471 you need to edit every user's profile, unless a better method can be … … 476 476 they are redirected. 477 477 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="sbehap-locgrppol"></a>The Local Group Policy</h4></div></div></div><p> 478 <a class="indexterm" name="id3 37464"></a>479 <a class="indexterm" name="id3 37471"></a>480 <a class="indexterm" name="id3 37478"></a>481 <a class="indexterm" name="id3 37484"></a>478 <a class="indexterm" name="id360282"></a> 479 <a class="indexterm" name="id360288"></a> 480 <a class="indexterm" name="id360295"></a> 481 <a class="indexterm" name="id360302"></a> 482 482 Without an Active Directory PDC, you cannot take full advantage of Group Policy 483 483 Objects. However, you can still make changes to the Local Group Policy by using … … 493 493 semicolon-separated list. Note that this change must be made on all clients 494 494 that are using roaming profiles. 495 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 37546"></a>Profile Changes</h4></div></div></div><p>496 <a class="indexterm" name="id3 37554"></a>497 <a class="indexterm" name="id3 37561"></a>495 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id360364"></a>Profile Changes</h4></div></div></div><p> 496 <a class="indexterm" name="id360372"></a> 497 <a class="indexterm" name="id360378"></a> 498 498 There are two changes that should be done to each user's profile. Move each of 499 499 the directories that you have excluded from being copied back and forth out of … … 502 502 path (<code class="filename">C:\Documents and Settings\%USERNAME%</code>). 503 503 </p><p> 504 <a class="indexterm" name="id3 37586"></a>505 <a class="indexterm" name="id3 37592"></a>504 <a class="indexterm" name="id360403"></a> 505 <a class="indexterm" name="id360410"></a> 506 506 The above modifies existing user profiles. So that newly created profiles have 507 507 these settings, you need to modify the <code class="filename">NTUSER.DAT</code> in … … 509 509 client machine, changing the same registry keys. You could do this by copying 510 510 <code class="filename">NTUSER.DAT</code> to a Linux box and using <code class="literal">regedt32</code>. 511 The basic method is described under <a href="happy.html#redirfold" title="Configuration of Default Profile with Folder Redirection">???</a>.512 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 37635"></a>Using a Network Default User Profile</h4></div></div></div><p>513 <a class="indexterm" name="id3 37643"></a>514 <a class="indexterm" name="id3 37649"></a>511 The basic method is described under <a class="link" href="happy.html#redirfold" title="Configuration of Default Profile with Folder Redirection">“Configuration of Default Profile with Folder Redirection”</a>. 512 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id360452"></a>Using a Network Default User Profile</h4></div></div></div><p> 513 <a class="indexterm" name="id360460"></a> 514 <a class="indexterm" name="id360467"></a> 515 515 If you are using Samba as your PDC, you should create a file share called 516 516 <code class="constant">NETLOGON</code> and within that create a directory called … … 519 519 If this share exists and the <code class="filename">Default User</code> folder exists, 520 520 the first login from a new account pulls its configuration from it. 521 See also <a href="http://isg.ee.ethz.ch/tools/realmen/det/skel.en.html" target="_top">521 See also <a class="ulink" href="http://isg.ee.ethz.ch/tools/realmen/det/skel.en.html" target="_top"> 522 522 the Real Men Don't Click</a> Web site. 523 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 37689"></a>Installation of Printer Driver Auto-Download</h4></div></div></div><p>524 <a class="indexterm" name="id3 37697"></a>525 <a class="indexterm" name="id3 37706"></a>526 <a class="indexterm" name="id3 37713"></a>523 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id360506"></a>Installation of Printer Driver Auto-Download</h4></div></div></div><p> 524 <a class="indexterm" name="id360514"></a> 525 <a class="indexterm" name="id360523"></a> 526 <a class="indexterm" name="id360530"></a> 527 527 The subject of printing is quite topical. Printing problems run second place to name 528 528 resolution issues today. So far in this book, you have experienced only what is generally … … 533 533 <code class="literal">Raw-Print-Through</code> printing. 534 534 </p><p> 535 <a class="indexterm" name="id3 37737"></a>536 <a class="indexterm" name="id3 37746"></a>535 <a class="indexterm" name="id360554"></a> 536 <a class="indexterm" name="id360564"></a> 537 537 Samba permits the configuration of <code class="literal">smart</code> printing using the Microsoft 538 538 Windows point-and-click (also called drag-and-drop) printing. What this provides is … … 548 548 suited to the printer to which the job is dispatched. 549 549 </p><p> 550 <a class="indexterm" name="id3 37786"></a>551 <a class="indexterm" name="id3 37793"></a>552 <a class="indexterm" name="id3 37800"></a>550 <a class="indexterm" name="id360604"></a> 551 <a class="indexterm" name="id360610"></a> 552 <a class="indexterm" name="id360617"></a> 553 553 The CUPS printing subsystem is capable of intelligent printing. It has the capacity to 554 554 detect the data format and apply a print filter. This means that it is feasible to install 555 555 on all Windows clients a single printer driver for use with all printers that are routed 556 556 through CUPS. The most sensible driver to use is one for a PostScript printer. Fortunately, 557 <a href="http://www.easysw.com" target="_top">Easy Software Products</a>, the authors of CUPS, have557 <a class="ulink" href="http://www.easysw.com" target="_top">Easy Software Products</a>, the authors of CUPS, have 558 558 released a PostScript printing driver for Windows. It can be installed into the Samba 559 559 printing backend so that it automatically downloads to the client when needed. … … 575 575 </p><p> 576 576 Here are some diagnostic guidelines that can be referred to when things go wrong: 577 </p><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id3 37852"></a>Preliminary Advice: Dangers Can Be Avoided</h5></div></div></div><p>577 </p><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id360669"></a>Preliminary Advice: Dangers Can Be Avoided</h5></div></div></div><p> 578 578 The best advice regarding how to mend a broken leg is “<span class="quote">Never break a leg!</span>” 579 579 </p><p> 580 <a class="indexterm" name="id3 37867"></a>580 <a class="indexterm" name="id360684"></a> 581 581 Newcomers to Samba and LDAP seem to struggle a great deal at first. If you want advice 582 582 regarding the best way to remedy LDAP and Samba problems: “<span class="quote">Avoid them like the plague!</span>” … … 594 594 book and adapt them without first working through the examples provided. A little 595 595 thing overlooked can cause untold pain and may permanently tarnish your experience. 596 </p></div></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id3 37902"></a>The Name Service Caching Daemon</h5></div></div></div><p>596 </p></div></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id360719"></a>The Name Service Caching Daemon</h5></div></div></div><p> 597 597 The name service caching daemon (nscd) is a primary cause of difficulties with name 598 598 resolution, particularly where <code class="literal">winbind</code> is used. Winbind does its … … 661 661 <code class="prompt">root# </code> rcnscd off 662 662 </pre><p> 663 </p></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id3 38019"></a>Debugging LDAP</h5></div></div></div><p>664 <a class="indexterm" name="id3 38027"></a>665 <a class="indexterm" name="id3 38034"></a>666 <a class="indexterm" name="id3 38041"></a>663 </p></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id360837"></a>Debugging LDAP</h5></div></div></div><p> 664 <a class="indexterm" name="id360844"></a> 665 <a class="indexterm" name="id360851"></a> 666 <a class="indexterm" name="id360858"></a> 667 667 In the example <code class="filename">/etc/openldap/slapd.conf</code> control file 668 (see <a href="happy.html#sbehap-dbconf" title="Example 5.1. LDAP DB_CONFIG File">???</a>) there is an entry for <code class="constant">loglevel 256</code>.668 (see <a class="link" href="happy.html#sbehap-dbconf" title="Example 5.1. LDAP DB_CONFIG File">“LDAP DB_CONFIG File”</a>) there is an entry for <code class="constant">loglevel 256</code>. 669 669 To enable logging via the syslog infrastructure, it is necessary to uncomment this parameter 670 670 and restart <code class="literal">slapd</code>. 671 671 </p><p> 672 <a class="indexterm" name="id3 38074"></a>673 <a class="indexterm" name="id3 38081"></a>672 <a class="indexterm" name="id360892"></a> 673 <a class="indexterm" name="id360898"></a> 674 674 LDAP log information can be directed into a file that is separate from the normal system 675 675 log files by changing the <code class="filename">/etc/syslog.conf</code> file so it has the following … … 690 690 customization with the intent that LDAP log files will be stored at a location 691 691 that meets local site needs and wishes more fully. 692 </p></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id3 38115"></a>Debugging NSS_LDAP</h5></div></div></div><p>692 </p></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id360932"></a>Debugging NSS_LDAP</h5></div></div></div><p> 693 693 The basic mechanism for diagnosing problems with the nss_ldap utility involves adding to the 694 694 <code class="filename">/etc/ldap.conf</code> file the following parameters: … … 703 703 </p><p> 704 704 The diagnostic process should follow these steps: 705 </p><div class="procedure"><a name="id3 38155"></a><p class="title"><b>Procedure 5.1. NSS_LDAP Diagnostic Steps</b></p><ol type="1"><li><p>705 </p><div class="procedure"><a name="id360973"></a><p class="title"><b>Procedure 5.1. NSS_LDAP Diagnostic Steps</b></p><ol type="1"><li><p> 706 706 Verify the <code class="constant">nss_base_passwd, nss_base_shadow, nss_base_group</code> entries 707 707 in the <code class="filename">/etc/ldap.conf</code> file and compare them closely with the directory … … 793 793 <code class="filename">/etc/ldap.secrets</code> file is correct, as specified in the 794 794 <code class="filename">/etc/openldap/slapd.conf</code> file. 795 </p></li></ol></div></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id3 38374"></a>Debugging Samba</h5></div></div></div><p>795 </p></li></ol></div></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id361191"></a>Debugging Samba</h5></div></div></div><p> 796 796 The following parameters in the <code class="filename">smb.conf</code> file can be useful in tracking down Samba-related problems: 797 797 </p><pre class="screen"> … … 823 823 Search for hints of what may have failed by looking for the words <span class="emphasis"><em>fail</em></span> 824 824 and <span class="emphasis"><em>error</em></span>. 825 </p></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id3 38438"></a>Debugging on the Windows Client</h5></div></div></div><p>825 </p></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id361256"></a>Debugging on the Windows Client</h5></div></div></div><p> 826 826 MS Windows 2000 Professional and Windows XP Professional clients can be configured 827 827 to create a netlogon.log file that can be very helpful in diagnosing network logon problems. Search 828 828 the Microsoft knowledge base for detailed instructions. The techniques vary a little with each 829 829 version of MS Windows. 830 </p></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 38453"></a>Political Issues</h3></div></div></div><p>830 </p></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id361271"></a>Political Issues</h3></div></div></div><p> 831 831 MS Windows network users are generally very sensitive to limits that may be imposed when 832 832 confronted with locked-down workstation configurations. The challenge you face must 833 833 be promoted as a choice between reliable, fast network operation and a constant flux 834 834 of problems that result in user irritation. 835 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 38466"></a>Installation Checklist</h3></div></div></div><p>835 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id361283"></a>Installation Checklist</h3></div></div></div><p> 836 836 You are starting a complex project. Even though you went through the installation of a complex 837 network in <a href="Big500users.html" title="Chapter 4. The 500-User Office">???</a>, this network is a bigger challenge because of the837 network in <a class="link" href="Big500users.html" title="Chapter 4. The 500-User Office">“The 500-User Office”</a>, this network is a bigger challenge because of the 838 838 large number of complex applications that must be configured before the first few steps 839 839 can be validated. Take stock of what you are about to undertake, prepare yourself, and … … 841 841 been completed. The following task list may help you to keep track of the task items 842 842 that are covered: 843 </p><div class="itemizedlist"><ul type="disc"><li><p>Samba-3 PDC Server Configuration</p><div class="orderedlist"><ol type="1"><li><p>DHCP and DNS servers</p></li><li><p>OpenLDAP server</p></li><li><p>PAM and NSS client tools</p></li><li><p>Samba-3 PDC</p></li><li><p>Idealx smbldap scripts</p></li><li><p>LDAP initialization</p></li><li><p>Create user and group accounts</p></li><li><p>Printers</p></li><li><p>Share point directory roots</p></li><li><p>Profile directories</p></li><li><p>Logon scripts</p></li><li><p>Configuration of user rights and privileges</p></li></ol></div></li><li><p>Samba-3 BDC Server Configuration</p><div class="orderedlist"><ol type="1"><li><p>DHCP and DNS servers</p></li><li><p>PAM and NSS client tools</p></li><li><p>Printers</p></li><li><p>Share point directory roots</p></li><li><p>Profiles directories</p></li></ol></div></li><li><p>Windows XP Client Configuration</p><div class="orderedlist"><ol type="1"><li><p>Default profile folder redirection</p></li><li><p>MS Outlook PST file relocation</p></li><li><p>Delete roaming profile on logout</p></li><li><p>Upload printer drivers to Samba servers</p></li><li><p>Install software</p></li><li><p>Creation of roll-out images</p></li></ol></div></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 38636"></a>Samba Server Implementation</h2></div></div></div><p>844 <a class="indexterm" name="id3 38644"></a>845 <a class="indexterm" name="id3 38651"></a>846 The network design shown in <a href="happy.html#chap6net" title="Figure 5.2. Network Topology 500 User Network Using ldapsam passdb backend">???</a> is not comprehensive. It is assumed843 </p><div class="itemizedlist"><ul type="disc"><li><p>Samba-3 PDC Server Configuration</p><div class="orderedlist"><ol type="1"><li><p>DHCP and DNS servers</p></li><li><p>OpenLDAP server</p></li><li><p>PAM and NSS client tools</p></li><li><p>Samba-3 PDC</p></li><li><p>Idealx smbldap scripts</p></li><li><p>LDAP initialization</p></li><li><p>Create user and group accounts</p></li><li><p>Printers</p></li><li><p>Share point directory roots</p></li><li><p>Profile directories</p></li><li><p>Logon scripts</p></li><li><p>Configuration of user rights and privileges</p></li></ol></div></li><li><p>Samba-3 BDC Server Configuration</p><div class="orderedlist"><ol type="1"><li><p>DHCP and DNS servers</p></li><li><p>PAM and NSS client tools</p></li><li><p>Printers</p></li><li><p>Share point directory roots</p></li><li><p>Profiles directories</p></li></ol></div></li><li><p>Windows XP Client Configuration</p><div class="orderedlist"><ol type="1"><li><p>Default profile folder redirection</p></li><li><p>MS Outlook PST file relocation</p></li><li><p>Delete roaming profile on logout</p></li><li><p>Upload printer drivers to Samba servers</p></li><li><p>Install software</p></li><li><p>Creation of roll-out images</p></li></ol></div></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id361454"></a>Samba Server Implementation</h2></div></div></div><p> 844 <a class="indexterm" name="id361462"></a> 845 <a class="indexterm" name="id361468"></a> 846 The network design shown in <a class="link" href="happy.html#chap6net" title="Figure 5.2. Network Topology 500 User Network Using ldapsam passdb backend">“Network Topology 500 User Network Using ldapsam passdb backend”</a> is not comprehensive. It is assumed 847 847 that you will install additional file servers and possibly additional BDCs. 848 848 </p><div class="figure"><a name="chap6net"></a><p class="title"><b>Figure 5.2. Network Topology 500 User Network Using ldapsam passdb backend</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap6-net.png" width="270" alt="Network Topology 500 User Network Using ldapsam passdb backend"></div></div></div><br class="figure-break"><p> 849 <a class="indexterm" name="id3 38711"></a>850 <a class="indexterm" name="id3 38718"></a>849 <a class="indexterm" name="id361529"></a> 850 <a class="indexterm" name="id361535"></a> 851 851 All configuration files and locations are shown for SUSE Linux 9.2 and are equally valid for SUSE 852 852 Linux Enterprise Server 9. The file locations for Red Hat Linux are similar. You may need to … … 864 864 </p></div><p> 865 865 The steps in the process involve changes from the network configuration shown in 866 <a href="Big500users.html" title="Chapter 4. The 500-User Office">???</a>. Before implementing the following steps, you must866 <a class="link" href="Big500users.html" title="Chapter 4. The 500-User Office">“The 500-User Office”</a>. Before implementing the following steps, you must 867 867 have completed the network implementation shown in that chapter. If you are starting 868 868 with newly installed Linux servers, you must complete the steps shown in 869 <a href="Big500users.html#ch5-dnshcp-setup" title="Installation of DHCP, DNS, and Samba Control Files">???</a> before commencing at <a href="happy.html#ldapsetup" title="OpenLDAP Server Configuration">???</a>.869 <a class="link" href="Big500users.html#ch5-dnshcp-setup" title="Installation of DHCP, DNS, and Samba Control Files">“Installation of DHCP, DNS, and Samba Control Files”</a> before commencing at <a class="link" href="happy.html#ldapsetup" title="OpenLDAP Server Configuration">“OpenLDAP Server Configuration”</a>. 870 870 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ldapsetup"></a>OpenLDAP Server Configuration</h3></div></div></div><p> 871 <a class="indexterm" name="id3 38788"></a>872 <a class="indexterm" name="id3 38794"></a>873 <a class="indexterm" name="id3 38801"></a>874 Confirm that the packages shown in <a href="happy.html#oldapreq" title="Table 5.2. Required OpenLDAP Linux Packages">???</a> are installed on your system.871 <a class="indexterm" name="id361605"></a> 872 <a class="indexterm" name="id361612"></a> 873 <a class="indexterm" name="id361618"></a> 874 Confirm that the packages shown in <a class="link" href="happy.html#oldapreq" title="Table 5.2. Required OpenLDAP Linux Packages">“Required OpenLDAP Linux Packages”</a> are installed on your system. 875 875 </p><div class="table"><a name="oldapreq"></a><p class="title"><b>Table 5.2. Required OpenLDAP Linux Packages</b></p><div class="table-contents"><table summary="Required OpenLDAP Linux Packages" border="1"><colgroup><col align="left"><col align="left"><col align="left"></colgroup><thead><tr><th align="center">SUSE Linux 8.x</th><th align="center">SUSE Linux 9.x</th><th align="center">Red Hat Linux</th></tr></thead><tbody><tr><td align="left">nss_ldap</td><td align="left">nss_ldap</td><td align="left">nss_ldap</td></tr><tr><td align="left">pam_ldap</td><td align="left">pam_ldap</td><td align="left">pam_ldap</td></tr><tr><td align="left">openldap2</td><td align="left">openldap2</td><td align="left">openldap</td></tr><tr><td align="left">openldap2-client</td><td align="left">openldap2-client</td><td align="left"> </td></tr></tbody></table></div></div><br class="table-break"><p> 876 876 Samba-3 and OpenLDAP will have a degree of interdependence that is unavoidable. The method 877 877 for bootstrapping the LDAP and Samba-3 configuration is relatively straightforward. If you 878 878 follow these guidelines, the resulting system should work fine. 879 </p><div class="procedure"><a name="id3 38930"></a><p class="title"><b>Procedure 5.2. OpenLDAP Server Configuration Steps</b></p><ol type="1"><li><p>880 <a class="indexterm" name="id3 38942"></a>881 Install the file shown in <a href="happy.html#sbehap-slapdconf" title="Example 5.2. LDAP Master Configuration File /etc/openldap/slapd.conf Part A">???</a> in the directory879 </p><div class="procedure"><a name="id361748"></a><p class="title"><b>Procedure 5.2. OpenLDAP Server Configuration Steps</b></p><ol type="1"><li><p> 880 <a class="indexterm" name="id361759"></a> 881 Install the file shown in <a class="link" href="happy.html#sbehap-slapdconf" title="Example 5.2. LDAP Master Configuration File /etc/openldap/slapd.conf Part A">“LDAP Master Configuration File /etc/openldap/slapd.conf Part A”</a> in the directory 882 882 <code class="filename">/etc/openldap</code>. 883 883 </p></li><li><p> 884 <a class="indexterm" name="id3 38968"></a>885 <a class="indexterm" name="id3 38975"></a>886 <a class="indexterm" name="id3 38982"></a>884 <a class="indexterm" name="id361785"></a> 885 <a class="indexterm" name="id361792"></a> 886 <a class="indexterm" name="id361799"></a> 887 887 Remove all files from the directory <code class="filename">/data/ldap</code>, making certain that 888 888 the directory exists with permissions: … … 893 893 This may require you to add a user and a group account for LDAP if they do not exist. 894 894 </p></li><li><p> 895 <a class="indexterm" name="id3 39015"></a>896 Install the file shown in <a href="happy.html#sbehap-dbconf" title="Example 5.1. LDAP DB_CONFIG File">???</a> in the directory895 <a class="indexterm" name="id361832"></a> 896 Install the file shown in <a class="link" href="happy.html#sbehap-dbconf" title="Example 5.1. LDAP DB_CONFIG File">“LDAP DB_CONFIG File”</a> in the directory 897 897 <code class="filename">/data/ldap</code>. In the event that this file is added after <code class="constant">ldap</code> 898 898 has been started, it is possible to cause the new settings to take effect by shutting down … … 900 900 <code class="filename">/data/ldap</code> directory, and then restarting the <code class="constant">LDAP</code> server. 901 901 </p></li><li><p> 902 <a class="indexterm" name="id3 39064"></a>902 <a class="indexterm" name="id361882"></a> 903 903 Performance logging can be enabled and should preferably be sent to a file on 904 904 a file system that is large enough to handle significantly sized logs. To enable … … 976 976 index default sub 977 977 </pre></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="sbehap-PAM-NSS"></a>PAM and NSS Client Configuration</h3></div></div></div><p> 978 <a class="indexterm" name="id3 39203"></a>979 <a class="indexterm" name="id3 39209"></a>980 <a class="indexterm" name="id3 39216"></a>978 <a class="indexterm" name="id362017"></a> 979 <a class="indexterm" name="id362023"></a> 980 <a class="indexterm" name="id362030"></a> 981 981 The steps that follow involve configuration of LDAP, NSS LDAP-based resolution of users and 982 982 groups. Also, so that LDAP-based accounts can log onto the system, the steps ahead configure 983 983 the Pluggable Authentication Modules (PAM) to permit LDAP-based authentication. 984 984 </p><p> 985 <a class="indexterm" name="id3 39228"></a>986 <a class="indexterm" name="id3 39237"></a>985 <a class="indexterm" name="id362042"></a> 986 <a class="indexterm" name="id362051"></a> 987 987 Since you have chosen to put UNIX user and group accounts into the LDAP database, it is likely 988 988 that you may want to use them for UNIX system (Linux) local machine logons. This necessitates … … 991 991 module also has the ability to redirect authentication requests through LDAP. 992 992 </p><p> 993 <a class="indexterm" name="id3 39262"></a>994 <a class="indexterm" name="id3 39269"></a>995 <a class="indexterm" name="id3 39276"></a>996 <a class="indexterm" name="id3 39283"></a>993 <a class="indexterm" name="id362076"></a> 994 <a class="indexterm" name="id362083"></a> 995 <a class="indexterm" name="id362090"></a> 996 <a class="indexterm" name="id362097"></a> 997 997 You have chosen to configure these services by directly editing the system files, but of course, you 998 998 know that this configuration can be done using system tools provided by the Linux system vendor. … … 1000 1000 configuration of SUSE Linux as an LDAP client. Red Hat Linux provides the <code class="literal">authconfig</code> 1001 1001 tool for this. 1002 </p><div class="procedure"><a name="id3 39319"></a><p class="title"><b>Procedure 5.3. PAM and NSS Client Configuration Steps</b></p><div class="example"><a name="sbehap-nss01"></a><p class="title"><b>Example 5.4. Configuration File for NSS LDAP Support <code class="filename">/etc/ldap.conf</code></b></p><div class="example-contents"><pre class="screen">1002 </p><div class="procedure"><a name="id362133"></a><p class="title"><b>Procedure 5.3. PAM and NSS Client Configuration Steps</b></p><div class="example"><a name="sbehap-nss01"></a><p class="title"><b>Example 5.4. Configuration File for NSS LDAP Support <code class="filename">/etc/ldap.conf</code></b></p><div class="example-contents"><pre class="screen"> 1003 1003 host 127.0.0.1 1004 1004 … … 1043 1043 ssl off 1044 1044 </pre></div></div><br class="example-break"><ol type="1"><li><p> 1045 <a class="indexterm" name="id3 39330"></a>1046 <a class="indexterm" name="id3 39337"></a>1047 <a class="indexterm" name="id3 39344"></a>1045 <a class="indexterm" name="id362145"></a> 1046 <a class="indexterm" name="id362151"></a> 1047 <a class="indexterm" name="id362158"></a> 1048 1048 Execute the following command to find where the <code class="filename">nss_ldap</code> module 1049 1049 expects to find its control file: … … 1054 1054 </p></li><li><p> 1055 1055 On the server <code class="constant">MASSIVE</code>, install the file shown in 1056 <a href="happy.html#sbehap-nss01" title="Example 5.4. Configuration File for NSS LDAP Support /etc/ldap.conf">???</a> into the path that was obtained from the step above.1056 <a class="link" href="happy.html#sbehap-nss01" title="Example 5.4. Configuration File for NSS LDAP Support /etc/ldap.conf">“Configuration File for NSS LDAP Support /etc/ldap.conf”</a> into the path that was obtained from the step above. 1057 1057 On the servers called <code class="constant">BLDG1</code> and <code class="constant">BLDG2</code>, install the file shown in 1058 <a href="happy.html#sbehap-nss02" title="Example 5.5. Configuration File for NSS LDAP Clients Support /etc/ldap.conf">???</a> into the path that was obtained from the step above.1059 </p></li><li><p> 1060 <a class="indexterm" name="id3 39466"></a>1058 <a class="link" href="happy.html#sbehap-nss02" title="Example 5.5. Configuration File for NSS LDAP Clients Support /etc/ldap.conf">“Configuration File for NSS LDAP Clients Support /etc/ldap.conf”</a> into the path that was obtained from the step above. 1059 </p></li><li><p> 1060 <a class="indexterm" name="id362281"></a> 1061 1061 Edit the NSS control file (<code class="filename">/etc/nsswitch.conf</code>) so that the lines that 1062 1062 control user and group resolution will obtain information from the normal system files as … … 1081 1081 <code class="filename">nsswitch.conf</code> file is a significant cause of operational problems with LDAP. 1082 1082 </p></li><li><p> 1083 <a class="indexterm" name="id3 39532"></a>1083 <a class="indexterm" name="id362347"></a> 1084 1084 For PAM LDAP configuration on this SUSE Linux 9.0 system, the simplest solution is to edit the following 1085 1085 files in the <code class="filename">/etc/pam.d</code> directory: <code class="literal">login</code>, <code class="literal">password</code>, … … 1103 1103 </pre><p> 1104 1104 </p><p> 1105 <a class="indexterm" name="id3 39609"></a>1105 <a class="indexterm" name="id362419"></a> 1106 1106 On other Linux systems that do not have an LDAP-enabled <code class="literal">pam_unix2.so</code> module, 1107 1107 you must edit these files by adding the <code class="literal">pam_ldap.so</code> modules as shown here: … … 1127 1127 LDAP, you probably want to use it rather than add an additional module. 1128 1128 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="sbehap-massive"></a>Samba-3 PDC Configuration</h3></div></div></div><p> 1129 <a class="indexterm" name="id3 39674"></a>1129 <a class="indexterm" name="id362489"></a> 1130 1130 Verify that the Samba-3.0.20 (or later) packages are installed on each SUSE Linux server 1131 1131 before following the steps below. If Samba-3.0.20 (or later) is not installed, you have the … … 1134 1134 Red Hat Fedora Core and Red Hat Enterprise Linux Server 3 and 4, are included on the CD-ROM that 1135 1135 is included with this book. 1136 </p><div class="procedure"><a name="id3 39685"></a><p class="title"><b>Procedure 5.4. Configuration of PDC Called <code class="constant">MASSIVE</code></b></p><ol type="1"><li><p>1137 Install the files in <a href="happy.html#sbehap-massive-smbconfa" title="Example 5.6. LDAP Based smb.conf File, Server: MASSIVE global Section: Part A">???</a>,1138 <a href="happy.html#sbehap-massive-smbconfb" title="Example 5.7. LDAP Based smb.conf File, Server: MASSIVE global Section: Part B">???</a>, <a href="happy.html#sbehap-shareconfa" title="Example 5.10. LDAP Based smb.conf File, Shares Section Part A">???</a>,1139 and <a href="happy.html#sbehap-shareconfb" title="Example 5.11. LDAP Based smb.conf File, Shares Section Part B">???</a> into the <code class="filename">/etc/samba/</code>1136 </p><div class="procedure"><a name="id362500"></a><p class="title"><b>Procedure 5.4. Configuration of PDC Called <code class="constant">MASSIVE</code></b></p><ol type="1"><li><p> 1137 Install the files in <a class="link" href="happy.html#sbehap-massive-smbconfa" title="Example 5.6. LDAP Based smb.conf File, Server: MASSIVE global Section: Part A">“LDAP Based smb.conf File, Server: MASSIVE global Section: Part A”</a>, 1138 <a class="link" href="happy.html#sbehap-massive-smbconfb" title="Example 5.7. LDAP Based smb.conf File, Server: MASSIVE global Section: Part B">“LDAP Based smb.conf File, Server: MASSIVE global Section: Part B”</a>, <a class="link" href="happy.html#sbehap-shareconfa" title="Example 5.10. LDAP Based smb.conf File, Shares Section Part A">“LDAP Based smb.conf File, Shares Section Part A”</a>, 1139 and <a class="link" href="happy.html#sbehap-shareconfb" title="Example 5.11. LDAP Based smb.conf File, Shares Section Part B">“LDAP Based smb.conf File, Shares Section Part B”</a> into the <code class="filename">/etc/samba/</code> 1140 1140 directory. The three files should be added together to form the <code class="filename">smb.conf</code> 1141 1141 master file. It is a good practice to call this file something like … … 1144 1144 the next step. 1145 1145 </p></li><li><p> 1146 <a class="indexterm" name="id3 39758"></a>1146 <a class="indexterm" name="id362572"></a> 1147 1147 Create and verify the contents of the <code class="filename">smb.conf</code> file that is generated by: 1148 1148 </p><pre class="screen"> … … 1181 1181 </pre><p> 1182 1182 </p></li><li><p> 1183 <a class="indexterm" name="id3 39849"></a>1184 <a class="indexterm" name="id3 39856"></a>1183 <a class="indexterm" name="id362664"></a> 1184 <a class="indexterm" name="id362671"></a> 1185 1185 Samba-3 communicates with the LDAP server. The password that it uses to 1186 1186 authenticate to the LDAP server must be stored in the <code class="filename">secrets.tdb</code> … … 1195 1195 </pre><p> 1196 1196 </p></li><li><p> 1197 <a class="indexterm" name="id3 39901"></a>1198 <a class="indexterm" name="id3 39908"></a>1197 <a class="indexterm" name="id362716"></a> 1198 <a class="indexterm" name="id362723"></a> 1199 1199 Samba-3 generates a Windows Security Identifier (SID) only when <code class="literal">smbd</code> 1200 1200 has been started. For this reason, you start Samba. After a few seconds delay, … … 1230 1230 When a positive domain SID has been reported, stop Samba. 1231 1231 </p></li><li><p> 1232 <a class="indexterm" name="id3 40007"></a>1233 <a class="indexterm" name="id3 40014"></a>1234 <a class="indexterm" name="id3 40020"></a>1235 <a class="indexterm" name="id3 40027"></a>1232 <a class="indexterm" name="id362822"></a> 1233 <a class="indexterm" name="id362828"></a> 1234 <a class="indexterm" name="id362835"></a> 1235 <a class="indexterm" name="id362842"></a> 1236 1236 Configure the NFS server for your Linux system. So you can complete the steps that 1237 1237 follow, enter into the <code class="filename">/etc/exports</code> the following entry: … … 1251 1251 Your Samba-3 PDC is now ready to communicate with the LDAP password backend. Let's get on with 1252 1252 configuration of the LDAP server. 1253 </p><div class="example"><a name="sbehap-massive-smbconfa"></a><p class="title"><b>Example 5.6. LDAP Based <code class="filename">smb.conf</code> File, Server: MASSIVE global Section: Part A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id3 40105"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id340117"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id340130"></a><em class="parameter"><code>netbios name = MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id340142"></a><em class="parameter"><code>interfaces = eth1, lo</code></em></td></tr><tr><td><a class="indexterm" name="id340155"></a><em class="parameter"><code>bind interfaces only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id340168"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id340180"></a><em class="parameter"><code>enable privileges = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id340193"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id340206"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id340218"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id340231"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id340243"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id340256"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id340268"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id340281"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id340294"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id340306"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id340319"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id340332"></a><em class="parameter"><code>delete user script = /opt/IDEALX/sbin/smbldap-userdel "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id340345"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd -p "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id340358"></a><em class="parameter"><code>delete group script = /opt/IDEALX/sbin/smbldap-groupdel "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id340371"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/smbldap-groupmod -m "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id340384"></a><em class="parameter"><code>delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id340397"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g "%g" "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id340410"></a><em class="parameter"><code>add machine script = /opt/IDEALX/sbin/smbldap-useradd -w "%u"</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-massive-smbconfb"></a><p class="title"><b>Example 5.7. LDAP Based <code class="filename">smb.conf</code> File, Server: MASSIVE global Section: Part B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id340447"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id340460"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id340472"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id340485"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id340498"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id340510"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id340523"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id340535"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id340548"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id340561"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id340573"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id340586"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id340599"></a><em class="parameter"><code>idmap backend = ldap:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id340612"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id340624"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id340637"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id340649"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id340662"></a><em class="parameter"><code>printer admin = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="sbeidealx"></a>Install and Configure Idealx smbldap-tools Scripts</h3></div></div></div><p>1254 <a class="indexterm" name="id3 40688"></a>1253 </p><div class="example"><a name="sbehap-massive-smbconfa"></a><p class="title"><b>Example 5.6. LDAP Based <code class="filename">smb.conf</code> File, Server: MASSIVE global Section: Part A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id362920"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id362931"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id362943"></a><em class="parameter"><code>netbios name = MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id362954"></a><em class="parameter"><code>interfaces = eth1, lo</code></em></td></tr><tr><td><a class="indexterm" name="id362966"></a><em class="parameter"><code>bind interfaces only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id362977"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id362989"></a><em class="parameter"><code>enable privileges = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id363000"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id363012"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id363024"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id363035"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id363047"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id363058"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id363070"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id363081"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id363093"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id363104"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id363116"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id363128"></a><em class="parameter"><code>delete user script = /opt/IDEALX/sbin/smbldap-userdel "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id363139"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd -p "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id363151"></a><em class="parameter"><code>delete group script = /opt/IDEALX/sbin/smbldap-groupdel "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id363163"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/smbldap-groupmod -m "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id363175"></a><em class="parameter"><code>delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id363187"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g "%g" "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id363200"></a><em class="parameter"><code>add machine script = /opt/IDEALX/sbin/smbldap-useradd -w "%u"</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-massive-smbconfb"></a><p class="title"><b>Example 5.7. LDAP Based <code class="filename">smb.conf</code> File, Server: MASSIVE global Section: Part B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id363236"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id363247"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id363259"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id363270"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id363282"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id363293"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id363304"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id363316"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id363328"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id363339"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id363351"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id363362"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id363374"></a><em class="parameter"><code>idmap backend = ldap:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id363386"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id363397"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id363409"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id363420"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id363432"></a><em class="parameter"><code>printer admin = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="sbeidealx"></a>Install and Configure Idealx smbldap-tools Scripts</h3></div></div></div><p> 1254 <a class="indexterm" name="id363457"></a> 1255 1255 The Idealx scripts, or equivalent, are necessary to permit Samba-3 to manage accounts 1256 1256 on the LDAP server. You have chosen the Idealx scripts because they are the best-known 1257 1257 LDAP configuration scripts. The use of these scripts will help avoid the necessity 1258 1258 to create custom scripts. It is easy to download them from the Idealx 1259 <a href="http://samba.idealx.org/index.en.html" target="_top">Web site</a>. The tarball may1260 be directly <a href="http://samba.idealx.org/dist/smbldap-tools-0.9.1.tgz" target="_top">downloaded</a>1259 <a class="ulink" href="http://samba.idealx.org/index.en.html" target="_top">Web site</a>. The tarball may 1260 be directly <a class="ulink" href="http://samba.idealx.org/dist/smbldap-tools-0.9.1.tgz" target="_top">downloaded</a> 1261 1261 from this site also. Alternatively, you may obtain the 1262 <a href="http://samba.idealx.org/dist/smbldap-tools-0.9.1-1.src.rpm" target="_top">smbldap-tools-0.9.1-1.src.rpm</a>1262 <a class="ulink" href="http://samba.idealx.org/dist/smbldap-tools-0.9.1-1.src.rpm" target="_top">smbldap-tools-0.9.1-1.src.rpm</a> 1263 1263 file that may be used to build an installable RPM package for your Linux system. 1264 1264 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> … … 1269 1269 The scripts are not needed on BDC machines because all LDAP updates are handled by 1270 1270 the PDC alone. 1271 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 40746"></a>Installation of smbldap-tools from the Tarball</h4></div></div></div><p>1271 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id363515"></a>Installation of smbldap-tools from the Tarball</h4></div></div></div><p> 1272 1272 To perform a manual installation of the smbldap-tools scripts, the following procedure may be used: 1273 1273 </p><div class="procedure"><a name="idealxscript"></a><p class="title"><b>Procedure 5.5. Unpacking and Installation Steps for the <code class="constant">smbldap-tools</code> Tarball</b></p><ol type="1"><li><p> … … 1320 1320 </pre><p> 1321 1321 The smbldap-tools scripts are now ready for the configuration step outlined in 1322 <a href="happy.html#smbldap-init" title="Configuration of smbldap-tools">???</a>.1323 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 40981"></a>Installing smbldap-tools from the RPM Package</h4></div></div></div><p>1322 <a class="link" href="happy.html#smbldap-init" title="Configuration of smbldap-tools">“Configuration of smbldap-tools”</a>. 1323 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id363750"></a>Installing smbldap-tools from the RPM Package</h4></div></div></div><p> 1324 1324 In the event that you have elected to use the RPM package provided by Idealx, download the 1325 1325 source RPM <code class="filename">smbldap-tools-0.9.1-1.src.rpm</code>, then follow this procedure: 1326 </p><div class="procedure"><a name="id3 40998"></a><p class="title"><b>Procedure 5.6. Installation Steps for <code class="constant">smbldap-tools</code> RPM's</b></p><ol type="1"><li><p>1326 </p><div class="procedure"><a name="id363767"></a><p class="title"><b>Procedure 5.6. Installation Steps for <code class="constant">smbldap-tools</code> RPM's</b></p><ol type="1"><li><p> 1327 1327 Install the source RPM that has been downloaded as follows: 1328 1328 </p><pre class="screen"> … … 1360 1360 </p></li></ol></div><p> 1361 1361 The Idealx scripts should now be ready for configuration using the steps outlined in 1362 <a href="happy.html#smbldap-init" title="Configuration of smbldap-tools">Configuration of smbldap-tools</a>.1362 <a class="link" href="happy.html#smbldap-init" title="Configuration of smbldap-tools">Configuration of smbldap-tools</a>. 1363 1363 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="smbldap-init"></a>Configuration of smbldap-tools</h4></div></div></div><p> 1364 1364 Prior to use, the smbldap-tools must be configured to match the settings in the <code class="filename">smb.conf</code> file … … 1369 1369 The smbldap-tools require that the NetBIOS name (machine name) of the Samba server be included 1370 1370 in the <code class="filename">smb.conf</code> file. 1371 </p><div class="procedure"><a name="id3 41180"></a><p class="title"><b>Procedure 5.7. Configuration Steps for <code class="constant">smbldap-tools</code> to Enable Use</b></p><ol type="1"><li><p>1371 </p><div class="procedure"><a name="id363949"></a><p class="title"><b>Procedure 5.7. Configuration Steps for <code class="constant">smbldap-tools</code> to Enable Use</b></p><ol type="1"><li><p> 1372 1372 Change into the directory that contains the <code class="filename">configure.pl</code> script. 1373 1373 </p><pre class="screen"> … … 1475 1475 </p></li></ol></div><p> 1476 1476 The smbldap-tools are now ready for use. 1477 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 41324"></a>LDAP Initialization and Creation of User and Group Accounts</h3></div></div></div><p>1477 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id364093"></a>LDAP Initialization and Creation of User and Group Accounts</h3></div></div></div><p> 1478 1478 The LDAP database must be populated with well-known Windows domain user accounts and domain group 1479 1479 accounts before Samba can be used. The following procedures step you through the process. … … 1488 1488 Addition of an account to the LDAP backend can be done in two ways: 1489 1489 </p><div class="itemizedlist"><ul type="disc"><li><p> 1490 <a class="indexterm" name="id3 41352"></a>1491 <a class="indexterm" name="id3 41359"></a>1492 <a class="indexterm" name="id3 41365"></a>1493 <a class="indexterm" name="id3 41372"></a>1494 <a class="indexterm" name="id3 41379"></a>1495 <a class="indexterm" name="id3 41386"></a>1490 <a class="indexterm" name="id364121"></a> 1491 <a class="indexterm" name="id364128"></a> 1492 <a class="indexterm" name="id364134"></a> 1493 <a class="indexterm" name="id364141"></a> 1494 <a class="indexterm" name="id364148"></a> 1495 <a class="indexterm" name="id364155"></a> 1496 1496 If you always have a user account in the <code class="filename">/etc/passwd</code> on every 1497 1497 server or in a NIS(+) backend, it is not necessary to add POSIX accounts for them in … … 1511 1511 is included on the enclosed CD-ROM under <code class="filename">Chap06/Tools.</code> 1512 1512 </p></li></ul></div><p> 1513 <a class="indexterm" name="id3 41437"></a>1513 <a class="indexterm" name="id364206"></a> 1514 1514 If you wish to have more control over how the LDAP database is initialized or 1515 1515 if you don't want to use the Idealx smbldap-tools, you should refer to 1516 <a href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">???</a>, <a href="appendix.html#altldapcfg" title="Alternative LDAP Database Initialization">???</a>.1517 </p><p> 1518 <a class="indexterm" name="id3 41463"></a>1516 <a class="link" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">“A Collection of Useful Tidbits”</a>, <a class="link" href="appendix.html#altldapcfg" title="Alternative LDAP Database Initialization">“Alternative LDAP Database Initialization”</a>. 1517 </p><p> 1518 <a class="indexterm" name="id364232"></a> 1519 1519 The following steps initialize the LDAP database, and then you can add user and group 1520 1520 accounts that Samba can use. You use the <code class="literal">smbldap-populate</code> to 1521 seed the LDAP database. You then manually add the accounts shown in <a href="happy.html#sbehap-bigacct" title="Table 5.3. Abmas Network Users and Groups">???</a>.1521 seed the LDAP database. You then manually add the accounts shown in <a class="link" href="happy.html#sbehap-bigacct" title="Table 5.3. Abmas Network Users and Groups">“Abmas Network Users and Groups”</a>. 1522 1522 The list of users does not cover all 500 network users; it provides examples only. 1523 1523 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 1524 <a class="indexterm" name="id3 41489"></a>1525 <a class="indexterm" name="id3 41498"></a>1526 <a class="indexterm" name="id3 41508"></a>1524 <a class="indexterm" name="id364258"></a> 1525 <a class="indexterm" name="id364267"></a> 1526 <a class="indexterm" name="id364277"></a> 1527 1527 In the following examples, as the LDAP database is initialized, we do create a container 1528 1528 for Computer (machine) accounts. In the Samba-3 <code class="filename">smb.conf</code> files, specific use is made … … 1601 1601 </pre><p> 1602 1602 </p></li><li><p> 1603 <a class="indexterm" name="id3 41886"></a>1603 <a class="indexterm" name="id364655"></a> 1604 1604 So that we can use a global IDMAP repository, the LDAP directory must have a container object for IDMAP data. 1605 1605 There are several ways you can check that your LDAP database is able to receive IDMAP information. One of … … 1610 1610 ou: idmap 1611 1611 </pre><p> 1612 <a class="indexterm" name="id3 41906"></a>1612 <a class="indexterm" name="id364676"></a> 1613 1613 If the execution of this command does not return IDMAP entries, you need to create an LDIF 1614 template file (see <a href="happy.html#sbehap-ldifadd" title="Example 5.12. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF">???</a>). You can add the required entries using1614 template file (see <a class="link" href="happy.html#sbehap-ldifadd" title="Example 5.12. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF">“LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF”</a>). You can add the required entries using 1615 1615 the following command: 1616 1616 </p><pre class="screen"> … … 1620 1620 Samba automatically populates this LDAP directory container when it needs to. 1621 1621 </p></li><li><p> 1622 <a class="indexterm" name="id3 41942"></a>1622 <a class="indexterm" name="id364711"></a> 1623 1623 It looks like all has gone well, as expected. Let's confirm that this is the case 1624 1624 by running a few tests. First we check the contents of the database directly … … 1658 1658 This looks good so far. 1659 1659 </p></li><li><p> 1660 <a class="indexterm" name="id3 41991"></a>1660 <a class="indexterm" name="id364752"></a> 1661 1661 The next step is to prove that the LDAP server is running and responds to a 1662 1662 search request. Execute the following as shown (output has been cut to save space): … … 1703 1703 Good. It is all working just fine. 1704 1704 </p></li><li><p> 1705 <a class="indexterm" name="id3 42032"></a>1705 <a class="indexterm" name="id364793"></a> 1706 1706 You must now make certain that the NSS resolver can interrogate LDAP also. 1707 1707 Execute the following commands: … … 1716 1716 Domain Computers:x:553: 1717 1717 </pre><p> 1718 <a class="indexterm" name="id3 42058"></a>1718 <a class="indexterm" name="id364820"></a> 1719 1719 This demonstrates that the <code class="literal">nss_ldap</code> library is functioning 1720 1720 as it should. If these two steps fail to produce this information, refer to 1721 <a href="happy.html#sbeavoid" title="Avoiding Failures: Solving Problems Before They Happen">???</a> for diagnostic procedures that can be followed to1721 <a class="link" href="happy.html#sbeavoid" title="Avoiding Failures: Solving Problems Before They Happen">“Avoiding Failures: Solving Problems Before They Happen”</a> for diagnostic procedures that can be followed to 1722 1722 isolate the cause of the problem. Proceed to the next step only when the previous steps 1723 1723 have been successfully completed. 1724 1724 </p></li><li><p> 1725 <a class="indexterm" name="id3 42086"></a>1726 <a class="indexterm" name="id3 42093"></a>1727 <a class="indexterm" name="id3 42100"></a>1725 <a class="indexterm" name="id364848"></a> 1726 <a class="indexterm" name="id364854"></a> 1727 <a class="indexterm" name="id364861"></a> 1728 1728 Our database is now ready for the addition of network users. For each user for 1729 1729 whom an account must be created, execute the following: … … 1741 1741 where <code class="constant">username</code> is the login ID for each user. 1742 1742 </p></li><li><p> 1743 <a class="indexterm" name="id3 42158"></a>1743 <a class="indexterm" name="id364919"></a> 1744 1744 Now verify that the UNIX (POSIX) accounts can be resolved via NSS by executing the 1745 1745 following: … … 1769 1769 by system tools that make a getentpw() system call. 1770 1770 </p></li><li><p> 1771 <a class="indexterm" name="id3 42218"></a>1771 <a class="indexterm" name="id364976"></a> 1772 1772 The root account must have UID=0; if not, this means that operations conducted from 1773 1773 a Windows client using tools such as the Domain User Manager fails under UNIX because … … 1803 1803 This is precisely what we want to see. 1804 1804 </p></li><li><p> 1805 <a class="indexterm" name="id3 42306"></a>1806 <a class="indexterm" name="id3 42312"></a>1805 <a class="indexterm" name="id365064"></a> 1806 <a class="indexterm" name="id365070"></a> 1807 1807 The final validation step involves making certain that Samba-3 can obtain the user 1808 1808 accounts from the LDAP ldapsam passwd backend. Execute the following command as shown: … … 1835 1835 This looks good. Of course, you fully expected that it would all work, didn't you? 1836 1836 </p></li><li><p> 1837 <a class="indexterm" name="id3 42355"></a>1837 <a class="indexterm" name="id365105"></a> 1838 1838 Now you add the group accounts that are used on the Abmas network. Execute 1839 1839 the following exactly as shown: … … 1846 1846 output is of no concern. 1847 1847 </p></li><li><p> 1848 <a class="indexterm" name="id3 42394"></a>1848 <a class="indexterm" name="id365145"></a> 1849 1849 You really do want to confirm that UNIX group resolution from LDAP is functioning 1850 1850 as it should. Let's do this as shown here: … … 1863 1863 as our own site-specific group accounts, are correctly listed. This is looking good. 1864 1864 </p></li><li><p> 1865 <a class="indexterm" name="id3 42423"></a>1865 <a class="indexterm" name="id365173"></a> 1866 1866 The final step we need to validate is that Samba can see all the Windows domain groups 1867 1867 and that they are correctly mapped to the respective UNIX group account. To do this, … … 1918 1918 </pre><p> 1919 1919 </p></li><li><p> 1920 <a class="indexterm" name="id3 42620"></a>1920 <a class="indexterm" name="id365370"></a> 1921 1921 You may now check Samba-3 operation as follows: 1922 1922 </p><pre class="screen"> … … 1964 1964 The server <code class="constant">MASSIVE</code> is now configured, and it is time to move onto the next task. 1965 1965 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="sbehap-ptrcfg"></a>Printer Configuration</h3></div></div></div><p> 1966 <a class="indexterm" name="id3 42697"></a>1966 <a class="indexterm" name="id365454"></a> 1967 1967 The configuration for Samba-3 to enable CUPS raw-print-through printing has already been 1968 1968 taken care of in the <code class="filename">smb.conf</code> file. The only preparation needed for <code class="constant">smart</code> 1969 1969 printing to be possible involves creation of the directories in which Samba-3 stores 1970 1970 Windows printing driver files. 1971 </p><div class="procedure"><a name="id3 42717"></a><p class="title"><b>Procedure 5.9. Printer Configuration Steps</b></p><ol type="1"><li><p>1971 </p><div class="procedure"><a name="id365474"></a><p class="title"><b>Procedure 5.9. Printer Configuration Steps</b></p><ol type="1"><li><p> 1972 1972 Configure all network-attached printers to have a fixed IP address. 1973 1973 </p></li><li><p> … … 1975 1975 in both the forward lookup database for the zone <code class="constant">abmas.biz.hosts</code> 1976 1976 and in the reverse lookup database for the network segment that the printer is to 1977 be located in. Example configuration files for similar zones were presented in <a href="secure.html" title="Chapter 3. Secure Office Networking">???</a>,1978 <a href="secure.html#abmasbiz" title="Example 3.14. DNS Abmas.biz Forward Zone File">???</a> and in <a href="secure.html#eth2zone" title="Example 3.13. DNS 192.168.2 Reverse Zone File">???</a>.1977 be located in. Example configuration files for similar zones were presented in <a class="link" href="secure.html" title="Chapter 3. Secure Office Networking">“Secure Office Networking”</a>, 1978 <a class="link" href="secure.html#abmasbiz" title="Example 3.14. DNS Abmas.biz Forward Zone File">“DNS Abmas.biz Forward Zone File”</a> and in <a class="link" href="secure.html#eth2zone" title="Example 3.13. DNS 192.168.2 Reverse Zone File">“DNS 192.168.2 Reverse Zone File”</a>. 1979 1979 </p></li><li><p> 1980 1980 Follow the instructions in the printer manufacturers' manuals to permit printing 1981 1981 to port 9100. Use any other port the manufacturer specifies for direct mode, 1982 1982 raw printing. This allows the CUPS spooler to print using raw mode protocols. 1983 <a class="indexterm" name="id3 42772"></a>1984 <a class="indexterm" name="id3 42778"></a>1983 <a class="indexterm" name="id365529"></a> 1984 <a class="indexterm" name="id365536"></a> 1985 1985 </p></li><li><p> 1986 <a class="indexterm" name="id3 42792"></a>1987 <a class="indexterm" name="id3 42799"></a>1986 <a class="indexterm" name="id365549"></a> 1987 <a class="indexterm" name="id365556"></a> 1988 1988 Only on the server to which the printer is attached, configure the CUPS Print 1989 1989 Queues as follows: … … 1992 1992 -v socket://<em class="parameter"><code>printer-name</code></em>.abmas.biz:9100 -E 1993 1993 </pre><p> 1994 <a class="indexterm" name="id3 42832"></a>1994 <a class="indexterm" name="id365590"></a> 1995 1995 This step creates the necessary print queue to use no assigned print filter. This 1996 1996 is ideal for raw printing, that is, printing without use of filters. … … 2012 2012 </pre><p> 2013 2013 </p></li><li><p> 2014 <a class="indexterm" name="id3 42906"></a>2015 <a class="indexterm" name="id3 42913"></a>2016 <a class="indexterm" name="id3 42920"></a>2014 <a class="indexterm" name="id365664"></a> 2015 <a class="indexterm" name="id365670"></a> 2016 <a class="indexterm" name="id365677"></a> 2017 2017 Edit the file <code class="filename">/etc/cups/mime.convs</code> to uncomment the line: 2018 2018 </p><pre class="screen"> … … 2020 2020 </pre><p> 2021 2021 </p></li><li><p> 2022 <a class="indexterm" name="id3 42946"></a>2022 <a class="indexterm" name="id365703"></a> 2023 2023 Edit the file <code class="filename">/etc/cups/mime.types</code> to uncomment the line: 2024 2024 </p><pre class="screen"> … … 2039 2039 <code class="prompt">root# </code> chmod -R ug=rwx,o=rx /var/lib/samba/drivers 2040 2040 </pre><p> 2041 </p></li></ol></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="sbehap-bldg1"></a>Samba-3 BDC Configuration</h2></div></div></div><div class="procedure"><a name="id3 43026"></a><p class="title"><b>Procedure 5.10. Configuration of BDC Called: <code class="constant">BLDG1</code></b></p><ol type="1"><li><p>2042 Install the files in <a href="happy.html#sbehap-bldg1-smbconf" title="Example 5.8. LDAP Based smb.conf File, Server: BLDG1">???</a>,2043 <a href="happy.html#sbehap-shareconfa" title="Example 5.10. LDAP Based smb.conf File, Shares Section Part A">???</a>, and <a href="happy.html#sbehap-shareconfb" title="Example 5.11. LDAP Based smb.conf File, Shares Section Part B">???</a>2041 </p></li></ol></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="sbehap-bldg1"></a>Samba-3 BDC Configuration</h2></div></div></div><div class="procedure"><a name="id365779"></a><p class="title"><b>Procedure 5.10. Configuration of BDC Called: <code class="constant">BLDG1</code></b></p><ol type="1"><li><p> 2042 Install the files in <a class="link" href="happy.html#sbehap-bldg1-smbconf" title="Example 5.8. LDAP Based smb.conf File, Server: BLDG1">“LDAP Based smb.conf File, Server: BLDG1”</a>, 2043 <a class="link" href="happy.html#sbehap-shareconfa" title="Example 5.10. LDAP Based smb.conf File, Shares Section Part A">“LDAP Based smb.conf File, Shares Section Part A”</a>, and <a class="link" href="happy.html#sbehap-shareconfb" title="Example 5.11. LDAP Based smb.conf File, Shares Section Part B">“LDAP Based smb.conf File, Shares Section Part B”</a> 2044 2044 into the <code class="filename">/etc/samba/</code> directory. The three files 2045 2045 should be added together to form the <code class="filename">smb.conf</code> file. 2046 2046 </p></li><li><p> 2047 Verify the <code class="filename">smb.conf</code> file as in step 2 of <a href="happy.html#sbehap-massive" title="Samba-3 PDC Configuration">???</a>.2048 </p></li><li><p> 2049 Carefully follow the steps outlined in <a href="happy.html#sbehap-PAM-NSS" title="PAM and NSS Client Configuration">???</a>, taking2047 Verify the <code class="filename">smb.conf</code> file as in step 2 of <a class="link" href="happy.html#sbehap-massive" title="Samba-3 PDC Configuration">“Samba-3 PDC Configuration”</a>. 2048 </p></li><li><p> 2049 Carefully follow the steps outlined in <a class="link" href="happy.html#sbehap-PAM-NSS" title="PAM and NSS Client Configuration">“PAM and NSS Client Configuration”</a>, taking 2050 2050 particular note to install the correct <code class="filename">ldap.conf</code>. 2051 2051 </p></li><li><p> … … 2082 2082 This is the correct output. If the accounts that have UIDs above 512 are not shown, there is a problem. 2083 2083 </p></li><li><p> 2084 <a class="indexterm" name="id3 43172"></a>2084 <a class="indexterm" name="id365926"></a> 2085 2085 The next step in the verification process involves testing the operation of UNIX group 2086 2086 resolution via the NSS LDAP resolver. Execute these commands: … … 2112 2112 is able to communicate correctly with the LDAP server (<code class="constant">MASSIVE</code>). 2113 2113 </p></li><li><p> 2114 <a class="indexterm" name="id3 43207"></a>2114 <a class="indexterm" name="id365960"></a> 2115 2115 You must now set the LDAP administrative password into the Samba-3 <code class="filename">secrets.tdb</code> 2116 2116 file by executing this command: … … 2144 2144 This indicates that the domain security account for the BDC has been correctly created. 2145 2145 </p></li><li><p> 2146 <a class="indexterm" name="id3 43296"></a>2146 <a class="indexterm" name="id366050"></a> 2147 2147 Verify that user and group account resolution works via Samba-3 tools as follows: 2148 2148 </p><pre class="screen"> … … 2226 2226 and configure the second BDC server (<code class="constant">BLDG2</code>) as follows: 2227 2227 </p><div class="procedure"><a name="sbehap-bldg2"></a><p class="title"><b>Procedure 5.11. Configuration of BDC Called <code class="constant">BLDG2</code></b></p><ol type="1"><li><p> 2228 Install the files in <a href="happy.html#sbehap-bldg2-smbconf" title="Example 5.9. LDAP Based smb.conf File, Server: BLDG2">???</a>,2229 <a href="happy.html#sbehap-shareconfa" title="Example 5.10. LDAP Based smb.conf File, Shares Section Part A">???</a>, and <a href="happy.html#sbehap-shareconfb" title="Example 5.11. LDAP Based smb.conf File, Shares Section Part B">???</a>2228 Install the files in <a class="link" href="happy.html#sbehap-bldg2-smbconf" title="Example 5.9. LDAP Based smb.conf File, Server: BLDG2">“LDAP Based smb.conf File, Server: BLDG2”</a>, 2229 <a class="link" href="happy.html#sbehap-shareconfa" title="Example 5.10. LDAP Based smb.conf File, Shares Section Part A">“LDAP Based smb.conf File, Shares Section Part A”</a>, and <a class="link" href="happy.html#sbehap-shareconfb" title="Example 5.11. LDAP Based smb.conf File, Shares Section Part B">“LDAP Based smb.conf File, Shares Section Part B”</a> 2230 2230 into the <code class="filename">/etc/samba/</code> directory. The three files 2231 2231 should be added together to form the <code class="filename">smb.conf</code> file. 2232 2232 </p></li><li><p> 2233 Follow carefully the steps shown in <a href="happy.html#sbehap-bldg1" title="Samba-3 BDC Configuration">???</a>, starting at step 2.2234 </p></li></ol></div><div class="example"><a name="sbehap-bldg1-smbconf"></a><p class="title"><b>Example 5.8. LDAP Based <code class="filename">smb.conf</code> File, Server: BLDG1</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id3 43601"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id343614"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id343626"></a><em class="parameter"><code>netbios name = BLDG1</code></em></td></tr><tr><td><a class="indexterm" name="id343639"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id343652"></a><em class="parameter"><code>enable privileges = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id343664"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id343677"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id343690"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id343702"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id343715"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id343727"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id343740"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id343752"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id343765"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id343778"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id343790"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id343803"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id343816"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id343828"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id343841"></a><em class="parameter"><code>wins server = 172.16.0.1</code></em></td></tr><tr><td><a class="indexterm" name="id343853"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id343866"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id343879"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id343891"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id343904"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id343917"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id343929"></a><em class="parameter"><code>idmap backend = ldap:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id343942"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id343955"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id343967"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id343980"></a><em class="parameter"><code>printer admin = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-bldg2-smbconf"></a><p class="title"><b>Example 5.9. LDAP Based <code class="filename">smb.conf</code> File, Server: BLDG2</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id344026"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id344039"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id344051"></a><em class="parameter"><code>netbios name = BLDG2</code></em></td></tr><tr><td><a class="indexterm" name="id344064"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id344076"></a><em class="parameter"><code>enable privileges = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id344089"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id344102"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id344114"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id344127"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id344139"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id344152"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id344164"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id344177"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id344190"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id344202"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id344215"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id344228"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id344240"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id344253"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id344265"></a><em class="parameter"><code>wins server = 172.16.0.1</code></em></td></tr><tr><td><a class="indexterm" name="id344278"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id344291"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id344303"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id344316"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id344329"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id344341"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id344354"></a><em class="parameter"><code>idmap backend = ldap:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id344367"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id344379"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id344392"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id344404"></a><em class="parameter"><code>printer admin = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-shareconfa"></a><p class="title"><b>Example 5.10. LDAP Based <code class="filename">smb.conf</code> File, Shares Section Part A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id344450"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id344463"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id344475"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id344497"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id344509"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id344522"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id344543"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id344556"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id344569"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id344590"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id344603"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id344615"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id344628"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id344649"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id344662"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id344674"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id344687"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id344700"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-shareconfb"></a><p class="title"><b>Example 5.11. LDAP Based <code class="filename">smb.conf</code> File, Shares Section Part B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id344745"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id344758"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id344770"></a><em class="parameter"><code>admin users = bjordan</code></em></td></tr><tr><td><a class="indexterm" name="id344783"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id344804"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id344817"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id344830"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id344842"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id344864"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id344876"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id344889"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id344901"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id344923"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id344935"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id344948"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id344961"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id344982"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id344995"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id345007"></a><em class="parameter"><code>browseable = yes</code></em></td></tr><tr><td><a class="indexterm" name="id345020"></a><em class="parameter"><code>guest ok = no</code></em></td></tr><tr><td><a class="indexterm" name="id345032"></a><em class="parameter"><code>read only = yes</code></em></td></tr><tr><td><a class="indexterm" name="id345045"></a><em class="parameter"><code>write list = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-ldifadd"></a><p class="title"><b>Example 5.12. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF</b></p><div class="example-contents"><pre class="screen">2233 Follow carefully the steps shown in <a class="link" href="happy.html#sbehap-bldg1" title="Samba-3 BDC Configuration">“Samba-3 BDC Configuration”</a>, starting at step 2. 2234 </p></li></ol></div><div class="example"><a name="sbehap-bldg1-smbconf"></a><p class="title"><b>Example 5.8. LDAP Based <code class="filename">smb.conf</code> File, Server: BLDG1</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id366355"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id366366"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id366378"></a><em class="parameter"><code>netbios name = BLDG1</code></em></td></tr><tr><td><a class="indexterm" name="id366389"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id366401"></a><em class="parameter"><code>enable privileges = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id366412"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id366424"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id366435"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id366447"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id366458"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id366470"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id366481"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id366493"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id366504"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id366516"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id366528"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id366539"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id366551"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id366562"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id366574"></a><em class="parameter"><code>wins server = 172.16.0.1</code></em></td></tr><tr><td><a class="indexterm" name="id366585"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id366597"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id366608"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id366620"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id366632"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id366643"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id366655"></a><em class="parameter"><code>idmap backend = ldap:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id366667"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id366678"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id366690"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id366701"></a><em class="parameter"><code>printer admin = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-bldg2-smbconf"></a><p class="title"><b>Example 5.9. LDAP Based <code class="filename">smb.conf</code> File, Server: BLDG2</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id366746"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id366758"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id366769"></a><em class="parameter"><code>netbios name = BLDG2</code></em></td></tr><tr><td><a class="indexterm" name="id366781"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id366792"></a><em class="parameter"><code>enable privileges = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id366804"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id366816"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id366827"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id366838"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id366850"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id366862"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id366873"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id366885"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id366896"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id366908"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id366919"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id366931"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id366942"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id366954"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id366965"></a><em class="parameter"><code>wins server = 172.16.0.1</code></em></td></tr><tr><td><a class="indexterm" name="id366977"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id366988"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id367000"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id367012"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id367023"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id367035"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id367047"></a><em class="parameter"><code>idmap backend = ldap:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id367058"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id367070"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id367081"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id367093"></a><em class="parameter"><code>printer admin = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-shareconfa"></a><p class="title"><b>Example 5.10. LDAP Based <code class="filename">smb.conf</code> File, Shares Section Part A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id367137"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id367149"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id367160"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id367181"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id367192"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id367204"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id367224"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id367236"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id367247"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id367268"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id367279"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id367291"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id367302"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id367323"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id367334"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id367346"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id367357"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id367369"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-shareconfb"></a><p class="title"><b>Example 5.11. LDAP Based <code class="filename">smb.conf</code> File, Shares Section Part B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id367413"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id367425"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id367436"></a><em class="parameter"><code>admin users = bjordan</code></em></td></tr><tr><td><a class="indexterm" name="id367448"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id367468"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id367480"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id367491"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id367503"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id367523"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id367534"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id367546"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id367558"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id367578"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id367590"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id367601"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id367613"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id367633"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id367645"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id367656"></a><em class="parameter"><code>browseable = yes</code></em></td></tr><tr><td><a class="indexterm" name="id367668"></a><em class="parameter"><code>guest ok = no</code></em></td></tr><tr><td><a class="indexterm" name="id367679"></a><em class="parameter"><code>read only = yes</code></em></td></tr><tr><td><a class="indexterm" name="id367691"></a><em class="parameter"><code>write list = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-ldifadd"></a><p class="title"><b>Example 5.12. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF</b></p><div class="example-contents"><pre class="screen"> 2235 2235 dn: ou=Idmap,dc=abmas,dc=biz 2236 2236 objectClass: organizationalUnit 2237 2237 ou: idmap 2238 2238 structuralObjectClass: organizationalUnit 2239 </pre></div></div><br class="example-break"></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 45079"></a>Miscellaneous Server Preparation Tasks</h2></div></div></div><p>2239 </pre></div></div><br class="example-break"></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id367724"></a>Miscellaneous Server Preparation Tasks</h2></div></div></div><p> 2240 2240 My father would say, “<span class="quote">Dinner is not over until the dishes have been done.</span>” 2241 2241 The makings of a great network environment take a lot of effort and attention to detail. … … 2244 2244 a few more steps that must be completed so that your network runs like a well-rehearsed 2245 2245 orchestra. 2246 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 45095"></a>Configuring Directory Share Point Roots</h3></div></div></div><p>2246 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id367740"></a>Configuring Directory Share Point Roots</h3></div></div></div><p> 2247 2247 In your <code class="filename">smb.conf</code> file, you have specified Windows shares. Each has a <em class="parameter"><code>path</code></em> 2248 2248 parameter. Even though it is obvious to all, one of the common Samba networking problems is … … 2262 2262 <code class="prompt">root# </code> chmod -R ug+rwx,o+rx-w /apps 2263 2263 </pre><p> 2264 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 45184"></a>Configuring Profile Directories</h3></div></div></div><p>2264 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id367829"></a>Configuring Profile Directories</h3></div></div></div><p> 2265 2265 You made a conscious decision to do everything it would take to improve network client 2266 2266 performance. One of your decisions was to implement folder redirection. This means that Windows … … 2287 2287 </pre><p> 2288 2288 </p><p> 2289 <a class="indexterm" name="id3 45294"></a>2290 <a class="indexterm" name="id3 45300"></a>2289 <a class="indexterm" name="id367938"></a> 2290 <a class="indexterm" name="id367945"></a> 2291 2291 You have three options insofar as the dynamically loaded portion of the roaming profile 2292 2292 is concerned: … … 2296 2296 that is, just by changing the filename extension. 2297 2297 </p><p> 2298 <a class="indexterm" name="id3 45346"></a>2299 <a class="indexterm" name="id3 45353"></a>2298 <a class="indexterm" name="id367990"></a> 2299 <a class="indexterm" name="id367997"></a> 2300 2300 The location of the profile that a user can obtain is set in the user's account in the LDAP passdb backend. 2301 2301 You can manage this using the Idealx smbldap-tools or using the 2302 <a href="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE" target="_top">Windows NT4 Domain User Manager</a>.2302 <a class="ulink" href="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE" target="_top">Windows NT4 Domain User Manager</a>. 2303 2303 </p><p> 2304 2304 It may not be obvious that you must ensure that the root directory for the user's profile exists … … 2310 2310 <code class="prompt">root# </code> chmod 700 /var/lib/samba/profiles/<span class="emphasis"><em>username</em></span> 2311 2311 </pre><p> 2312 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 45412"></a>Preparation of Logon Scripts</h3></div></div></div><p>2313 <a class="indexterm" name="id3 45420"></a>2312 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id368057"></a>Preparation of Logon Scripts</h3></div></div></div><p> 2313 <a class="indexterm" name="id368065"></a> 2314 2314 The use of a logon script with Windows XP Professional is an option that every site should consider. 2315 2315 Unless you have locked down the desktop so the user cannot change anything, there is risk that … … 2335 2335 You should research the options for logon script implementation by referring to <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 24, 2336 2336 Section 24.4. A quick Web search will bring up a host of options. One of the most popular logon 2337 facilities in use today is called <a href="http://www.kixtart.org" target="_top">KiXtart</a>.2338 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 45510"></a>Assigning User Rights and Privileges</h3></div></div></div><p>2337 facilities in use today is called <a class="ulink" href="http://www.kixtart.org" target="_top">KiXtart</a>. 2338 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id368155"></a>Assigning User Rights and Privileges</h3></div></div></div><p> 2339 2339 The ability to perform tasks such as joining Windows clients to the domain can be assigned to 2340 2340 normal user accounts. By default, only the domain administrator account (<code class="constant">root</code> on UNIX … … 2348 2348 are granted rights can be restricted to particular machines. It is left to the network administrator 2349 2349 to determine which rights should be provided and to whom. 2350 </p><div class="procedure"><a name="id3 45539"></a><p class="title"><b>Procedure 5.12. Steps for Assignment of User Rights and Privileges</b></p><ol type="1"><li><p>2350 </p><div class="procedure"><a name="id368184"></a><p class="title"><b>Procedure 5.12. Steps for Assignment of User Rights and Privileges</b></p><ol type="1"><li><p> 2351 2351 Log onto the PDC as the <code class="constant">root</code> account. 2352 2352 </p></li><li><p> … … 2406 2406 SeDiskOperatorPrivilege 2407 2407 </pre><p> 2408 </p></li></ol></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 45624"></a>Windows Client Configuration</h2></div></div></div><p>2409 <a class="indexterm" name="id3 45632"></a>2408 </p></li></ol></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id368268"></a>Windows Client Configuration</h2></div></div></div><p> 2409 <a class="indexterm" name="id368276"></a> 2410 2410 In the next few sections, you can configure a new Windows XP Professional disk image on a staging 2411 2411 machine. You will configure all software, printer settings, profile and policy handling, and desktop … … 2416 2416 Much can be learned from the Microsoft Support site regarding how best to set up shared profiles. 2417 2417 One knowledge-base article in particular stands out: 2418 "<a href="http://support.microsoft.com/default.aspx?scid=kb;EN-US;168475" target="_top">How to Create a2418 "<a class="ulink" href="http://support.microsoft.com/default.aspx?scid=kb;EN-US;168475" target="_top">How to Create a 2419 2419 Base Profile for All Users."</a> 2420 2420 2421 2421 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="redirfold"></a>Configuration of Default Profile with Folder Redirection</h3></div></div></div><p> 2422 <a class="indexterm" name="id3 45675"></a>2422 <a class="indexterm" name="id368320"></a> 2423 2423 Log onto the Windows XP Professional workstation as the local <code class="constant">Administrator</code>. 2424 2424 It is necessary to expose folders that are generally hidden to provide access to the 2425 2425 <code class="constant">Default User</code> folder. 2426 </p><div class="procedure"><a name="id3 45692"></a><p class="title"><b>Procedure 5.13. Expose Hidden Folders</b></p><ol type="1"><li><p>2426 </p><div class="procedure"><a name="id368336"></a><p class="title"><b>Procedure 5.13. Expose Hidden Folders</b></p><ol type="1"><li><p> 2427 2427 Launch the Windows Explorer by clicking 2428 2428 <span class="guimenu">Start</span> → <span class="guimenuitem">My Computer</span> → <span class="guimenuitem">Tools</span> → <span class="guimenuitem">Folder Options</span> → <span class="guimenuitem">View Tab</span>. … … 2430 2430 and click <span class="guibutton">OK</span>. Exit Windows Explorer. 2431 2431 </p></li><li><p> 2432 <a class="indexterm" name="id3 45756"></a>2432 <a class="indexterm" name="id368401"></a> 2433 2433 Launch the Registry Editor. Click 2434 2434 <span class="guimenu">Start</span> → <span class="guimenuitem">Run</span>. Key in <code class="literal">regedt32</code>, and click … … 2436 2436 </p></li></ol></div><p> 2437 2437 </p><div class="procedure"><a name="sbehap-rdrfldr"></a><p class="title"><b>Procedure 5.14. Redirect Folders in Default System User Profile</b></p><ol type="1"><li><p> 2438 <a class="indexterm" name="id3 45813"></a>2439 <a class="indexterm" name="id3 45820"></a>2438 <a class="indexterm" name="id368457"></a> 2439 <a class="indexterm" name="id368464"></a> 2440 2440 Give focus to <code class="constant">HKEY_LOCAL_MACHINE</code> hive entry in the left panel. 2441 2441 Click <span class="guimenu">File</span> → <span class="guimenuitem">Load Hive...</span> → <span class="guimenuitem">Documents and Settings</span> → <span class="guimenuitem">Default User</span> → <span class="guimenuitem">NTUSER</span> → <span class="guimenuitem">Open</span>. In the dialog box that opens, enter the key name … … 2447 2447 CurrentVersion\Explorer\User Shell Folders\ 2448 2448 </pre><p> 2449 The right panel reveals the contents as shown in <a href="happy.html#XP-screen001" title="Figure 5.3. Windows XP Professional User Shared Folders">???</a>.2450 </p></li><li><p> 2451 <a class="indexterm" name="id3 45908"></a>2452 <a class="indexterm" name="id3 45915"></a>2449 The right panel reveals the contents as shown in <a class="link" href="happy.html#XP-screen001" title="Figure 5.3. Windows XP Professional User Shared Folders">“Windows XP Professional User Shared Folders”</a>. 2450 </p></li><li><p> 2451 <a class="indexterm" name="id368553"></a> 2452 <a class="indexterm" name="id368559"></a> 2453 2453 You edit hive keys. Acceptable values to replace the 2454 2454 <code class="constant">%USERPROFILE%</code> variable includes: … … 2457 2457 <code class="constant">\\MASSIVE\profdata</code></p></li><li><p>A network redirection (UNC name) that contains a macro such as </p><p><code class="constant">%LOGONSERVER%\profdata\</code></p></li></ul></div><p> 2458 2458 </p></li><li><p> 2459 <a class="indexterm" name="id3 45959"></a>2460 Set the registry keys as shown in <a href="happy.html#proffold" title="Table 5.4. Default Profile Redirections">???</a>. Your implementation makes the assumption2459 <a class="indexterm" name="id368604"></a> 2460 Set the registry keys as shown in <a class="link" href="happy.html#proffold" title="Table 5.4. Default Profile Redirections">“Default Profile Redirections”</a>. Your implementation makes the assumption 2461 2461 that users have statically located machines. Notebook computers (mobile users) need to be 2462 2462 accommodated using local profiles. This is not an uncommon assumption. … … 2465 2465 Click <span class="guimenu">File</span> → <span class="guimenuitem">Unload Hive...</span> → <span class="guimenuitem">Yes</span>. 2466 2466 </p></li><li><p> 2467 <a class="indexterm" name="id3 46011"></a>2467 <a class="indexterm" name="id368656"></a> 2468 2468 Click <span class="guimenu">File</span> → <span class="guimenuitem">Exit</span>. This exits the 2469 2469 Registry Editor. 2470 2470 </p></li><li><p> 2471 Now follow the procedure given in <a href="happy.html#sbehap-locgrppol" title="The Local Group Policy">???</a>. Make sure that each folder you2471 Now follow the procedure given in <a class="link" href="happy.html#sbehap-locgrppol" title="The Local Group Policy">“The Local Group Policy”</a>. Make sure that each folder you 2472 2472 have redirected is in the exclusion list. 2473 2473 </p></li><li><p> 2474 You are now ready to copy<sup>[<a name="id3 46053" href="#ftn.id346053">11</a>]</sup>2474 You are now ready to copy<sup>[<a name="id368697" href="#ftn.id368697" class="footnote">11</a>]</sup> 2475 2475 the Default User profile to the Samba domain controllers. Launch Microsoft Windows Explorer, 2476 2476 and use it to copy the full contents of the directory <code class="filename">Default User</code> that … … 2483 2483 desktop behavior should be returned to the original Microsoft settings. The following steps achieve 2484 2484 that ojective: 2485 </p><div class="procedure"><a name="id3 46112"></a><p class="title"><b>Procedure 5.15. Reset Folder Display to Original Behavior</b></p><ul><li><p>2485 </p><div class="procedure"><a name="id368757"></a><p class="title"><b>Procedure 5.15. Reset Folder Display to Original Behavior</b></p><ul><li><p> 2486 2486 To launch the Windows Explorer, click 2487 2487 <span class="guimenu">Start</span> → <span class="guimenuitem">My Computer</span> → <span class="guimenuitem">Tools</span> → <span class="guimenuitem">Folder Options</span> → <span class="guimenuitem">View Tab</span>. 2488 2488 Deselect <span class="guilabel">Show hidden files and folders</span>, and click <span class="guibutton">OK</span>. 2489 2489 Exit Windows Explorer. 2490 </p></li></ul></div><div class="figure"><a name="XP-screen001"></a><p class="title"><b>Figure 5.3. Windows XP Professional User Shared Folders</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/XP-screen001.png" width="351" alt="Windows XP Professional User Shared Folders"></div></div></div><br class="figure-break"><div class="table"><a name="proffold"></a><p class="title"><b>Table 5.4. Default Profile Redirections</b></p><div class="table-contents"><table summary="Default Profile Redirections" border="1"><colgroup><col align="left"><col align="left"></colgroup><thead><tr><th align="left">Registry Key</th><th align="left">Redirected Value</th></tr></thead><tbody><tr><td align="left">Cache</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\InternetFiles</td></tr><tr><td align="left">Cookies</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\Cookies</td></tr><tr><td align="left">History</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\History</td></tr><tr><td align="left">Local AppData</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\AppData</td></tr><tr><td align="left">Local Settings</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\LocalSettings</td></tr><tr><td align="left">My Pictures</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\MyPictures</td></tr><tr><td align="left">Personal</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\MyDocuments</td></tr><tr><td align="left">Recent</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\Recent</td></tr></tbody></table></div></div><br class="table-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 46340"></a>Configuration of MS Outlook to Relocate PST File</h3></div></div></div><p>2491 <a class="indexterm" name="id3 46348"></a>2492 <a class="indexterm" name="id3 46357"></a>2490 </p></li></ul></div><div class="figure"><a name="XP-screen001"></a><p class="title"><b>Figure 5.3. Windows XP Professional User Shared Folders</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/XP-screen001.png" width="351" alt="Windows XP Professional User Shared Folders"></div></div></div><br class="figure-break"><div class="table"><a name="proffold"></a><p class="title"><b>Table 5.4. Default Profile Redirections</b></p><div class="table-contents"><table summary="Default Profile Redirections" border="1"><colgroup><col align="left"><col align="left"></colgroup><thead><tr><th align="left">Registry Key</th><th align="left">Redirected Value</th></tr></thead><tbody><tr><td align="left">Cache</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\InternetFiles</td></tr><tr><td align="left">Cookies</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\Cookies</td></tr><tr><td align="left">History</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\History</td></tr><tr><td align="left">Local AppData</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\AppData</td></tr><tr><td align="left">Local Settings</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\LocalSettings</td></tr><tr><td align="left">My Pictures</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\MyPictures</td></tr><tr><td align="left">Personal</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\MyDocuments</td></tr><tr><td align="left">Recent</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\Recent</td></tr></tbody></table></div></div><br class="table-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id368985"></a>Configuration of MS Outlook to Relocate PST File</h3></div></div></div><p> 2491 <a class="indexterm" name="id368993"></a> 2492 <a class="indexterm" name="id369002"></a> 2493 2493 Microsoft Outlook can store a Personal Storage file, generally known as a PST file. 2494 2494 It is the nature of email storage that this file grows, at times quite rapidly. … … 2499 2499 To redirect the Outlook PST file in Outlook 2003 (older versions of Outlook behave 2500 2500 slightly differently), follow these steps: 2501 </p><div class="procedure"><a name="id3 46375"></a><p class="title"><b>Procedure 5.16. Outlook PST File Relocation</b></p><ol type="1"><li><p>2501 </p><div class="procedure"><a name="id369020"></a><p class="title"><b>Procedure 5.16. Outlook PST File Relocation</b></p><ol type="1"><li><p> 2502 2502 Close Outlook if it is open. 2503 2503 </p></li><li><p> … … 2529 2529 Go back to the <span class="guimenu">Data Files</span> window, then delete the old data file entry. 2530 2530 </p></li></ol></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 2531 <a class="indexterm" name="id3 46514"></a>2531 <a class="indexterm" name="id369159"></a> 2532 2532 You may have to remove and reinstall the Outlook Address Book (Contacts) entries, otherwise 2533 2533 the user may be not be able to retrieve contacts when addressing a new email message. 2534 2534 </p></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 2535 <a class="indexterm" name="id3 46527"></a>2535 <a class="indexterm" name="id369172"></a> 2536 2536 Outlook Express is not at all like MS OutLook. It stores file very differently also. Outlook 2537 2537 Express storage files can not be redirected to network shares. The options panel will not permit … … 2542 2542 registry, experience has shown that data corruption and loss of email messages will result. 2543 2543 </p><p> 2544 <a class="indexterm" name="id3 46545"></a>2545 <a class="indexterm" name="id3 46552"></a>2544 <a class="indexterm" name="id369190"></a> 2545 <a class="indexterm" name="id369196"></a> 2546 2546 In the same vane as MS Outlook, Outlook Express data stores can become very large. When used with 2547 2547 roaming profiles this can result in excruciatingly long login and logout behavior will files are … … 2549 2549 profiles are used. 2550 2550 </p></div><p> 2551 <a class="indexterm" name="id3 46565"></a>2551 <a class="indexterm" name="id369209"></a> 2552 2552 Microsoft does not support storing PST files on network shares, although the practice does appear 2553 2553 to be rather popular. Anyone who does relocation the PST file to a network resource should refer 2554 the Microsoft <a href="http://support.microsoft.com/kb/297019/" target="_top">reference</a> to better2554 the Microsoft <a class="ulink" href="http://support.microsoft.com/kb/297019/" target="_top">reference</a> to better 2555 2555 understand the issues. 2556 2556 </p><p> 2557 <a class="indexterm" name="id3 46583"></a>2557 <a class="indexterm" name="id369227"></a> 2558 2558 Apart from manually moving PST files to a network share, it is possible to set the default PST 2559 location for new accounts by following the instructions at the WindowsITPro <a href="http://www.windowsitpro.com/Windows/Article/ArticleID/48228/48228.html" target="_top">web</a> site.2560 </p><p> 2561 <a class="indexterm" name="id3 46601"></a>2559 location for new accounts by following the instructions at the WindowsITPro <a class="ulink" href="http://www.windowsitpro.com/Windows/Article/ArticleID/48228/48228.html" target="_top">web</a> site. 2560 </p><p> 2561 <a class="indexterm" name="id369245"></a> 2562 2562 User feedback suggests that disabling of oplocks on PST files will significantly improve 2563 2563 network performance by reducing locking overheads. One way this can be done is to add to the … … 2566 2566 veto oplock files = /*.pdf/*.PST/ 2567 2567 </pre><p> 2568 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 46624"></a>Configure Delete Cached Profiles on Logout</h3></div></div></div><p>2568 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id369268"></a>Configure Delete Cached Profiles on Logout</h3></div></div></div><p> 2569 2569 Configure the Windows XP Professional client to auto-delete roaming profiles on logout: 2570 2570 </p><p> 2571 <a class="indexterm" name="id3 46636"></a>2571 <a class="indexterm" name="id369280"></a> 2572 2572 Click 2573 2573 <span class="guimenu">Start</span> → <span class="guimenuitem">Run</span>. In the dialog box, enter <code class="literal">MMC</code> and click <span class="guibutton">OK</span>. … … 2577 2577 <span class="guimenu">File</span> → <span class="guimenuitem">Add/Remove Snap-in</span> → <span class="guimenuitem">Add</span> → <span class="guimenuitem">Group Policy</span> → <span class="guimenuitem">Add</span> → <span class="guimenuitem">Finish</span> → <span class="guimenuitem">Close</span> → <span class="guimenuitem">OK</span>. 2578 2578 </p><p> 2579 <a class="indexterm" name="id3 46729"></a>2579 <a class="indexterm" name="id369374"></a> 2580 2580 The Microsoft Management Console now shows the <span class="guimenu">Group Policy</span> 2581 2581 utility that enables you to set the policies needed. In the left panel, click … … 2585 2585 Close the Microsoft Management Console. The settings take immediate effect and persist onto all image copies 2586 2586 made of this system to deploy the new standard desktop system. 2587 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 46795"></a>Uploading Printer Drivers to Samba Servers</h3></div></div></div><p>2588 <a class="indexterm" name="id3 46803"></a>2587 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id369439"></a>Uploading Printer Drivers to Samba Servers</h3></div></div></div><p> 2588 <a class="indexterm" name="id369447"></a> 2589 2589 Users want to be able to use network printers. You have a vested interest in making 2590 2590 it easy for them to print. You have chosen to install the printer drivers onto the Samba … … 2593 2593 print to the printer chosen. The following procedure must be followed for every network 2594 2594 printer: 2595 </p><div class="procedure"><a name="id3 46817"></a><p class="title"><b>Procedure 5.17. Steps to Install Printer Drivers on the Samba Servers</b></p><ol type="1"><li><p>2595 </p><div class="procedure"><a name="id369462"></a><p class="title"><b>Procedure 5.17. Steps to Install Printer Drivers on the Samba Servers</b></p><ol type="1"><li><p> 2596 2596 Join your Windows XP Professional workstation (the staging machine) to the 2597 2597 <code class="constant">MEGANET2</code> domain. If you are not sure of the procedure, 2598 follow the guidance given in <a href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">???</a>, <a href="appendix.html#domjoin" title="Joining a Domain: Windows 200x/XP Professional">???</a>.2598 follow the guidance given in <a class="link" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">“A Collection of Useful Tidbits”</a>, <a class="link" href="appendix.html#domjoin" title="Joining a Domain: Windows 200x/XP Professional">“Joining a Domain: Windows 200x/XP Professional”</a>. 2599 2599 </p></li><li><p> 2600 2600 After the machine has rebooted, log onto the workstation as the domain … … 2618 2618 button that is next to the <span class="guimenu">Driver</span> box. This launches the “<span class="quote">Add Printer Wizard</span>”. 2619 2619 </p></li><li><p> 2620 <a class="indexterm" name="id3 46996"></a>2621 <a class="indexterm" name="id3 47005"></a>2620 <a class="indexterm" name="id369641"></a> 2621 <a class="indexterm" name="id369650"></a> 2622 2622 The “<span class="quote">Add Printer Driver Wizard on <code class="constant">MASSIVE</code></span>” panel 2623 2623 is now presented. Click <span class="guimenu">Next</span> to continue. From the left panel, select the … … 2628 2628 directed at the network server <code class="constant">\\massive\ps01-color</code>. 2629 2629 </p></li><li><p> 2630 <a class="indexterm" name="id3 47050"></a>2631 <a class="indexterm" name="id3 47059"></a>2632 <a class="indexterm" name="id3 47068"></a>2633 <a class="indexterm" name="id3 47077"></a>2634 <a class="indexterm" name="id3 47087"></a>2635 <a class="indexterm" name="id3 47096"></a>2630 <a class="indexterm" name="id369694"></a> 2631 <a class="indexterm" name="id369704"></a> 2632 <a class="indexterm" name="id369713"></a> 2633 <a class="indexterm" name="id369722"></a> 2634 <a class="indexterm" name="id369731"></a> 2635 <a class="indexterm" name="id369740"></a> 2636 2636 The driver upload completes in anywhere from a few seconds to a few minutes. When it completes, 2637 2637 you are returned to the <span class="guimenu">Advanced</span> tab in the <span class="guimenu">Properties</span> panel. … … 2642 2642 (Applicable to Active Directory use only.) 2643 2643 </p></li><li><p> 2644 <a class="indexterm" name="id3 47146"></a>2644 <a class="indexterm" name="id369791"></a> 2645 2645 Click <span class="guimenu">OK</span>. It will take a minute or so to upload the settings to the server. 2646 2646 You are now returned to the <span class="guimenu">Printers and Faxes on Massive</span> monitor. … … 2654 2654 click <span class="guimenu">Apply</span> again. 2655 2655 </p></li><li><p> 2656 <a class="indexterm" name="id3 47214"></a>2656 <a class="indexterm" name="id369858"></a> 2657 2657 Verify that all printer settings are at the desired configuration. When you are satisfied that they are, 2658 2658 click the <span class="guimenu">General</span> tab. Now click the <span class="guimenu">Print Test Page</span> button. … … 2664 2664 When you have finished uploading drivers to all printers, close all applications. The next task 2665 2665 is to install software your users require to do their work. 2666 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 47264"></a>Software Installation</h3></div></div></div><p>2666 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id369909"></a>Software Installation</h3></div></div></div><p> 2667 2667 Your network has both fixed desktop workstations as well as notebook computers. As a general rule, it is 2668 2668 a good idea to not tamper with the operating system that is provided by the notebook computer manufacturer. … … 2679 2679 and migrate that to the Samba server for later reuse when creating custom mandatory profiles, just in 2680 2680 case a user may have specific needs you had not anticipated. 2681 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 47290"></a>Roll-out Image Creation</h3></div></div></div><p>2681 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id369934"></a>Roll-out Image Creation</h3></div></div></div><p> 2682 2682 The final steps before preparing the distribution Norton Ghost image file you might follow are: 2683 2683 </p><div class="blockquote"><blockquote class="blockquote"><p> … … 2688 2688 in better performance and often significantly reduces the size of the compressed disk image. That 2689 2689 also means it will take less time to deploy the image onto 500 workstations. 2690 </p></blockquote></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 47320"></a>Key Points Learned</h2></div></div></div><p>2690 </p></blockquote></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id369964"></a>Key Points Learned</h2></div></div></div><p> 2691 2691 This chapter introduced many new concepts. Is it a sad fact that the example presented deliberately 2692 2692 avoided any consideration of security. Security does not just happen; you must design it into your total … … 2697 2697 of compromise. 2698 2698 </p><p> 2699 <a class="indexterm" name="id3 47336"></a>2700 <a class="indexterm" name="id3 47345"></a>2699 <a class="indexterm" name="id369981"></a> 2700 <a class="indexterm" name="id369989"></a> 2701 2701 As a minimum, the LDAP server must be protected by way of Access Control Lists (ACLs), and it must be 2702 2702 configured to use secure protocols for all communications over the network. Of course, secure networking … … 2704 2704 training and, above all, disciplined attention to detail and constant searching for signs of unfriendly 2705 2705 or alien activities. Security is itself a topic for a whole book. Please do consult appropriate sources. 2706 Jerry Carter's book <a href="http://www.booksense.com/product/info.jsp&isbn=1565924916" target="_top">2706 Jerry Carter's book <a class="ulink" href="http://www.booksense.com/product/info.jsp&isbn=1565924916" target="_top"> 2707 2707 <span class="emphasis"><em>LDAP System Administration</em></span></a> is a good place to start reading about OpenLDAP 2708 2708 as well as security considerations. … … 2725 2725 </p></li><li><p> 2726 2726 Use of the CUPS printing system together with Samba-based printer driver auto-download. 2727 </p></li></ul></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 47408"></a>Questions and Answers</h2></div></div></div><p>2727 </p></li></ul></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id370057"></a>Questions and Answers</h2></div></div></div><p> 2728 2728 Well, here we are at the end of this chapter and we have only ten questions to help you to 2729 2729 remember so much. There are bound to be some sticky issues here. 2730 </p><div class="qandaset"><dl><dt> <a href="happy.html#id3 47424">2730 </p><div class="qandaset"><dl><dt> <a href="happy.html#id370074"> 2731 2731 Why did you not cover secure practices? Isn't it rather irresponsible to instruct 2732 2732 network administrators to implement insecure solutions? 2733 </a></dt><dt> <a href="happy.html#id3 47458">2733 </a></dt><dt> <a href="happy.html#id370107"> 2734 2734 You have focused much on SUSE Linux and little on the market leader, Red Hat. Do 2735 2735 you have a problem with Red Hat Linux? Doesn't that make your guidance irrelevant 2736 2736 to the Linux I might be using? 2737 </a></dt><dt> <a href="happy.html#id3 47502">2737 </a></dt><dt> <a href="happy.html#id370149"> 2738 2738 You did not use SWAT to configure Samba. Is there something wrong with it? 2739 </a></dt><dt> <a href="happy.html#id3 47537">2739 </a></dt><dt> <a href="happy.html#id370184"> 2740 2740 You have exposed a well-used password not24get. Is that 2741 2741 not irresponsible? 2742 </a></dt><dt> <a href="happy.html#id3 47559">2742 </a></dt><dt> <a href="happy.html#id370206"> 2743 2743 The Idealx smbldap-tools create many domain group accounts that are not used. Is that 2744 2744 a good thing? 2745 </a></dt><dt> <a href="happy.html#id3 47582">2745 </a></dt><dt> <a href="happy.html#id370229"> 2746 2746 Can I use LDAP just for Samba accounts and not for UNIX system accounts? 2747 </a></dt><dt> <a href="happy.html#id3 47602">2747 </a></dt><dt> <a href="happy.html#id370249"> 2748 2748 Why are the Windows domain RID portions not the same as the UNIX UID? 2749 </a></dt><dt> <a href="happy.html#id3 47634">2749 </a></dt><dt> <a href="happy.html#id370281"> 2750 2750 Printer configuration examples all show printing to the HP port 9100. Does this 2751 2751 mean that I must have HP printers for these solutions to work? 2752 </a></dt><dt> <a href="happy.html#id3 47659">2752 </a></dt><dt> <a href="happy.html#id370306"> 2753 2753 Is folder redirection dangerous? I've heard that you can lose your data that way. 2754 </a></dt><dt> <a href="happy.html#id3 47681">2754 </a></dt><dt> <a href="happy.html#id370327"> 2755 2755 Is it really necessary to set a local Group Policy to exclude the redirected 2756 2756 folders from the roaming profile? 2757 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id3 47424"></a><a name="id347427"></a></td><td align="left" valign="top"><p>2757 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id370074"></a><a name="id370076"></a></td><td align="left" valign="top"><p> 2758 2758 Why did you not cover secure practices? Isn't it rather irresponsible to instruct 2759 2759 network administrators to implement insecure solutions? … … 2774 2774 that you should implement a network without provision for data recovery and for disaster 2775 2775 management? Back to our focus: The deployment of Samba has been clearly demonstrated. 2776 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 47458"></a><a name="id347460"></a></td><td align="left" valign="top"><p>2776 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id370107"></a><a name="id370109"></a></td><td align="left" valign="top"><p> 2777 2777 You have focused much on SUSE Linux and little on the market leader, Red Hat. Do 2778 2778 you have a problem with Red Hat Linux? Doesn't that make your guidance irrelevant … … 2801 2801 features of both products (companies also). No bias in presentation is intended. 2802 2802 Oh, before I forget, I particularly like Debian Linux; that is my favorite playground. 2803 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 47502"></a><a name="id347504"></a></td><td align="left" valign="top"><p>2803 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id370149"></a><a name="id370151"></a></td><td align="left" valign="top"><p> 2804 2804 You did not use SWAT to configure Samba. Is there something wrong with it? 2805 2805 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 2812 2812 and insecure. Many will not touch it with a barge-pole. By not introducing SWAT, I 2813 2813 hope to have brought their interests on board. SWAT is well covered is <span class="emphasis"><em>TOSHARG2</em></span>. 2814 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 47537"></a><a name="id347539"></a></td><td align="left" valign="top"><p>2814 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id370184"></a><a name="id370186"></a></td><td align="left" valign="top"><p> 2815 2815 You have exposed a well-used password <span class="emphasis"><em>not24get</em></span>. Is that 2816 2816 not irresponsible? … … 2819 2819 used throughout. I guess you can figure out that in a real deployment it would make 2820 2820 sense to use a more secure and original password. 2821 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 47559"></a><a name="id347561"></a></td><td align="left" valign="top"><p>2821 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id370206"></a><a name="id370208"></a></td><td align="left" valign="top"><p> 2822 2822 The Idealx smbldap-tools create many domain group accounts that are not used. Is that 2823 2823 a good thing? … … 2827 2827 and, besides, it does no harm to create accounts that are not now used at some time 2828 2828 Samba may well use them. 2829 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 47582"></a><a name="id347584"></a></td><td align="left" valign="top"><p>2829 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id370229"></a><a name="id370231"></a></td><td align="left" valign="top"><p> 2830 2830 Can I use LDAP just for Samba accounts and not for UNIX system accounts? 2831 2831 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 2835 2835 password files in sync? I think that having everything in LDAP makes a lot of sense 2836 2836 for the UNIX administrator who is still learning the craft and is migrating from MS Windows. 2837 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 47602"></a><a name="id347605"></a></td><td align="left" valign="top"><p>2837 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id370249"></a><a name="id370251"></a></td><td align="left" valign="top"><p> 2838 2838 Why are the Windows domain RID portions not the same as the UNIX UID? 2839 2839 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 2844 2844 permit you to override that to some extent. See the <code class="filename">smb.conf</code> man page entry 2845 2845 for <em class="parameter"><code>algorithmic rid base</code></em>. 2846 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 47634"></a><a name="id347636"></a></td><td align="left" valign="top"><p>2846 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id370281"></a><a name="id370283"></a></td><td align="left" valign="top"><p> 2847 2847 Printer configuration examples all show printing to the HP port 9100. Does this 2848 2848 mean that I must have HP printers for these solutions to work? … … 2854 2854 argument to the <code class="constant">lpadmin -v</code> option that is right for your 2855 2855 printer. 2856 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 47659"></a><a name="id347661"></a></td><td align="left" valign="top"><p>2856 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id370306"></a><a name="id370308"></a></td><td align="left" valign="top"><p> 2857 2857 Is folder redirection dangerous? I've heard that you can lose your data that way. 2858 2858 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 2864 2864 folder. That was not the case, so by declining to move the data back, he wiped out 2865 2865 the data. You cannot hold the tool responsible for that. Caveat emptor still applies. 2866 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 47681"></a><a name="id347683"></a></td><td align="left" valign="top"><p>2866 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id370327"></a><a name="id370330"></a></td><td align="left" valign="top"><p> 2867 2867 Is it really necessary to set a local Group Policy to exclude the redirected 2868 2868 folders from the roaming profile? … … 2870 2870 Yes. If you do not do this, the data will still be copied from the network folder 2871 2871 (share) to the local cached copy of the profile. 2872 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id3 46053" href="#id346053">11</a>] </sup>2872 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id368697" href="#id368697" class="para">11</a>] </sup> 2873 2873 There is an alternate method by which a default user profile can be added to the 2874 2874 <code class="constant">NETLOGON</code> share. This facility in the Windows System tool -
branches/samba-3.0/docs/htmldocs/Samba3-ByExample/index.html
r44 r134 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Samba-3 by Example</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="next" href="pr01.html" title="About the Cover Artwork"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Samba-3 by Example</th></tr><tr><td width="20%" align="left"> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="pr01.html">Next</a></td></tr></table><hr></div><div class="book" lang="en"><div class="titlepage"><div><div><h1 class="title"><a name="S3bE"></a>Samba-3 by Example</h1></div><div><h2 class="subtitle">Practical Exercises in Successful Samba Deployment</h2></div><div><div class="authorgroup"><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div></div><div><p class="pubdate">July, 2006</p></div></div><hr></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="preface"><a href="pr01.html">About the Cover Artwork</a></span></dt><dt><span class="preface"><a href="pr02.html">Acknowledgments</a></span></dt><dt><span class="preface"><a href="pr03.html">Foreword</a></span></dt><dd><dl><dt><span class="sect1"><a href="pr03.html#id275401">By John M. Weathersby, Executive Director, OSSI</a></span></dt></dl></dd><dt><span class="preface"><a href="preface.html">Preface</a></span></dt><dd><dl><dt><span class="sect1"><a href="preface.html#id274305">Why Is This Book Necessary?</a></span></dt><dd><dl><dt><span class="sect2"><a href="preface.html#id274342">Samba 3.0.20 Update Edition</a></span></dt></dl></dd><dt><span class="sect1"><a href="preface.html#id274092">Prerequisites</a></span></dt><dt><span class="sect1"><a href="preface.html#id315668">Approach</a></span></dt><dt><span class="sect1"><a href="preface.html#id315719">Summary of Topics</a></span></dt><dt><span class="sect1"><a href="preface.html#id316343">Conventions Used</a></span></dt></dl></dd><dt><span class="part"><a href="ExNetworks.html">I. Example Network Configurations</a></span></dt><dd><dl><dt><span class="chapter"><a href="simple.html">1. No-Frills Samba Servers</a></span></dt><dd><dl><dt><span class="sect1"><a href="simple.html#id316528">Introduction</a></span></dt><dt><span class="sect1"><a href="simple.html#id316559">Assignment Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="simple.html#id316598">Drafting Office</a></span></dt><dt><span class="sect2"><a href="simple.html#id317306">Charity Administration Office</a></span></dt><dt><span class="sect2"><a href="simple.html#AccountingOffice">Accounting Office</a></span></dt></dl></dd><dt><span class="sect1"><a href="simple.html#id320818">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="small.html">2. Small Office Networking</a></span></dt><dd><dl><dt><span class="sect1"><a href="small.html#id321229">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id321247">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id321293">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id321342">Technical Issues</a></span></dt><dt><span class="sect2"><a href="small.html#id321528">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id321546">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id323199">Validation</a></span></dt><dt><span class="sect2"><a href="small.html#id323822">Notebook Computers: A Special Case</a></span></dt><dt><span class="sect2"><a href="small.html#id323841">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id323907">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="secure.html">3. Secure Office Networking</a></span></dt><dd><dl><dt><span class="sect1"><a href="secure.html#id324364">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id324404">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id324626">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id324638">Technical Issues</a></span></dt><dt><span class="sect2"><a href="secure.html#id325007">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id325041">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#ch4bsc">Basic System Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id325866">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4ptrcfg">Printer Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4valid">Validation</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4appscfg">Application Share Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id330151">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id330204">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="Big500users.html">4. The 500-User Office</a></span></dt><dd><dl><dt><span class="sect1"><a href="Big500users.html#id330645">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id330675">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id330756">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id330784">Technical Issues</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id330961">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id330980">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#ch5-dnshcp-setup">Installation of DHCP, DNS, and Samba Control Files</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id331694">Server Preparation: All Servers</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id332210">Server-Specific Preparation</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5-procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id335273">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id335326">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="happy.html">5. Making Happy Users</a></span></dt><dd><dl><dt><span class="sect1"><a href="happy.html#id336072">Regarding LDAP Directories and Windows Computer Accounts</a></span></dt><dt><span class="sect1"><a href="happy.html#id336196">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id336272">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id336400">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id336802">Technical Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id338453">Political Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id338466">Installation Checklist</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id338636">Samba Server Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbeidealx">Install and Configure Idealx smbldap-tools Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id341324">LDAP Initialization and Creation of User and Group Accounts</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-ptrcfg">Printer Configuration</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a></span></dt><dt><span class="sect1"><a href="happy.html#id345079">Miscellaneous Server Preparation Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id345095">Configuring Directory Share Point Roots</a></span></dt><dt><span class="sect2"><a href="happy.html#id345184">Configuring Profile Directories</a></span></dt><dt><span class="sect2"><a href="happy.html#id345412">Preparation of Logon Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id345510">Assigning User Rights and Privileges</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id345624">Windows Client Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></span></dt><dt><span class="sect2"><a href="happy.html#id346340">Configuration of MS Outlook to Relocate PST File</a></span></dt><dt><span class="sect2"><a href="happy.html#id346624">Configure Delete Cached Profiles on Logout</a></span></dt><dt><span class="sect2"><a href="happy.html#id346795">Uploading Printer Drivers to Samba Servers</a></span></dt><dt><span class="sect2"><a href="happy.html#id347264">Software Installation</a></span></dt><dt><span class="sect2"><a href="happy.html#id347290">Roll-out Image Creation</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id347320">Key Points Learned</a></span></dt><dt><span class="sect1"><a href="happy.html#id347408">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="2000users.html">6. A Distributed 2000-User Network</a></span></dt><dd><dl><dt><span class="sect1"><a href="2000users.html#id347742">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id347767">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id347824">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id348070">Technical Issues</a></span></dt><dt><span class="sect2"><a href="2000users.html#id348898">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id348912">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id352072">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id352211">Questions and Answers</a></span></dt></dl></dd></dl></dd><dt><span class="part"><a href="DMSMig.html">II. Domain Members, Updating Samba and Migration</a></span></dt><dd><dl><dt><span class="chapter"><a href="unixclients.html">7. Adding Domain Member Servers and Clients</a></span></dt><dd><dl><dt><span class="sect1"><a href="unixclients.html#id352990">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id353039">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id353067">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id353091">Technical Issues</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id353679">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id353760">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></span></dt><dt><span class="sect2"><a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></span></dt><dt><span class="sect2"><a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a></span></dt><dt><span class="sect2"><a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id359708">UNIX/Linux Client Domain Member</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id360196">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id360240">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="upgrades.html">8. Updating Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="upgrades.html#id361313">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id361397">Cautions and Notes</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id362605">Upgrading from Samba 1.x and 2.x to Samba-3</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id362947">Applicable to All Samba 2.x to Samba-3 Upgrades</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id363269">Samba-2.x with LDAP Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id363384">Updating a Samba-3 Installation</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id363478">Samba-3 to Samba-3 Updates on the Same Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id363662">Migrating Samba-3 to a New Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id364040">Migration of Samba Accounts to Active Directory</a></span></dt></dl></dd></dl></dd><dt><span class="chapter"><a href="ntmigration.html">9. Migrating NT4 Domain to Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="ntmigration.html#id364185">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id364261">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id364312">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id364468">Technical Issues</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id364771">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id364791">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id367204">NT4 Migration Using tdbsam Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id367537">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id367572">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="nw4migration.html">10. Migrating NetWare Server to Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="nw4migration.html#id368455">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id368561">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id368660">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id368732">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id368903">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id368911">NetWare Migration Using LDAP Backend</a></span></dt></dl></dd></dl></dd></dl></dd><dt><span class="part"><a href="RefSection.html">III. Reference Section</a></span></dt><dd><dl><dt><span class="chapter"><a href="kerberos.html">11. Active Directory, Kerberos, and Security</a></span></dt><dd><dl><dt><span class="sect1"><a href="kerberos.html#id372607">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id373189">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id373203">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id373574">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#ch10expl">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id375060">Share Access Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id375395">Share Definition Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id375952">Share Point Directory and File Permissions</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id376321">Managing Windows 200x ACLs</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id377005">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id377127">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="DomApps.html">12. Integrating Additional Services</a></span></dt><dd><dl><dt><span class="sect1"><a href="DomApps.html#id377711">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id377734">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id377820">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id377849">Technical Issues</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id377995">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id378010">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id379772">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id379827">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="HA.html">13. Performance, Reliability, and Availability</a></span></dt><dd><dl><dt><span class="sect1"><a href="HA.html#id380314">Introduction</a></span></dt><dt><span class="sect1"><a href="HA.html#id380391">Dissection and Discussion</a></span></dt><dt><span class="sect1"><a href="HA.html#id380842">Guidelines for Reliable Samba Operation</a></span></dt><dd><dl><dt><span class="sect2"><a href="HA.html#id380866">Name Resolution</a></span></dt><dt><span class="sect2"><a href="HA.html#id381308">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="HA.html#id381603">Use and Location of BDCs</a></span></dt><dt><span class="sect2"><a href="HA.html#id381671">Use One Consistent Version of MS Windows Client</a></span></dt><dt><span class="sect2"><a href="HA.html#id381688">For Scalability, Use SAN-Based Storage on Samba Servers</a></span></dt><dt><span class="sect2"><a href="HA.html#id381733">Distribute Network Load with MSDFS</a></span></dt><dt><span class="sect2"><a href="HA.html#id381784">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></span></dt><dt><span class="sect2"><a href="HA.html#id381824">Hardware Problems</a></span></dt><dt><span class="sect2"><a href="HA.html#id381957">Large Directories</a></span></dt></dl></dd><dt><span class="sect1"><a href="HA.html#id382035">Key Points Learned</a></span></dt></dl></dd><dt><span class="chapter"><a href="ch14.html">14. Samba Support</a></span></dt><dd><dl><dt><span class="sect1"><a href="ch14.html#id382184">Free Support</a></span></dt><dt><span class="sect1"><a href="ch14.html#id382382">Commercial Support</a></span></dt></dl></dd><dt><span class="chapter"><a href="appendix.html">15. A Collection of Useful Tidbits</a></span></dt><dd><dl><dt><span class="sect1"><a href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></span></dt><dt><span class="sect1"><a href="appendix.html#id383041">Samba System File Location</a></span></dt><dt><span class="sect1"><a href="appendix.html#id383432">Starting Samba</a></span></dt><dt><span class="sect1"><a href="appendix.html#id383730">DNS Configuration Files</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id383740">The Forward Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id383783">The Reverse Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id383865">DNS Root Server Hint File</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id383921">Initialization of the LDAP Database</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#id384378">The LDAP Account Manager</a></span></dt><dt><span class="sect1"><a href="appendix.html#id385293">IDEALX Management Console</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12dblck">Shared Data Integrity</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id385724">Microsoft Access</a></span></dt><dt><span class="sect2"><a href="appendix.html#id385863">Act! Database Sharing</a></span></dt><dt><span class="sect2"><a href="appendix.html#id385938">Opportunistic Locking Controls</a></span></dt></dl></dd></dl></dd><dt><span class="chapter"><a href="primer.html">16. Networking Primer</a></span></dt><dd><dl><dt><span class="sect1"><a href="primer.html#id386080">Requirements and Notes</a></span></dt><dt><span class="sect1"><a href="primer.html#id386216">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id386266">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#id386373">Exercises</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id386486">Single-Machine Broadcast Activity</a></span></dt><dt><span class="sect2"><a href="primer.html#secondmachine">Second Machine Startup Broadcast Interaction</a></span></dt><dt><span class="sect2"><a href="primer.html#id387580">Simple Windows Client Connection Characteristics</a></span></dt><dt><span class="sect2"><a href="primer.html#id388041">Windows 200x/XP Client Interaction with Samba-3</a></span></dt><dt><span class="sect2"><a href="primer.html#id388566">Conclusions to Exercises</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01conc">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id388668">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01qa">Questions and Answers</a></span></dt></dl></dd><dt><span class="appendix"><a href="gpl.html">A. GNU General Public License</a></span></dt><dd><dl><dt><span class="sect1"><a href="gpl.html#gpl-1">Preamble</a></span></dt><dt><span class="sect1"><a href="gpl.html#gpl-2">TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION</a></span></dt><dd><dl><dt><span class="sect2"><a href="gpl.html#gpl-2-0">Section 0</a></span></dt><dt><span class="sect2"><a href="gpl.html#gpl-2-1">Section 1</a></span></dt><dt><span class="sect2"><a href="gpl.html#gpl-2-2">Section 2</a></span></dt><dt><span class="sect2"><a href="gpl.html#gpl-2-3">Section 3 2 </a></span></dt><dt><span class="sect2"><a href="gpl.html#gpl-2-4">Section 4 3 </a></span></dt><dt><span class="sect2"><a href="gpl.html#gpl-2-5">Section 5 4 </a></span></dt><dt><span class="sect2"><a href="gpl.html#gpl-2-6">Section 6 5 </a></span></dt><dt><span class="sect2"><a href="gpl.html#gpl-2-7">Section 7 6 </a></span></dt><dt><span class="sect2"><a href="gpl.html#gpl-2-8">Section 8 7 </a></span></dt><dt><span class="sect2"><a href="gpl.html#gpl-2-9">Section 9 8 </a></span></dt><dt><span class="sect2"><a href="gpl.html#gpl-2-10">Section 10 9 </a></span></dt><dt><span class="sect2"><a href="gpl.html#gpl-2-11">NO WARRANTY Section 11 10 </a></span></dt><dt><span class="sect2"><a href="gpl.html#gpl-2-12">Section 12 11 </a></span></dt></dl></dd><dt><span class="sect1"><a href="gpl.html#gpl-3">How to Apply These Terms to Your New Programs 12 </a></span></dt></dl></dd></dl></dd><dt><span class="glossary"><a href="go01.html">Glossary</a></span></dt><dt><span class="index"><a href="ix01.html">Index</a></span></dt></dl></div><div class="list-of-figures"><p><b>List of Figures</b></p><dl><dt>1.1. <a href="simple.html#charitynet">Charity Administration Office Network</a></dt><dt>1.2. <a href="simple.html#acctingnet2">Accounting Office Network Topology</a></dt><dt>2.1. <a href="small.html#acct2net">Abmas Accounting 52-User Network Topology</a></dt><dt>3.1. <a href="secure.html#ch04net">Abmas Network Topology 130 Users</a></dt><dt>4.1. <a href="Big500users.html#chap05net">Network Topology 500 User Network Using tdbsam passdb backend.</a></dt><dt>5.1. <a href="happy.html#sbehap-LDAPdiag">The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts</a></dt><dt>5.2. <a href="happy.html#chap6net">Network Topology 500 User Network Using ldapsam passdb backend</a></dt><dt>5.3. <a href="happy.html#XP-screen001">Windows XP Professional User Shared Folders</a></dt><dt>6.1. <a href="2000users.html#chap7idres">Samba and Authentication Backend Search Pathways</a></dt><dt>6.2. <a href="2000users.html#ch7singleLDAP">Samba Configuration to Use a Single LDAP Server</a></dt><dt>6.3. <a href="2000users.html#ch7dualLDAP">Samba Configuration to Use a Dual (Fail-over) LDAP Server</a></dt><dt>6.4. <a href="2000users.html#ch7dualadd">Samba Configuration to Use Dual LDAP Databases - Broken - Do Not Use!</a></dt><dt>6.5. <a href="2000users.html#ch7dualok">Samba Configuration to Use Two LDAP Databases - The result is additive.</a></dt><dt>6.6. <a href="2000users.html#chap7net">Network Topology 2000 User Complex Design A</a></dt><dt>6.7. <a href="2000users.html#chap7net2">Network Topology 2000 User Complex Design B</a></dt><dt>7.1. <a href="unixclients.html#ch09openmag">Open Magazine Samba Survey</a></dt><dt>7.2. <a href="unixclients.html#ch9-sambadc">Samba Domain: Samba Member Server</a></dt><dt>7.3. <a href="unixclients.html#ch9-adsdc">Active Directory Domain: Samba Member Server</a></dt><dt>9.1. <a href="ntmigration.html#ch8-migration">Schematic Explaining the <code class="literal">net rpc vampire</code> Process</a></dt><dt>9.2. <a href="ntmigration.html#NT4DUM">View of Accounts in NT4 Domain User Manager</a></dt><dt>15.1. <a href="appendix.html#swxpp001">The General Panel.</a></dt><dt>15.2. <a href="appendix.html#swxpp004">The Computer Name Panel.</a></dt><dt>15.3. <a href="appendix.html#swxpp006">The Computer Name Changes Panel</a></dt><dt>15.4. <a href="appendix.html#swxpp007">The Computer Name Changes Panel Domain MIDEARTH</a></dt><dt>15.5. <a href="appendix.html#swxpp008">Computer Name Changes User name and Password Panel</a></dt><dt>15.6. <a href="appendix.html#lam-login">The LDAP Account Manager Login Screen</a></dt><dt>15.7. <a href="appendix.html#lam-config">The LDAP Account Manager Configuration Screen</a></dt><dt>15.8. <a href="appendix.html#lam-user">The LDAP Account Manager User Edit Screen</a></dt><dt>15.9. <a href="appendix.html#lam-group">The LDAP Account Manager Group Edit Screen</a></dt><dt>15.10. <a href="appendix.html#lam-group-mem">The LDAP Account Manager Group Membership Edit Screen</a></dt><dt>15.11. <a href="appendix.html#lam-host">The LDAP Account Manager Host Edit Screen</a></dt><dt>15.12. <a href="appendix.html#imcidealx">The IMC Samba User Account Screen</a></dt><dt>16.1. <a href="primer.html#pktcap01">Windows Me Broadcasts The First 10 Minutes</a></dt><dt>16.2. <a href="primer.html#pktcap02">Windows Me Later Broadcast Sample</a></dt><dt>16.3. <a href="primer.html#hostannounce">Typical Windows 9x/Me Host Announcement</a></dt><dt>16.4. <a href="primer.html#nullconnect">Typical Windows 9x/Me NULL SessionSetUp AndX Request</a></dt><dt>16.5. <a href="primer.html#userconnect">Typical Windows 9x/Me User SessionSetUp AndX Request</a></dt><dt>16.6. <a href="primer.html#XPCap01">Typical Windows XP NULL Session Setup AndX Request</a></dt><dt>16.7. <a href="primer.html#XPCap02">Typical Windows XP User Session Setup AndX Request</a></dt></dl></div><div class="list-of-tables"><p><b>List of Tables</b></p><dl><dt>1. <a href="preface.html#pref-new">Samba Changes 3.0.2 to 3.0.20</a></dt><dt>1.1. <a href="simple.html#acctingnet">Accounting Office Network Information</a></dt><dt>3.1. <a href="secure.html#chap4netid">Abmas.US ISP Information</a></dt><dt>3.2. <a href="secure.html#namedrscfiles">DNS (named) Resource Files</a></dt><dt>4.1. <a href="Big500users.html#ch5-filelocations">Domain: <code class="constant">MEGANET</code>, File Locations for Servers</a></dt><dt>5.1. <a href="happy.html#sbehap-privs">Current Privilege Capabilities</a></dt><dt>5.2. <a href="happy.html#oldapreq">Required OpenLDAP Linux Packages</a></dt><dt>5.3. <a href="happy.html#sbehap-bigacct">Abmas Network Users and Groups</a></dt><dt>5.4. <a href="happy.html#proffold">Default Profile Redirections</a></dt><dt>9.1. <a href="ntmigration.html#ch8-vampire">Samba <code class="filename">smb.conf</code> Scripts Essential to Samba Operation</a></dt><dt>13.1. <a href="HA.html#ProbList">Effect of Common Problems</a></dt><dt>16.1. <a href="primer.html#capsstats01">Windows Me Startup Broadcast Capture Statistics</a></dt><dt>16.2. <a href="primer.html#capsstats02">Second Machine (Windows 98) Capture Statistics</a></dt></dl></div><div class="list-of-examples"><p><b>List of Examples</b></p><dl><dt>1.1. <a href="simple.html#draft-smbconf">Drafting Office <code class="filename">smb.conf</code> File</a></dt><dt>1.2. <a href="simple.html#charity-smbconfnew">Charity Administration Office <code class="filename">smb.conf</code> New-style File</a></dt><dt>1.3. <a href="simple.html#charity-smbconf">Charity Administration Office <code class="filename">smb.conf</code> Old-style File</a></dt><dt>1.4. <a href="simple.html#MEreg">Windows Me Registry Edit File: Disable Password Caching</a></dt><dt>1.5. <a href="simple.html#acctconf">Accounting Office Network <code class="filename">smb.conf</code> Old Style Configuration File</a></dt><dt>2.1. <a href="small.html#initGrps">Script to Map Windows NT Groups to UNIX Groups</a></dt><dt>2.2. <a href="small.html#dhcp01">Abmas Accounting DHCP Server Configuration File <code class="filename">/etc/dhcpd.conf</code></a></dt><dt>2.3. <a href="small.html#acct2conf">Accounting Office Network <code class="filename">smb.conf</code> File [globals] Section</a></dt><dt>2.4. <a href="small.html#acct3conf">Accounting Office Network <code class="filename">smb.conf</code> File Services and Shares Section</a></dt><dt>3.1. <a href="secure.html#ch4memoryest">Estimation of Memory Requirements</a></dt><dt>3.2. <a href="secure.html#ch4diskest">Estimation of Disk Storage Requirements</a></dt><dt>3.3. <a href="secure.html#ch4natfw">NAT Firewall Configuration Script</a></dt><dt>3.4. <a href="secure.html#promisnet">130 User Network with <span class="emphasis"><em>tdbsam</em></span> [globals] Section</a></dt><dt>3.5. <a href="secure.html#promisnetsvca">130 User Network with <span class="emphasis"><em>tdbsam</em></span> Services Section Part A</a></dt><dt>3.6. <a href="secure.html#promisnetsvcb">130 User Network with <span class="emphasis"><em>tdbsam</em></span> Services Section Part B</a></dt><dt>3.7. <a href="secure.html#ch4initGrps">Script to Map Windows NT Groups to UNIX Groups</a></dt><dt>3.8. <a href="secure.html#prom-dhcp">DHCP Server Configuration File <code class="filename">/etc/dhcpd.conf</code></a></dt><dt>3.9. <a href="secure.html#ch4namedcfg">DNS Master Configuration File <code class="filename">/etc/named.conf</code> Master Section</a></dt><dt>3.10. <a href="secure.html#ch4namedvarfwd">DNS Master Configuration File <code class="filename">/etc/named.conf</code> Forward Lookup Definition Section</a></dt><dt>3.11. <a href="secure.html#ch4namedvarrev">DNS Master Configuration File <code class="filename">/etc/named.conf</code> Reverse Lookup Definition Section</a></dt><dt>3.12. <a href="secure.html#eth1zone">DNS 192.168.1 Reverse Zone File</a></dt><dt>3.13. <a href="secure.html#eth2zone">DNS 192.168.2 Reverse Zone File</a></dt><dt>3.14. <a href="secure.html#abmasbiz">DNS Abmas.biz Forward Zone File</a></dt><dt>3.15. <a href="secure.html#abmasus">DNS Abmas.us Forward Zone File</a></dt><dt>4.1. <a href="Big500users.html#ch5-massivesmb">Server: MASSIVE (PDC), File: <code class="filename">/etc/samba/smb.conf</code></a></dt><dt>4.2. <a href="Big500users.html#ch5-dc-common">Server: MASSIVE (PDC), File: <code class="filename">/etc/samba/dc-common.conf</code></a></dt><dt>4.3. <a href="Big500users.html#ch5-commonsmb">Common Samba Configuration File: <code class="filename">/etc/samba/common.conf</code></a></dt><dt>4.4. <a href="Big500users.html#ch5-bldg1-smb">Server: BLDG1 (Member), File: smb.conf</a></dt><dt>4.5. <a href="Big500users.html#ch5-bldg2-smb">Server: BLDG2 (Member), File: smb.conf</a></dt><dt>4.6. <a href="Big500users.html#ch5-dommem-smb">Common Domain Member Include File: dom-mem.conf</a></dt><dt>4.7. <a href="Big500users.html#massive-dhcp">Server: MASSIVE, File: dhcpd.conf</a></dt><dt>4.8. <a href="Big500users.html#bldg1dhcp">Server: BLDG1, File: dhcpd.conf</a></dt><dt>4.9. <a href="Big500users.html#bldg2dhcp">Server: BLDG2, File: dhcpd.conf</a></dt><dt>4.10. <a href="Big500users.html#massive-nameda">Server: MASSIVE, File: named.conf, Part: A</a></dt><dt>4.11. <a href="Big500users.html#massive-namedb">Server: MASSIVE, File: named.conf, Part: B</a></dt><dt>4.12. <a href="Big500users.html#massive-namedc">Server: MASSIVE, File: named.conf, Part: C</a></dt><dt>4.13. <a href="Big500users.html#abmasbizdns">Forward Zone File: abmas.biz.hosts</a></dt><dt>4.14. <a href="Big500users.html#abmasusdns">Forward Zone File: abmas.biz.hosts</a></dt><dt>4.15. <a href="Big500users.html#bldg12nameda">Servers: BLDG1/BLDG2, File: named.conf, Part: A</a></dt><dt>4.16. <a href="Big500users.html#bldg12namedb">Servers: BLDG1/BLDG2, File: named.conf, Part: B</a></dt><dt>4.17. <a href="Big500users.html#ch5-initgrps">Initialize Groups Script, File: /etc/samba/initGrps.sh</a></dt><dt>5.1. <a href="happy.html#sbehap-dbconf">LDAP DB_CONFIG File</a></dt><dt>5.2. <a href="happy.html#sbehap-slapdconf">LDAP Master Configuration File <code class="filename">/etc/openldap/slapd.conf</code> Part A</a></dt><dt>5.3. <a href="happy.html#sbehap-slapdconf2">LDAP Master Configuration File <code class="filename">/etc/openldap/slapd.conf</code> Part B</a></dt><dt>5.4. <a href="happy.html#sbehap-nss01">Configuration File for NSS LDAP Support <code class="filename">/etc/ldap.conf</code></a></dt><dt>5.5. <a href="happy.html#sbehap-nss02">Configuration File for NSS LDAP Clients Support <code class="filename">/etc/ldap.conf</code></a></dt><dt>5.6. <a href="happy.html#sbehap-massive-smbconfa">LDAP Based <code class="filename">smb.conf</code> File, Server: MASSIVE global Section: Part A</a></dt><dt>5.7. <a href="happy.html#sbehap-massive-smbconfb">LDAP Based <code class="filename">smb.conf</code> File, Server: MASSIVE global Section: Part B</a></dt><dt>5.8. <a href="happy.html#sbehap-bldg1-smbconf">LDAP Based <code class="filename">smb.conf</code> File, Server: BLDG1</a></dt><dt>5.9. <a href="happy.html#sbehap-bldg2-smbconf">LDAP Based <code class="filename">smb.conf</code> File, Server: BLDG2</a></dt><dt>5.10. <a href="happy.html#sbehap-shareconfa">LDAP Based <code class="filename">smb.conf</code> File, Shares Section Part A</a></dt><dt>5.11. <a href="happy.html#sbehap-shareconfb">LDAP Based <code class="filename">smb.conf</code> File, Shares Section Part B</a></dt><dt>5.12. <a href="happy.html#sbehap-ldifadd">LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF</a></dt><dt>6.1. <a href="2000users.html#ch7-LDAP-master">LDAP Master Server Configuration File <code class="filename">/etc/openldap/slapd.conf</code></a></dt><dt>6.2. <a href="2000users.html#ch7-LDAP-slave">LDAP Slave Configuration File <code class="filename">/etc/openldap/slapd.conf</code></a></dt><dt>6.3. <a href="2000users.html#ch7-massmbconfA">Primary Domain Controller <code class="filename">smb.conf</code> File Part A</a></dt><dt>6.4. <a href="2000users.html#ch7-massmbconfB">Primary Domain Controller <code class="filename">smb.conf</code> File Part B</a></dt><dt>6.5. <a href="2000users.html#ch7-massmbconfC">Primary Domain Controller <code class="filename">smb.conf</code> File Part C</a></dt><dt>6.6. <a href="2000users.html#ch7-slvsmbocnfA">Backup Domain Controller <code class="filename">smb.conf</code> File Part A</a></dt><dt>6.7. <a href="2000users.html#ch7-slvsmbocnfB">Backup Domain Controller <code class="filename">smb.conf</code> File Part B</a></dt><dt>7.1. <a href="unixclients.html#ch9-sdmsdc">Samba Domain Member in Samba Domain Using LDAP <code class="filename">smb.conf</code> File</a></dt><dt>7.2. <a href="unixclients.html#ch9-ldifadd">LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF</a></dt><dt>7.3. <a href="unixclients.html#ch9-sdmlcnf">Configuration File for NSS LDAP Support <code class="filename">/etc/ldap.conf</code></a></dt><dt>7.4. <a href="unixclients.html#ch9-sdmnss">NSS using LDAP for Identity Resolution File: <code class="filename">/etc/nsswitch.conf</code></a></dt><dt>7.5. <a href="unixclients.html#ch0-NT4DSDM">Samba Domain Member Server Using Winbind <code class="filename">smb.conf</code> File for NT4 Domain</a></dt><dt>7.6. <a href="unixclients.html#ch0-NT4DSCM">Samba Domain Member Server Using Local Accounts <code class="filename">smb.conf</code> File for NT4 Domain</a></dt><dt>7.7. <a href="unixclients.html#ch9-adssdm">Samba Domain Member <code class="filename">smb.conf</code> File for Active Directory Membership</a></dt><dt>7.8. <a href="unixclients.html#sbe-idmapridex">Example <code class="filename">smb.conf</code> File Using <code class="constant">idmap_rid</code></a></dt><dt>7.9. <a href="unixclients.html#sbeunxa">Typical ADS Style Domain <code class="filename">smb.conf</code> File</a></dt><dt>7.10. <a href="unixclients.html#sbewinbindex">ADS Membership Using RFC2307bis Identity Resolution <code class="filename">smb.conf</code> File</a></dt><dt>7.11. <a href="unixclients.html#ch9-pamwnbdlogin">SUSE: PAM <code class="filename">login</code> Module Using Winbind</a></dt><dt>7.12. <a href="unixclients.html#ch9-pamwbndxdm">SUSE: PAM <code class="filename">xdm</code> Module Using Winbind</a></dt><dt>7.13. <a href="unixclients.html#ch9-rhsysauth">Red Hat 9: PAM System Authentication File: <code class="filename">/etc/pam.d/system-auth</code> Module Using Winbind</a></dt><dt>9.1. <a href="ntmigration.html#sbent4smb">NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: A</a></dt><dt>9.2. <a href="ntmigration.html#sbent4smb2">NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: B</a></dt><dt>9.3. <a href="ntmigration.html#sbentslapd">NT4 Migration LDAP Server Configuration File: <code class="filename">/etc/openldap/slapd.conf</code> Part A</a></dt><dt>9.4. <a href="ntmigration.html#sbentslapd2">NT4 Migration LDAP Server Configuration File: <code class="filename">/etc/openldap/slapd.conf</code> Part B</a></dt><dt>9.5. <a href="ntmigration.html#sbrntldapconf">NT4 Migration NSS LDAP File: <code class="filename">/etc/ldap.conf</code></a></dt><dt>9.6. <a href="ntmigration.html#sbentnss">NT4 Migration NSS Control File: <code class="filename">/etc/nsswitch.conf</code> (Stage:1)</a></dt><dt>9.7. <a href="ntmigration.html#sbentnss2">NT4 Migration NSS Control File: <code class="filename">/etc/nsswitch.conf</code> (Stage:2)</a></dt><dt>10.1. <a href="nw4migration.html#sbeamg">A Rough Tool to Create an LDIF File from the System Account Files</a></dt><dt>10.2. <a href="nw4migration.html#ch8ldap">NSS LDAP Control File /etc/ldap.conf</a></dt><dt>10.3. <a href="nw4migration.html#sbepu2">The PAM Control File <code class="filename">/etc/security/pam_unix2.conf</code></a></dt><dt>10.4. <a href="nw4migration.html#ch8smbconf">Samba Configuration File smb.conf Part A</a></dt><dt>10.5. <a href="nw4migration.html#ch8smbconf2">Samba Configuration File smb.conf Part B</a></dt><dt>10.6. <a href="nw4migration.html#ch8smbconf3">Samba Configuration File smb.conf Part C</a></dt><dt>10.7. <a href="nw4migration.html#ch8smbconf4">Samba Configuration File smb.conf Part D</a></dt><dt>10.8. <a href="nw4migration.html#ch8smbconf5">Samba Configuration File smb.conf Part E</a></dt><dt>10.9. <a href="nw4migration.html#sbersync">Rsync Script</a></dt><dt>10.10. <a href="nw4migration.html#sbexcld">Rsync Files Exclusion List <code class="filename">/root/excludes.txt</code></a></dt><dt>10.11. <a href="nw4migration.html#ch8ideal">Idealx smbldap-tools Control File Part A</a></dt><dt>10.12. <a href="nw4migration.html#ch8ideal2">Idealx smbldap-tools Control File Part B</a></dt><dt>10.13. <a href="nw4migration.html#ch8ideal3">Idealx smbldap-tools Control File Part C</a></dt><dt>10.14. <a href="nw4migration.html#ch8ideal4">Idealx smbldap-tools Control File Part D</a></dt><dt>10.15. <a href="nw4migration.html#ch8kix">Kixtart Control File File: logon.kix</a></dt><dt>10.16. <a href="nw4migration.html#ch8kix2">Kixtart Control File File: main.kix</a></dt><dt>10.17. <a href="nw4migration.html#ch8kix3">Kixtart Control File File: setup.kix, Part A</a></dt><dt>10.18. <a href="nw4migration.html#ch8kix3b">Kixtart Control File File: setup.kix, Part B</a></dt><dt>10.19. <a href="nw4migration.html#ch8kix4">Kixtart Control File File: acct.kix</a></dt><dt>12.1. <a href="DomApps.html#ch10-krb5conf">Kerberos Configuration File: <code class="filename">/etc/krb5.conf</code></a></dt><dt>12.2. <a href="DomApps.html#ch10-smbconf">Samba Configuration File: <code class="filename">/etc/samba/smb.conf</code></a></dt><dt>12.3. <a href="DomApps.html#ch10-etcnsscfg">NSS Configuration File Extract File: <code class="filename">/etc/nsswitch.conf</code></a></dt><dt>12.4. <a href="DomApps.html#etcsquidcfg">Squid Configuration File Extract <code class="filename">/etc/squid.conf</code> [ADMINISTRATIVE PARAMETERS Section]</a></dt><dt>12.5. <a href="DomApps.html#etcsquid2">Squid Configuration File extract File: <code class="filename">/etc/squid.conf</code> [AUTHENTICATION PARAMETERS Section]</a></dt><dt>15.1. <a href="appendix.html#ch12SL">A Useful Samba Control Script for SUSE Linux</a></dt><dt>15.2. <a href="appendix.html#ch12RHscript">A Sample Samba Control Script for Red Hat Linux</a></dt><dt>15.3. <a href="appendix.html#loopback">DNS Localhost Forward Zone File: <code class="filename">/var/lib/named/localhost.zone</code></a></dt><dt>15.4. <a href="appendix.html#dnsloopy">DNS Localhost Reverse Zone File: <code class="filename">/var/lib/named/127.0.0.zone</code></a></dt><dt>15.5. <a href="appendix.html#roothint">DNS Root Name Server Hint File: <code class="filename">/var/lib/named/root.hint</code></a></dt><dt>15.6. <a href="appendix.html#sbehap-ldapreconfa">LDAP Pre-configuration Script: <code class="filename">SMBLDAP-ldif-preconfig.sh</code> Part A</a></dt><dt>15.7. <a href="appendix.html#sbehap-ldapreconfb">LDAP Pre-configuration Script: <code class="filename">SMBLDAP-ldif-preconfig.sh</code> Part B</a></dt><dt>15.8. <a href="appendix.html#sbehap-ldapreconfc">LDAP Pre-configuration Script: <code class="filename">SMBLDAP-ldif-preconfig.sh</code> Part C</a></dt><dt>15.9. <a href="appendix.html#sbehap-ldifpata">LDIF Pattern File Used to Pre-configure LDAP Part A</a></dt><dt>15.10. <a href="appendix.html#sbehap-ldifpatb">LDIF Pattern File Used to Pre-configure LDAP Part B</a></dt><dt>15.11. <a href="appendix.html#lamcfg">Example LAM Configuration File <code class="filename">config.cfg</code></a></dt><dt>15.12. <a href="appendix.html#lamconf">LAM Profile Control File <code class="filename">lam.conf</code></a></dt></dl></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="pr01.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top"> </td><td width="20%" align="center"> </td><td width="40%" align="right" valign="top"> About the Cover Artwork</td></tr></table></div></body></html> 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Samba-3 by Example</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="next" href="pr01.html" title="About the Cover Artwork"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Samba-3 by Example</th></tr><tr><td width="20%" align="left"> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="pr01.html">Next</a></td></tr></table><hr></div><div class="book" lang="en"><div class="titlepage"><div><div><h1 class="title"><a name="S3bE"></a>Samba-3 by Example</h1></div><div><h2 class="subtitle">Practical Exercises in Successful Samba Deployment</h2></div><div><div class="authorgroup"><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div></div><div><p class="pubdate">July, 2006</p></div></div><hr></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="preface"><a href="pr01.html">About the Cover Artwork</a></span></dt><dt><span class="preface"><a href="pr02.html">Acknowledgments</a></span></dt><dt><span class="preface"><a href="pr03.html">Foreword</a></span></dt><dd><dl><dt><span class="sect1"><a href="pr03.html#id298553">By John M. Weathersby, Executive Director, OSSI</a></span></dt></dl></dd><dt><span class="preface"><a href="preface.html">Preface</a></span></dt><dd><dl><dt><span class="sect1"><a href="preface.html#id298129">Why Is This Book Necessary?</a></span></dt><dd><dl><dt><span class="sect2"><a href="preface.html#id298166">Samba 3.0.20 Update Edition</a></span></dt></dl></dd><dt><span class="sect1"><a href="preface.html#id297715">Prerequisites</a></span></dt><dt><span class="sect1"><a href="preface.html#id339863">Approach</a></span></dt><dt><span class="sect1"><a href="preface.html#id339912">Summary of Topics</a></span></dt><dt><span class="sect1"><a href="preface.html#id340490">Conventions Used</a></span></dt></dl></dd><dt><span class="part"><a href="ExNetworks.html">I. Example Network Configurations</a></span></dt><dd><dl><dt><span class="chapter"><a href="simple.html">1. No-Frills Samba Servers</a></span></dt><dd><dl><dt><span class="sect1"><a href="simple.html#id340660">Introduction</a></span></dt><dt><span class="sect1"><a href="simple.html#id340690">Assignment Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="simple.html#id340728">Drafting Office</a></span></dt><dt><span class="sect2"><a href="simple.html#id341373">Charity Administration Office</a></span></dt><dt><span class="sect2"><a href="simple.html#AccountingOffice">Accounting Office</a></span></dt></dl></dd><dt><span class="sect1"><a href="simple.html#id344496">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="small.html">2. Small Office Networking</a></span></dt><dd><dl><dt><span class="sect1"><a href="small.html#id344880">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id344898">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id344943">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id344988">Technical Issues</a></span></dt><dt><span class="sect2"><a href="small.html#id345160">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id345178">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id346626">Validation</a></span></dt><dt><span class="sect2"><a href="small.html#id347201">Notebook Computers: A Special Case</a></span></dt><dt><span class="sect2"><a href="small.html#id347221">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id347285">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="secure.html">3. Secure Office Networking</a></span></dt><dd><dl><dt><span class="sect1"><a href="secure.html#id347711">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id347745">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id347954">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id347966">Technical Issues</a></span></dt><dt><span class="sect2"><a href="secure.html#id348311">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id348344">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#ch4bsc">Basic System Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id349099">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4ptrcfg">Printer Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4valid">Validation</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4appscfg">Application Share Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id353060">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id353113">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="Big500users.html">4. The 500-User Office</a></span></dt><dd><dl><dt><span class="sect1"><a href="Big500users.html#id353553">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id353583">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id353662">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id353690">Technical Issues</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id353866">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id353886">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#ch5-dnshcp-setup">Installation of DHCP, DNS, and Samba Control Files</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id354601">Server Preparation: All Servers</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id355116">Server-Specific Preparation</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5-procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id358090">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id358142">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="happy.html">5. Making Happy Users</a></span></dt><dd><dl><dt><span class="sect1"><a href="happy.html#id358884">Regarding LDAP Directories and Windows Computer Accounts</a></span></dt><dt><span class="sect1"><a href="happy.html#id359008">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id359084">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id359212">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id359614">Technical Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id361271">Political Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id361283">Installation Checklist</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id361454">Samba Server Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbeidealx">Install and Configure Idealx smbldap-tools Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id364093">LDAP Initialization and Creation of User and Group Accounts</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-ptrcfg">Printer Configuration</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a></span></dt><dt><span class="sect1"><a href="happy.html#id367724">Miscellaneous Server Preparation Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id367740">Configuring Directory Share Point Roots</a></span></dt><dt><span class="sect2"><a href="happy.html#id367829">Configuring Profile Directories</a></span></dt><dt><span class="sect2"><a href="happy.html#id368057">Preparation of Logon Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id368155">Assigning User Rights and Privileges</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id368268">Windows Client Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></span></dt><dt><span class="sect2"><a href="happy.html#id368985">Configuration of MS Outlook to Relocate PST File</a></span></dt><dt><span class="sect2"><a href="happy.html#id369268">Configure Delete Cached Profiles on Logout</a></span></dt><dt><span class="sect2"><a href="happy.html#id369439">Uploading Printer Drivers to Samba Servers</a></span></dt><dt><span class="sect2"><a href="happy.html#id369909">Software Installation</a></span></dt><dt><span class="sect2"><a href="happy.html#id369934">Roll-out Image Creation</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id369964">Key Points Learned</a></span></dt><dt><span class="sect1"><a href="happy.html#id370057">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="2000users.html">6. A Distributed 2000-User Network</a></span></dt><dd><dl><dt><span class="sect1"><a href="2000users.html#id370394">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id370419">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id370476">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id370722">Technical Issues</a></span></dt><dt><span class="sect2"><a href="2000users.html#id371541">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id371556">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id374570">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id374709">Questions and Answers</a></span></dt></dl></dd></dl></dd><dt><span class="part"><a href="DMSMig.html">II. Domain Members, Updating Samba and Migration</a></span></dt><dd><dl><dt><span class="chapter"><a href="unixclients.html">7. Adding Domain Member Servers and Clients</a></span></dt><dd><dl><dt><span class="sect1"><a href="unixclients.html#id375489">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id375537">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id375566">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id375589">Technical Issues</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id376189">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id376274">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></span></dt><dt><span class="sect2"><a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></span></dt><dt><span class="sect2"><a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a></span></dt><dt><span class="sect2"><a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id382025">UNIX/Linux Client Domain Member</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id382521">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id382565">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="upgrades.html">8. Updating Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="upgrades.html#id383639">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id383722">Cautions and Notes</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id384934">Upgrading from Samba 1.x and 2.x to Samba-3</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id385275">Applicable to All Samba 2.x to Samba-3 Upgrades</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id385597">Samba-2.x with LDAP Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id385712">Updating a Samba-3 Installation</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id385807">Samba-3 to Samba-3 Updates on the Same Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id385991">Migrating Samba-3 to a New Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id386368">Migration of Samba Accounts to Active Directory</a></span></dt></dl></dd></dl></dd><dt><span class="chapter"><a href="ntmigration.html">9. Migrating NT4 Domain to Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="ntmigration.html#id386514">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id386589">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id386640">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id386802">Technical Issues</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id387105">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id387125">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id387250">NT4 Migration Using LDAP Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id389442">NT4 Migration Using tdbsam Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id389787">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id389822">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="nw4migration.html">10. Migrating NetWare Server to Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="nw4migration.html#id390707">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id390814">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id390913">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id390984">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id391152">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id391161">NetWare Migration Using LDAP Backend</a></span></dt></dl></dd></dl></dd></dl></dd><dt><span class="part"><a href="RefSection.html">III. Reference Section</a></span></dt><dd><dl><dt><span class="chapter"><a href="kerberos.html">11. Active Directory, Kerberos, and Security</a></span></dt><dd><dl><dt><span class="sect1"><a href="kerberos.html#id394729">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id395316">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id395330">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id395699">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#ch10expl">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id397184">Share Access Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id397519">Share Definition Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id398076">Share Point Directory and File Permissions</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id398445">Managing Windows 200x ACLs</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id399129">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id399251">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="DomApps.html">12. Integrating Additional Services</a></span></dt><dd><dl><dt><span class="sect1"><a href="DomApps.html#id399839">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id399862">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id399948">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id399977">Technical Issues</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id400123">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id400137">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id401888">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id401943">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="HA.html">13. Performance, Reliability, and Availability</a></span></dt><dd><dl><dt><span class="sect1"><a href="HA.html#id402421">Introduction</a></span></dt><dt><span class="sect1"><a href="HA.html#id402498">Dissection and Discussion</a></span></dt><dt><span class="sect1"><a href="HA.html#id402949">Guidelines for Reliable Samba Operation</a></span></dt><dd><dl><dt><span class="sect2"><a href="HA.html#id402973">Name Resolution</a></span></dt><dt><span class="sect2"><a href="HA.html#id403415">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="HA.html#id403710">Use and Location of BDCs</a></span></dt><dt><span class="sect2"><a href="HA.html#id403778">Use One Consistent Version of MS Windows Client</a></span></dt><dt><span class="sect2"><a href="HA.html#id403795">For Scalability, Use SAN-Based Storage on Samba Servers</a></span></dt><dt><span class="sect2"><a href="HA.html#id403840">Distribute Network Load with MSDFS</a></span></dt><dt><span class="sect2"><a href="HA.html#id403891">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></span></dt><dt><span class="sect2"><a href="HA.html#id403932">Hardware Problems</a></span></dt><dt><span class="sect2"><a href="HA.html#id404070">Large Directories</a></span></dt></dl></dd><dt><span class="sect1"><a href="HA.html#id404151">Key Points Learned</a></span></dt></dl></dd><dt><span class="chapter"><a href="ch14.html">14. Samba Support</a></span></dt><dd><dl><dt><span class="sect1"><a href="ch14.html#id404300">Free Support</a></span></dt><dt><span class="sect1"><a href="ch14.html#id404499">Commercial Support</a></span></dt></dl></dd><dt><span class="chapter"><a href="appendix.html">15. A Collection of Useful Tidbits</a></span></dt><dd><dl><dt><span class="sect1"><a href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></span></dt><dt><span class="sect1"><a href="appendix.html#id405157">Samba System File Location</a></span></dt><dt><span class="sect1"><a href="appendix.html#id405549">Starting Samba</a></span></dt><dt><span class="sect1"><a href="appendix.html#id405844">DNS Configuration Files</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id405854">The Forward Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id405898">The Reverse Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id405998">DNS Root Server Hint File</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id406053">Initialization of the LDAP Database</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#id406519">The LDAP Account Manager</a></span></dt><dt><span class="sect1"><a href="appendix.html#id407438">IDEALX Management Console</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12dblck">Shared Data Integrity</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id407872">Microsoft Access</a></span></dt><dt><span class="sect2"><a href="appendix.html#id408011">Act! Database Sharing</a></span></dt><dt><span class="sect2"><a href="appendix.html#id408086">Opportunistic Locking Controls</a></span></dt></dl></dd></dl></dd><dt><span class="chapter"><a href="primer.html">16. Networking Primer</a></span></dt><dd><dl><dt><span class="sect1"><a href="primer.html#id408228">Requirements and Notes</a></span></dt><dt><span class="sect1"><a href="primer.html#id408364">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id408414">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#id408521">Exercises</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id408634">Single-Machine Broadcast Activity</a></span></dt><dt><span class="sect2"><a href="primer.html#secondmachine">Second Machine Startup Broadcast Interaction</a></span></dt><dt><span class="sect2"><a href="primer.html#id409728">Simple Windows Client Connection Characteristics</a></span></dt><dt><span class="sect2"><a href="primer.html#id410194">Windows 200x/XP Client Interaction with Samba-3</a></span></dt><dt><span class="sect2"><a href="primer.html#id410719">Conclusions to Exercises</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01conc">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id410820">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01qa">Questions and Answers</a></span></dt></dl></dd><dt><span class="appendix"><a href="apa.html">A. 2 <acronym class="acronym">GNU</acronym> General Public License version 3 3 </a></span></dt><dd><dl><dt><span class="bridgehead"><a href="apa.html#id411425">A. 4 Preamble 5 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id411534">A. 6 TERMS AND CONDITIONS 7 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id411537">A. 8 0. Definitions. 9 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id411601">A. 10 1. Source Code. 11 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id411663">A. 12 2. Basic Permissions. 13 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id411691">A. 14 3. Protecting Users’ Legal Rights From Anti-Circumvention Law. 15 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id411717">A. 16 4. Conveying Verbatim Copies. 17 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id411737">A. 18 5. Conveying Modified Source Versions. 19 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id411809">A. 20 6. Conveying Non-Source Forms. 21 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id411941">A. 22 7. Additional Terms. 23 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id412046">A. 24 8. Termination. 25 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id412078">A. 26 9. Acceptance Not Required for Having Copies. 27 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id412092">A. 28 10. Automatic Licensing of Downstream Recipients. 29 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id412126">A. 30 11. Patents. 31 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id412210">A. 32 12. No Surrender of Others’ Freedom. 33 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id412225">A. 34 13. Use with the ???TITLE??? Affero General Public License. 35 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id412249">A. 36 14. Revised Versions of this License. 37 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id412296">A. 38 15. Disclaimer of Warranty. 39 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id412314">A. 40 16. Limitation of Liability. 41 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id412328">A. 42 17. Interpretation of Sections 15 and 16. 43 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id412341">A. 44 END OF TERMS AND CONDITIONS 45 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id412344">A. 46 How to Apply These Terms to Your New Programs 47 </a></span></dt></dl></dd></dl></dd><dt><span class="glossary"><a href="go01.html">Glossary</a></span></dt><dt><span class="index"><a href="ix01.html">Index</a></span></dt></dl></div><div class="list-of-figures"><p><b>List of Figures</b></p><dl><dt>1.1. <a href="simple.html#charitynet">Charity Administration Office Network</a></dt><dt>1.2. <a href="simple.html#acctingnet2">Accounting Office Network Topology</a></dt><dt>2.1. <a href="small.html#acct2net">Abmas Accounting 52-User Network Topology</a></dt><dt>3.1. <a href="secure.html#ch04net">Abmas Network Topology 130 Users</a></dt><dt>4.1. <a href="Big500users.html#chap05net">Network Topology 500 User Network Using tdbsam passdb backend.</a></dt><dt>5.1. <a href="happy.html#sbehap-LDAPdiag">The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts</a></dt><dt>5.2. <a href="happy.html#chap6net">Network Topology 500 User Network Using ldapsam passdb backend</a></dt><dt>5.3. <a href="happy.html#XP-screen001">Windows XP Professional User Shared Folders</a></dt><dt>6.1. <a href="2000users.html#chap7idres">Samba and Authentication Backend Search Pathways</a></dt><dt>6.2. <a href="2000users.html#ch7singleLDAP">Samba Configuration to Use a Single LDAP Server</a></dt><dt>6.3. <a href="2000users.html#ch7dualLDAP">Samba Configuration to Use a Dual (Fail-over) LDAP Server</a></dt><dt>6.4. <a href="2000users.html#ch7dualadd">Samba Configuration to Use Dual LDAP Databases - Broken - Do Not Use!</a></dt><dt>6.5. <a href="2000users.html#ch7dualok">Samba Configuration to Use Two LDAP Databases - The result is additive.</a></dt><dt>6.6. <a href="2000users.html#chap7net">Network Topology 2000 User Complex Design A</a></dt><dt>6.7. <a href="2000users.html#chap7net2">Network Topology 2000 User Complex Design B</a></dt><dt>7.1. <a href="unixclients.html#ch09openmag">Open Magazine Samba Survey</a></dt><dt>7.2. <a href="unixclients.html#ch9-sambadc">Samba Domain: Samba Member Server</a></dt><dt>7.3. <a href="unixclients.html#ch9-adsdc">Active Directory Domain: Samba Member Server</a></dt><dt>9.1. <a href="ntmigration.html#ch8-migration">Schematic Explaining the <code class="literal">net rpc vampire</code> Process</a></dt><dt>9.2. <a href="ntmigration.html#NT4DUM">View of Accounts in NT4 Domain User Manager</a></dt><dt>15.1. <a href="appendix.html#swxpp001">The General Panel.</a></dt><dt>15.2. <a href="appendix.html#swxpp004">The Computer Name Panel.</a></dt><dt>15.3. <a href="appendix.html#swxpp006">The Computer Name Changes Panel</a></dt><dt>15.4. <a href="appendix.html#swxpp007">The Computer Name Changes Panel Domain MIDEARTH</a></dt><dt>15.5. <a href="appendix.html#swxpp008">Computer Name Changes User name and Password Panel</a></dt><dt>15.6. <a href="appendix.html#lam-login">The LDAP Account Manager Login Screen</a></dt><dt>15.7. <a href="appendix.html#lam-config">The LDAP Account Manager Configuration Screen</a></dt><dt>15.8. <a href="appendix.html#lam-user">The LDAP Account Manager User Edit Screen</a></dt><dt>15.9. <a href="appendix.html#lam-group">The LDAP Account Manager Group Edit Screen</a></dt><dt>15.10. <a href="appendix.html#lam-group-mem">The LDAP Account Manager Group Membership Edit Screen</a></dt><dt>15.11. <a href="appendix.html#lam-host">The LDAP Account Manager Host Edit Screen</a></dt><dt>15.12. <a href="appendix.html#imcidealx">The IMC Samba User Account Screen</a></dt><dt>16.1. <a href="primer.html#pktcap01">Windows Me Broadcasts The First 10 Minutes</a></dt><dt>16.2. <a href="primer.html#pktcap02">Windows Me Later Broadcast Sample</a></dt><dt>16.3. <a href="primer.html#hostannounce">Typical Windows 9x/Me Host Announcement</a></dt><dt>16.4. <a href="primer.html#nullconnect">Typical Windows 9x/Me NULL SessionSetUp AndX Request</a></dt><dt>16.5. <a href="primer.html#userconnect">Typical Windows 9x/Me User SessionSetUp AndX Request</a></dt><dt>16.6. <a href="primer.html#XPCap01">Typical Windows XP NULL Session Setup AndX Request</a></dt><dt>16.7. <a href="primer.html#XPCap02">Typical Windows XP User Session Setup AndX Request</a></dt></dl></div><div class="list-of-tables"><p><b>List of Tables</b></p><dl><dt>1. <a href="preface.html#pref-new">Samba Changes 3.0.2 to 3.0.20</a></dt><dt>1.1. <a href="simple.html#acctingnet">Accounting Office Network Information</a></dt><dt>3.1. <a href="secure.html#chap4netid">Abmas.US ISP Information</a></dt><dt>3.2. <a href="secure.html#namedrscfiles">DNS (named) Resource Files</a></dt><dt>4.1. <a href="Big500users.html#ch5-filelocations">Domain: <code class="constant">MEGANET</code>, File Locations for Servers</a></dt><dt>5.1. <a href="happy.html#sbehap-privs">Current Privilege Capabilities</a></dt><dt>5.2. <a href="happy.html#oldapreq">Required OpenLDAP Linux Packages</a></dt><dt>5.3. <a href="happy.html#sbehap-bigacct">Abmas Network Users and Groups</a></dt><dt>5.4. <a href="happy.html#proffold">Default Profile Redirections</a></dt><dt>9.1. <a href="ntmigration.html#ch8-vampire">Samba <code class="filename">smb.conf</code> Scripts Essential to Samba Operation</a></dt><dt>13.1. <a href="HA.html#ProbList">Effect of Common Problems</a></dt><dt>16.1. <a href="primer.html#capsstats01">Windows Me Startup Broadcast Capture Statistics</a></dt><dt>16.2. <a href="primer.html#capsstats02">Second Machine (Windows 98) Capture Statistics</a></dt></dl></div><div class="list-of-examples"><p><b>List of Examples</b></p><dl><dt>1.1. <a href="simple.html#draft-smbconf">Drafting Office <code class="filename">smb.conf</code> File</a></dt><dt>1.2. <a href="simple.html#charity-smbconfnew">Charity Administration Office <code class="filename">smb.conf</code> New-style File</a></dt><dt>1.3. <a href="simple.html#charity-smbconf">Charity Administration Office <code class="filename">smb.conf</code> Old-style File</a></dt><dt>1.4. <a href="simple.html#MEreg">Windows Me Registry Edit File: Disable Password Caching</a></dt><dt>1.5. <a href="simple.html#acctconf">Accounting Office Network <code class="filename">smb.conf</code> Old Style Configuration File</a></dt><dt>2.1. <a href="small.html#initGrps">Script to Map Windows NT Groups to UNIX Groups</a></dt><dt>2.2. <a href="small.html#dhcp01">Abmas Accounting DHCP Server Configuration File <code class="filename">/etc/dhcpd.conf</code></a></dt><dt>2.3. <a href="small.html#acct2conf">Accounting Office Network <code class="filename">smb.conf</code> File [globals] Section</a></dt><dt>2.4. <a href="small.html#acct3conf">Accounting Office Network <code class="filename">smb.conf</code> File Services and Shares Section</a></dt><dt>3.1. <a href="secure.html#ch4memoryest">Estimation of Memory Requirements</a></dt><dt>3.2. <a href="secure.html#ch4diskest">Estimation of Disk Storage Requirements</a></dt><dt>3.3. <a href="secure.html#ch4natfw">NAT Firewall Configuration Script</a></dt><dt>3.4. <a href="secure.html#promisnet">130 User Network with <span class="emphasis"><em>tdbsam</em></span> [globals] Section</a></dt><dt>3.5. <a href="secure.html#promisnetsvca">130 User Network with <span class="emphasis"><em>tdbsam</em></span> Services Section Part A</a></dt><dt>3.6. <a href="secure.html#promisnetsvcb">130 User Network with <span class="emphasis"><em>tdbsam</em></span> Services Section Part B</a></dt><dt>3.7. <a href="secure.html#ch4initGrps">Script to Map Windows NT Groups to UNIX Groups</a></dt><dt>3.8. <a href="secure.html#prom-dhcp">DHCP Server Configuration File <code class="filename">/etc/dhcpd.conf</code></a></dt><dt>3.9. <a href="secure.html#ch4namedcfg">DNS Master Configuration File <code class="filename">/etc/named.conf</code> Master Section</a></dt><dt>3.10. <a href="secure.html#ch4namedvarfwd">DNS Master Configuration File <code class="filename">/etc/named.conf</code> Forward Lookup Definition Section</a></dt><dt>3.11. <a href="secure.html#ch4namedvarrev">DNS Master Configuration File <code class="filename">/etc/named.conf</code> Reverse Lookup Definition Section</a></dt><dt>3.12. <a href="secure.html#eth1zone">DNS 192.168.1 Reverse Zone File</a></dt><dt>3.13. <a href="secure.html#eth2zone">DNS 192.168.2 Reverse Zone File</a></dt><dt>3.14. <a href="secure.html#abmasbiz">DNS Abmas.biz Forward Zone File</a></dt><dt>3.15. <a href="secure.html#abmasus">DNS Abmas.us Forward Zone File</a></dt><dt>4.1. <a href="Big500users.html#ch5-massivesmb">Server: MASSIVE (PDC), File: <code class="filename">/etc/samba/smb.conf</code></a></dt><dt>4.2. <a href="Big500users.html#ch5-dc-common">Server: MASSIVE (PDC), File: <code class="filename">/etc/samba/dc-common.conf</code></a></dt><dt>4.3. <a href="Big500users.html#ch5-commonsmb">Common Samba Configuration File: <code class="filename">/etc/samba/common.conf</code></a></dt><dt>4.4. <a href="Big500users.html#ch5-bldg1-smb">Server: BLDG1 (Member), File: smb.conf</a></dt><dt>4.5. <a href="Big500users.html#ch5-bldg2-smb">Server: BLDG2 (Member), File: smb.conf</a></dt><dt>4.6. <a href="Big500users.html#ch5-dommem-smb">Common Domain Member Include File: dom-mem.conf</a></dt><dt>4.7. <a href="Big500users.html#massive-dhcp">Server: MASSIVE, File: dhcpd.conf</a></dt><dt>4.8. <a href="Big500users.html#bldg1dhcp">Server: BLDG1, File: dhcpd.conf</a></dt><dt>4.9. <a href="Big500users.html#bldg2dhcp">Server: BLDG2, File: dhcpd.conf</a></dt><dt>4.10. <a href="Big500users.html#massive-nameda">Server: MASSIVE, File: named.conf, Part: A</a></dt><dt>4.11. <a href="Big500users.html#massive-namedb">Server: MASSIVE, File: named.conf, Part: B</a></dt><dt>4.12. <a href="Big500users.html#massive-namedc">Server: MASSIVE, File: named.conf, Part: C</a></dt><dt>4.13. <a href="Big500users.html#abmasbizdns">Forward Zone File: abmas.biz.hosts</a></dt><dt>4.14. <a href="Big500users.html#abmasusdns">Forward Zone File: abmas.biz.hosts</a></dt><dt>4.15. <a href="Big500users.html#bldg12nameda">Servers: BLDG1/BLDG2, File: named.conf, Part: A</a></dt><dt>4.16. <a href="Big500users.html#bldg12namedb">Servers: BLDG1/BLDG2, File: named.conf, Part: B</a></dt><dt>4.17. <a href="Big500users.html#ch5-initgrps">Initialize Groups Script, File: /etc/samba/initGrps.sh</a></dt><dt>5.1. <a href="happy.html#sbehap-dbconf">LDAP DB_CONFIG File</a></dt><dt>5.2. <a href="happy.html#sbehap-slapdconf">LDAP Master Configuration File <code class="filename">/etc/openldap/slapd.conf</code> Part A</a></dt><dt>5.3. <a href="happy.html#sbehap-slapdconf2">LDAP Master Configuration File <code class="filename">/etc/openldap/slapd.conf</code> Part B</a></dt><dt>5.4. <a href="happy.html#sbehap-nss01">Configuration File for NSS LDAP Support <code class="filename">/etc/ldap.conf</code></a></dt><dt>5.5. <a href="happy.html#sbehap-nss02">Configuration File for NSS LDAP Clients Support <code class="filename">/etc/ldap.conf</code></a></dt><dt>5.6. <a href="happy.html#sbehap-massive-smbconfa">LDAP Based <code class="filename">smb.conf</code> File, Server: MASSIVE global Section: Part A</a></dt><dt>5.7. <a href="happy.html#sbehap-massive-smbconfb">LDAP Based <code class="filename">smb.conf</code> File, Server: MASSIVE global Section: Part B</a></dt><dt>5.8. <a href="happy.html#sbehap-bldg1-smbconf">LDAP Based <code class="filename">smb.conf</code> File, Server: BLDG1</a></dt><dt>5.9. <a href="happy.html#sbehap-bldg2-smbconf">LDAP Based <code class="filename">smb.conf</code> File, Server: BLDG2</a></dt><dt>5.10. <a href="happy.html#sbehap-shareconfa">LDAP Based <code class="filename">smb.conf</code> File, Shares Section Part A</a></dt><dt>5.11. <a href="happy.html#sbehap-shareconfb">LDAP Based <code class="filename">smb.conf</code> File, Shares Section Part B</a></dt><dt>5.12. <a href="happy.html#sbehap-ldifadd">LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF</a></dt><dt>6.1. <a href="2000users.html#ch7-LDAP-master">LDAP Master Server Configuration File <code class="filename">/etc/openldap/slapd.conf</code></a></dt><dt>6.2. <a href="2000users.html#ch7-LDAP-slave">LDAP Slave Configuration File <code class="filename">/etc/openldap/slapd.conf</code></a></dt><dt>6.3. <a href="2000users.html#ch7-massmbconfA">Primary Domain Controller <code class="filename">smb.conf</code> File Part A</a></dt><dt>6.4. <a href="2000users.html#ch7-massmbconfB">Primary Domain Controller <code class="filename">smb.conf</code> File Part B</a></dt><dt>6.5. <a href="2000users.html#ch7-massmbconfC">Primary Domain Controller <code class="filename">smb.conf</code> File Part C</a></dt><dt>6.6. <a href="2000users.html#ch7-slvsmbocnfA">Backup Domain Controller <code class="filename">smb.conf</code> File Part A</a></dt><dt>6.7. <a href="2000users.html#ch7-slvsmbocnfB">Backup Domain Controller <code class="filename">smb.conf</code> File Part B</a></dt><dt>7.1. <a href="unixclients.html#ch9-sdmsdc">Samba Domain Member in Samba Domain Using LDAP <code class="filename">smb.conf</code> File</a></dt><dt>7.2. <a href="unixclients.html#ch9-ldifadd">LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF</a></dt><dt>7.3. <a href="unixclients.html#ch9-sdmlcnf">Configuration File for NSS LDAP Support <code class="filename">/etc/ldap.conf</code></a></dt><dt>7.4. <a href="unixclients.html#ch9-sdmnss">NSS using LDAP for Identity Resolution File: <code class="filename">/etc/nsswitch.conf</code></a></dt><dt>7.5. <a href="unixclients.html#ch0-NT4DSDM">Samba Domain Member Server Using Winbind <code class="filename">smb.conf</code> File for NT4 Domain</a></dt><dt>7.6. <a href="unixclients.html#ch0-NT4DSCM">Samba Domain Member Server Using Local Accounts <code class="filename">smb.conf</code> File for NT4 Domain</a></dt><dt>7.7. <a href="unixclients.html#ch9-adssdm">Samba Domain Member <code class="filename">smb.conf</code> File for Active Directory Membership</a></dt><dt>7.8. <a href="unixclients.html#sbe-idmapridex">Example <code class="filename">smb.conf</code> File Using <code class="constant">idmap_rid</code></a></dt><dt>7.9. <a href="unixclients.html#sbeunxa">Typical ADS Style Domain <code class="filename">smb.conf</code> File</a></dt><dt>7.10. <a href="unixclients.html#sbewinbindex">ADS Membership Using RFC2307bis Identity Resolution <code class="filename">smb.conf</code> File</a></dt><dt>7.11. <a href="unixclients.html#ch9-pamwnbdlogin">SUSE: PAM <code class="filename">login</code> Module Using Winbind</a></dt><dt>7.12. <a href="unixclients.html#ch9-pamwbndxdm">SUSE: PAM <code class="filename">xdm</code> Module Using Winbind</a></dt><dt>7.13. <a href="unixclients.html#ch9-rhsysauth">Red Hat 9: PAM System Authentication File: <code class="filename">/etc/pam.d/system-auth</code> Module Using Winbind</a></dt><dt>9.1. <a href="ntmigration.html#sbent4smb">NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: A</a></dt><dt>9.2. <a href="ntmigration.html#sbent4smb2">NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: B</a></dt><dt>9.3. <a href="ntmigration.html#sbentslapd">NT4 Migration LDAP Server Configuration File: <code class="filename">/etc/openldap/slapd.conf</code> Part A</a></dt><dt>9.4. <a href="ntmigration.html#sbentslapd2">NT4 Migration LDAP Server Configuration File: <code class="filename">/etc/openldap/slapd.conf</code> Part B</a></dt><dt>9.5. <a href="ntmigration.html#sbrntldapconf">NT4 Migration NSS LDAP File: <code class="filename">/etc/ldap.conf</code></a></dt><dt>9.6. <a href="ntmigration.html#sbentnss">NT4 Migration NSS Control File: <code class="filename">/etc/nsswitch.conf</code> (Stage:1)</a></dt><dt>9.7. <a href="ntmigration.html#sbentnss2">NT4 Migration NSS Control File: <code class="filename">/etc/nsswitch.conf</code> (Stage:2)</a></dt><dt>10.1. <a href="nw4migration.html#sbeamg">A Rough Tool to Create an LDIF File from the System Account Files</a></dt><dt>10.2. <a href="nw4migration.html#ch8ldap">NSS LDAP Control File /etc/ldap.conf</a></dt><dt>10.3. <a href="nw4migration.html#sbepu2">The PAM Control File <code class="filename">/etc/security/pam_unix2.conf</code></a></dt><dt>10.4. <a href="nw4migration.html#ch8smbconf">Samba Configuration File smb.conf Part A</a></dt><dt>10.5. <a href="nw4migration.html#ch8smbconf2">Samba Configuration File smb.conf Part B</a></dt><dt>10.6. <a href="nw4migration.html#ch8smbconf3">Samba Configuration File smb.conf Part C</a></dt><dt>10.7. <a href="nw4migration.html#ch8smbconf4">Samba Configuration File smb.conf Part D</a></dt><dt>10.8. <a href="nw4migration.html#ch8smbconf5">Samba Configuration File smb.conf Part E</a></dt><dt>10.9. <a href="nw4migration.html#sbersync">Rsync Script</a></dt><dt>10.10. <a href="nw4migration.html#sbexcld">Rsync Files Exclusion List <code class="filename">/root/excludes.txt</code></a></dt><dt>10.11. <a href="nw4migration.html#ch8ideal">Idealx smbldap-tools Control File Part A</a></dt><dt>10.12. <a href="nw4migration.html#ch8ideal2">Idealx smbldap-tools Control File Part B</a></dt><dt>10.13. <a href="nw4migration.html#ch8ideal3">Idealx smbldap-tools Control File Part C</a></dt><dt>10.14. <a href="nw4migration.html#ch8ideal4">Idealx smbldap-tools Control File Part D</a></dt><dt>10.15. <a href="nw4migration.html#ch8kix">Kixtart Control File File: logon.kix</a></dt><dt>10.16. <a href="nw4migration.html#ch8kix2">Kixtart Control File File: main.kix</a></dt><dt>10.17. <a href="nw4migration.html#ch8kix3">Kixtart Control File File: setup.kix, Part A</a></dt><dt>10.18. <a href="nw4migration.html#ch8kix3b">Kixtart Control File File: setup.kix, Part B</a></dt><dt>10.19. <a href="nw4migration.html#ch8kix4">Kixtart Control File File: acct.kix</a></dt><dt>12.1. <a href="DomApps.html#ch10-krb5conf">Kerberos Configuration File: <code class="filename">/etc/krb5.conf</code></a></dt><dt>12.2. <a href="DomApps.html#ch10-smbconf">Samba Configuration File: <code class="filename">/etc/samba/smb.conf</code></a></dt><dt>12.3. <a href="DomApps.html#ch10-etcnsscfg">NSS Configuration File Extract File: <code class="filename">/etc/nsswitch.conf</code></a></dt><dt>12.4. <a href="DomApps.html#etcsquidcfg">Squid Configuration File Extract <code class="filename">/etc/squid.conf</code> [ADMINISTRATIVE PARAMETERS Section]</a></dt><dt>12.5. <a href="DomApps.html#etcsquid2">Squid Configuration File extract File: <code class="filename">/etc/squid.conf</code> [AUTHENTICATION PARAMETERS Section]</a></dt><dt>15.1. <a href="appendix.html#ch12SL">A Useful Samba Control Script for SUSE Linux</a></dt><dt>15.2. <a href="appendix.html#ch12RHscript">A Sample Samba Control Script for Red Hat Linux</a></dt><dt>15.3. <a href="appendix.html#loopback">DNS Localhost Forward Zone File: <code class="filename">/var/lib/named/localhost.zone</code></a></dt><dt>15.4. <a href="appendix.html#dnsloopy">DNS Localhost Reverse Zone File: <code class="filename">/var/lib/named/127.0.0.zone</code></a></dt><dt>15.5. <a href="appendix.html#roothint">DNS Root Name Server Hint File: <code class="filename">/var/lib/named/root.hint</code></a></dt><dt>15.6. <a href="appendix.html#sbehap-ldapreconfa">LDAP Pre-configuration Script: <code class="filename">SMBLDAP-ldif-preconfig.sh</code> Part A</a></dt><dt>15.7. <a href="appendix.html#sbehap-ldapreconfb">LDAP Pre-configuration Script: <code class="filename">SMBLDAP-ldif-preconfig.sh</code> Part B</a></dt><dt>15.8. <a href="appendix.html#sbehap-ldapreconfc">LDAP Pre-configuration Script: <code class="filename">SMBLDAP-ldif-preconfig.sh</code> Part C</a></dt><dt>15.9. <a href="appendix.html#sbehap-ldifpata">LDIF Pattern File Used to Pre-configure LDAP Part A</a></dt><dt>15.10. <a href="appendix.html#sbehap-ldifpatb">LDIF Pattern File Used to Pre-configure LDAP Part B</a></dt><dt>15.11. <a href="appendix.html#lamcfg">Example LAM Configuration File <code class="filename">config.cfg</code></a></dt><dt>15.12. <a href="appendix.html#lamconf">LAM Profile Control File <code class="filename">lam.conf</code></a></dt></dl></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="pr01.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top"> </td><td width="20%" align="center"> </td><td width="40%" align="right" valign="top"> About the Cover Artwork</td></tr></table></div></body></html> -
branches/samba-3.0/docs/htmldocs/Samba3-ByExample/ix01.html
r44 r134 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Index</title><link rel="stylesheet" href=" samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="go01.html" title="Glossary"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Index</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="go01.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> </td></tr></table><hr></div><div class="index"><div class="titlepage"><div><div><h2 class="title"><a name="id390342"></a>Index</h2></div></div></div><div class="index"><div class="indexdiv"><h3>Symbols</h3><dl><dt>#delete group script, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a></dt><dt>#delete user from group script, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a></dt><dt>#delete user script, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a></dt><dt>#wins support, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a></dt><dt>%LOGONSERVER%, <a href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>%USERNAME%, <a href="happy.html#id337279">Roaming Profile Background</a>, <a href="happy.html#id337546">Profile Changes</a></dt><dt>%USERPROFILE%, <a href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>/data/ldap, <a href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>/etc/cups/mime.convs, <a href="simple.html#id317589">Implementation</a>, <a href="simple.html#AcctgNet">Implementation</a></dt><dt>/etc/cups/mime.types, <a href="simple.html#id317589">Implementation</a>, <a href="simple.html#AcctgNet">Implementation</a></dt><dt>/etc/dhcpd.conf, <a href="small.html#id321546">Implementation</a>, <a href="small.html#id323199">Validation</a>, <a href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a>, <a href="secure.html#ch4valid">Validation</a></dt><dt>/etc/exports, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></dt><dt>/etc/group, <a href="happy.html#id336802">Technical Issues</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="upgrades.html#id363672">Replacing a Domain Member Server</a>, <a href="ntmigration.html#id367572">Questions and Answers</a>, <a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>/etc/hosts, <a href="simple.html#id316708">Implementation</a>, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#ch4bsc">Basic System Configuration</a>, <a href="secure.html#ch4valid">Validation</a>, <a href="Big500users.html#id331694">Server Preparation: All Servers</a>, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="DomApps.html#id378243">Kerberos Configuration</a>, <a href="HA.html#id380877">Bad Hostnames</a></dt><dt>/etc/krb5.conf, <a href="unixclients.html#id358814">IDMAP Storage in LDAP using Winbind</a>, <a href="DomApps.html#id378243">Kerberos Configuration</a></dt><dt>/etc/ldap.conf, <a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a href="unixclients.html#id358814">IDMAP Storage in LDAP using Winbind</a>, <a href="unixclients.html#id359380">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>/etc/mime.convs, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a href="Big500users.html#id331694">Server Preparation: All Servers</a>, <a href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>/etc/mime.types, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a href="Big500users.html#id331694">Server Preparation: All Servers</a>, <a href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>/etc/named.conf, <a href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></dt><dt>/etc/nsswitch.conf, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a>, <a href="secure.html#ch4valid">Validation</a>, <a href="Big500users.html#id332221">Configuration for Server: MASSIVE</a>, <a href="Big500users.html#ch5-domsvrspec">Configuration Specific to Domain Member Servers: BLDG1, BLDG2</a>, <a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#id358229">IDMAP_RID with Winbind</a>, <a href="unixclients.html#id359380">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a></dt><dt>/etc/openldap/slapd.conf, <a href="happy.html#id338019">Debugging LDAP</a>, <a href="happy.html#ldapsetup">OpenLDAP Server Configuration</a>, <a href="2000users.html#id348912">Implementation</a></dt><dt>/etc/passwd, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id332221">Configuration for Server: MASSIVE</a>, <a href="happy.html#id341324">LDAP Initialization and Creation of User and Group Accounts</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="upgrades.html#id363672">Replacing a Domain Member Server</a>, <a href="ntmigration.html#id364468">Technical Issues</a>, <a href="ntmigration.html#id367572">Questions and Answers</a>, <a href="nw4migration.html#id368732">Technical Issues</a>, <a href="kerberos.html#id375952">Share Point Directory and File Permissions</a>, <a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a href="primer.html#id387800">Findings and Comments</a></dt><dt>/etc/rc.d/boot.local, <a href="secure.html#ch4bsc">Basic System Configuration</a>, <a href="Big500users.html#id332221">Configuration for Server: MASSIVE</a></dt><dt>/etc/rc.d/rc.local, <a href="small.html#id321546">Implementation</a></dt><dt>/etc/resolv.conf, <a href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a>, <a href="Big500users.html#id331694">Server Preparation: All Servers</a></dt><dt>/etc/samba, <a href="appendix.html#id383041">Samba System File Location</a></dt><dt>/etc/samba/secrets.tdb, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>/etc/samba/smbusers, <a href="Big500users.html#id331694">Server Preparation: All Servers</a></dt><dt>/etc/shadow, <a href="upgrades.html#id363672">Replacing a Domain Member Server</a>, <a href="nw4migration.html#id368732">Technical Issues</a></dt><dt>/etc/squid/squid.conf, <a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>/etc/syslog.conf, <a href="happy.html#id338019">Debugging LDAP</a></dt><dt>/etc/xinetd.d, <a href="secure.html#procstart">Process Startup Configuration</a>, <a href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dt>/lib/libnss_ldap.so.2, <a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dt>/opt/IDEALX/sbin, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a></dt><dt>/proc/sys/net/ipv4/ip_forward, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#ch4bsc">Basic System Configuration</a></dt><dt>/usr/bin, <a href="appendix.html#id383041">Samba System File Location</a></dt><dt>/usr/lib/samba, <a href="appendix.html#id383041">Samba System File Location</a></dt><dt>/usr/local, <a href="appendix.html#id383041">Samba System File Location</a></dt><dt>/usr/local/samba, <a href="appendix.html#id383041">Samba System File Location</a></dt><dt>/usr/local/samba/var/locks, <a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></dt><dt>/usr/sbin, <a href="appendix.html#id383041">Samba System File Location</a></dt><dt>/usr/share, <a href="appendix.html#id383041">Samba System File Location</a></dt><dt>/usr/share/samba/swat, <a href="appendix.html#id383041">Samba System File Location</a></dt><dt>/usr/share/swat, <a href="appendix.html#id383041">Samba System File Location</a></dt><dt>/var/cache/samba, <a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></dt><dt>/var/lib/samba, <a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a href="appendix.html#id383041">Samba System File Location</a></dt><dt>/var/log/ldaplogs, <a href="happy.html#id338019">Debugging LDAP</a></dt><dt>/var/log/samba, <a href="appendix.html#id383041">Samba System File Location</a></dt><dt>8-bit, <a href="upgrades.html#id362458">International Language Support</a></dt></dl></div><div class="indexdiv"><h3></h3><dl><dt>, <a href="secure.html#ch4appscfg">Application Share Configuration</a>, <a href="happy.html#sbehap-ppc">Addition of Machines to the Domain</a>, <a href="unixclients.html#id358229">IDMAP_RID with Winbind</a>, <a href="upgrades.html#sbeug1">Location of config files</a></dt><dd><dl><dt>Domain account, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>liability, <a href="kerberos.html#id373203">Dissection and Discussion</a></dt><dt>logon, <a href="simple.html#id317589">Implementation</a></dt><dt>problem, <a href="kerberos.html#id373203">Dissection and Discussion</a></dt><dt>transparent inter-operability, <a href="DomApps.html#id379827">Questions and Answers</a></dt></dl></dd></dl></div><div class="indexdiv"><h3>A</h3><dl><dt>abmas-netfw.sh, <a href="secure.html#ch4bsc">Basic System Configuration</a></dt><dt>abort shutdown script, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="2000users.html#id348912">Implementation</a></dt><dt>accept, <a href="secure.html#ch4ptrcfg">Printer Configuration</a></dt><dt>accepts liability, <a href="kerberos.html#id373203">Dissection and Discussion</a></dt><dt>access, <a href="kerberos.html#id373574">Technical Issues</a>, <a href="kerberos.html#id375528">Checkpoint Controls</a></dt><dt>access control, <a href="kerberos.html#id374766">Kerberos Exposed</a>, <a href="kerberos.html#id376370">Using the MMC Computer Management Interface</a></dt><dt>Access Control Lists (see ACLs)</dt><dt>access control settings, <a href="kerberos.html#id375060">Share Access Controls</a></dt><dt>access controls, <a href="kerberos.html#id373574">Technical Issues</a>, <a href="kerberos.html#id375395">Share Definition Controls</a></dt><dt>accessible, <a href="kerberos.html#id375952">Share Point Directory and File Permissions</a></dt><dt>account, <a href="happy.html#id336072">Regarding LDAP Directories and Windows Computer Accounts</a>, <a href="kerberos.html#id375060">Share Access Controls</a></dt><dd><dl><dt>ADS Domain, <a href="kerberos.html#id373574">Technical Issues</a></dt></dl></dd><dt>account credentials, <a href="primer.html#id387800">Findings and Comments</a></dt><dt>account information, <a href="unixclients.html#id360240">Questions and Answers</a></dt><dt>account names, <a href="ntmigration.html#id367572">Questions and Answers</a></dt><dt>account policies, <a href="appendix.html#id384378">The LDAP Account Manager</a></dt><dt>accountable, <a href="kerberos.html#id372607">Introduction</a>, <a href="kerberos.html#id373203">Dissection and Discussion</a></dt><dt>accounts</dt><dd><dl><dt>authoritative, <a href="unixclients.html#id353091">Technical Issues</a></dt><dt>Domain, <a href="ntmigration.html#id364185">Introduction</a>, <a href="ntmigration.html#id367572">Questions and Answers</a></dt><dt>group, <a href="ntmigration.html#id364185">Introduction</a>, <a href="ntmigration.html#id367572">Questions and Answers</a>, <a href="kerberos.html#id372607">Introduction</a></dt><dt>machine, <a href="ntmigration.html#id364185">Introduction</a>, <a href="ntmigration.html#id367572">Questions and Answers</a></dt><dt>manage, <a href="appendix.html#id384378">The LDAP Account Manager</a></dt><dt>user, <a href="ntmigration.html#id364185">Introduction</a>, <a href="ntmigration.html#id367572">Questions and Answers</a>, <a href="kerberos.html#id372607">Introduction</a></dt></dl></dd><dt>ACL, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a>, <a href="kerberos.html#id375528">Checkpoint Controls</a></dt><dt>ACLs, <a href="happy.html#id347320">Key Points Learned</a>, <a href="kerberos.html#id375060">Share Access Controls</a>, <a href="kerberos.html#id375395">Share Definition Controls</a></dt><dt>acquisitions, <a href="kerberos.html#id372607">Introduction</a></dt><dt>Act!, <a href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>ACT! database, <a href="appendix.html#id385863">Act! Database Sharing</a></dt><dt>Act!Diag, <a href="appendix.html#id385863">Act! Database Sharing</a></dt><dt>Active Directory, <a href="happy.html#id336400">Dissection and Discussion</a>, <a href="happy.html#sbehap-locgrppol">The Local Group Policy</a>, <a href="2000users.html#id347824">Dissection and Discussion</a>, <a href="unixclients.html#id353039">Assignment Tasks</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="unixclients.html#id358229">IDMAP_RID with Winbind</a>, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="kerberos.html#id372607">Introduction</a>, <a href="kerberos.html#id377005">Key Points Learned</a>, <a href="kerberos.html#id377127">Questions and Answers</a>, <a href="DomApps.html">Integrating Additional Services</a>, <a href="DomApps.html#id377734">Assignment Tasks</a>, <a href="DomApps.html#id377849">Technical Issues</a>, <a href="DomApps.html#id378606">Samba Configuration</a>, <a href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dd><dl><dt>authentication, <a href="DomApps.html#id379397">Squid Configuration</a></dt><dt>domain, <a href="DomApps.html#id378606">Samba Configuration</a></dt><dt>join, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>management tools, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>realm, <a href="HA.html#id380877">Bad Hostnames</a></dt><dt>Replacement, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>server, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="DomApps.html#id378243">Kerberos Configuration</a></dt><dt>Server, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>tree, <a href="DomApps.html#id378606">Samba Configuration</a></dt></dl></dd><dt>active directory, <a href="ntmigration.html#id364468">Technical Issues</a></dt><dt>AD printer publishing, <a href="happy.html#id346795">Uploading Printer Drivers to Samba Servers</a></dt><dt>ADAM, <a href="happy.html#id336400">Dissection and Discussion</a>, <a href="unixclients.html#id358814">IDMAP Storage in LDAP using Winbind</a></dt><dt>add group script, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a href="upgrades.html#id362947">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>add machine script, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a href="upgrades.html#id362947">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>Add Printer Wizard</dt><dd><dl><dt>APW, <a href="happy.html#id346795">Uploading Printer Drivers to Samba Servers</a></dt></dl></dd><dt>add user script, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a href="upgrades.html#id362947">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>add user to group script, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="upgrades.html#id362947">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>adduser, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id332221">Configuration for Server: MASSIVE</a></dt><dt>adequate precautions, <a href="upgrades.html#id361313">Introduction</a></dt><dt>admin users, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>administrative installation, <a href="secure.html#ch4appscfg">Application Share Configuration</a></dt><dt>administrative rights, <a href="kerberos.html#id375528">Checkpoint Controls</a></dt><dt>administrator, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id331694">Server Preparation: All Servers</a></dt><dt>ADMT, <a href="upgrades.html#id364040">Migration of Samba Accounts to Active Directory</a></dt><dt>ADS, <a href="unixclients.html#id358814">IDMAP Storage in LDAP using Winbind</a>, <a href="kerberos.html#id373574">Technical Issues</a>, <a href="DomApps.html#id378243">Kerberos Configuration</a>, <a href="HA.html#id380877">Bad Hostnames</a></dt><dd><dl><dt>server, <a href="kerberos.html#id373574">Technical Issues</a></dt></dl></dd><dt>ADS Domain, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>affordability, <a href="2000users.html#id348183">The Nature of Windows Networking Protocols</a></dt><dt>alarm, <a href="kerberos.html#id372607">Introduction</a></dt><dt>algorithm, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>allow trusted domains, <a href="unixclients.html#id358229">IDMAP_RID with Winbind</a></dt><dt>alternative, <a href="kerberos.html#id373203">Dissection and Discussion</a></dt><dt>analysis, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>anonymous connection, <a href="small.html#id323199">Validation</a>, <a href="secure.html#ch4valid">Validation</a></dt><dt>Apache Web server, <a href="DomApps.html#id379827">Questions and Answers</a></dt><dt>appliance mode, <a href="unixclients.html#id353091">Technical Issues</a></dt><dt>application server, <a href="secure.html#id324638">Technical Issues</a>, <a href="secure.html#ch4appscfg">Application Share Configuration</a></dt><dt>application servers, <a href="2000users.html#id348183">The Nature of Windows Networking Protocols</a></dt><dt>application/octet-stream, <a href="simple.html#id317589">Implementation</a>, <a href="simple.html#AcctgNet">Implementation</a>, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a href="Big500users.html#id331694">Server Preparation: All Servers</a>, <a href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>APW, <a href="happy.html#id346795">Uploading Printer Drivers to Samba Servers</a></dt><dt>arp, <a href="secure.html#ch4valid">Validation</a></dt><dt>assessment, <a href="kerberos.html#id372607">Introduction</a></dt><dt>assistance, <a href="ch14.html#id382184">Free Support</a></dt><dt>assumptions, <a href="HA.html#id382035">Key Points Learned</a></dt><dt>authconfig, <a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dt>authenticate, <a href="nw4migration.html#id368982">LDAP Server Configuration</a>, <a href="DomApps.html#id378606">Samba Configuration</a></dt><dt>authenticated, <a href="DomApps.html#id377734">Assignment Tasks</a></dt><dt>authenticated connection, <a href="small.html#id323199">Validation</a>, <a href="secure.html#ch4valid">Validation</a></dt><dt>authentication, <a href="2000users.html#id348183">The Nature of Windows Networking Protocols</a>, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="nw4migration.html#id368660">Dissection and Discussion</a>, <a href="DomApps.html">Integrating Additional Services</a>, <a href="DomApps.html#id377849">Technical Issues</a>, <a href="DomApps.html#id379127">NSS Configuration</a>, <a href="DomApps.html#id379827">Questions and Answers</a></dt><dd><dl><dt>plain-text, <a href="DomApps.html#id379827">Questions and Answers</a></dt></dl></dd><dt>authentication process, <a href="unixclients.html#id353760">Implementation</a></dt><dt>authentication protocols, <a href="DomApps.html#id379772">Key Points Learned</a></dt><dt>authoritative, <a href="unixclients.html#id353091">Technical Issues</a></dt><dt>authorized location, <a href="kerberos.html#id374766">Kerberos Exposed</a></dt><dt>auto-generated SID, <a href="ntmigration.html#id367572">Questions and Answers</a></dt><dt>automatically allocate, <a href="unixclients.html#id353091">Technical Issues</a></dt><dt>availability, <a href="HA.html">Performance, Reliability, and Availability</a></dt></dl></div><div class="indexdiv"><h3>B</h3><dl><dt>backends, <a href="DomApps.html">Integrating Additional Services</a></dt><dt>background communication, <a href="2000users.html#id352211">Questions and Answers</a></dt><dt>Backup, <a href="kerberos.html#id372607">Introduction</a></dt><dt>Backup Domain Controller (see BDC)</dt><dt>bandwidth, <a href="DomApps.html#id377734">Assignment Tasks</a></dt><dd><dl><dt>requirements, <a href="2000users.html#id348107">User Needs</a></dt></dl></dd><dt>bandwidth calculations, <a href="secure.html#id324872">Hardware Requirements</a></dt><dt>BDC, <a href="Big500users.html#id330784">Technical Issues</a>, <a href="happy.html">Making Happy Users</a>, <a href="happy.html#id336272">Assignment Tasks</a>, <a href="happy.html#id336400">Dissection and Discussion</a>, <a href="happy.html#id338636">Samba Server Implementation</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="2000users.html#id348183">The Nature of Windows Networking Protocols</a>, <a href="2000users.html#id352072">Key Points Learned</a>, <a href="unixclients.html#id353091">Technical Issues</a>, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a>, <a href="ntmigration.html#id367204">NT4 Migration Using tdbsam Backend</a>, <a href="HA.html#id381603">Use and Location of BDCs</a></dt><dt>benefit, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="kerberos.html#id373203">Dissection and Discussion</a></dt><dt>best practices, <a href="kerberos.html#id372607">Introduction</a></dt><dt>bias, <a href="kerberos.html#id377127">Questions and Answers</a></dt><dt>binary database, <a href="secure.html#id325041">Implementation</a></dt><dt>binary files, <a href="upgrades.html#id363384">Updating a Samba-3 Installation</a></dt><dt>binary package, <a href="upgrades.html#id363384">Updating a Samba-3 Installation</a></dt><dt>bind interfaces only, <a href="secure.html#id325041">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></dt><dt>broadcast, <a href="HA.html#id381054">Routed Networks</a>, <a href="primer.html#chap01qa">Questions and Answers</a></dt><dd><dl><dt>directed, <a href="2000users.html#id348183">The Nature of Windows Networking Protocols</a></dt><dt>mailslot, <a href="2000users.html#id348183">The Nature of Windows Networking Protocols</a></dt></dl></dd><dt>broadcast messages, <a href="secure.html#id325041">Implementation</a></dt><dt>broadcast storms, <a href="HA.html#id381218">Network Collisions</a></dt><dt>broken, <a href="kerberos.html#id373203">Dissection and Discussion</a></dt><dt>broken behavior, <a href="HA.html#id380391">Dissection and Discussion</a></dt><dt>browse, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>browse master, <a href="primer.html#id386612">Findings</a></dt><dt>Browse Master, <a href="primer.html#chap01qa">Questions and Answers</a></dt><dt>browse.dat, <a href="upgrades.html#id363672">Replacing a Domain Member Server</a></dt><dt>browseable, <a href="simple.html#id317589">Implementation</a>, <a href="simple.html#AcctgNet">Implementation</a>, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>Browser Election Service, <a href="primer.html#chap01qa">Questions and Answers</a></dt><dt>browsing, <a href="kerberos.html#id373574">Technical Issues</a>, <a href="DomApps.html#id377849">Technical Issues</a>, <a href="primer.html#id386266">Assignment Tasks</a></dt><dt>budgetted, <a href="kerberos.html#id372607">Introduction</a></dt><dt>bug fixes, <a href="kerberos.html#id372607">Introduction</a></dt><dt>bug report, <a href="ch14.html#id382184">Free Support</a></dt></dl></div><div class="indexdiv"><h3>C</h3><dl><dt>cache, <a href="appendix.html#id385938">Opportunistic Locking Controls</a></dt><dt>cache directories, <a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>caching, <a href="HA.html#id381308">Samba Configuration</a></dt><dt>case sensitive, <a href="HA.html#id381957">Large Directories</a></dt><dt>case-sensitive, <a href="DomApps.html#id378243">Kerberos Configuration</a></dt><dt>centralized storage, <a href="unixclients.html#id360240">Questions and Answers</a></dt><dt>character set, <a href="upgrades.html#id362458">International Language Support</a></dt><dt>check samba daemons, <a href="small.html#id323199">Validation</a>, <a href="secure.html#ch4valid">Validation</a></dt><dt>check-point, <a href="kerberos.html#id375395">Share Definition Controls</a></dt><dt>check-point controls, <a href="kerberos.html#id375528">Checkpoint Controls</a></dt><dt>Checkpoint Controls, <a href="kerberos.html#id375528">Checkpoint Controls</a></dt><dt>chgrp, <a href="DomApps.html#id378606">Samba Configuration</a></dt><dt>chkconfig, <a href="simple.html#id316708">Implementation</a>, <a href="simple.html#id317589">Implementation</a>, <a href="simple.html#AcctgNet">Implementation</a>, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#procstart">Process Startup Configuration</a>, <a href="Big500users.html#ch5-procstart">Process Startup Configuration</a>, <a href="2000users.html#id348912">Implementation</a></dt><dt>chmod, <a href="DomApps.html#id378606">Samba Configuration</a></dt><dt>choice, <a href="kerberos.html#id373203">Dissection and Discussion</a>, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>chown, <a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>CIFS, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a>, <a href="primer.html#id386612">Findings</a></dt><dt>cifsfs, <a href="HA.html#id380391">Dissection and Discussion</a></dt><dt>clean database, <a href="ntmigration.html#id367572">Questions and Answers</a></dt><dt>clients per DC, <a href="happy.html">Making Happy Users</a></dt><dt>Clock skew, <a href="DomApps.html#id378243">Kerberos Configuration</a></dt><dt>cluster, <a href="HA.html#id380314">Introduction</a></dt><dt>clustering, <a href="HA.html#id380314">Introduction</a>, <a href="HA.html#id381688">For Scalability, Use SAN-Based Storage on Samba Servers</a></dt><dt>code maintainer, <a href="ch14.html#id382184">Free Support</a></dt><dt>codepage, <a href="upgrades.html#id362458">International Language Support</a></dt><dt>collision rates, <a href="HA.html#id381218">Network Collisions</a></dt><dt>comment, <a href="simple.html#id317589">Implementation</a>, <a href="simple.html#AcctgNet">Implementation</a>, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>commercial, <a href="kerberos.html#id373203">Dissection and Discussion</a></dt><dt>commercial software, <a href="kerberos.html#id373203">Dissection and Discussion</a></dt><dt>commercial support, <a href="ch14.html">Samba Support</a>, <a href="ch14.html#id382382">Commercial Support</a></dt><dt>Common Internet File System (see CIFS)</dt><dt>comparison</dt><dd><dl><dt>Active Directory & OpenLDAP, <a href="happy.html#id336400">Dissection and Discussion</a></dt></dl></dd><dt>compat, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>compatible, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>compile-time, <a href="upgrades.html#sbeug1">Location of config files</a></dt><dt>complexities, <a href="HA.html#id380391">Dissection and Discussion</a></dt><dt>compromise, <a href="happy.html#id336196">Introduction</a>, <a href="kerberos.html#id372607">Introduction</a>, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>computer account, <a href="DomApps.html#id378606">Samba Configuration</a></dt><dt>Computer Management, <a href="kerberos.html#id375060">Share Access Controls</a>, <a href="kerberos.html#id377127">Questions and Answers</a></dt><dt>computer name, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a></dt><dt>condemns, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>conferences, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>configuration files, <a href="upgrades.html#id361313">Introduction</a></dt><dt>configure.pl, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a></dt><dt>connection, <a href="kerberos.html#id375060">Share Access Controls</a></dt><dt>connectivity, <a href="ntmigration.html#id367572">Questions and Answers</a></dt><dt>consequential risk, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>consultant, <a href="simple.html#id316598">Drafting Office</a>, <a href="kerberos.html#id372607">Introduction</a>, <a href="kerberos.html#id373203">Dissection and Discussion</a></dt><dt>consumer, <a href="kerberos.html#id373203">Dissection and Discussion</a>, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>consumer expects, <a href="ch14.html">Samba Support</a></dt><dt>contiguous directory, <a href="2000users.html#id348912">Implementation</a></dt><dt>contributions, <a href="upgrades.html">Updating Samba-3</a></dt><dt>control files, <a href="upgrades.html#id363384">Updating a Samba-3 Installation</a></dt><dt>convmv, <a href="upgrades.html#id362458">International Language Support</a></dt><dt>copy, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>corrective action, <a href="HA.html#id381824">Hardware Problems</a></dt><dt>cost, <a href="kerberos.html#id373203">Dissection and Discussion</a></dt><dt>cost-benefit, <a href="nw4migration.html#id368561">Assignment Tasks</a></dt><dt>country of origin, <a href="ch14.html#id382382">Commercial Support</a></dt><dt>Courier-IMAP, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>create mask, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>credential, <a href="kerberos.html#id375395">Share Definition Controls</a></dt><dt>credentials, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>crippled, <a href="ntmigration.html#id364312">Dissection and Discussion</a></dt><dt>criticism, <a href="kerberos.html">Active Directory, Kerberos, and Security</a>, <a href="kerberos.html#id372607">Introduction</a></dt><dt>Critics, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>Cryptographic, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>CUPS, <a href="simple.html#id317402">Dissection and Discussion</a>, <a href="small.html#id321342">Technical Issues</a>, <a href="small.html#id321546">Implementation</a>, <a href="small.html#id323841">Key Points Learned</a>, <a href="secure.html#id325041">Implementation</a>, <a href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a href="Big500users.html#id331694">Server Preparation: All Servers</a>, <a href="happy.html#id336272">Assignment Tasks</a>, <a href="happy.html#id337689">Installation of Printer Driver Auto-Download</a>, <a href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dd><dl><dt>queue, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a href="Big500users.html#id331694">Server Preparation: All Servers</a>, <a href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt></dl></dd><dt>cups options, <a href="secure.html#id325866">Samba Configuration</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>cupsd, <a href="secure.html#ch4bsc">Basic System Configuration</a></dt><dt>customer expected, <a href="ch14.html">Samba Support</a></dt><dt>customers, <a href="ch14.html">Samba Support</a></dt></dl></div><div class="indexdiv"><h3>D</h3><dl><dt>daemon, <a href="simple.html#validate1">Validation</a>, <a href="secure.html#ch4bsc">Basic System Configuration</a>, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a>, <a href="DomApps.html#id377849">Technical Issues</a>, <a href="DomApps.html#id379827">Questions and Answers</a>, <a href="appendix.html#id383432">Starting Samba</a></dt><dt>daemon control, <a href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dt>data</dt><dd><dl><dt>corruption, <a href="happy.html">Making Happy Users</a></dt><dt>integrity, <a href="unixclients.html#id360240">Questions and Answers</a></dt></dl></dd><dt>data corruption, <a href="HA.html#id381824">Hardware Problems</a>, <a href="appendix.html#id385863">Act! Database Sharing</a></dt><dt>data integrity, <a href="HA.html#id381824">Hardware Problems</a>, <a href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>data storage, <a href="simple.html#AcctgNet">Implementation</a></dt><dt>database, <a href="2000users.html#id347824">Dissection and Discussion</a>, <a href="2000users.html#id352211">Questions and Answers</a>, <a href="nw4migration.html#id368660">Dissection and Discussion</a></dt><dt>database applications, <a href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>DB_CONFIG, <a href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>DCE, <a href="kerberos.html#id374766">Kerberos Exposed</a></dt><dt>DDNS (see dynamic DNS)</dt><dt>Debian, <a href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>default devmode, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a></dt><dt>default installation, <a href="appendix.html#id383041">Samba System File Location</a></dt><dt>default password, <a href="appendix.html#id384378">The LDAP Account Manager</a></dt><dt>default profile, <a href="happy.html#id336272">Assignment Tasks</a>, <a href="happy.html#id336802">Technical Issues</a></dt><dt>Default User, <a href="happy.html#id337546">Profile Changes</a>, <a href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>defective</dt><dd><dl><dt>cables, <a href="HA.html#id381824">Hardware Problems</a></dt><dt>HUBs, <a href="HA.html#id381824">Hardware Problems</a></dt><dt>switches, <a href="HA.html#id381824">Hardware Problems</a></dt></dl></dd><dt>defects, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>defensible standards, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>defragmentation, <a href="secure.html#ch4wincfg">Windows Client Configuration</a></dt><dt>delete group script, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="upgrades.html#id362947">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>delete user from group script, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="upgrades.html#id362947">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>delete user script, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a></dt><dt>delimiter, <a href="kerberos.html#id375528">Checkpoint Controls</a></dt><dt>dependability, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>deployment, <a href="ch14.html#id382184">Free Support</a></dt><dt>desired security setting, <a href="kerberos.html#id376809">Setting Posix ACLs in UNIX/Linux</a></dt><dt>development, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>DHCP, <a href="small.html#id321342">Technical Issues</a>, <a href="small.html#id321546">Implementation</a>, <a href="small.html#id323841">Key Points Learned</a>, <a href="secure.html#ch4wincfg">Windows Client Configuration</a>, <a href="Big500users.html#ch5wincfg">Windows Client Configuration</a>, <a href="2000users.html#id348183">The Nature of Windows Networking Protocols</a>, <a href="2000users.html#id352211">Questions and Answers</a></dt><dd><dl><dt>client, <a href="HA.html#id380877">Bad Hostnames</a></dt><dt>relay, <a href="Big500users.html#id330784">Technical Issues</a></dt><dt>Relay Agent, <a href="2000users.html#id352211">Questions and Answers</a></dt><dt>request, <a href="2000users.html#id352211">Questions and Answers</a></dt><dt>requests, <a href="Big500users.html#id330784">Technical Issues</a></dt><dt>servers, <a href="2000users.html#id352211">Questions and Answers</a></dt><dt>traffic, <a href="2000users.html#id352211">Questions and Answers</a></dt></dl></dd><dt>dhcp client validation, <a href="small.html#id323199">Validation</a>, <a href="secure.html#ch4valid">Validation</a></dt><dt>DHCP Server, <a href="small.html#id321546">Implementation</a></dt><dt>DHCP server, <a href="secure.html#id324638">Technical Issues</a></dt><dt>diagnostic, <a href="unixclients.html#id358814">IDMAP Storage in LDAP using Winbind</a></dt><dt>diffusion, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>digital rights, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>digital sign'n'seal, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>digits, <a href="HA.html#id380877">Bad Hostnames</a></dt><dt>diligence, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>directory, <a href="2000users.html#id347824">Dissection and Discussion</a>, <a href="unixclients.html#id353679">Political Issues</a>, <a href="upgrades.html#sbeug1">Location of config files</a></dt><dd><dl><dt>Computers container, <a href="happy.html#id341324">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>management, <a href="happy.html#id336400">Dissection and Discussion</a></dt><dt>People container, <a href="happy.html#id341324">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>replication, <a href="happy.html#id336400">Dissection and Discussion</a></dt><dt>schema, <a href="happy.html#id336400">Dissection and Discussion</a></dt><dt>server, <a href="happy.html#id336802">Technical Issues</a></dt><dt>synchronization, <a href="happy.html#id336400">Dissection and Discussion</a></dt></dl></dd><dt>directory mask, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>directory tree, <a href="kerberos.html#id376809">Setting Posix ACLs in UNIX/Linux</a></dt><dt>disable, <a href="kerberos.html#id372607">Introduction</a></dt><dt>disable spoolss, <a href="simple.html#id317589">Implementation</a>, <a href="simple.html#AcctgNet">Implementation</a></dt><dt>disaster recovery, <a href="kerberos.html#id372607">Introduction</a></dt><dt>disk image, <a href="happy.html#id336272">Assignment Tasks</a></dt><dt>disruptive, <a href="ntmigration.html#id364312">Dissection and Discussion</a></dt><dt>distributed, <a href="2000users.html#id348480">Identity Management Needs</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="HA.html#id381733">Distribute Network Load with MSDFS</a></dt><dt>distributed domain, <a href="2000users.html#id348480">Identity Management Needs</a></dt><dt>DMB, <a href="primer.html#chap01qa">Questions and Answers</a></dt><dt>DMS, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a>, <a href="upgrades.html#id363672">Replacing a Domain Member Server</a></dt><dt>DNS, <a href="small.html#id321342">Technical Issues</a>, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id324638">Technical Issues</a>, <a href="2000users.html#id348183">The Nature of Windows Networking Protocols</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a>, <a href="HA.html#id380877">Bad Hostnames</a>, <a href="HA.html#id381054">Routed Networks</a>, <a href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dd><dl><dt>configuration, <a href="unixclients.html#id360240">Questions and Answers</a></dt><dt>Dynamic, <a href="2000users.html#id352211">Questions and Answers</a></dt><dt>dynamic, <a href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dt>lookup, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="DomApps.html#id378243">Kerberos Configuration</a></dt><dt>name lookup, <a href="HA.html#id380877">Bad Hostnames</a></dt><dt>SRV records, <a href="DomApps.html#id378243">Kerberos Configuration</a></dt><dt>suffix, <a href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt></dl></dd><dt>DNS server, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></dt><dt>document the settings, <a href="HA.html#id381308">Samba Configuration</a></dt><dt>documentation, <a href="kerberos.html#id373203">Dissection and Discussion</a>, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>documented, <a href="HA.html#id381308">Samba Configuration</a></dt><dt>Domain, <a href="small.html#id321342">Technical Issues</a></dt><dd><dl><dt>groups, <a href="small.html#id321342">Technical Issues</a></dt></dl></dd><dt>domain</dt><dd><dl><dt>Active Directory, <a href="DomApps.html#id377849">Technical Issues</a></dt><dt>controller, <a href="upgrades.html#id363862">Replacing a Domain Controller</a></dt><dt>joining, <a href="appendix.html">A Collection of Useful Tidbits</a></dt><dt>trusted, <a href="unixclients.html#id360240">Questions and Answers</a></dt></dl></dd><dt>Domain accounts, <a href="unixclients.html#id353091">Technical Issues</a></dt><dt>Domain Administrator, <a href="kerberos.html#id375060">Share Access Controls</a></dt><dt>Domain Controller, <a href="small.html#id323841">Key Points Learned</a>, <a href="2000users.html#id348183">The Nature of Windows Networking Protocols</a>, <a href="unixclients.html#id353091">Technical Issues</a>, <a href="unixclients.html#id353760">Implementation</a>, <a href="HA.html#id381603">Use and Location of BDCs</a></dt><dd><dl><dt>closest, <a href="2000users.html#id348183">The Nature of Windows Networking Protocols</a></dt></dl></dd><dt>domain controller, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a>, <a href="upgrades.html#id362947">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>domain controllers, <a href="unixclients.html#id353091">Technical Issues</a></dt><dt>Domain Controllers, <a href="unixclients.html#id360240">Questions and Answers</a></dt><dt>Domain Groups</dt><dd><dl><dt>well-known, <a href="appendix.html#id383921">Initialization of the LDAP Database</a></dt></dl></dd><dt>Domain join, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>domain logons, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>domain master, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="ntmigration.html#id367204">NT4 Migration Using tdbsam Backend</a></dt><dt>Domain Master Browser (see DMB)</dt><dt>Domain Member, <a href="HA.html#id381603">Use and Location of BDCs</a></dt><dd><dl><dt>authoritative</dt><dd><dl><dt>local accounts, <a href="unixclients.html#id353091">Technical Issues</a></dt></dl></dd><dt>client, <a href="unixclients.html#id353760">Implementation</a></dt><dt>desktop, <a href="unixclients.html#id352990">Introduction</a></dt><dt>server, <a href="unixclients.html#id352990">Introduction</a>, <a href="unixclients.html#id353091">Technical Issues</a>, <a href="unixclients.html#id353760">Implementation</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>servers, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="kerberos.html#id375528">Checkpoint Controls</a></dt><dt>workstations, <a href="unixclients.html#id353760">Implementation</a></dt></dl></dd><dt>domain member</dt><dd><dl><dt>servers, <a href="unixclients.html#id353091">Technical Issues</a></dt></dl></dd><dt>Domain Member server, <a href="kerberos.html#id373574">Technical Issues</a>, <a href="kerberos.html#id377127">Questions and Answers</a></dt><dt>Domain Member servers, <a href="unixclients.html#id360240">Questions and Answers</a></dt><dt>domain members, <a href="unixclients.html#id360240">Questions and Answers</a></dt><dt>domain name space, <a href="2000users.html#id348480">Identity Management Needs</a></dt><dt>domain replication, <a href="2000users.html#id352211">Questions and Answers</a></dt><dt>domain SID, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a></dt><dt>Domain SID, <a href="ntmigration.html#id364468">Technical Issues</a>, <a href="ntmigration.html#id367572">Questions and Answers</a></dt><dt>domain tree, <a href="2000users.html#id348480">Identity Management Needs</a></dt><dt>Domain User Manager, <a href="happy.html#id345184">Configuring Profile Directories</a></dt><dt>Domain users, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>DOS, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a></dt><dt>dos2unix, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id332221">Configuration for Server: MASSIVE</a></dt><dt>down-grade, <a href="upgrades.html#id361313">Introduction</a></dt><dt>drive letters, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>drive mapping, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>dumb printing, <a href="happy.html#id337689">Installation of Printer Driver Auto-Download</a></dt><dt>dump, <a href="ntmigration.html#id364468">Technical Issues</a>, <a href="ntmigration.html#id367572">Questions and Answers</a></dt><dt>duplicate accounts, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt><dt>dynamic DNS, <a href="secure.html#id324638">Technical Issues</a></dt></dl></div><div class="indexdiv"><h3>E</h3><dl><dt>e-Directory, <a href="nw4migration.html#id368660">Dissection and Discussion</a></dt><dt>ea support, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a></dt><dt>Easy Software Products, <a href="happy.html#id337689">Installation of Printer Driver Auto-Download</a></dt><dt>economically sustainable, <a href="kerberos.html#id373203">Dissection and Discussion</a></dt><dt>eDirectory, <a href="happy.html#id336400">Dissection and Discussion</a></dt><dt>education, <a href="2000users.html#id348480">Identity Management Needs</a></dt><dt>election, <a href="primer.html#id386612">Findings</a></dt><dt>employment, <a href="kerberos.html#id372607">Introduction</a>, <a href="kerberos.html#id373203">Dissection and Discussion</a></dt><dt>enable, <a href="secure.html#ch4ptrcfg">Printer Configuration</a></dt><dt>enable privileges, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a></dt><dt>encrypt passwords, <a href="DomApps.html#id379127">NSS Configuration</a>, <a href="primer.html#chap01qa">Questions and Answers</a></dt><dt>encrypted, <a href="primer.html#id387800">Findings and Comments</a></dt><dt>encrypted password, <a href="primer.html#id388041">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>encrypted passwords, <a href="unixclients.html#id360240">Questions and Answers</a></dt><dt>End User License Agreement (see EULA)</dt><dt>enumerating, <a href="DomApps.html#id378606">Samba Configuration</a></dt><dt>essential, <a href="kerberos.html#id372607">Introduction</a></dt><dt>Ethereal, <a href="primer.html#id386080">Requirements and Notes</a></dt><dt>ethereal, <a href="primer.html#id386373">Exercises</a></dt><dt>Ethernet switch, <a href="small.html#id321342">Technical Issues</a></dt><dt>ethernet switch, <a href="happy.html">Making Happy Users</a></dt><dt>EULA, <a href="kerberos.html#id373203">Dissection and Discussion</a></dt><dt>Everyone, <a href="kerberos.html#id375060">Share Access Controls</a></dt><dt>Excel, <a href="kerberos.html#id375952">Share Point Directory and File Permissions</a></dt><dt>exclusive open, <a href="appendix.html#id385724">Microsoft Access</a></dt><dt>experiment, <a href="kerberos.html">Active Directory, Kerberos, and Security</a></dt><dt>export, <a href="ntmigration.html#id364468">Technical Issues</a></dt><dt>extent, <a href="kerberos.html#id373203">Dissection and Discussion</a></dt><dt>External Domains, <a href="unixclients.html#id353091">Technical Issues</a></dt><dt>extreme demand, <a href="HA.html#id380842">Guidelines for Reliable Samba Operation</a></dt></dl></div><div class="indexdiv"><h3>F</h3><dl><dt>fail, <a href="2000users.html#id348183">The Nature of Windows Networking Protocols</a></dt><dt>fail-over, <a href="2000users.html#id348480">Identity Management Needs</a>, <a href="2000users.html#id348912">Implementation</a></dt><dt>failed, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>failed join, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="unixclients.html#id358229">IDMAP_RID with Winbind</a></dt><dt>failure, <a href="DomApps.html#id378606">Samba Configuration</a></dt><dt>familiar, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>fatal problem, <a href="HA.html#id381308">Samba Configuration</a></dt><dt>fear, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>fears, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>Fedora, <a href="simple.html#id316598">Drafting Office</a></dt><dt>FHS, <a href="appendix.html#id383041">Samba System File Location</a></dt><dt>file and print server, <a href="DomApps.html#id379827">Questions and Answers</a></dt><dt>file and print service, <a href="kerberos.html#id373203">Dissection and Discussion</a></dt><dt>file caching, <a href="HA.html#id381308">Samba Configuration</a>, <a href="appendix.html#id385938">Opportunistic Locking Controls</a></dt><dt>File Hierarchy System (see FHS)</dt><dt>file locations, <a href="appendix.html#id383041">Samba System File Location</a></dt><dt>file permissions, <a href="appendix.html#id384378">The LDAP Account Manager</a></dt><dt>file server</dt><dd><dl><dt>read-only, <a href="simple.html#id316663">Dissection and Discussion</a></dt></dl></dd><dt>file servers, <a href="happy.html#id338636">Samba Server Implementation</a></dt><dt>file system, <a href="kerberos.html#id373574">Technical Issues</a></dt><dd><dl><dt>access control, <a href="secure.html#id325866">Samba Configuration</a></dt><dt>Ext3, <a href="simple.html#id316708">Implementation</a></dt><dt>permissions, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id332221">Configuration for Server: MASSIVE</a></dt></dl></dd><dt>file system security, <a href="kerberos.html#id377127">Questions and Answers</a></dt><dt>filter, <a href="kerberos.html#id375060">Share Access Controls</a></dt><dt>financial responsibility, <a href="kerberos.html#id372607">Introduction</a></dt><dt>firewall, <a href="secure.html#id324638">Technical Issues</a>, <a href="secure.html#ch4bsc">Basic System Configuration</a>, <a href="kerberos.html#id372607">Introduction</a></dt><dt>fix, <a href="kerberos.html#id373203">Dissection and Discussion</a></dt><dt>flaws, <a href="kerberos.html#id372607">Introduction</a></dt><dt>flexibility, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>flush</dt><dd><dl><dt>cache memory, <a href="appendix.html#id385938">Opportunistic Locking Controls</a></dt></dl></dd><dt>folder redirection, <a href="happy.html#id336802">Technical Issues</a>, <a href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a>, <a href="2000users.html#id352211">Questions and Answers</a></dt><dt>force group, <a href="simple.html#id317589">Implementation</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a>, <a href="kerberos.html#id375808">Override Controls</a>, <a href="kerberos.html#id377127">Questions and Answers</a></dt><dt>force printername, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>force user, <a href="simple.html#id317402">Dissection and Discussion</a>, <a href="simple.html#id317589">Implementation</a>, <a href="kerberos.html#id375808">Override Controls</a>, <a href="kerberos.html#id377127">Questions and Answers</a></dt><dt>forced settings, <a href="kerberos.html#id375808">Override Controls</a></dt><dt>foreign, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>foreign SID, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>forwarded, <a href="HA.html#id381054">Routed Networks</a></dt><dt>foundation members, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>Free Standards Group (see FSG)</dt><dt>free support, <a href="ch14.html">Samba Support</a>, <a href="ch14.html#id382184">Free Support</a></dt><dt>front-end, <a href="HA.html#id380391">Dissection and Discussion</a></dt><dd><dl><dt>server, <a href="HA.html#id381733">Distribute Network Load with MSDFS</a></dt></dl></dd><dt>frustration, <a href="upgrades.html#id361313">Introduction</a></dt><dt>FSG, <a href="appendix.html#id383041">Samba System File Location</a></dt><dt>FTP</dt><dd><dl><dt>proxy, <a href="DomApps.html#id379827">Questions and Answers</a></dt></dl></dd><dt>full control, <a href="kerberos.html#id375060">Share Access Controls</a>, <a href="kerberos.html#id376647">Using MS Windows Explorer (File Manager)</a></dt><dt>fully qualified, <a href="kerberos.html#id375528">Checkpoint Controls</a></dt><dt>functional differences, <a href="upgrades.html#id361397">Cautions and Notes</a></dt></dl></div><div class="indexdiv"><h3>G</h3><dl><dt>generation, <a href="upgrades.html#id361397">Cautions and Notes</a></dt><dt>Gentoo, <a href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>getent, <a href="happy.html#id341324">LDAP Initialization and Creation of User and Group Accounts</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="unixclients.html#id358229">IDMAP_RID with Winbind</a></dt><dt>getfacl, <a href="kerberos.html#id376809">Setting Posix ACLs in UNIX/Linux</a></dt><dt>getgrnam, <a href="unixclients.html#id353091">Technical Issues</a></dt><dt>getpwnam, <a href="unixclients.html#id353091">Technical Issues</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>getpwnam(), <a href="unixclients.html#id360240">Questions and Answers</a></dt><dt>GID, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="ntmigration.html#id367572">Questions and Answers</a></dt><dt>Goettingen, <a href="DomApps.html#id379827">Questions and Answers</a></dt><dt>government, <a href="2000users.html#id348480">Identity Management Needs</a></dt><dt>GPL, <a href="secure.html#id329651">Comments Regarding Software Terms of Use</a></dt><dt>group account, <a href="simple.html#AcctgNet">Implementation</a>, <a href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>group management, <a href="secure.html#id325041">Implementation</a></dt><dt>group mapping, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>group membership, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="kerberos.html#id375952">Share Point Directory and File Permissions</a></dt><dt>group names, <a href="ntmigration.html#id367572">Questions and Answers</a></dt><dt>group policies, <a href="ntmigration.html#id364185">Introduction</a></dt><dt>Group Policy, <a href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dt>Group Policy editor, <a href="happy.html#sbehap-locgrppol">The Local Group Policy</a></dt><dt>Group Policy Objects, <a href="happy.html#sbehap-locgrppol">The Local Group Policy</a></dt><dt>groupadd, <a href="simple.html#id317589">Implementation</a>, <a href="simple.html#AcctgNet">Implementation</a>, <a href="upgrades.html#id362947">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a href="ntmigration.html#id367572">Questions and Answers</a></dt><dt>groupdel, <a href="upgrades.html#id362947">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a href="ntmigration.html#id367572">Questions and Answers</a></dt><dt>groupmem, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a></dt><dt>groupmod, <a href="upgrades.html#id362947">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a href="ntmigration.html#id367572">Questions and Answers</a></dt><dt>GSS-API, <a href="primer.html#id388041">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>guest account, <a href="primer.html#id387800">Findings and Comments</a>, <a href="primer.html#chap01conc">Dissection and Discussion</a>, <a href="primer.html#id388668">Technical Issues</a>, <a href="primer.html#chap01qa">Questions and Answers</a></dt><dt>guest ok, <a href="simple.html#id316708">Implementation</a>, <a href="simple.html#id317589">Implementation</a>, <a href="simple.html#AcctgNet">Implementation</a>, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt></dl></div><div class="indexdiv"><h3>H</h3><dl><dt>hackers, <a href="kerberos.html#id372607">Introduction</a></dt><dt>hardware prices, <a href="HA.html#id381824">Hardware Problems</a></dt><dt>hardware problems, <a href="HA.html#id381824">Hardware Problems</a></dt><dt>Heimdal, <a href="DomApps.html#id378010">Implementation</a>, <a href="DomApps.html#id378243">Kerberos Configuration</a></dt><dt>Heimdal Kerberos, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="kerberos.html#id374766">Kerberos Exposed</a></dt><dt>Heimdal kerberos, <a href="unixclients.html#id358814">IDMAP Storage in LDAP using Winbind</a></dt><dt>help, <a href="ch14.html#id382184">Free Support</a></dt><dt>helper agent, <a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>hesiod, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>hide files, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>hierarchy of control, <a href="kerberos.html#id375395">Share Definition Controls</a></dt><dt>high availability, <a href="happy.html#id336400">Dissection and Discussion</a></dt><dt>hire, <a href="kerberos.html#id373203">Dissection and Discussion</a></dt><dt>HKEY_CURRENT_USER, <a href="happy.html#id337279">Roaming Profile Background</a></dt><dt>HKEY_LOCAL_MACHINE, <a href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>HKEY_LOCAL_USER, <a href="2000users.html#id352211">Questions and Answers</a></dt><dt>host announcement, <a href="primer.html#id386266">Assignment Tasks</a>, <a href="primer.html#id387234">Findings</a></dt><dt>hostname, <a href="secure.html#ch4bsc">Basic System Configuration</a>, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a></dt><dt>hosts, <a href="unixclients.html#id360240">Questions and Answers</a></dt><dt>hosts allow, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a></dt><dt>HUB, <a href="happy.html">Making Happy Users</a></dt><dt>Hybrid, <a href="primer.html#chap01qa">Questions and Answers</a></dt><dt>hypothetical, <a href="kerberos.html#id372607">Introduction</a></dt></dl></div><div class="indexdiv"><h3>I</h3><dl><dt>Idealx, <a href="upgrades.html#id362947">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a></dt><dd><dl><dt>smbldap-tools, <a href="happy.html#sbeidealx">Install and Configure Idealx smbldap-tools Scripts</a>, <a href="happy.html#id341324">LDAP Initialization and Creation of User and Group Accounts</a></dt></dl></dd><dt>identifiers, <a href="unixclients.html#id353091">Technical Issues</a></dt><dt>identity, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="kerberos.html#id374766">Kerberos Exposed</a></dt><dd><dl><dt>management, <a href="happy.html#id336802">Technical Issues</a></dt></dl></dd><dt>identity management, <a href="Big500users.html#id330784">Technical Issues</a>, <a href="2000users.html#id347824">Dissection and Discussion</a>, <a href="unixclients.html#id353679">Political Issues</a>, <a href="nw4migration.html#id368660">Dissection and Discussion</a></dt><dt>Identity Management, <a href="happy.html#id336400">Dissection and Discussion</a>, <a href="2000users.html#id348183">The Nature of Windows Networking Protocols</a>, <a href="2000users.html#id348480">Identity Management Needs</a></dt><dt>Identity management, <a href="unixclients.html#id359708">UNIX/Linux Client Domain Member</a></dt><dt>Identity resolution, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="unixclients.html#id359708">UNIX/Linux Client Domain Member</a>, <a href="unixclients.html#id360240">Questions and Answers</a></dt><dt>Identity resolver, <a href="DomApps.html#id379827">Questions and Answers</a></dt><dt>IDMAP, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#id358229">IDMAP_RID with Winbind</a></dt><dt>idmap backend, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#id353091">Technical Issues</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#id358229">IDMAP_RID with Winbind</a>, <a href="unixclients.html#id358814">IDMAP Storage in LDAP using Winbind</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a></dt><dt>IDMAP backend, <a href="unixclients.html#id360240">Questions and Answers</a></dt><dt>idmap gid, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="unixclients.html#id358229">IDMAP_RID with Winbind</a>, <a href="unixclients.html#id358814">IDMAP Storage in LDAP using Winbind</a>, <a href="unixclients.html#id359380">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="DomApps.html#id379127">NSS Configuration</a></dt><dt>idmap uid, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="unixclients.html#id358229">IDMAP_RID with Winbind</a>, <a href="unixclients.html#id358814">IDMAP Storage in LDAP using Winbind</a>, <a href="unixclients.html#id359380">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="DomApps.html#id379127">NSS Configuration</a></dt><dt>idmap_rid, <a href="unixclients.html#id358229">IDMAP_RID with Winbind</a></dt><dt>IMAP, <a href="nw4migration.html#id368732">Technical Issues</a></dt><dt>import, <a href="ntmigration.html#id364468">Technical Issues</a></dt><dt>include, <a href="Big500users.html#id330980">Implementation</a></dt><dt>income, <a href="kerberos.html#id373203">Dissection and Discussion</a></dt><dt>independent expert, <a href="kerberos.html#id372607">Introduction</a></dt><dt>inetd, <a href="secure.html#procstart">Process Startup Configuration</a></dt><dt>inetOrgPerson, <a href="nw4migration.html#id368732">Technical Issues</a></dt><dt>inheritance, <a href="kerberos.html#id376809">Setting Posix ACLs in UNIX/Linux</a></dt><dt>initGrps.sh, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id332221">Configuration for Server: MASSIVE</a></dt><dt>initial credentials, <a href="DomApps.html#id378243">Kerberos Configuration</a></dt><dt>inoperative, <a href="ntmigration.html#id364312">Dissection and Discussion</a></dt><dt>install, <a href="upgrades.html">Updating Samba-3</a></dt><dt>installation, <a href="kerberos.html#id373203">Dissection and Discussion</a></dt><dt>integrate, <a href="unixclients.html#id353091">Technical Issues</a></dt><dt>integrity, <a href="kerberos.html#id372607">Introduction</a>, <a href="kerberos.html#id374766">Kerberos Exposed</a></dt><dt>inter-domain, <a href="upgrades.html#id362947">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>inter-operability, <a href="kerberos.html#id373203">Dissection and Discussion</a>, <a href="kerberos.html#id373574">Technical Issues</a>, <a href="kerberos.html#id377005">Key Points Learned</a>, <a href="DomApps.html#id379827">Questions and Answers</a></dt><dt>interactive help, <a href="ch14.html#id382184">Free Support</a></dt><dt>interdomain trusts, <a href="2000users.html#id348480">Identity Management Needs</a></dt><dt>interfaces, <a href="secure.html#id325041">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></dt><dt>intermittent, <a href="HA.html#id381824">Hardware Problems</a></dt><dt>internationalization, <a href="upgrades.html#id362458">International Language Support</a></dt><dt>Internet Explorer, <a href="DomApps.html#id377849">Technical Issues</a></dt><dt>Internet Information Server, <a href="DomApps.html#id379827">Questions and Answers</a></dt><dt>interoperability, <a href="happy.html#id336400">Dissection and Discussion</a></dt><dt>IP forwarding, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#ch4bsc">Basic System Configuration</a>, <a href="Big500users.html#id332221">Configuration for Server: MASSIVE</a></dt><dt>IPC$, <a href="primer.html#id387800">Findings and Comments</a></dt><dt>iptables, <a href="secure.html#id324638">Technical Issues</a></dt><dt>IRC, <a href="ch14.html#id382184">Free Support</a></dt><dt>isolated, <a href="kerberos.html#id372607">Introduction</a></dt><dt>Italian, <a href="DomApps.html#id379827">Questions and Answers</a></dt></dl></div><div class="indexdiv"><h3>J</h3><dl><dt>jobs, <a href="kerberos.html#id372607">Introduction</a></dt><dt>joining a domain, <a href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt></dl></div><div class="indexdiv"><h3>K</h3><dl><dt>KDC, <a href="DomApps.html#id378243">Kerberos Configuration</a></dt><dt>Kerberos, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="kerberos.html#id372607">Introduction</a>, <a href="kerberos.html#id373574">Technical Issues</a>, <a href="kerberos.html#id377005">Key Points Learned</a>, <a href="DomApps.html#id377849">Technical Issues</a>, <a href="DomApps.html#id378010">Implementation</a>, <a href="DomApps.html#id378243">Kerberos Configuration</a></dt><dd><dl><dt>Heimdal, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>interoperability, <a href="kerberos.html#id374766">Kerberos Exposed</a></dt><dt>libraries, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>MIT, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>unspecified fields, <a href="kerberos.html#id374766">Kerberos Exposed</a></dt></dl></dd><dt>kerberos, <a href="kerberos.html#id374766">Kerberos Exposed</a></dt><dd><dl><dt>server, <a href="kerberos.html#id374766">Kerberos Exposed</a></dt></dl></dd><dt>Kerberos ticket, <a href="DomApps.html#id378606">Samba Configuration</a></dt><dt>kinit, <a href="DomApps.html#id378243">Kerberos Configuration</a></dt><dt>Kixtart, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>klist, <a href="DomApps.html#id378243">Kerberos Configuration</a></dt><dt>krb5, <a href="DomApps.html#id378010">Implementation</a></dt><dt>krb5.conf, <a href="DomApps.html#id378243">Kerberos Configuration</a></dt></dl></div><div class="indexdiv"><h3>L</h3><dl><dt>LAM, <a href="appendix.html#id384378">The LDAP Account Manager</a></dt><dd><dl><dt>configuration editor, <a href="appendix.html#id384378">The LDAP Account Manager</a></dt><dt>configuration file, <a href="appendix.html#id384378">The LDAP Account Manager</a></dt><dt>login screen, <a href="appendix.html#id384378">The LDAP Account Manager</a></dt><dt>opening screen, <a href="appendix.html#id384378">The LDAP Account Manager</a></dt><dt>profile, <a href="appendix.html#id384378">The LDAP Account Manager</a></dt><dt>wizard, <a href="appendix.html#id384378">The LDAP Account Manager</a></dt></dl></dd><dt>large domain, <a href="unixclients.html#id358229">IDMAP_RID with Winbind</a></dt><dt>LDAP, <a href="Big500users.html#id330784">Technical Issues</a>, <a href="happy.html#id336272">Assignment Tasks</a>, <a href="happy.html#id336400">Dissection and Discussion</a>, <a href="happy.html#id336802">Technical Issues</a>, <a href="happy.html#id337852">Preliminary Advice: Dangers Can Be Avoided</a>, <a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a href="2000users.html#id347742">Introduction</a>, <a href="2000users.html#id347824">Dissection and Discussion</a>, <a href="2000users.html#id348480">Identity Management Needs</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="2000users.html#id352072">Key Points Learned</a>, <a href="2000users.html#id352211">Questions and Answers</a>, <a href="unixclients.html#id353091">Technical Issues</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a>, <a href="upgrades.html#id362947">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a href="ntmigration.html#id364261">Assignment Tasks</a>, <a href="ntmigration.html#id364468">Technical Issues</a>, <a href="ntmigration.html#id367572">Questions and Answers</a>, <a href="nw4migration.html#id368660">Dissection and Discussion</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a>, <a href="kerberos.html#id373574">Technical Issues</a></dt><dd><dl><dt>backend, <a href="2000users.html#id348480">Identity Management Needs</a></dt><dt>database, <a href="happy.html#id341324">LDAP Initialization and Creation of User and Group Accounts</a>, <a href="2000users.html#id348480">Identity Management Needs</a>, <a href="2000users.html#id352211">Questions and Answers</a>, <a href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></dt><dt>directory, <a href="happy.html#id336072">Regarding LDAP Directories and Windows Computer Accounts</a>, <a href="2000users.html#id348480">Identity Management Needs</a></dt><dt>fail-over, <a href="2000users.html#id348912">Implementation</a></dt><dt>initial configuration, <a href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></dt><dt>master, <a href="2000users.html#id348480">Identity Management Needs</a></dt><dt>master/slave</dt><dd><dl><dt>background communication, <a href="2000users.html#id352211">Questions and Answers</a></dt></dl></dd><dt>preload, <a href="2000users.html#id348912">Implementation</a></dt><dt>schema, <a href="upgrades.html#id363507">Updating from Samba Versions between 3.0.6 and 3.0.10</a></dt><dt>secure, <a href="happy.html#id336802">Technical Issues</a></dt><dt>server, <a href="unixclients.html#id360240">Questions and Answers</a></dt><dt>slave, <a href="2000users.html#id348480">Identity Management Needs</a></dt><dt>updates, <a href="2000users.html#id348480">Identity Management Needs</a></dt></dl></dd><dt>ldap, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>LDAP Account Manager (see LAM)</dt><dt>ldap admin dn, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#id358814">IDMAP Storage in LDAP using Winbind</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>LDAP backend, <a href="ntmigration.html#id364468">Technical Issues</a></dt><dt>LDAP database, <a href="ntmigration.html#id367572">Questions and Answers</a></dt><dt>ldap group suffix, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>ldap idmap suffix, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#id358814">IDMAP Storage in LDAP using Winbind</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>LDAP Interchange Format (see LDIF)</dt><dt>ldap machine suffix, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>ldap passwd sync, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>LDAP server, <a href="2000users.html#id348480">Identity Management Needs</a></dt><dt>ldap ssl, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>ldap suffix, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#id358814">IDMAP Storage in LDAP using Winbind</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>ldap timeout, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a></dt><dt>ldap user suffix, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>LDAP-transfer-LDIF.txt, <a href="2000users.html#id348912">Implementation</a></dt><dt>ldap.conf, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>ldapadd, <a href="happy.html#id341324">LDAP Initialization and Creation of User and Group Accounts</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>ldapsam, <a href="happy.html#id341324">LDAP Initialization and Creation of User and Group Accounts</a>, <a href="2000users.html#id347824">Dissection and Discussion</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="upgrades.html#id363507">Updating from Samba Versions between 3.0.6 and 3.0.10</a>, <a href="ntmigration.html#id364261">Assignment Tasks</a>, <a href="DomApps.html">Integrating Additional Services</a></dt><dt>ldapsam backend, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>ldapsearch, <a href="happy.html#id341324">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>LDIF, <a href="happy.html#id336802">Technical Issues</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="nw4migration.html#id368732">Technical Issues</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a>, <a href="appendix.html#id383921">Initialization of the LDAP Database</a></dt><dt>leadership, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>Lightweight Directory Access Protocol (see LDAP)</dt><dt>limit, <a href="ntmigration.html#id367572">Questions and Answers</a></dt><dt>Linux desktop, <a href="unixclients.html#id352990">Introduction</a></dt><dt>Linux Standards Base (see LSB)</dt><dt>LMB, <a href="primer.html#id386612">Findings</a>, <a href="primer.html#chap01qa">Questions and Answers</a></dt><dt>LMHOSTS, <a href="HA.html#id381054">Routed Networks</a></dt><dt>load distribution, <a href="HA.html#id381688">For Scalability, Use SAN-Based Storage on Samba Servers</a></dt><dt>local accounts, <a href="unixclients.html#id353091">Technical Issues</a></dt><dt>Local Group Policy, <a href="happy.html#id337279">Roaming Profile Background</a></dt><dt>Local Master Announcement, <a href="primer.html#id387234">Findings</a></dt><dt>Local Master Browser (see LMB)</dt><dt>localhost, <a href="secure.html#ch4bsc">Basic System Configuration</a>, <a href="HA.html#id380877">Bad Hostnames</a></dt><dt>lock directory, <a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></dt><dt>locking, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a></dt><dd><dl><dt>Application level, <a href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>Client side, <a href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>Server side, <a href="appendix.html#ch12dblck">Shared Data Integrity</a></dt></dl></dd><dt>log file, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>log level, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="unixclients.html#id358814">IDMAP Storage in LDAP using Winbind</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>logging, <a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>login, <a href="secure.html#id324638">Technical Issues</a></dt><dt>loglevel, <a href="happy.html#id338019">Debugging LDAP</a></dt><dt>logon credentials, <a href="DomApps.html#id379827">Questions and Answers</a></dt><dt>logon drive, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>logon home, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>logon hours, <a href="ntmigration.html#id364468">Technical Issues</a>, <a href="kerberos.html#id377005">Key Points Learned</a></dt><dt>logon machines, <a href="ntmigration.html#id364468">Technical Issues</a></dt><dt>logon path, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325041">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>logon process, <a href="unixclients.html#id353760">Implementation</a></dt><dt>logon scrip, <a href="secure.html#id325866">Samba Configuration</a></dt><dt>logon script, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325041">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#id336802">Technical Issues</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="happy.html#id345412">Preparation of Logon Scripts</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="ntmigration.html#id364468">Technical Issues</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>logon server, <a href="2000users.html#id348183">The Nature of Windows Networking Protocols</a></dt><dt>logon services, <a href="secure.html#id325041">Implementation</a></dt><dt>logon time, <a href="happy.html#id336272">Assignment Tasks</a></dt><dt>logon traffic, <a href="2000users.html#id348183">The Nature of Windows Networking Protocols</a></dt><dt>logon.kix, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>loopback, <a href="simple.html#validate1">Validation</a></dt><dt>low performance, <a href="HA.html#id381824">Hardware Problems</a></dt><dt>lower-case, <a href="ntmigration.html#id364791">Implementation</a></dt><dt>lpadmin, <a href="simple.html#id317589">Implementation</a>, <a href="simple.html#AcctgNet">Implementation</a>, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>LSB, <a href="appendix.html#id383041">Samba System File Location</a></dt></dl></div><div class="indexdiv"><h3>M</h3><dl><dt>machine, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a></dt><dt>machine account, <a href="happy.html#id336072">Regarding LDAP Directories and Windows Computer Accounts</a></dt><dt>machine accounts, <a href="ntmigration.html#id367572">Questions and Answers</a></dt><dt>machine secret password, <a href="Big500users.html#id330784">Technical Issues</a></dt><dt>MACHINE.SID, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a></dt><dt>mailing list, <a href="ch14.html#id382184">Free Support</a></dt><dt>mailing lists, <a href="ch14.html#id382184">Free Support</a></dt><dt>managed, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>management, <a href="unixclients.html#id353679">Political Issues</a>, <a href="unixclients.html#id360240">Questions and Answers</a></dt><dd><dl><dt>group, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>User, <a href="kerberos.html#id373574">Technical Issues</a></dt></dl></dd><dt>mandatory profile, <a href="happy.html#id336802">Technical Issues</a>, <a href="happy.html#id345184">Configuring Profile Directories</a></dt><dt>Mandrake, <a href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>map acl inherit, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a></dt><dt>map to guest, <a href="simple.html#id317589">Implementation</a></dt><dt>mapped drives, <a href="unixclients.html#id360240">Questions and Answers</a></dt><dt>mapping, <a href="unixclients.html#id353091">Technical Issues</a>, <a href="DomApps.html#id378243">Kerberos Configuration</a></dt><dd><dl><dt>consistent, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt></dl></dd><dt>Mars_NWE, <a href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>master, <a href="2000users.html#id347824">Dissection and Discussion</a></dt><dt>material, <a href="appendix.html">A Collection of Useful Tidbits</a></dt><dt>max log size, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a></dt><dt>memberUID, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>memory requirements, <a href="secure.html#id324872">Hardware Requirements</a></dt><dt>merge, <a href="ntmigration.html#id364468">Technical Issues</a>, <a href="ntmigration.html#id367572">Questions and Answers</a></dt><dt>merged, <a href="ntmigration.html#id364468">Technical Issues</a></dt><dt>meta-directory, <a href="2000users.html#id352211">Questions and Answers</a></dt><dt>meta-service, <a href="kerberos.html#id377127">Questions and Answers</a></dt><dt>Microsoft Access, <a href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>Microsoft Excel, <a href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>Microsoft ISA, <a href="DomApps.html#id377734">Assignment Tasks</a></dt><dt>Microsoft Management Console (see MMC)</dt><dt>Microsoft Office, <a href="secure.html#ch4appscfg">Application Share Configuration</a>, <a href="kerberos.html#id375952">Share Point Directory and File Permissions</a></dt><dt>Microsoft Outlook</dt><dd><dl><dt>PST files, <a href="2000users.html#id352211">Questions and Answers</a></dt></dl></dd><dt>migrate, <a href="upgrades.html">Updating Samba-3</a>, <a href="ntmigration.html#id364468">Technical Issues</a></dt><dt>migration, <a href="simple.html#AcctgNet">Implementation</a>, <a href="small.html#id321546">Implementation</a>, <a href="happy.html#id336272">Assignment Tasks</a>, <a href="ntmigration.html#id364185">Introduction</a>, <a href="ntmigration.html#id367572">Questions and Answers</a>, <a href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dd><dl><dt>objectives, <a href="ntmigration.html#id364312">Dissection and Discussion</a></dt></dl></dd><dt>Migration speed, <a href="ntmigration.html#id367572">Questions and Answers</a></dt><dt>mime type, <a href="simple.html#id317589">Implementation</a>, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a href="Big500users.html#id331694">Server Preparation: All Servers</a>, <a href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>mime types, <a href="simple.html#AcctgNet">Implementation</a></dt><dt>missing RPC's, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>MIT, <a href="DomApps.html#id378010">Implementation</a>, <a href="DomApps.html#id378243">Kerberos Configuration</a></dt><dt>MIT Kerberos, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="kerberos.html#id374766">Kerberos Exposed</a></dt><dt>MIT kerberos, <a href="unixclients.html#id358814">IDMAP Storage in LDAP using Winbind</a></dt><dt>MIT KRB5, <a href="DomApps.html#id378606">Samba Configuration</a></dt><dt>mixed mode, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>mixed-mode, <a href="kerberos.html#id377127">Questions and Answers</a></dt><dt>MMC, <a href="happy.html#id346624">Configure Delete Cached Profiles on Logout</a>, <a href="kerberos.html#id373574">Technical Issues</a>, <a href="kerberos.html#id377127">Questions and Answers</a></dt><dt>mobile computing, <a href="small.html#id321293">Dissection and Discussion</a></dt><dt>mobility, <a href="2000users.html#id348070">Technical Issues</a></dt><dt>modularization, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>modules, <a href="DomApps.html#id379827">Questions and Answers</a></dt><dt>MS Access</dt><dd><dl><dt>validate, <a href="appendix.html#id385724">Microsoft Access</a></dt></dl></dd><dt>MS Outlook, <a href="happy.html#id346340">Configuration of MS Outlook to Relocate PST File</a></dt><dd><dl><dt>PST, <a href="happy.html#id346340">Configuration of MS Outlook to Relocate PST File</a></dt><dt>PST file, <a href="happy.html">Making Happy Users</a></dt></dl></dd><dt>MS Windows Server 2003, <a href="DomApps.html#id378010">Implementation</a></dt><dt>MS Word, <a href="kerberos.html#id375952">Share Point Directory and File Permissions</a></dt><dt>MSDFS, <a href="HA.html#id381733">Distribute Network Load with MSDFS</a></dt><dt>multi-subnet, <a href="HA.html#id381054">Routed Networks</a></dt><dt>multi-user</dt><dd><dl><dt>access, <a href="appendix.html#id385724">Microsoft Access</a></dt><dt>data access, <a href="appendix.html#ch12dblck">Shared Data Integrity</a></dt></dl></dd><dt>multiple directories, <a href="2000users.html#id348480">Identity Management Needs</a></dt><dt>multiple domain controllers, <a href="happy.html">Making Happy Users</a></dt><dt>multiple group mappings, <a href="ntmigration.html#id367572">Questions and Answers</a></dt><dt>mutual assistance, <a href="ch14.html#id382184">Free Support</a></dt><dt>My Documents, <a href="happy.html#id337279">Roaming Profile Background</a></dt><dt>My Network Places, <a href="simple.html#id317589">Implementation</a></dt><dt>mysqlsam, <a href="2000users.html#id348912">Implementation</a></dt></dl></div><div class="indexdiv"><h3>N</h3><dl><dt>name resolution, <a href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a>, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="primer.html#id386266">Assignment Tasks</a></dt><dd><dl><dt>Defective, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt></dl></dd><dt>name resolve order, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325041">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a>, <a href="primer.html#chap01qa">Questions and Answers</a></dt><dt>name service switch, <a href="small.html#id321546">Implementation</a> (see NSS)</dt><dt>named, <a href="secure.html#ch4bsc">Basic System Configuration</a>, <a href="secure.html#ch4valid">Validation</a>, <a href="Big500users.html#id331694">Server Preparation: All Servers</a></dt><dt>NAT, <a href="secure.html#id324638">Technical Issues</a></dt><dt>native, <a href="kerberos.html#id377127">Questions and Answers</a></dt><dt>net</dt><dd><dl><dt>ads</dt><dd><dl><dt>info, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>join, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="DomApps.html#id378606">Samba Configuration</a></dt><dt>status, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt></dl></dd><dt>getlocalsid, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a></dt><dt>group, <a href="ntmigration.html#id367204">NT4 Migration Using tdbsam Backend</a></dt><dt>groupmap</dt><dd><dl><dt>add, <a href="secure.html#id325866">Samba Configuration</a></dt><dt>list, <a href="secure.html#id325866">Samba Configuration</a>, <a href="happy.html#id341324">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>modify, <a href="secure.html#id325866">Samba Configuration</a></dt></dl></dd><dt>rpc</dt><dd><dl><dt>info, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a></dt><dt>join, <a href="Big500users.html#ch5-domsvrspec">Configuration Specific to Domain Member Servers: BLDG1, BLDG2</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="ntmigration.html#id367204">NT4 Migration Using tdbsam Backend</a></dt><dt>vampire, <a href="upgrades.html">Updating Samba-3</a>, <a href="ntmigration.html#id367204">NT4 Migration Using tdbsam Backend</a></dt></dl></dd><dt>setlocalsid, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a></dt></dl></dd><dt>NetBIOS, <a href="2000users.html#id348183">The Nature of Windows Networking Protocols</a>, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="HA.html#id380877">Bad Hostnames</a>, <a href="HA.html#id381054">Routed Networks</a>, <a href="primer.html#chap01qa">Questions and Answers</a></dt><dd><dl><dt>name cache, <a href="2000users.html#id352211">Questions and Answers</a></dt><dt>name resolution</dt><dd><dl><dt>delays, <a href="happy.html">Making Happy Users</a></dt></dl></dd><dt>Node Type, <a href="primer.html#chap01qa">Questions and Answers</a></dt></dl></dd><dt>netbios</dt><dd><dl><dt>machine name, <a href="upgrades.html#id362157">Change of hostname</a></dt></dl></dd><dt>netbios forwarding, <a href="HA.html#id381218">Network Collisions</a></dt><dt>netbios name, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a href="unixclients.html#id358229">IDMAP_RID with Winbind</a>, <a href="unixclients.html#id358814">IDMAP Storage in LDAP using Winbind</a>, <a href="unixclients.html#id359380">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a>, <a href="upgrades.html#id362157">Change of hostname</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a>, <a href="DomApps.html#id379127">NSS Configuration</a>, <a href="HA.html#id380877">Bad Hostnames</a></dt><dt>NetBIOS name, <a href="DomApps.html#id378243">Kerberos Configuration</a></dt><dd><dl><dt>aliases, <a href="2000users.html#id348480">Identity Management Needs</a></dt></dl></dd><dt>NETLOGON, <a href="happy.html#id337635">Using a Network Default User Profile</a>, <a href="happy.html#id345624">Windows Client Configuration</a></dt><dt>netlogon, <a href="2000users.html#id348183">The Nature of Windows Networking Protocols</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>Netlogon, <a href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dt>netmask, <a href="simple.html#id316708">Implementation</a></dt><dt>Netware, <a href="small.html">Small Office Networking</a></dt><dt>NetWare, <a href="nw4migration.html">Migrating NetWare Server to Samba-3</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>network</dt><dd><dl><dt>administrators, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>analyzer, <a href="primer.html#id386266">Assignment Tasks</a></dt><dt>bandwidth, <a href="2000users.html#id348480">Identity Management Needs</a>, <a href="2000users.html#id352211">Questions and Answers</a></dt><dt>broadcast, <a href="primer.html#id386216">Introduction</a></dt><dt>captures, <a href="primer.html#id386080">Requirements and Notes</a></dt><dt>collisions, <a href="HA.html#id381218">Network Collisions</a></dt><dt>load, <a href="HA.html#id381218">Network Collisions</a></dt><dt>logon, <a href="happy.html">Making Happy Users</a></dt><dt>logon scripts, <a href="ntmigration.html#id364312">Dissection and Discussion</a></dt><dt>management, <a href="kerberos.html#id372607">Introduction</a></dt><dt>multi-segment, <a href="happy.html#id336196">Introduction</a></dt><dt>overload, <a href="happy.html">Making Happy Users</a></dt><dt>performance, <a href="HA.html#id381308">Samba Configuration</a></dt><dt>routed, <a href="2000users.html#id347824">Dissection and Discussion</a></dt><dt>secure, <a href="kerberos.html#id372607">Introduction</a></dt><dt>segment, <a href="happy.html#id336400">Dissection and Discussion</a></dt><dt>services, <a href="DomApps.html#id379827">Questions and Answers</a></dt><dt>sniffer, <a href="primer.html#id386080">Requirements and Notes</a></dt><dt>timeout, <a href="happy.html">Making Happy Users</a></dt><dt>timeouts, <a href="HA.html#id381218">Network Collisions</a></dt><dt>trace, <a href="primer.html#id386266">Assignment Tasks</a></dt><dt>traffic</dt><dd><dl><dt>observation, <a href="kerberos.html#id373574">Technical Issues</a></dt></dl></dd><dt>wide-area, <a href="happy.html#id336400">Dissection and Discussion</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt></dl></dd><dt>Network Address Translation (see NAT)</dt><dt>network administrators, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>network attached storage (see NAS)</dt><dt>network bandwidth</dt><dd><dl><dt>utilization, <a href="happy.html">Making Happy Users</a></dt></dl></dd><dt>Network Default Profile, <a href="happy.html#id337279">Roaming Profile Background</a></dt><dt>network hardware</dt><dd><dl><dt>defective, <a href="happy.html">Making Happy Users</a></dt></dl></dd><dt>network hygiene, <a href="HA.html#id380391">Dissection and Discussion</a></dt><dt>network Identities, <a href="unixclients.html#id360240">Questions and Answers</a></dt><dt>network load factors, <a href="Big500users.html#id330756">Dissection and Discussion</a></dt><dt>Network Neighborhood, <a href="simple.html#validate1">Validation</a>, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>network segment, <a href="HA.html#id381603">Use and Location of BDCs</a></dt><dt>network segments, <a href="secure.html#id324872">Hardware Requirements</a></dt><dt>network share, <a href="happy.html#id336272">Assignment Tasks</a></dt><dt>networking</dt><dd><dl><dt>client, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a></dt></dl></dd><dt>networking hardware</dt><dd><dl><dt>defective, <a href="happy.html">Making Happy Users</a></dt></dl></dd><dt>networking protocols, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>next generation, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>NextFreeUnixId, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a></dt><dt>NFS server, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></dt><dt>NICs, <a href="HA.html#id381824">Hardware Problems</a></dt><dt>NIS, <a href="happy.html#id341324">LDAP Initialization and Creation of User and Group Accounts</a>, <a href="2000users.html#id348480">Identity Management Needs</a>, <a href="2000users.html#id352211">Questions and Answers</a>, <a href="unixclients.html#id353091">Technical Issues</a>, <a href="unixclients.html#id353679">Political Issues</a>, <a href="unixclients.html#id360240">Questions and Answers</a></dt><dt>nis, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>NIS schema, <a href="2000users.html#id352211">Questions and Answers</a></dt><dt>NIS server, <a href="2000users.html#id352211">Questions and Answers</a></dt><dt>NIS+, <a href="2000users.html#id348480">Identity Management Needs</a></dt><dt>nisplus, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>NLM, <a href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>nmap, <a href="secure.html#ch4valid">Validation</a></dt><dt>nmbd, <a href="small.html#id323199">Validation</a>, <a href="secure.html#ch4valid">Validation</a>, <a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a href="upgrades.html#id363672">Replacing a Domain Member Server</a>, <a href="DomApps.html#id378606">Samba Configuration</a>, <a href="appendix.html#id383432">Starting Samba</a></dt><dt>nobody, <a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a href="primer.html#id387800">Findings and Comments</a></dt><dt>Novell, <a href="nw4migration.html">Migrating NetWare Server to Samba-3</a>, <a href="nw4migration.html#id368455">Introduction</a></dt><dt>Novell SUSE SLES 9, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a></dt><dt>NSS, <a href="happy.html#id336072">Regarding LDAP Directories and Windows Computer Accounts</a>, <a href="happy.html#id336802">Technical Issues</a>, <a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a href="unixclients.html#id353091">Technical Issues</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#id358229">IDMAP_RID with Winbind</a>, <a href="unixclients.html#id359708">UNIX/Linux Client Domain Member</a>, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a>, <a href="DomApps.html#id379127">NSS Configuration</a> (see same service switch)</dt><dt>nss_ldap, <a href="happy.html#id336072">Regarding LDAP Directories and Windows Computer Accounts</a>, <a href="happy.html#id336802">Technical Issues</a>, <a href="happy.html#ldapsetup">OpenLDAP Server Configuration</a>, <a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a href="happy.html#id341324">LDAP Initialization and Creation of User and Group Accounts</a>, <a href="unixclients.html#id353091">Technical Issues</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#id359380">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a href="upgrades.html#id363672">Replacing a Domain Member Server</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a></dt><dt>nt acl support, <a href="simple.html#id317402">Dissection and Discussion</a>, <a href="simple.html#id317589">Implementation</a></dt><dt>NT4 registry, <a href="ntmigration.html#id364312">Dissection and Discussion</a></dt><dt>NTLM, <a href="DomApps.html#id377849">Technical Issues</a></dt><dt>NTLM authentication daemon, <a href="DomApps.html#id377849">Technical Issues</a></dt><dt>NTLMSSP, <a href="DomApps.html#id379772">Key Points Learned</a>, <a href="DomApps.html#id379827">Questions and Answers</a>, <a href="primer.html#id388041">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>NTLMSSP_AUTH, <a href="primer.html#id388041">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>ntlm_auth, <a href="DomApps.html#id378606">Samba Configuration</a>, <a href="DomApps.html#id379827">Questions and Answers</a></dt><dt>NTP, <a href="DomApps.html#id378243">Kerberos Configuration</a></dt><dt>NTUSER.DAT, <a href="happy.html#id337279">Roaming Profile Background</a>, <a href="happy.html#id337546">Profile Changes</a>, <a href="happy.html#id337635">Using a Network Default User Profile</a>, <a href="2000users.html#id352211">Questions and Answers</a></dt><dt>NULL connection, <a href="simple.html#validate1">Validation</a></dt><dt>NULL session, <a href="primer.html#id387800">Findings and Comments</a></dt><dt>NULL-Session, <a href="primer.html#id388539">Discussion</a></dt></dl></div><div class="indexdiv"><h3>O</h3><dl><dt>objectClass, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>off-site storage, <a href="kerberos.html#id372607">Introduction</a></dt><dt>Open Magazine, <a href="unixclients.html">Adding Domain Member Servers and Clients</a></dt><dt>Open Source, <a href="kerberos.html#id373203">Dissection and Discussion</a></dt><dt>OpenLDAP, <a href="happy.html#id336400">Dissection and Discussion</a>, <a href="2000users.html#id347824">Dissection and Discussion</a>, <a href="2000users.html#id352211">Questions and Answers</a>, <a href="unixclients.html#id353679">Political Issues</a>, <a href="nw4migration.html#id368732">Technical Issues</a>, <a href="kerberos.html#id372607">Introduction</a>, <a href="kerberos.html#id373574">Technical Issues</a>, <a href="kerberos.html#id377005">Key Points Learned</a>, <a href="appendix.html#id384378">The LDAP Account Manager</a></dt><dt>openldap, <a href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>OpenOffice, <a href="secure.html#ch4appscfg">Application Share Configuration</a></dt><dt>operating profiles, <a href="appendix.html#id384378">The LDAP Account Manager</a></dt><dt>oplock break, <a href="kerberos.html#id375808">Override Controls</a></dt><dt>oplocks, <a href="HA.html#id381308">Samba Configuration</a></dt><dt>Oplocks</dt><dd><dl><dt>disabled, <a href="appendix.html#id385938">Opportunistic Locking Controls</a></dt></dl></dd><dt>opportunistic</dt><dd><dl><dt>locking, <a href="kerberos.html#id375808">Override Controls</a></dt></dl></dd><dt>opportunistic locking, <a href="secure.html#id325041">Implementation</a>, <a href="HA.html#id381308">Samba Configuration</a>, <a href="appendix.html#id385863">Act! Database Sharing</a></dt><dt>optimized, <a href="HA.html#id381308">Samba Configuration</a></dt><dt>organizational units, <a href="appendix.html#id384378">The LDAP Account Manager</a></dt><dt>os level, <a href="2000users.html#id348912">Implementation</a></dt><dt>OS/2, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a></dt><dt>Outlook</dt><dd><dl><dt>PST, <a href="happy.html#id346340">Configuration of MS Outlook to Relocate PST File</a></dt></dl></dd><dt>Outlook Address Book, <a href="happy.html#id346340">Configuration of MS Outlook to Relocate PST File</a></dt><dt>Outlook Express, <a href="secure.html#id325007">Political Issues</a>, <a href="happy.html#id346340">Configuration of MS Outlook to Relocate PST File</a></dt><dt>over-ride, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>over-ride controls, <a href="kerberos.html#id375808">Override Controls</a></dt><dt>over-rule, <a href="kerberos.html#id375060">Share Access Controls</a>, <a href="kerberos.html#id376647">Using MS Windows Explorer (File Manager)</a></dt><dt>overheads, <a href="kerberos.html#id375808">Override Controls</a></dt><dt>ownership, <a href="kerberos.html#id375952">Share Point Directory and File Permissions</a></dt></dl></div><div class="indexdiv"><h3>P</h3><dl><dt>package, <a href="simple.html#id316708">Implementation</a></dt><dt>package names, <a href="appendix.html#id383041">Samba System File Location</a></dt><dt>packages, <a href="upgrades.html#id363384">Updating a Samba-3 Installation</a></dt><dt>PADL, <a href="unixclients.html#id353091">Technical Issues</a>, <a href="unixclients.html#id358814">IDMAP Storage in LDAP using Winbind</a></dt><dt>PADL LDAP tools, <a href="happy.html#id336802">Technical Issues</a></dt><dt>PADL Software, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>paid-for support, <a href="ch14.html">Samba Support</a></dt><dt>PAM, <a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a href="unixclients.html#id359708">UNIX/Linux Client Domain Member</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>pam password change, <a href="secure.html#id325866">Samba Configuration</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>pam_ldap, <a href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>pam_ldap.so, <a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dt>pam_unix2.so, <a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dd><dl><dt>use_ldap, <a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt></dl></dd><dt>parameters, <a href="upgrades.html#id362947">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>passdb backend, <a href="secure.html#id325041">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html">The 500-User Office</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#id336400">Dissection and Discussion</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id347824">Dissection and Discussion</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#id353091">Technical Issues</a>, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="upgrades.html">Updating Samba-3</a>, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a>, <a href="upgrades.html#id362947">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a href="upgrades.html#id363507">Updating from Samba Versions between 3.0.6 and 3.0.10</a>, <a href="ntmigration.html#id364261">Assignment Tasks</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="ntmigration.html#id367572">Questions and Answers</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>passdb.tdb, <a href="ntmigration.html#id364468">Technical Issues</a></dt><dt>passwd, <a href="simple.html#id317589">Implementation</a>, <a href="simple.html#AcctgNet">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a></dt><dt>passwd chat, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a></dt><dt>passwd program, <a href="secure.html#id325866">Samba Configuration</a></dt><dt>password</dt><dd><dl><dt>backend, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id332221">Configuration for Server: MASSIVE</a></dt></dl></dd><dt>password caching, <a href="simple.html#id317589">Implementation</a></dt><dt>password change, <a href="kerberos.html#id377005">Key Points Learned</a></dt><dt>password length, <a href="primer.html#id387580">Simple Windows Client Connection Characteristics</a>, <a href="primer.html#id388041">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>password server, <a href="DomApps.html#id379127">NSS Configuration</a></dt><dt>path, <a href="simple.html#id316708">Implementation</a>, <a href="simple.html#id317589">Implementation</a>, <a href="simple.html#AcctgNet">Implementation</a>, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>payroll, <a href="nw4migration.html#id368455">Introduction</a></dt><dt>pdbedit, <a href="happy.html#id341324">LDAP Initialization and Creation of User and Group Accounts</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="ntmigration.html#id367204">NT4 Migration Using tdbsam Backend</a>, <a href="ntmigration.html#id367572">Questions and Answers</a></dt><dt>PDC, <a href="Big500users.html#id330675">Assignment Tasks</a>, <a href="Big500users.html#id330784">Technical Issues</a>, <a href="happy.html">Making Happy Users</a>, <a href="happy.html#id336802">Technical Issues</a>, <a href="happy.html#sbehap-locgrppol">The Local Group Policy</a>, <a href="2000users.html#id348183">The Nature of Windows Networking Protocols</a>, <a href="unixclients.html#id353091">Technical Issues</a>, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a>, <a href="upgrades.html#id362947">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a href="ntmigration.html#id364791">Implementation</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="ntmigration.html#id367204">NT4 Migration Using tdbsam Backend</a>, <a href="HA.html#id381603">Use and Location of BDCs</a></dt><dt>PDC/BDC ratio, <a href="happy.html">Making Happy Users</a></dt><dt>PDF, <a href="appendix.html#id384378">The LDAP Account Manager</a></dt><dt>performance, <a href="happy.html#id336400">Dissection and Discussion</a>, <a href="kerberos.html#id377127">Questions and Answers</a>, <a href="HA.html">Performance, Reliability, and Availability</a>, <a href="HA.html#id380314">Introduction</a>, <a href="HA.html#id381218">Network Collisions</a></dt><dt>performance degradation, <a href="kerberos.html#id375808">Override Controls</a>, <a href="HA.html#id381308">Samba Configuration</a></dt><dt>Perl, <a href="nw4migration.html#id368982">LDAP Server Configuration</a>, <a href="appendix.html#id384378">The LDAP Account Manager</a></dt><dt>permission, <a href="kerberos.html#id375952">Share Point Directory and File Permissions</a></dt><dt>permissions, <a href="simple.html#id317589">Implementation</a>, <a href="kerberos.html#id373574">Technical Issues</a>, <a href="kerberos.html#id375060">Share Access Controls</a>, <a href="kerberos.html#id375528">Checkpoint Controls</a>, <a href="kerberos.html#id375952">Share Point Directory and File Permissions</a>, <a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dd><dl><dt>excessive, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>group, <a href="kerberos.html#id375952">Share Point Directory and File Permissions</a></dt><dt>user, <a href="kerberos.html#id375952">Share Point Directory and File Permissions</a></dt></dl></dd><dt>Permissions, <a href="kerberos.html#id376370">Using the MMC Computer Management Interface</a></dt><dt>permits, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>permitted group, <a href="kerberos.html#id376370">Using the MMC Computer Management Interface</a></dt><dt>PHP, <a href="appendix.html#id384378">The LDAP Account Manager</a></dt><dt>PHP4, <a href="appendix.html#id384378">The LDAP Account Manager</a></dt><dt>pile-driver, <a href="kerberos.html#id375395">Share Definition Controls</a></dt><dt>ping, <a href="secure.html#ch4valid">Validation</a></dt><dt>pitfalls, <a href="appendix.html#id384378">The LDAP Account Manager</a></dt><dt>plain-text, <a href="DomApps.html#id379827">Questions and Answers</a></dt><dt>Pluggable Authentication Modules (see PAM)</dt><dt>policy, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="kerberos.html#id372607">Introduction</a></dt><dt>poor performance, <a href="HA.html#id380391">Dissection and Discussion</a></dt><dt>POP3, <a href="nw4migration.html#id368732">Technical Issues</a></dt><dt>Posix, <a href="simple.html#id317402">Dissection and Discussion</a>, <a href="happy.html#id336802">Technical Issues</a>, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="ntmigration.html#id364791">Implementation</a>, <a href="ntmigration.html#id367572">Questions and Answers</a>, <a href="appendix.html#id384378">The LDAP Account Manager</a></dt><dt>POSIX, <a href="happy.html#id336072">Regarding LDAP Directories and Windows Computer Accounts</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>Posix accounts, <a href="happy.html#id341324">LDAP Initialization and Creation of User and Group Accounts</a>, <a href="unixclients.html#id353091">Technical Issues</a></dt><dt>Posix ACLs, <a href="kerberos.html#id376321">Managing Windows 200x ACLs</a></dt><dt>PosixAccount, <a href="happy.html#id341324">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>posixAccount, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>Postfix, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>Postscript, <a href="happy.html#id337689">Installation of Printer Driver Auto-Download</a></dt><dt>powers, <a href="kerberos.html#id375395">Share Definition Controls</a></dt><dt>practices, <a href="kerberos.html#id372607">Introduction</a></dt><dt>precaution, <a href="upgrades.html#id361313">Introduction</a></dt><dt>preferred master, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></dt><dt>presence and leadership, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>price paid, <a href="kerberos.html#id373203">Dissection and Discussion</a></dt><dt>primary group, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="kerberos.html#id375952">Share Point Directory and File Permissions</a></dt><dt>principals, <a href="kerberos.html#id374766">Kerberos Exposed</a></dt><dt>print filter, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a href="Big500users.html#id331694">Server Preparation: All Servers</a>, <a href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>print queue, <a href="simple.html#id317306">Charity Administration Office</a>, <a href="simple.html#id317402">Dissection and Discussion</a></dt><dt>print spooler, <a href="simple.html#id317306">Charity Administration Office</a></dt><dt>Print Test Page, <a href="happy.html#id346795">Uploading Printer Drivers to Samba Servers</a></dt><dt>printable, <a href="simple.html#id317589">Implementation</a>, <a href="simple.html#AcctgNet">Implementation</a>, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>printcap name, <a href="simple.html#id317589">Implementation</a>, <a href="simple.html#AcctgNet">Implementation</a>, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325041">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>printer admin, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a href="unixclients.html#id358229">IDMAP_RID with Winbind</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>printer validation, <a href="small.html#id323199">Validation</a>, <a href="secure.html#ch4valid">Validation</a></dt><dt>printers</dt><dd><dl><dt>Advanced, <a href="happy.html#id346795">Uploading Printer Drivers to Samba Servers</a></dt><dt>Default Settings, <a href="happy.html#id346795">Uploading Printer Drivers to Samba Servers</a></dt><dt>General, <a href="happy.html#id346795">Uploading Printer Drivers to Samba Servers</a></dt><dt>Properties, <a href="happy.html#id346795">Uploading Printer Drivers to Samba Servers</a></dt><dt>Security, <a href="happy.html#id346795">Uploading Printer Drivers to Samba Servers</a></dt><dt>Sharing, <a href="happy.html#id346795">Uploading Printer Drivers to Samba Servers</a></dt></dl></dd><dt>printing, <a href="simple.html#id317589">Implementation</a>, <a href="simple.html#AcctgNet">Implementation</a>, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325041">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dd><dl><dt>drag-and-drop, <a href="happy.html#id337689">Installation of Printer Driver Auto-Download</a>, <a href="happy.html#id346795">Uploading Printer Drivers to Samba Servers</a></dt><dt>dumb, <a href="happy.html#id337689">Installation of Printer Driver Auto-Download</a></dt><dt>point-n-click, <a href="happy.html#id337689">Installation of Printer Driver Auto-Download</a></dt><dt>raw, <a href="simple.html#id317402">Dissection and Discussion</a></dt></dl></dd><dt>privacy, <a href="2000users.html#id348480">Identity Management Needs</a></dt><dt>Privilege Attribute Certificates (see PAC)</dt><dt>privilege controls, <a href="kerberos.html#id375952">Share Point Directory and File Permissions</a></dt><dt>privileged pipe, <a href="DomApps.html#id378606">Samba Configuration</a></dt><dt>privileges, <a href="2000users.html#id348480">Identity Management Needs</a>, <a href="upgrades.html#id363581">Updating from Samba Versions after 3.0.6 to a Current Release</a>, <a href="kerberos.html#id373574">Technical Issues</a>, <a href="kerberos.html#id375395">Share Definition Controls</a></dt><dt>problem report, <a href="ch14.html#id382184">Free Support</a></dt><dt>problem resolution, <a href="ch14.html">Samba Support</a></dt><dt>product defects, <a href="kerberos.html#id373203">Dissection and Discussion</a></dt><dt>professional support, <a href="ch14.html#id382184">Free Support</a></dt><dt>profile</dt><dd><dl><dt>default, <a href="happy.html#id336272">Assignment Tasks</a></dt><dt>mandatory, <a href="2000users.html#id348183">The Nature of Windows Networking Protocols</a></dt><dt>roaming, <a href="happy.html">Making Happy Users</a></dt></dl></dd><dt>profile acls, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>profile path, <a href="ntmigration.html#id364468">Technical Issues</a></dt><dt>profile share, <a href="secure.html#id325041">Implementation</a></dt><dt>profiles, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a></dt><dt>profiles share, <a href="ntmigration.html#id364312">Dissection and Discussion</a></dt><dt>programmer, <a href="kerberos.html#id373203">Dissection and Discussion</a></dt><dt>project, <a href="ch14.html#id382184">Free Support</a></dt><dt>project maintainers, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>Properties, <a href="kerberos.html#id376370">Using the MMC Computer Management Interface</a></dt><dt>proprietary, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>protected, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>protection, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>protocol</dt><dd><dl><dt>negotiation, <a href="2000users.html#id348183">The Nature of Windows Networking Protocols</a></dt></dl></dd><dt>protocol analysis, <a href="primer.html#id386080">Requirements and Notes</a></dt><dt>protocols, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>provided services, <a href="ch14.html">Samba Support</a></dt><dt>proxy, <a href="DomApps.html#id377734">Assignment Tasks</a>, <a href="DomApps.html#id377849">Technical Issues</a></dt><dt>PST file, <a href="happy.html#id346340">Configuration of MS Outlook to Relocate PST File</a></dt><dt>public specifications, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>purchase support, <a href="ch14.html#id382184">Free Support</a></dt></dl></div><div class="indexdiv"><h3>Q</h3><dl><dt>Qbasic, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>qualified problem, <a href="ch14.html#id382184">Free Support</a></dt></dl></div><div class="indexdiv"><h3>R</h3><dl><dt>RAID, <a href="secure.html#id324872">Hardware Requirements</a></dt><dt>RAID controllers, <a href="HA.html#id381824">Hardware Problems</a></dt><dt>Raw Print Through, <a href="happy.html#id337689">Installation of Printer Driver Auto-Download</a></dt><dt>raw printing, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a href="Big500users.html#id331694">Server Preparation: All Servers</a>, <a href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>Rbase, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>rcldap, <a href="2000users.html#id348912">Implementation</a></dt><dt>read only, <a href="simple.html#id316708">Implementation</a>, <a href="simple.html#id317589">Implementation</a>, <a href="simple.html#AcctgNet">Implementation</a>, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>realm, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="unixclients.html#id358229">IDMAP_RID with Winbind</a>, <a href="unixclients.html#id358814">IDMAP Storage in LDAP using Winbind</a>, <a href="unixclients.html#id359380">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a href="DomApps.html#id378243">Kerberos Configuration</a>, <a href="DomApps.html#id379127">NSS Configuration</a></dt><dt>recognize, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>record locking, <a href="appendix.html#id385724">Microsoft Access</a></dt><dt>recursively, <a href="kerberos.html#id376809">Setting Posix ACLs in UNIX/Linux</a></dt><dt>Red Hat, <a href="simple.html#id316598">Drafting Office</a>, <a href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>Red Hat Fedora Linux, <a href="DomApps.html#id378606">Samba Configuration</a></dt><dt>Red Hat Linux, <a href="simple.html#id317402">Dissection and Discussion</a>, <a href="simple.html#AccountingOffice">Accounting Office</a>, <a href="happy.html#id338636">Samba Server Implementation</a>, <a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="DomApps.html#id378010">Implementation</a>, <a href="DomApps.html#id378606">Samba Configuration</a></dt><dt>redirected folders, <a href="happy.html#id337279">Roaming Profile Background</a>, <a href="2000users.html#id348183">The Nature of Windows Networking Protocols</a></dt><dt>refereed standards, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>regedit, <a href="simple.html#id317589">Implementation</a></dt><dt>regedt32, <a href="happy.html#id337546">Profile Changes</a>, <a href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>registry, <a href="ntmigration.html#id367572">Questions and Answers</a></dt><dd><dl><dt>keys</dt><dd><dl><dt>SAM, <a href="ntmigration.html#id364312">Dissection and Discussion</a></dt><dt>SECURITY, <a href="ntmigration.html#id364312">Dissection and Discussion</a></dt></dl></dd></dl></dd><dt>registry change, <a href="kerberos.html#id377127">Questions and Answers</a></dt><dt>Registry Editor, <a href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>registry hacks, <a href="kerberos.html#id377127">Questions and Answers</a></dt><dt>registry keys, <a href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>reimburse, <a href="kerberos.html#id373203">Dissection and Discussion</a></dt><dt>rejected, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="kerberos.html#id375060">Share Access Controls</a></dt><dt>rejoin, <a href="ntmigration.html#id367572">Questions and Answers</a></dt><dt>reliability, <a href="HA.html">Performance, Reliability, and Availability</a></dt><dt>remote announce, <a href="HA.html#id381054">Routed Networks</a></dt><dt>remote browse sync, <a href="HA.html#id381054">Routed Networks</a></dt><dt>remote procedure call (see RPC)</dt><dt>replicate, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="HA.html#id381784">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></dt><dt>replicated, <a href="2000users.html#id347824">Dissection and Discussion</a></dt><dt>requesting payment, <a href="ch14.html#id382184">Free Support</a></dt><dt>resilient, <a href="HA.html#id380842">Guidelines for Reliable Samba Operation</a></dt><dt>resolution, <a href="upgrades.html#id363672">Replacing a Domain Member Server</a></dt><dt>resolve, <a href="unixclients.html#id353091">Technical Issues</a>, <a href="HA.html#id380877">Bad Hostnames</a></dt><dt>response, <a href="unixclients.html#id358229">IDMAP_RID with Winbind</a></dt><dt>responsibility, <a href="kerberos.html#id373203">Dissection and Discussion</a></dt><dt>responsible, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>restrict anonymous, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>restricted export, <a href="kerberos.html#id374766">Kerberos Exposed</a></dt><dt>Restrictive security, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>reverse DNS, <a href="DomApps.html#id378243">Kerberos Configuration</a></dt><dt>rfc2307bis, <a href="unixclients.html#id359380">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a></dt><dt>RID, <a href="unixclients.html#id358229">IDMAP_RID with Winbind</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>risk, <a href="secure.html#id324638">Technical Issues</a>, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="ntmigration.html#id367572">Questions and Answers</a>, <a href="kerberos.html#id372607">Introduction</a></dt><dt>road-map, <a href="kerberos.html#id373574">Technical Issues</a></dt><dd><dl><dt>published, <a href="kerberos.html#id373574">Technical Issues</a></dt></dl></dd><dt>roaming profile, <a href="happy.html#id336802">Technical Issues</a>, <a href="happy.html#id337279">Roaming Profile Background</a>, <a href="happy.html#id345184">Configuring Profile Directories</a>, <a href="2000users.html#id348107">User Needs</a>, <a href="2000users.html#id352211">Questions and Answers</a></dt><dt>roaming profiles, <a href="secure.html#id324638">Technical Issues</a>, <a href="secure.html#id325041">Implementation</a>, <a href="happy.html#id337279">Roaming Profile Background</a></dt><dt>routed network, <a href="HA.html#id381603">Use and Location of BDCs</a></dt><dt>router, <a href="small.html#id321546">Implementation</a></dt><dt>routers, <a href="2000users.html#id352211">Questions and Answers</a>, <a href="HA.html#id381054">Routed Networks</a></dt><dt>RPC, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="kerberos.html#id374766">Kerberos Exposed</a></dt><dt>rpc, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a></dt><dt>rpcclient, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a></dt><dt>RPM, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a>, <a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a href="nw4migration.html#id368660">Dissection and Discussion</a></dt><dd><dl><dt>install, <a href="simple.html#id316708">Implementation</a></dt></dl></dd><dt>rpm, <a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a href="appendix.html#id383041">Samba System File Location</a></dt><dt>RPMs, <a href="DomApps.html#id378606">Samba Configuration</a></dt><dt>rpms, <a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>rsync, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a>, <a href="HA.html#id381784">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></dt><dt>rsyncd.conf, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>run-time control files, <a href="appendix.html#id383041">Samba System File Location</a></dt></dl></div><div class="indexdiv"><h3>S</h3><dl><dt>safe-guards, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>SAM, <a href="ntmigration.html#id364312">Dissection and Discussion</a></dt><dt>samba, <a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dd><dl><dt>starting samba, <a href="simple.html#id316708">Implementation</a></dt></dl></dd><dt>Samba, <a href="DomApps.html#id378606">Samba Configuration</a></dt><dt>Samba accounts, <a href="unixclients.html#id353091">Technical Issues</a></dt><dt>samba cluster, <a href="HA.html#id380314">Introduction</a></dt><dt>samba control script, <a href="appendix.html#id383432">Starting Samba</a></dt><dt>Samba Domain, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="ntmigration.html#id367572">Questions and Answers</a></dt><dt>Samba Domain server, <a href="kerberos.html#id376370">Using the MMC Computer Management Interface</a></dt><dt>Samba RPM Packages, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></dt><dt>Samba Tea, <a href="DomApps.html#id378606">Samba Configuration</a></dt><dt>sambaDomainName, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a></dt><dt>sambaGroupMapping, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>SambaSAMAccount, <a href="happy.html#id336072">Regarding LDAP Directories and Windows Computer Accounts</a></dt><dt>SambaSamAccount, <a href="happy.html#id341324">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>sambaSamAccount, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>SambaXP conference, <a href="DomApps.html#id379827">Questions and Answers</a></dt><dt>SAN, <a href="HA.html#id381688">For Scalability, Use SAN-Based Storage on Samba Servers</a></dt><dt>SAS, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a></dt><dt>scalability, <a href="HA.html#id380314">Introduction</a></dt><dt>scalable, <a href="2000users.html#id348480">Identity Management Needs</a></dt><dt>schannel, <a href="kerberos.html#id373574">Technical Issues</a>, <a href="kerberos.html#id377005">Key Points Learned</a>, <a href="kerberos.html#id377127">Questions and Answers</a></dt><dt>schema, <a href="unixclients.html#id359380">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="upgrades.html#id363269">Samba-2.x with LDAP Support</a>, <a href="upgrades.html#id363507">Updating from Samba Versions between 3.0.6 and 3.0.10</a></dt><dt>scripts, <a href="appendix.html#id384378">The LDAP Account Manager</a></dt><dt>secondary group, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>secret, <a href="kerberos.html#id374766">Kerberos Exposed</a></dt><dt>secrets.tdb, <a href="happy.html#id336802">Technical Issues</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a>, <a href="upgrades.html#sbeug1">Location of config files</a></dt><dt>secure, <a href="kerberos.html#id372607">Introduction</a></dt><dt>secure account password, <a href="unixclients.html#id360240">Questions and Answers</a></dt><dt>secure connections, <a href="appendix.html#id384378">The LDAP Account Manager</a></dt><dt>secure networking, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>secure networking protocols, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>security, <a href="simple.html#id316708">Implementation</a>, <a href="simple.html#id317589">Implementation</a>, <a href="happy.html#id336802">Technical Issues</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="unixclients.html#id358229">IDMAP_RID with Winbind</a>, <a href="unixclients.html#id358814">IDMAP Storage in LDAP using Winbind</a>, <a href="unixclients.html#id359380">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a>, <a href="kerberos.html#id372607">Introduction</a>, <a href="kerberos.html#id373574">Technical Issues</a>, <a href="kerberos.html#id375952">Share Point Directory and File Permissions</a>, <a href="kerberos.html#id377127">Questions and Answers</a>, <a href="DomApps.html#id379127">NSS Configuration</a></dt><dd><dl><dt>identifier, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a></dt><dt>share mode, <a href="simple.html#id317402">Dissection and Discussion</a></dt><dt>user mode, <a href="simple.html#id319572">Dissection and Discussion</a></dt></dl></dd><dt>Security, <a href="kerberos.html#id373574">Technical Issues</a>, <a href="kerberos.html#id376370">Using the MMC Computer Management Interface</a></dt><dt>Security Account Manager (see SAM)</dt><dt>security controls, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>security descriptors, <a href="ntmigration.html#id364312">Dissection and Discussion</a></dt><dt>security fixes, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>security updates, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>SerNet, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="DomApps.html#id378606">Samba Configuration</a></dt><dt>server</dt><dd><dl><dt>domain member, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a></dt><dt>stand-alone, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a></dt></dl></dd><dt>server string, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="unixclients.html#id358229">IDMAP_RID with Winbind</a>, <a href="unixclients.html#id358814">IDMAP Storage in LDAP using Winbind</a>, <a href="unixclients.html#id359380">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>service, <a href="2000users.html#id348912">Implementation</a></dt><dd><dl><dt>smb</dt><dd><dl><dt>start, <a href="Big500users.html#ch5-domsvrspec">Configuration Specific to Domain Member Servers: BLDG1, BLDG2</a></dt></dl></dd></dl></dd><dt>Service Packs, <a href="secure.html#ch4appscfg">Application Share Configuration</a></dt><dt>services, <a href="DomApps.html#id379772">Key Points Learned</a></dt><dt>services provided, <a href="ch14.html">Samba Support</a></dt><dt>session setup, <a href="primer.html#id387580">Simple Windows Client Connection Characteristics</a>, <a href="primer.html#id388041">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>Session Setup, <a href="primer.html#id387580">Simple Windows Client Connection Characteristics</a></dt><dt>SessionSetUpAndX, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a></dt><dt>set primary group script, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="upgrades.html#id362947">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>setfacl, <a href="kerberos.html#id376809">Setting Posix ACLs in UNIX/Linux</a></dt><dt>severely degrade, <a href="HA.html#id381308">Samba Configuration</a></dt><dt>SFU, <a href="unixclients.html#id359663">IDMAP, Active Directory, and MS Services for UNIX 3.5</a></dt><dt>SGID, <a href="simple.html#id317402">Dissection and Discussion</a>, <a href="kerberos.html#id375952">Share Point Directory and File Permissions</a>, <a href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></dt><dt>shadow-utils, <a href="ntmigration.html#id367572">Questions and Answers</a></dt><dt>Share Access Controls, <a href="kerberos.html#id375060">Share Access Controls</a></dt><dt>share ACLs, <a href="kerberos.html#id377127">Questions and Answers</a></dt><dt>share definition, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>Share Definition</dt><dd><dl><dt>Controls, <a href="kerberos.html#id375395">Share Definition Controls</a></dt></dl></dd><dt>share definition controls, <a href="kerberos.html#id375395">Share Definition Controls</a>, <a href="kerberos.html#id375528">Checkpoint Controls</a>, <a href="kerberos.html#id375952">Share Point Directory and File Permissions</a>, <a href="kerberos.html#id377127">Questions and Answers</a></dt><dt>share level access controls, <a href="kerberos.html#id377127">Questions and Answers</a></dt><dt>share level ACL, <a href="kerberos.html#id377127">Questions and Answers</a></dt><dt>Share Permissions, <a href="kerberos.html#id375060">Share Access Controls</a></dt><dt>shared resource, <a href="kerberos.html#id373574">Technical Issues</a>, <a href="kerberos.html#id376809">Setting Posix ACLs in UNIX/Linux</a></dt><dt>shares, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>show add printer wizard, <a href="simple.html#id317589">Implementation</a>, <a href="simple.html#AcctgNet">Implementation</a>, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>shutdown script, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="2000users.html#id348912">Implementation</a></dt><dt>SID, <a href="secure.html#ch4wincfg">Windows Client Configuration</a>, <a href="happy.html#id336072">Regarding LDAP Directories and Windows Computer Accounts</a>, <a href="2000users.html#id348480">Identity Management Needs</a>, <a href="unixclients.html#id353091">Technical Issues</a>, <a href="unixclients.html#id358229">IDMAP_RID with Winbind</a>, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a>, <a href="upgrades.html#id362215">Change of Workgroup (Domain) Name</a>, <a href="ntmigration.html#id367572">Questions and Answers</a>, <a href="appendix.html#id383921">Initialization of the LDAP Database</a></dt><dt>side effects, <a href="kerberos.html#id376321">Managing Windows 200x ACLs</a></dt><dt>Sign'n'seal, <a href="kerberos.html#id377005">Key Points Learned</a>, <a href="kerberos.html#id377127">Questions and Answers</a></dt><dt>silent return, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>simple, <a href="HA.html#id380391">Dissection and Discussion</a></dt><dt>Single Sign-On (see SSO)</dt><dt>slapcat, <a href="happy.html#id341324">LDAP Initialization and Creation of User and Group Accounts</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>slapd, <a href="happy.html#id338019">Debugging LDAP</a></dt><dt>slapd.conf, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a></dt><dt>slave, <a href="2000users.html#id347824">Dissection and Discussion</a></dt><dt>slow logon, <a href="happy.html">Making Happy Users</a></dt><dt>slow network, <a href="HA.html#id381824">Hardware Problems</a></dt><dt>slurpd, <a href="2000users.html#id348912">Implementation</a>, <a href="2000users.html#id352211">Questions and Answers</a></dt><dt>smart printing, <a href="happy.html#id336400">Dissection and Discussion</a></dt><dt>SMB, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a></dt><dt>SMB passwords, <a href="2000users.html#id348912">Implementation</a></dt><dt>smb ports, <a href="secure.html#id325866">Samba Configuration</a>, <a href="secure.html#id330204">Questions and Answers</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a></dt><dt>SMB/CIFS, <a href="DomApps.html#id379827">Questions and Answers</a></dt><dt>smbclient, <a href="simple.html#validate1">Validation</a>, <a href="secure.html#ch4valid">Validation</a>, <a href="happy.html#id341324">LDAP Initialization and Creation of User and Group Accounts</a>, <a href="DomApps.html#id379827">Questions and Answers</a></dt><dt>smbd, <a href="simple.html#validate1">Validation</a>, <a href="simple.html#id317589">Implementation</a>, <a href="small.html#id323199">Validation</a>, <a href="secure.html#ch4valid">Validation</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="unixclients.html#id353091">Technical Issues</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a>, <a href="upgrades.html#sbeug1">Location of config files</a>, <a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a href="upgrades.html#id363672">Replacing a Domain Member Server</a>, <a href="DomApps.html#id378606">Samba Configuration</a>, <a href="DomApps.html#id379827">Questions and Answers</a>, <a href="appendix.html#id383432">Starting Samba</a></dt><dd><dl><dt>location of files, <a href="appendix.html#id383041">Samba System File Location</a></dt></dl></dd><dt>smbfs, <a href="HA.html#id380391">Dissection and Discussion</a></dt><dt>smbldap-groupadd, <a href="happy.html#id341324">LDAP Initialization and Creation of User and Group Accounts</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>smbldap-groupmod, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>smbldap-passwd, <a href="happy.html#id341324">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>smbldap-populate, <a href="happy.html#id341324">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>smbldap-tools, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a>, <a href="appendix.html#id384378">The LDAP Account Manager</a></dt><dt>smbldap-tools updating, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a></dt><dt>smbldap-useradd, <a href="happy.html#id341324">LDAP Initialization and Creation of User and Group Accounts</a>, <a href="2000users.html#id348912">Implementation</a></dt><dt>smbldap-usermod, <a href="happy.html#id341324">LDAP Initialization and Creation of User and Group Accounts</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>smbmnt, <a href="HA.html#id380391">Dissection and Discussion</a></dt><dt>smbmount, <a href="HA.html#id380391">Dissection and Discussion</a></dt><dt>smbpasswd, <a href="simple.html#AcctgNet">Implementation</a>, <a href="small.html#id321342">Technical Issues</a>, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id324638">Technical Issues</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id331694">Server Preparation: All Servers</a>, <a href="Big500users.html#id332221">Configuration for Server: MASSIVE</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="happy.html#id341324">LDAP Initialization and Creation of User and Group Accounts</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id347824">Dissection and Discussion</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="upgrades.html">Updating Samba-3</a>, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a>, <a href="upgrades.html#id362947">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a href="ntmigration.html#id364468">Technical Issues</a>, <a href="ntmigration.html#id367572">Questions and Answers</a>, <a href="DomApps.html">Integrating Additional Services</a></dt><dt>smbumnt, <a href="HA.html#id380391">Dissection and Discussion</a></dt><dt>smbumount, <a href="HA.html#id380391">Dissection and Discussion</a></dt><dt>SMTP, <a href="nw4migration.html#id368732">Technical Issues</a></dt><dt>snap-shot, <a href="ntmigration.html#id364312">Dissection and Discussion</a></dt><dt>socket address, <a href="HA.html#id381308">Samba Configuration</a></dt><dt>socket options, <a href="HA.html#id381308">Samba Configuration</a></dt><dt>software, <a href="kerberos.html#id373203">Dissection and Discussion</a></dt><dt>solve, <a href="kerberos.html#id373203">Dissection and Discussion</a></dt><dt>source code, <a href="kerberos.html#id373203">Dissection and Discussion</a></dt><dt>SPNEGO, <a href="primer.html#id388041">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>SQL, <a href="2000users.html#id347824">Dissection and Discussion</a>, <a href="2000users.html#id352211">Questions and Answers</a></dt><dt>Squid, <a href="DomApps.html#id378010">Implementation</a>, <a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a href="DomApps.html#id378606">Samba Configuration</a>, <a href="DomApps.html#id379397">Squid Configuration</a></dt><dt>squid, <a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a href="DomApps.html#id378606">Samba Configuration</a></dt><dt>Squid proxy, <a href="DomApps.html#id377849">Technical Issues</a></dt><dt>SRVTOOLS.EXE, <a href="secure.html#id325041">Implementation</a>, <a href="happy.html#id345184">Configuring Profile Directories</a>, <a href="ntmigration.html#id367572">Questions and Answers</a>, <a href="kerberos.html#id377127">Questions and Answers</a></dt><dt>SSL, <a href="appendix.html#id384378">The LDAP Account Manager</a></dt><dt>stand-alone server, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a></dt><dt>starting CUPS, <a href="simple.html#id317589">Implementation</a>, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#procstart">Process Startup Configuration</a>, <a href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dt>starting dhcpd, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#procstart">Process Startup Configuration</a>, <a href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dt>starting samba, <a href="simple.html#id316708">Implementation</a>, <a href="simple.html#id317589">Implementation</a>, <a href="simple.html#AcctgNet">Implementation</a>, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#procstart">Process Startup Configuration</a>, <a href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dd><dl><dt>nmbd, <a href="appendix.html#id383432">Starting Samba</a></dt><dt>smbd, <a href="appendix.html#id383432">Starting Samba</a></dt><dt>winbindd, <a href="appendix.html#id383432">Starting Samba</a></dt></dl></dd><dt>startingCUPS, <a href="simple.html#AcctgNet">Implementation</a></dt><dt>startup script, <a href="appendix.html#id383432">Starting Samba</a></dt><dt>sticky bit, <a href="small.html#id321546">Implementation</a></dt><dt>storage capacity, <a href="secure.html#id324872">Hardware Requirements</a></dt><dt>strategic, <a href="ntmigration.html#id364468">Technical Issues</a></dt><dt>strategy, <a href="unixclients.html#id360240">Questions and Answers</a></dt><dt>straw-man, <a href="kerberos.html">Active Directory, Kerberos, and Security</a></dt><dt>strict sync, <a href="HA.html#id381308">Samba Configuration</a></dt><dt>stripped, <a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></dt><dt>strong cryptography, <a href="kerberos.html#id374766">Kerberos Exposed</a></dt><dt>subscription, <a href="ch14.html#id382184">Free Support</a></dt><dt>SUID, <a href="simple.html#id317402">Dissection and Discussion</a>, <a href="kerberos.html#id377127">Questions and Answers</a>, <a href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></dt><dt>Sun ONE Identity Server, <a href="happy.html#id336400">Dissection and Discussion</a></dt><dt>super daemon, <a href="secure.html#procstart">Process Startup Configuration</a></dt><dt>support, <a href="kerberos.html#id373203">Dissection and Discussion</a>, <a href="ch14.html">Samba Support</a></dt><dt>survey, <a href="unixclients.html">Adding Domain Member Servers and Clients</a></dt><dt>SUSE, <a href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>SUSE Enterprise Linux Server, <a href="simple.html#id317306">Charity Administration Office</a>, <a href="secure.html#ch4bsc">Basic System Configuration</a>, <a href="DomApps.html#id378010">Implementation</a></dt><dt>SUSE Linux, <a href="simple.html#id317402">Dissection and Discussion</a>, <a href="happy.html#id338636">Samba Server Implementation</a>, <a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="DomApps.html#id378010">Implementation</a>, <a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>SWAT, <a href="appendix.html#id383041">Samba System File Location</a></dt><dt>sync always, <a href="HA.html#id381308">Samba Configuration</a></dt><dt>synchronization, <a href="DomApps.html#id378243">Kerberos Configuration</a>, <a href="HA.html#id381688">For Scalability, Use SAN-Based Storage on Samba Servers</a></dt><dt>synchronize, <a href="2000users.html#id348107">User Needs</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>synchronized, <a href="unixclients.html#id360240">Questions and Answers</a></dt><dt>syslog, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#ldapsetup">OpenLDAP Server Configuration</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a></dt><dt>system level logins, <a href="unixclients.html#id360240">Questions and Answers</a></dt><dt>system security, <a href="kerberos.html#id373574">Technical Issues</a></dt></dl></div><div class="indexdiv"><h3>T</h3><dl><dt>tattooing, <a href="ntmigration.html#id367572">Questions and Answers</a></dt><dt>TCP/IP, <a href="unixclients.html#id360240">Questions and Answers</a></dt><dt>tdbdump, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a></dt><dt>tdbsam, <a href="secure.html#id324638">Technical Issues</a>, <a href="secure.html#id325041">Implementation</a>, <a href="Big500users.html">The 500-User Office</a>, <a href="happy.html#id336272">Assignment Tasks</a>, <a href="2000users.html#id347824">Dissection and Discussion</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="upgrades.html#id362947">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a href="upgrades.html#id363507">Updating from Samba Versions between 3.0.6 and 3.0.10</a>, <a href="ntmigration.html#id364468">Technical Issues</a>, <a href="ntmigration.html#id367572">Questions and Answers</a></dt><dt>template primary group, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>template shell, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="unixclients.html#id358229">IDMAP_RID with Winbind</a>, <a href="unixclients.html#id358814">IDMAP Storage in LDAP using Winbind</a>, <a href="unixclients.html#id359380">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a></dt><dt>testparm, <a href="small.html#id323199">Validation</a>, <a href="secure.html#ch4valid">Validation</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a href="HA.html#id381308">Samba Configuration</a></dt><dt>ticket, <a href="DomApps.html#id378606">Samba Configuration</a></dt><dt>time server, <a href="secure.html#id325041">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>Tivoli Directory Server, <a href="happy.html#id336400">Dissection and Discussion</a></dt><dt>TLS, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>token, <a href="DomApps.html#id377849">Technical Issues</a></dt><dt>tool, <a href="ntmigration.html#id367572">Questions and Answers</a>, <a href="kerberos.html#id373203">Dissection and Discussion</a></dt><dt>TOSHARG2, <a href="simple.html#id317589">Implementation</a></dt><dt>track record, <a href="kerberos.html#id373203">Dissection and Discussion</a></dt><dt>traffic collisions, <a href="happy.html">Making Happy Users</a></dt><dt>transaction processing, <a href="2000users.html#id347824">Dissection and Discussion</a></dt><dt>transactional, <a href="2000users.html#id352211">Questions and Answers</a></dt><dt>transfer, <a href="ntmigration.html#id367572">Questions and Answers</a></dt><dt>translate, <a href="kerberos.html#id376321">Managing Windows 200x ACLs</a></dt><dt>traverse, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt><dt>tree, <a href="nw4migration.html#id368660">Dissection and Discussion</a></dt><dt>Tree Connect, <a href="primer.html#id387580">Simple Windows Client Connection Characteristics</a></dt><dt>trust account, <a href="happy.html#id336072">Regarding LDAP Directories and Windows Computer Accounts</a></dt><dt>trusted computing, <a href="kerberos.html#id372607">Introduction</a></dt><dt>Trusted Domains, <a href="unixclients.html#id353091">Technical Issues</a></dt><dt>trusted domains, <a href="unixclients.html#id360240">Questions and Answers</a></dt><dt>trusted third-party, <a href="kerberos.html#id374766">Kerberos Exposed</a></dt><dt>trusting, <a href="kerberos.html#id374766">Kerberos Exposed</a></dt><dt>turn-around time, <a href="kerberos.html#id373574">Technical Issues</a></dt></dl></div><div class="indexdiv"><h3>U</h3><dl><dt>UDP</dt><dd><dl><dt>broadcast, <a href="HA.html#id381054">Routed Networks</a></dt></dl></dd><dt>UID, <a href="simple.html#id317402">Dissection and Discussion</a>, <a href="happy.html#id336072">Regarding LDAP Directories and Windows Computer Accounts</a>, <a href="happy.html#id336802">Technical Issues</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="ntmigration.html#id367572">Questions and Answers</a></dt><dt>un-join, <a href="ntmigration.html#id367572">Questions and Answers</a></dt><dt>unauthorized activities, <a href="kerberos.html#id374766">Kerberos Exposed</a></dt><dt>UNC name, <a href="2000users.html#id352211">Questions and Answers</a></dt><dt>unencrypted, <a href="appendix.html#id384378">The LDAP Account Manager</a></dt><dt>Unicast, <a href="2000users.html#id348183">The Nature of Windows Networking Protocols</a></dt><dt>unicode, <a href="upgrades.html#id362458">International Language Support</a></dt><dt>Universal Naming Convention (see UNC name)</dt><dt>UNIX, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dd><dl><dt>groups, <a href="small.html#id321342">Technical Issues</a>, <a href="small.html#id321546">Implementation</a></dt></dl></dd><dt>UNIX accounts, <a href="happy.html#id336802">Technical Issues</a></dt><dt>unix charset, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>unix password sync, <a href="secure.html#id325866">Samba Configuration</a></dt><dt>UNIX/Linux server, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>unix2dos, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id332221">Configuration for Server: MASSIVE</a></dt><dt>unknown, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>unsupported software, <a href="ch14.html#id382382">Commercial Support</a></dt><dt>update, <a href="upgrades.html#id361313">Introduction</a>, <a href="upgrades.html#id361397">Cautions and Notes</a></dt><dt>updates, <a href="kerberos.html#id372607">Introduction</a>, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>updating smbldap-tools, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a></dt><dt>upgrade, <a href="upgrades.html#id361313">Introduction</a>, <a href="upgrades.html#id361397">Cautions and Notes</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>uppercase, <a href="ntmigration.html#id364791">Implementation</a></dt><dt>use client driver, <a href="simple.html#id317589">Implementation</a>, <a href="simple.html#AcctgNet">Implementation</a>, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>user</dt><dd><dl><dt>management, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id332221">Configuration for Server: MASSIVE</a></dt></dl></dd><dt>user account, <a href="happy.html">Making Happy Users</a>, <a href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>User and Group Controls, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>user credentials, <a href="2000users.html#id348480">Identity Management Needs</a>, <a href="unixclients.html#id359708">UNIX/Linux Client Domain Member</a></dt><dt>user errors, <a href="unixclients.html#id360240">Questions and Answers</a></dt><dt>user groups, <a href="ch14.html#id382184">Free Support</a></dt><dt>user identities, <a href="unixclients.html#id353760">Implementation</a></dt><dt>user logins, <a href="unixclients.html#id360240">Questions and Answers</a></dt><dt>user management, <a href="secure.html#id325041">Implementation</a></dt><dt>User Manager, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a></dt><dt>User Mode, <a href="secure.html#id325041">Implementation</a>, <a href="primer.html#id387580">Simple Windows Client Connection Characteristics</a>, <a href="primer.html#id388041">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>useradd, <a href="simple.html#id317589">Implementation</a>, <a href="simple.html#AcctgNet">Implementation</a>, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id332221">Configuration for Server: MASSIVE</a>, <a href="upgrades.html#id362947">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>userdel, <a href="upgrades.html#id362947">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>usermod, <a href="upgrades.html#id362947">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a></dt><dt>username, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a></dt><dt>username map, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id331694">Server Preparation: All Servers</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>UTF-8, <a href="upgrades.html#id362458">International Language Support</a></dt><dt>utilities, <a href="DomApps.html#id379827">Questions and Answers</a></dt><dt>utmp, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="2000users.html#id348912">Implementation</a></dt></dl></div><div class="indexdiv"><h3>V</h3><dl><dt>valid users, <a href="simple.html#AcctgNet">Implementation</a>, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a>, <a href="kerberos.html#id375528">Checkpoint Controls</a>, <a href="kerberos.html#id377127">Questions and Answers</a></dt><dt>validate, <a href="ntmigration.html#id367572">Questions and Answers</a>, <a href="kerberos.html#id375528">Checkpoint Controls</a></dt><dt>validated, <a href="2000users.html#id348480">Identity Management Needs</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="kerberos.html#id372607">Introduction</a></dt><dt>validation, <a href="simple.html#validate1">Validation</a>, <a href="secure.html#ch4valid">Validation</a>, <a href="DomApps.html#id379827">Questions and Answers</a></dt><dt>vampire, <a href="ntmigration.html#id367572">Questions and Answers</a></dt><dt>vendor, <a href="kerberos.html#id373203">Dissection and Discussion</a></dt><dt>vendors, <a href="upgrades.html#id363384">Updating a Samba-3 Installation</a></dt><dt>veto files, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>veto oplock files, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a></dt><dt>VFS modules, <a href="appendix.html#id383041">Samba System File Location</a></dt><dt>virus, <a href="secure.html#id325041">Implementation</a></dt><dt>VPN, <a href="2000users.html#id347767">Assignment Tasks</a></dt><dt>vulnerabilities, <a href="kerberos.html#id372607">Introduction</a></dt></dl></div><div class="indexdiv"><h3>W</h3><dl><dt>wbinfo, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="DomApps.html#id378606">Samba Configuration</a></dt><dt>weakness, <a href="kerberos.html#id373574">Technical Issues</a></dt><dt>web</dt><dd><dl><dt>caching, <a href="DomApps.html#id377734">Assignment Tasks</a></dt><dt>proxying, <a href="DomApps.html#id377734">Assignment Tasks</a></dt></dl></dd><dt>Web</dt><dd><dl><dt>proxy, <a href="DomApps.html#id379827">Questions and Answers</a></dt><dd><dl><dt>access, <a href="DomApps.html#id379772">Key Points Learned</a></dt></dl></dd></dl></dd><dt>Web browsers, <a href="DomApps.html#id379772">Key Points Learned</a></dt><dt>WebClient, <a href="happy.html">Making Happy Users</a></dt><dt>WHATSNEW.txt, <a href="upgrades.html#id363269">Samba-2.x with LDAP Support</a></dt><dt>white-pages, <a href="nw4migration.html#id368732">Technical Issues</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>wide-area, <a href="2000users.html#id348107">User Needs</a>, <a href="2000users.html#id348480">Identity Management Needs</a>, <a href="2000users.html#id352072">Key Points Learned</a>, <a href="2000users.html#id352211">Questions and Answers</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt><dt>wide-area network, <a href="HA.html#id381603">Use and Location of BDCs</a>, <a href="HA.html#id381784">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></dt><dt>winbind, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#id353067">Dissection and Discussion</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="kerberos.html#id372607">Introduction</a>, <a href="kerberos.html#id373574">Technical Issues</a>, <a href="DomApps.html#id377849">Technical Issues</a>, <a href="DomApps.html#id378606">Samba Configuration</a>, <a href="DomApps.html#id379127">NSS Configuration</a></dt><dt>Winbind, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="kerberos.html#id373574">Technical Issues</a>, <a href="kerberos.html#id377005">Key Points Learned</a></dt><dt>winbind enum groups, <a href="unixclients.html#id358229">IDMAP_RID with Winbind</a>, <a href="DomApps.html#id379127">NSS Configuration</a></dt><dt>winbind enum users, <a href="unixclients.html#id358229">IDMAP_RID with Winbind</a>, <a href="DomApps.html#id379127">NSS Configuration</a></dt><dt>winbind nested groups, <a href="unixclients.html#id358229">IDMAP_RID with Winbind</a>, <a href="unixclients.html#id359380">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a></dt><dt>winbind separator, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="DomApps.html#id379127">NSS Configuration</a></dt><dt>winbind trusted domains only, <a href="unixclients.html#id353091">Technical Issues</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#id359380">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a href="unixclients.html#id360240">Questions and Answers</a></dt><dt>winbind use default domain, <a href="unixclients.html#id358229">IDMAP_RID with Winbind</a>, <a href="unixclients.html#id358814">IDMAP Storage in LDAP using Winbind</a>, <a href="unixclients.html#id359380">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a href="kerberos.html#id375528">Checkpoint Controls</a></dt><dt>winbind user default domain, <a href="DomApps.html#id379127">NSS Configuration</a></dt><dt>winbindd, <a href="small.html#id323199">Validation</a>, <a href="secure.html#ch4valid">Validation</a>, <a href="Big500users.html#id330784">Technical Issues</a>, <a href="unixclients.html#id353091">Technical Issues</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#id360240">Questions and Answers</a>, <a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a href="upgrades.html#id363581">Updating from Samba Versions after 3.0.6 to a Current Release</a>, <a href="upgrades.html#id363672">Replacing a Domain Member Server</a>, <a href="DomApps.html#id378606">Samba Configuration</a>, <a href="DomApps.html#id379827">Questions and Answers</a>, <a href="appendix.html#id383432">Starting Samba</a></dt><dt>winbindd_cache.tdb, <a href="unixclients.html#id353091">Technical Issues</a></dt><dt>winbindd_idmap.tdb, <a href="unixclients.html#id353091">Technical Issues</a></dt><dt>Windows, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dd><dl><dt>client, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a></dt><dt>NT, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a></dt></dl></dd><dt>Windows 2000 ACLs, <a href="kerberos.html#id376321">Managing Windows 200x ACLs</a></dt><dt>Windows 2003 Serve, <a href="kerberos.html#id372607">Introduction</a></dt><dt>Windows 200x ACLs, <a href="kerberos.html#id377127">Questions and Answers</a></dt><dt>Windows accounts, <a href="happy.html#id336802">Technical Issues</a></dt><dt>Windows ACLs, <a href="kerberos.html#id376809">Setting Posix ACLs in UNIX/Linux</a></dt><dt>Windows Address Book, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>Windows ADS Domain, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt><dt>Windows clients, <a href="DomApps.html#id379827">Questions and Answers</a></dt><dt>Windows Explorer, <a href="simple.html#validate1">Validation</a></dt><dt>Windows explorer, <a href="DomApps.html#id379827">Questions and Answers</a></dt><dt>Windows security identifier (see SID)</dt><dt>Windows Servers, <a href="kerberos.html#id372607">Introduction</a></dt><dt>Windows Services for UNIX (see SUS)</dt><dt>Windows XP, <a href="small.html#id321247">Assignment Tasks</a></dt><dt>WINS, <a href="simple.html#id317589">Implementation</a>, <a href="small.html#id321342">Technical Issues</a>, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#ch4wincfg">Windows Client Configuration</a>, <a href="Big500users.html#id330784">Technical Issues</a>, <a href="Big500users.html#ch5wincfg">Windows Client Configuration</a>, <a href="2000users.html#id348183">The Nature of Windows Networking Protocols</a>, <a href="2000users.html#id348480">Identity Management Needs</a>, <a href="2000users.html#id352211">Questions and Answers</a>, <a href="primer.html#chap01qa">Questions and Answers</a></dt><dd><dl><dt>lookup, <a href="unixclients.html#id360240">Questions and Answers</a></dt><dt>name resolution, <a href="HA.html#id381054">Routed Networks</a></dt><dt>server, <a href="happy.html">Making Happy Users</a>, <a href="HA.html#id381054">Routed Networks</a></dt></dl></dd><dt>WINS server, <a href="Big500users.html">The 500-User Office</a>, <a href="2000users.html#id352211">Questions and Answers</a></dt><dt>wins server, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a></dt><dt>WINS serving, <a href="secure.html#id325041">Implementation</a></dt><dt>wins support, <a href="simple.html#id317589">Implementation</a>, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325041">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="secure.html#ch4valid">Validation</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>wins.dat, <a href="2000users.html#id348480">Identity Management Needs</a>, <a href="upgrades.html#id363672">Replacing a Domain Member Server</a></dt><dt>Word, <a href="kerberos.html#id375952">Share Point Directory and File Permissions</a></dt><dt>workgroup, <a href="simple.html#id316708">Implementation</a>, <a href="simple.html#id317589">Implementation</a>, <a href="simple.html#AcctgNet">Implementation</a>, <a href="small.html#id321546">Implementation</a>, <a href="secure.html#id325866">Samba Configuration</a>, <a href="Big500users.html#id330980">Implementation</a>, <a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="unixclients.html#id358229">IDMAP_RID with Winbind</a>, <a href="unixclients.html#id358814">IDMAP Storage in LDAP using Winbind</a>, <a href="unixclients.html#id359380">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a href="upgrades.html#id361487">Security Identifiers (SIDs)</a>, <a href="upgrades.html#id362215">Change of Workgroup (Domain) Name</a>, <a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a>, <a href="DomApps.html#id379127">NSS Configuration</a></dt><dt>Workgroup Announcement, <a href="primer.html#id387234">Findings</a></dt><dt>workstation, <a href="unixclients.html#id353760">Implementation</a></dt><dt>wrapper, <a href="DomApps.html#id379827">Questions and Answers</a></dt><dt>write list, <a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a href="2000users.html#id348912">Implementation</a>, <a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a href="nw4migration.html#id368982">LDAP Server Configuration</a></dt><dt>write lock, <a href="appendix.html#id385938">Opportunistic Locking Controls</a></dt></dl></div><div class="indexdiv"><h3>X</h3><dl><dt>xinetd, <a href="secure.html#procstart">Process Startup Configuration</a></dt><dt>XML, <a href="2000users.html#id347824">Dissection and Discussion</a></dt><dt>xmlsam, <a href="2000users.html#id348912">Implementation</a></dt></dl></div><div class="indexdiv"><h3>Y</h3><dl><dt>YaST, <a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dt>Yellow Pages, <a href="2000users.html#id348480">Identity Management Needs</a></dt><dt>yellow pages (see NIS)</dt></dl></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="go01.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> </td></tr><tr><td width="40%" align="left" valign="top">Glossary </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> </td></tr></table></div></body></html>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Index</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="go01.html" title="Glossary"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Index</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="go01.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> </td></tr></table><hr></div><div class="index"><div class="titlepage"><div><div><h2 class="title"><a name="id412935"></a>Index</h2></div></div></div><div class="index"><div class="indexdiv"><h3>Symbols</h3><dl><dt>%LOGONSERVER%, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>%USERNAME%, <a class="indexterm" href="happy.html#id360094">Roaming Profile Background</a>, <a class="indexterm" href="happy.html#id360364">Profile Changes</a></dt><dt>%USERPROFILE%, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>/data/ldap, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>/etc/cups/mime.convs, <a class="indexterm" href="simple.html#id341634">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a></dt><dt>/etc/cups/mime.types, <a class="indexterm" href="simple.html#id341634">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a></dt><dt>/etc/dhcpd.conf, <a class="indexterm" href="small.html#id345178">Implementation</a>, <a class="indexterm" href="small.html#id346626">Validation</a>, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>/etc/exports, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></dt><dt>/etc/group, <a class="indexterm" href="happy.html#id359614">Technical Issues</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="upgrades.html#id386001">Replacing a Domain Member Server</a>, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a>, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>/etc/hosts, <a class="indexterm" href="simple.html#id340832">Implementation</a>, <a class="indexterm" href="small.html#id345178">Implementation</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="Big500users.html#id354601">Server Preparation: All Servers</a>, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a>, <a class="indexterm" href="DomApps.html#id400370">Kerberos Configuration</a>, <a class="indexterm" href="HA.html#id402984">Bad Hostnames</a></dt><dt>/etc/krb5.conf, <a class="indexterm" href="unixclients.html#id381158">IDMAP Storage in LDAP using Winbind</a>, <a class="indexterm" href="DomApps.html#id400370">Kerberos Configuration</a></dt><dt>/etc/ldap.conf, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="unixclients.html#id381158">IDMAP Storage in LDAP using Winbind</a>, <a class="indexterm" href="unixclients.html#id381708">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a class="indexterm" href="ntmigration.html#id387250">NT4 Migration Using LDAP Backend</a>, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a></dt><dt>/etc/mime.convs, <a class="indexterm" href="small.html#id345178">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id354601">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>/etc/mime.types, <a class="indexterm" href="small.html#id345178">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id354601">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>/etc/named.conf, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></dt><dt>/etc/nsswitch.conf, <a class="indexterm" href="small.html#id345178">Implementation</a>, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="Big500users.html#id355127">Configuration for Server: MASSIVE</a>, <a class="indexterm" href="Big500users.html#ch5-domsvrspec">Configuration Specific to Domain Member Servers: BLDG1, BLDG2</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#id380589">IDMAP_RID with Winbind</a>, <a class="indexterm" href="unixclients.html#id381708">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id387250">NT4 Migration Using LDAP Backend</a></dt><dt>/etc/openldap/slapd.conf, <a class="indexterm" href="happy.html#id360837">Debugging LDAP</a>, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a>, <a class="indexterm" href="2000users.html#id371556">Implementation</a></dt><dt>/etc/passwd, <a class="indexterm" href="small.html#id345178">Implementation</a>, <a class="indexterm" href="secure.html#id349099">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id355127">Configuration for Server: MASSIVE</a>, <a class="indexterm" href="happy.html#id364093">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id386001">Replacing a Domain Member Server</a>, <a class="indexterm" href="ntmigration.html#id386802">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id390984">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id398076">Share Point Directory and File Permissions</a>, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a class="indexterm" href="primer.html#id409948">Findings and Comments</a></dt><dt>/etc/rc.d/boot.local, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="Big500users.html#id355127">Configuration for Server: MASSIVE</a></dt><dt>/etc/rc.d/rc.local, <a class="indexterm" href="small.html#id345178">Implementation</a></dt><dt>/etc/resolv.conf, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a>, <a class="indexterm" href="Big500users.html#id354601">Server Preparation: All Servers</a></dt><dt>/etc/samba, <a class="indexterm" href="appendix.html#id405157">Samba System File Location</a></dt><dt>/etc/samba/secrets.tdb, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>/etc/samba/smbusers, <a class="indexterm" href="Big500users.html#id354601">Server Preparation: All Servers</a></dt><dt>/etc/shadow, <a class="indexterm" href="upgrades.html#id386001">Replacing a Domain Member Server</a>, <a class="indexterm" href="nw4migration.html#id390984">Technical Issues</a></dt><dt>/etc/squid/squid.conf, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>/etc/syslog.conf, <a class="indexterm" href="happy.html#id360837">Debugging LDAP</a></dt><dt>/etc/xinetd.d, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a>, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dt>/lib/libnss_ldap.so.2, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dt>/opt/IDEALX/sbin, <a class="indexterm" href="ntmigration.html#id387250">NT4 Migration Using LDAP Backend</a></dt><dt>/proc/sys/net/ipv4/ip_forward, <a class="indexterm" href="small.html#id345178">Implementation</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a></dt><dt>/usr/bin, <a class="indexterm" href="appendix.html#id405157">Samba System File Location</a></dt><dt>/usr/lib/samba, <a class="indexterm" href="appendix.html#id405157">Samba System File Location</a></dt><dt>/usr/local, <a class="indexterm" href="appendix.html#id405157">Samba System File Location</a></dt><dt>/usr/local/samba, <a class="indexterm" href="appendix.html#id405157">Samba System File Location</a></dt><dt>/usr/local/samba/var/locks, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></dt><dt>/usr/sbin, <a class="indexterm" href="appendix.html#id405157">Samba System File Location</a></dt><dt>/usr/share, <a class="indexterm" href="appendix.html#id405157">Samba System File Location</a></dt><dt>/usr/share/samba/swat, <a class="indexterm" href="appendix.html#id405157">Samba System File Location</a></dt><dt>/usr/share/swat, <a class="indexterm" href="appendix.html#id405157">Samba System File Location</a></dt><dt>/var/cache/samba, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></dt><dt>/var/lib/samba, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="appendix.html#id405157">Samba System File Location</a></dt><dt>/var/log/ldaplogs, <a class="indexterm" href="happy.html#id360837">Debugging LDAP</a></dt><dt>/var/log/samba, <a class="indexterm" href="appendix.html#id405157">Samba System File Location</a></dt><dt>8-bit, <a class="indexterm" href="upgrades.html#id384787">International Language Support</a></dt></dl></div><div class="indexdiv"><h3></h3><dl><dt>, <a class="indexterm" href="simple.html#id340832">Implementation</a>, <a class="indexterm" href="simple.html#id341634">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id345178">Implementation</a>, <a class="indexterm" href="secure.html#id349099">Samba Configuration</a>, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a>, <a class="indexterm" href="Big500users.html#id353886">Implementation</a>, <a class="indexterm" href="happy.html#sbehap-ppc">Addition of Machines to the Domain</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a class="indexterm" href="2000users.html#id371556">Implementation</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id380589">IDMAP_RID with Winbind</a>, <a class="indexterm" href="unixclients.html#id381158">IDMAP Storage in LDAP using Winbind</a>, <a class="indexterm" href="unixclients.html#id381708">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a class="indexterm" href="upgrades.html#sbeug1">Location of config files</a>, <a class="indexterm" href="ntmigration.html#id387250">NT4 Migration Using LDAP Backend</a>, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a>, <a class="indexterm" href="DomApps.html#id401255">NSS Configuration</a></dt><dd><dl><dt>Domain account, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>liability, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a></dt><dt>logon, <a class="indexterm" href="simple.html#id341634">Implementation</a></dt><dt>problem, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a></dt><dt>transparent inter-operability, <a class="indexterm" href="DomApps.html#id401943">Questions and Answers</a></dt></dl></dd></dl></div><div class="indexdiv"><h3>A</h3><dl><dt>abmas-netfw.sh, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a></dt><dt>accept, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a></dt><dt>accepts liability, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a></dt><dt>access, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id397648">Checkpoint Controls</a></dt><dt>access control, <a class="indexterm" href="kerberos.html#id396888">Kerberos Exposed</a>, <a class="indexterm" href="kerberos.html#id398494">Using the MMC Computer Management Interface</a></dt><dt>Access Control Lists (see ACLs)</dt><dt>access control settings, <a class="indexterm" href="kerberos.html#id397184">Share Access Controls</a></dt><dt>access controls, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id397519">Share Definition Controls</a></dt><dt>accessible, <a class="indexterm" href="kerberos.html#id398076">Share Point Directory and File Permissions</a></dt><dt>account, <a class="indexterm" href="happy.html#id358884">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="kerberos.html#id397184">Share Access Controls</a></dt><dd><dl><dt>ADS Domain, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt></dl></dd><dt>account credentials, <a class="indexterm" href="primer.html#id409948">Findings and Comments</a></dt><dt>account information, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a></dt><dt>account names, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a></dt><dt>account policies, <a class="indexterm" href="appendix.html#id406519">The LDAP Account Manager</a></dt><dt>accountable, <a class="indexterm" href="kerberos.html#id394729">Introduction</a>, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a></dt><dt>accounts</dt><dd><dl><dt>authoritative, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a></dt><dt>Domain, <a class="indexterm" href="ntmigration.html#id386514">Introduction</a>, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a></dt><dt>group, <a class="indexterm" href="ntmigration.html#id386514">Introduction</a>, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id394729">Introduction</a></dt><dt>machine, <a class="indexterm" href="ntmigration.html#id386514">Introduction</a>, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a></dt><dt>manage, <a class="indexterm" href="appendix.html#id406519">The LDAP Account Manager</a></dt><dt>user, <a class="indexterm" href="ntmigration.html#id386514">Introduction</a>, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id394729">Introduction</a></dt></dl></dd><dt>ACL, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a>, <a class="indexterm" href="kerberos.html#id397648">Checkpoint Controls</a></dt><dt>ACLs, <a class="indexterm" href="happy.html#id369964">Key Points Learned</a>, <a class="indexterm" href="kerberos.html#id397184">Share Access Controls</a>, <a class="indexterm" href="kerberos.html#id397519">Share Definition Controls</a></dt><dt>acquisitions, <a class="indexterm" href="kerberos.html#id394729">Introduction</a></dt><dt>Act!, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>ACT! database, <a class="indexterm" href="appendix.html#id408011">Act! Database Sharing</a></dt><dt>Act!Diag, <a class="indexterm" href="appendix.html#id408011">Act! Database Sharing</a></dt><dt>Active Directory, <a class="indexterm" href="happy.html#id359212">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#sbehap-locgrppol">The Local Group Policy</a>, <a class="indexterm" href="2000users.html#id370476">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#id375537">Assignment Tasks</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id380589">IDMAP_RID with Winbind</a>, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id394729">Introduction</a>, <a class="indexterm" href="kerberos.html#id399129">Key Points Learned</a>, <a class="indexterm" href="kerberos.html#id399251">Questions and Answers</a>, <a class="indexterm" href="DomApps.html">Integrating Additional Services</a>, <a class="indexterm" href="DomApps.html#id399862">Assignment Tasks</a>, <a class="indexterm" href="DomApps.html#id399977">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id400733">Samba Configuration</a>, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dd><dl><dt>authentication, <a class="indexterm" href="DomApps.html#id401512">Squid Configuration</a></dt><dt>domain, <a class="indexterm" href="DomApps.html#id400733">Samba Configuration</a></dt><dt>join, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>management tools, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>realm, <a class="indexterm" href="HA.html#id402984">Bad Hostnames</a></dt><dt>Replacement, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>server, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id400370">Kerberos Configuration</a></dt><dt>Server, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>tree, <a class="indexterm" href="DomApps.html#id400733">Samba Configuration</a></dt></dl></dd><dt>active directory, <a class="indexterm" href="ntmigration.html#id386802">Technical Issues</a></dt><dt>AD printer publishing, <a class="indexterm" href="happy.html#id369439">Uploading Printer Drivers to Samba Servers</a></dt><dt>ADAM, <a class="indexterm" href="happy.html#id359212">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#id381158">IDMAP Storage in LDAP using Winbind</a></dt><dt>add group script, <a class="indexterm" href="upgrades.html#id385275">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>add machine script, <a class="indexterm" href="upgrades.html#id385275">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>Add Printer Wizard</dt><dd><dl><dt>APW, <a class="indexterm" href="happy.html#id369439">Uploading Printer Drivers to Samba Servers</a></dt></dl></dd><dt>add user script, <a class="indexterm" href="upgrades.html#id385275">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>add user to group script, <a class="indexterm" href="upgrades.html#id385275">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>adduser, <a class="indexterm" href="small.html#id345178">Implementation</a>, <a class="indexterm" href="secure.html#id349099">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id355127">Configuration for Server: MASSIVE</a></dt><dt>adequate precautions, <a class="indexterm" href="upgrades.html#id383639">Introduction</a></dt><dt>administrative installation, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a></dt><dt>administrative rights, <a class="indexterm" href="kerberos.html#id397648">Checkpoint Controls</a></dt><dt>administrator, <a class="indexterm" href="small.html#id345178">Implementation</a>, <a class="indexterm" href="secure.html#id349099">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id354601">Server Preparation: All Servers</a></dt><dt>ADMT, <a class="indexterm" href="upgrades.html#id386368">Migration of Samba Accounts to Active Directory</a></dt><dt>ADS, <a class="indexterm" href="unixclients.html#id381158">IDMAP Storage in LDAP using Winbind</a>, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id400370">Kerberos Configuration</a>, <a class="indexterm" href="HA.html#id402984">Bad Hostnames</a></dt><dd><dl><dt>server, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt></dl></dd><dt>ADS Domain, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>affordability, <a class="indexterm" href="2000users.html#id370835">The Nature of Windows Networking Protocols</a></dt><dt>alarm, <a class="indexterm" href="kerberos.html#id394729">Introduction</a></dt><dt>algorithm, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>allow trusted domains, <a class="indexterm" href="unixclients.html#id380589">IDMAP_RID with Winbind</a></dt><dt>alternative, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a></dt><dt>analysis, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>anonymous connection, <a class="indexterm" href="small.html#id346626">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>Apache Web server, <a class="indexterm" href="DomApps.html#id401943">Questions and Answers</a></dt><dt>appliance mode, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a></dt><dt>application server, <a class="indexterm" href="secure.html#id347966">Technical Issues</a>, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a></dt><dt>application servers, <a class="indexterm" href="2000users.html#id370835">The Nature of Windows Networking Protocols</a></dt><dt>application/octet-stream, <a class="indexterm" href="simple.html#id341634">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id345178">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id354601">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>APW, <a class="indexterm" href="happy.html#id369439">Uploading Printer Drivers to Samba Servers</a></dt><dt>arp, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>assessment, <a class="indexterm" href="kerberos.html#id394729">Introduction</a></dt><dt>assistance, <a class="indexterm" href="ch14.html#id404300">Free Support</a></dt><dt>assumptions, <a class="indexterm" href="HA.html#id404151">Key Points Learned</a></dt><dt>authconfig, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dt>authenticate, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a>, <a class="indexterm" href="DomApps.html#id400733">Samba Configuration</a></dt><dt>authenticated, <a class="indexterm" href="DomApps.html#id399862">Assignment Tasks</a></dt><dt>authenticated connection, <a class="indexterm" href="small.html#id346626">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>authentication, <a class="indexterm" href="2000users.html#id370835">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id390913">Dissection and Discussion</a>, <a class="indexterm" href="DomApps.html">Integrating Additional Services</a>, <a class="indexterm" href="DomApps.html#id399977">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id401255">NSS Configuration</a>, <a class="indexterm" href="DomApps.html#id401943">Questions and Answers</a></dt><dd><dl><dt>plain-text, <a class="indexterm" href="DomApps.html#id401943">Questions and Answers</a></dt></dl></dd><dt>authentication process, <a class="indexterm" href="unixclients.html#id376274">Implementation</a></dt><dt>authentication protocols, <a class="indexterm" href="DomApps.html#id401888">Key Points Learned</a></dt><dt>authoritative, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a></dt><dt>authorized location, <a class="indexterm" href="kerberos.html#id396888">Kerberos Exposed</a></dt><dt>auto-generated SID, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a></dt><dt>automatically allocate, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a></dt><dt>availability, <a class="indexterm" href="HA.html">Performance, Reliability, and Availability</a></dt></dl></div><div class="indexdiv"><h3>B</h3><dl><dt>backends, <a class="indexterm" href="DomApps.html">Integrating Additional Services</a></dt><dt>background communication, <a class="indexterm" href="2000users.html#id374709">Questions and Answers</a></dt><dt>Backup, <a class="indexterm" href="kerberos.html#id394729">Introduction</a></dt><dt>Backup Domain Controller (see BDC)</dt><dt>bandwidth, <a class="indexterm" href="DomApps.html#id399862">Assignment Tasks</a></dt><dd><dl><dt>requirements, <a class="indexterm" href="2000users.html#id370759">User Needs</a></dt></dl></dd><dt>bandwidth calculations, <a class="indexterm" href="secure.html#id348190">Hardware Requirements</a></dt><dt>BDC, <a class="indexterm" href="Big500users.html#id353690">Technical Issues</a>, <a class="indexterm" href="happy.html">Making Happy Users</a>, <a class="indexterm" href="happy.html#id359084">Assignment Tasks</a>, <a class="indexterm" href="happy.html#id359212">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#id361454">Samba Server Implementation</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="2000users.html#id370835">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="2000users.html#id374570">Key Points Learned</a>, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a>, <a class="indexterm" href="ntmigration.html#id389442">NT4 Migration Using tdbsam Backend</a>, <a class="indexterm" href="HA.html#id403710">Use and Location of BDCs</a></dt><dt>benefit, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a></dt><dt>best practices, <a class="indexterm" href="kerberos.html#id394729">Introduction</a></dt><dt>bias, <a class="indexterm" href="kerberos.html#id399251">Questions and Answers</a></dt><dt>binary database, <a class="indexterm" href="secure.html#id348344">Implementation</a></dt><dt>binary files, <a class="indexterm" href="upgrades.html#id385712">Updating a Samba-3 Installation</a></dt><dt>binary package, <a class="indexterm" href="upgrades.html#id385712">Updating a Samba-3 Installation</a></dt><dt>bind interfaces only, <a class="indexterm" href="secure.html#id348344">Implementation</a></dt><dt>broadcast, <a class="indexterm" href="HA.html#id403161">Routed Networks</a>, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dd><dl><dt>directed, <a class="indexterm" href="2000users.html#id370835">The Nature of Windows Networking Protocols</a></dt><dt>mailslot, <a class="indexterm" href="2000users.html#id370835">The Nature of Windows Networking Protocols</a></dt></dl></dd><dt>broadcast messages, <a class="indexterm" href="secure.html#id348344">Implementation</a></dt><dt>broadcast storms, <a class="indexterm" href="HA.html#id403325">Network Collisions</a></dt><dt>broken, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a></dt><dt>broken behavior, <a class="indexterm" href="HA.html#id402498">Dissection and Discussion</a></dt><dt>browse, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>browse master, <a class="indexterm" href="primer.html#id408760">Findings</a></dt><dt>Browse Master, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dt>browse.dat, <a class="indexterm" href="upgrades.html#id386001">Replacing a Domain Member Server</a></dt><dt>Browser Election Service, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dt>browsing, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id399977">Technical Issues</a>, <a class="indexterm" href="primer.html#id408414">Assignment Tasks</a></dt><dt>budgetted, <a class="indexterm" href="kerberos.html#id394729">Introduction</a></dt><dt>bug fixes, <a class="indexterm" href="kerberos.html#id394729">Introduction</a></dt><dt>bug report, <a class="indexterm" href="ch14.html#id404300">Free Support</a></dt></dl></div><div class="indexdiv"><h3>C</h3><dl><dt>cache, <a class="indexterm" href="appendix.html#id408086">Opportunistic Locking Controls</a></dt><dt>cache directories, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>caching, <a class="indexterm" href="HA.html#id403415">Samba Configuration</a></dt><dt>case-sensitive, <a class="indexterm" href="DomApps.html#id400370">Kerberos Configuration</a></dt><dt>centralized storage, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a></dt><dt>character set, <a class="indexterm" href="upgrades.html#id384787">International Language Support</a></dt><dt>check samba daemons, <a class="indexterm" href="small.html#id346626">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>check-point, <a class="indexterm" href="kerberos.html#id397519">Share Definition Controls</a></dt><dt>check-point controls, <a class="indexterm" href="kerberos.html#id397648">Checkpoint Controls</a></dt><dt>Checkpoint Controls, <a class="indexterm" href="kerberos.html#id397648">Checkpoint Controls</a></dt><dt>chgrp, <a class="indexterm" href="DomApps.html#id400733">Samba Configuration</a></dt><dt>chkconfig, <a class="indexterm" href="simple.html#id340832">Implementation</a>, <a class="indexterm" href="simple.html#id341634">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id345178">Implementation</a>, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a>, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a>, <a class="indexterm" href="2000users.html#id371556">Implementation</a></dt><dt>chmod, <a class="indexterm" href="DomApps.html#id400733">Samba Configuration</a></dt><dt>choice, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>chown, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>CIFS, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a>, <a class="indexterm" href="primer.html#id408760">Findings</a></dt><dt>cifsfs, <a class="indexterm" href="HA.html#id402498">Dissection and Discussion</a></dt><dt>clean database, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a></dt><dt>clients per DC, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>Clock skew, <a class="indexterm" href="DomApps.html#id400370">Kerberos Configuration</a></dt><dt>cluster, <a class="indexterm" href="HA.html#id402421">Introduction</a></dt><dt>clustering, <a class="indexterm" href="HA.html#id402421">Introduction</a>, <a class="indexterm" href="HA.html#id403795">For Scalability, Use SAN-Based Storage on Samba Servers</a></dt><dt>code maintainer, <a class="indexterm" href="ch14.html#id404300">Free Support</a></dt><dt>codepage, <a class="indexterm" href="upgrades.html#id384787">International Language Support</a></dt><dt>collision rates, <a class="indexterm" href="HA.html#id403325">Network Collisions</a></dt><dt>commercial, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a></dt><dt>commercial software, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a></dt><dt>commercial support, <a class="indexterm" href="ch14.html">Samba Support</a>, <a class="indexterm" href="ch14.html#id404499">Commercial Support</a></dt><dt>Common Internet File System (see CIFS)</dt><dt>comparison</dt><dd><dl><dt>Active Directory & OpenLDAP, <a class="indexterm" href="happy.html#id359212">Dissection and Discussion</a></dt></dl></dd><dt>compat, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>compatible, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>compile-time, <a class="indexterm" href="upgrades.html#sbeug1">Location of config files</a></dt><dt>complexities, <a class="indexterm" href="HA.html#id402498">Dissection and Discussion</a></dt><dt>compromise, <a class="indexterm" href="happy.html#id359008">Introduction</a>, <a class="indexterm" href="kerberos.html#id394729">Introduction</a>, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>computer account, <a class="indexterm" href="DomApps.html#id400733">Samba Configuration</a></dt><dt>Computer Management, <a class="indexterm" href="kerberos.html#id397184">Share Access Controls</a>, <a class="indexterm" href="kerberos.html#id399251">Questions and Answers</a></dt><dt>computer name, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a></dt><dt>condemns, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>conferences, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>configuration files, <a class="indexterm" href="upgrades.html#id383639">Introduction</a></dt><dt>configure.pl, <a class="indexterm" href="ntmigration.html#id387250">NT4 Migration Using LDAP Backend</a></dt><dt>connection, <a class="indexterm" href="kerberos.html#id397184">Share Access Controls</a></dt><dt>connectivity, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a></dt><dt>consequential risk, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>consultant, <a class="indexterm" href="simple.html#id340728">Drafting Office</a>, <a class="indexterm" href="kerberos.html#id394729">Introduction</a>, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a></dt><dt>consumer, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>consumer expects, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>contiguous directory, <a class="indexterm" href="2000users.html#id371556">Implementation</a></dt><dt>contributions, <a class="indexterm" href="upgrades.html">Updating Samba-3</a></dt><dt>control files, <a class="indexterm" href="upgrades.html#id385712">Updating a Samba-3 Installation</a></dt><dt>convmv, <a class="indexterm" href="upgrades.html#id384787">International Language Support</a></dt><dt>copy, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a></dt><dt>corrective action, <a class="indexterm" href="HA.html#id403932">Hardware Problems</a></dt><dt>cost, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a></dt><dt>cost-benefit, <a class="indexterm" href="nw4migration.html#id390814">Assignment Tasks</a></dt><dt>country of origin, <a class="indexterm" href="ch14.html#id404499">Commercial Support</a></dt><dt>Courier-IMAP, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a></dt><dt>credential, <a class="indexterm" href="kerberos.html#id397519">Share Definition Controls</a></dt><dt>credentials, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>crippled, <a class="indexterm" href="ntmigration.html#id386640">Dissection and Discussion</a></dt><dt>criticism, <a class="indexterm" href="kerberos.html">Active Directory, Kerberos, and Security</a>, <a class="indexterm" href="kerberos.html#id394729">Introduction</a></dt><dt>Critics, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>Cryptographic, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>CUPS, <a class="indexterm" href="simple.html#id341464">Dissection and Discussion</a>, <a class="indexterm" href="small.html#id344988">Technical Issues</a>, <a class="indexterm" href="small.html#id345178">Implementation</a>, <a class="indexterm" href="small.html#id347221">Key Points Learned</a>, <a class="indexterm" href="secure.html#id348344">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id354601">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#id359084">Assignment Tasks</a>, <a class="indexterm" href="happy.html#id360506">Installation of Printer Driver Auto-Download</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dd><dl><dt>queue, <a class="indexterm" href="small.html#id345178">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id354601">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt></dl></dd><dt>cupsd, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a></dt><dt>customer expected, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>customers, <a class="indexterm" href="ch14.html">Samba Support</a></dt></dl></div><div class="indexdiv"><h3>D</h3><dl><dt>daemon, <a class="indexterm" href="simple.html#validate1">Validation</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a>, <a class="indexterm" href="DomApps.html#id399977">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id401943">Questions and Answers</a>, <a class="indexterm" href="appendix.html#id405549">Starting Samba</a></dt><dt>daemon control, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dt>data</dt><dd><dl><dt>corruption, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>integrity, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a></dt></dl></dd><dt>data corruption, <a class="indexterm" href="HA.html#id403932">Hardware Problems</a>, <a class="indexterm" href="appendix.html#id408011">Act! Database Sharing</a></dt><dt>data integrity, <a class="indexterm" href="HA.html#id403932">Hardware Problems</a>, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>data storage, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a></dt><dt>database, <a class="indexterm" href="2000users.html#id370476">Dissection and Discussion</a>, <a class="indexterm" href="2000users.html#id374709">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id390913">Dissection and Discussion</a></dt><dt>database applications, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>DB_CONFIG, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>DCE, <a class="indexterm" href="kerberos.html#id396888">Kerberos Exposed</a></dt><dt>DDNS (see dynamic DNS)</dt><dt>Debian, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>default installation, <a class="indexterm" href="appendix.html#id405157">Samba System File Location</a></dt><dt>default password, <a class="indexterm" href="appendix.html#id406519">The LDAP Account Manager</a></dt><dt>default profile, <a class="indexterm" href="happy.html#id359084">Assignment Tasks</a>, <a class="indexterm" href="happy.html#id359614">Technical Issues</a></dt><dt>Default User, <a class="indexterm" href="happy.html#id360364">Profile Changes</a>, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>defective</dt><dd><dl><dt>cables, <a class="indexterm" href="HA.html#id403932">Hardware Problems</a></dt><dt>HUBs, <a class="indexterm" href="HA.html#id403932">Hardware Problems</a></dt><dt>switches, <a class="indexterm" href="HA.html#id403932">Hardware Problems</a></dt></dl></dd><dt>defects, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>defensible standards, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>defragmentation, <a class="indexterm" href="secure.html#ch4wincfg">Windows Client Configuration</a></dt><dt>delete group script, <a class="indexterm" href="upgrades.html#id385275">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>delete user from group script, <a class="indexterm" href="upgrades.html#id385275">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>delimiter, <a class="indexterm" href="kerberos.html#id397648">Checkpoint Controls</a></dt><dt>dependability, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>deployment, <a class="indexterm" href="ch14.html#id404300">Free Support</a></dt><dt>desired security setting, <a class="indexterm" href="kerberos.html#id398933">Setting Posix ACLs in UNIX/Linux</a></dt><dt>development, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>DHCP, <a class="indexterm" href="small.html#id344988">Technical Issues</a>, <a class="indexterm" href="small.html#id345178">Implementation</a>, <a class="indexterm" href="small.html#id347221">Key Points Learned</a>, <a class="indexterm" href="secure.html#ch4wincfg">Windows Client Configuration</a>, <a class="indexterm" href="Big500users.html#ch5wincfg">Windows Client Configuration</a>, <a class="indexterm" href="2000users.html#id370835">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="2000users.html#id374709">Questions and Answers</a></dt><dd><dl><dt>client, <a class="indexterm" href="HA.html#id402984">Bad Hostnames</a></dt><dt>relay, <a class="indexterm" href="Big500users.html#id353690">Technical Issues</a></dt><dt>Relay Agent, <a class="indexterm" href="2000users.html#id374709">Questions and Answers</a></dt><dt>request, <a class="indexterm" href="2000users.html#id374709">Questions and Answers</a></dt><dt>requests, <a class="indexterm" href="Big500users.html#id353690">Technical Issues</a></dt><dt>servers, <a class="indexterm" href="2000users.html#id374709">Questions and Answers</a></dt><dt>traffic, <a class="indexterm" href="2000users.html#id374709">Questions and Answers</a></dt></dl></dd><dt>dhcp client validation, <a class="indexterm" href="small.html#id346626">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>DHCP Server, <a class="indexterm" href="small.html#id345178">Implementation</a></dt><dt>DHCP server, <a class="indexterm" href="secure.html#id347966">Technical Issues</a></dt><dt>diagnostic, <a class="indexterm" href="unixclients.html#id381158">IDMAP Storage in LDAP using Winbind</a></dt><dt>diffusion, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>digital rights, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>digital sign'n'seal, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>digits, <a class="indexterm" href="HA.html#id402984">Bad Hostnames</a></dt><dt>diligence, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>directory, <a class="indexterm" href="2000users.html#id370476">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#id376189">Political Issues</a>, <a class="indexterm" href="upgrades.html#sbeug1">Location of config files</a></dt><dd><dl><dt>Computers container, <a class="indexterm" href="happy.html#id364093">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>management, <a class="indexterm" href="happy.html#id359212">Dissection and Discussion</a></dt><dt>People container, <a class="indexterm" href="happy.html#id364093">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>replication, <a class="indexterm" href="happy.html#id359212">Dissection and Discussion</a></dt><dt>schema, <a class="indexterm" href="happy.html#id359212">Dissection and Discussion</a></dt><dt>server, <a class="indexterm" href="happy.html#id359614">Technical Issues</a></dt><dt>synchronization, <a class="indexterm" href="happy.html#id359212">Dissection and Discussion</a></dt></dl></dd><dt>directory tree, <a class="indexterm" href="kerberos.html#id398933">Setting Posix ACLs in UNIX/Linux</a></dt><dt>disable, <a class="indexterm" href="kerberos.html#id394729">Introduction</a></dt><dt>disaster recovery, <a class="indexterm" href="kerberos.html#id394729">Introduction</a></dt><dt>disk image, <a class="indexterm" href="happy.html#id359084">Assignment Tasks</a></dt><dt>disruptive, <a class="indexterm" href="ntmigration.html#id386640">Dissection and Discussion</a></dt><dt>distributed, <a class="indexterm" href="2000users.html#id371136">Identity Management Needs</a>, <a class="indexterm" href="2000users.html#id371556">Implementation</a>, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a>, <a class="indexterm" href="HA.html#id403840">Distribute Network Load with MSDFS</a></dt><dt>distributed domain, <a class="indexterm" href="2000users.html#id371136">Identity Management Needs</a></dt><dt>DMB, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dt>DMS, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id386001">Replacing a Domain Member Server</a></dt><dt>DNS, <a class="indexterm" href="small.html#id344988">Technical Issues</a>, <a class="indexterm" href="small.html#id345178">Implementation</a>, <a class="indexterm" href="secure.html#id347966">Technical Issues</a>, <a class="indexterm" href="2000users.html#id370835">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a>, <a class="indexterm" href="HA.html#id402984">Bad Hostnames</a>, <a class="indexterm" href="HA.html#id403161">Routed Networks</a>, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dd><dl><dt>configuration, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a></dt><dt>Dynamic, <a class="indexterm" href="2000users.html#id374709">Questions and Answers</a></dt><dt>dynamic, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dt>lookup, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a>, <a class="indexterm" href="DomApps.html#id400370">Kerberos Configuration</a></dt><dt>name lookup, <a class="indexterm" href="HA.html#id402984">Bad Hostnames</a></dt><dt>SRV records, <a class="indexterm" href="DomApps.html#id400370">Kerberos Configuration</a></dt><dt>suffix, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt></dl></dd><dt>DNS server, <a class="indexterm" href="small.html#id345178">Implementation</a>, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></dt><dt>document the settings, <a class="indexterm" href="HA.html#id403415">Samba Configuration</a></dt><dt>documentation, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>documented, <a class="indexterm" href="HA.html#id403415">Samba Configuration</a></dt><dt>Domain, <a class="indexterm" href="small.html#id344988">Technical Issues</a></dt><dd><dl><dt>groups, <a class="indexterm" href="small.html#id344988">Technical Issues</a></dt></dl></dd><dt>domain</dt><dd><dl><dt>Active Directory, <a class="indexterm" href="DomApps.html#id399977">Technical Issues</a></dt><dt>controller, <a class="indexterm" href="upgrades.html#id386190">Replacing a Domain Controller</a></dt><dt>joining, <a class="indexterm" href="appendix.html">A Collection of Useful Tidbits</a></dt><dt>trusted, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a></dt></dl></dd><dt>Domain accounts, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a></dt><dt>Domain Administrator, <a class="indexterm" href="kerberos.html#id397184">Share Access Controls</a></dt><dt>Domain Controller, <a class="indexterm" href="small.html#id347221">Key Points Learned</a>, <a class="indexterm" href="2000users.html#id370835">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id376274">Implementation</a>, <a class="indexterm" href="HA.html#id403710">Use and Location of BDCs</a></dt><dd><dl><dt>closest, <a class="indexterm" href="2000users.html#id370835">The Nature of Windows Networking Protocols</a></dt></dl></dd><dt>domain controller, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id385275">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>domain controllers, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a></dt><dt>Domain Controllers, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a></dt><dt>Domain Groups</dt><dd><dl><dt>well-known, <a class="indexterm" href="appendix.html#id406053">Initialization of the LDAP Database</a></dt></dl></dd><dt>Domain join, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>domain master, <a class="indexterm" href="ntmigration.html#id387250">NT4 Migration Using LDAP Backend</a>, <a class="indexterm" href="ntmigration.html#id389442">NT4 Migration Using tdbsam Backend</a></dt><dt>Domain Master Browser (see DMB)</dt><dt>Domain Member, <a class="indexterm" href="HA.html#id403710">Use and Location of BDCs</a></dt><dd><dl><dt>authoritative</dt><dd><dl><dt>local accounts, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a></dt></dl></dd><dt>client, <a class="indexterm" href="unixclients.html#id376274">Implementation</a></dt><dt>desktop, <a class="indexterm" href="unixclients.html#id375489">Introduction</a></dt><dt>server, <a class="indexterm" href="unixclients.html#id375489">Introduction</a>, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id376274">Implementation</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>servers, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id397648">Checkpoint Controls</a></dt><dt>workstations, <a class="indexterm" href="unixclients.html#id376274">Implementation</a></dt></dl></dd><dt>domain member</dt><dd><dl><dt>servers, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a></dt></dl></dd><dt>Domain Member server, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id399251">Questions and Answers</a></dt><dt>Domain Member servers, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a></dt><dt>domain members, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a></dt><dt>domain name space, <a class="indexterm" href="2000users.html#id371136">Identity Management Needs</a></dt><dt>domain replication, <a class="indexterm" href="2000users.html#id374709">Questions and Answers</a></dt><dt>domain SID, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a></dt><dt>Domain SID, <a class="indexterm" href="ntmigration.html#id386802">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a></dt><dt>domain tree, <a class="indexterm" href="2000users.html#id371136">Identity Management Needs</a></dt><dt>Domain User Manager, <a class="indexterm" href="happy.html#id367829">Configuring Profile Directories</a></dt><dt>Domain users, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>DOS, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a></dt><dt>dos2unix, <a class="indexterm" href="secure.html#id349099">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id355127">Configuration for Server: MASSIVE</a></dt><dt>down-grade, <a class="indexterm" href="upgrades.html#id383639">Introduction</a></dt><dt>drive letters, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a></dt><dt>drive mapping, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>dumb printing, <a class="indexterm" href="happy.html#id360506">Installation of Printer Driver Auto-Download</a></dt><dt>dump, <a class="indexterm" href="ntmigration.html#id386802">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a></dt><dt>duplicate accounts, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt><dt>dynamic DNS, <a class="indexterm" href="secure.html#id347966">Technical Issues</a></dt></dl></div><div class="indexdiv"><h3>E</h3><dl><dt>e-Directory, <a class="indexterm" href="nw4migration.html#id390913">Dissection and Discussion</a></dt><dt>Easy Software Products, <a class="indexterm" href="happy.html#id360506">Installation of Printer Driver Auto-Download</a></dt><dt>economically sustainable, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a></dt><dt>eDirectory, <a class="indexterm" href="happy.html#id359212">Dissection and Discussion</a></dt><dt>education, <a class="indexterm" href="2000users.html#id371136">Identity Management Needs</a></dt><dt>election, <a class="indexterm" href="primer.html#id408760">Findings</a></dt><dt>employment, <a class="indexterm" href="kerberos.html#id394729">Introduction</a>, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a></dt><dt>enable, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a></dt><dt>encrypted, <a class="indexterm" href="primer.html#id409948">Findings and Comments</a></dt><dt>encrypted password, <a class="indexterm" href="primer.html#id410194">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>encrypted passwords, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a></dt><dt>End User License Agreement (see EULA)</dt><dt>enumerating, <a class="indexterm" href="DomApps.html#id400733">Samba Configuration</a></dt><dt>essential, <a class="indexterm" href="kerberos.html#id394729">Introduction</a></dt><dt>ethereal, <a class="indexterm" href="primer.html#id408521">Exercises</a></dt><dt>Ethernet switch, <a class="indexterm" href="small.html#id344988">Technical Issues</a></dt><dt>ethernet switch, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>EULA, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a></dt><dt>Everyone, <a class="indexterm" href="kerberos.html#id397184">Share Access Controls</a></dt><dt>Excel, <a class="indexterm" href="kerberos.html#id398076">Share Point Directory and File Permissions</a></dt><dt>exclusive open, <a class="indexterm" href="appendix.html#id407872">Microsoft Access</a></dt><dt>experiment, <a class="indexterm" href="kerberos.html">Active Directory, Kerberos, and Security</a></dt><dt>export, <a class="indexterm" href="ntmigration.html#id386802">Technical Issues</a></dt><dt>extent, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a></dt><dt>External Domains, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a></dt><dt>extreme demand, <a class="indexterm" href="HA.html#id402949">Guidelines for Reliable Samba Operation</a></dt></dl></div><div class="indexdiv"><h3>F</h3><dl><dt>fail, <a class="indexterm" href="2000users.html#id370835">The Nature of Windows Networking Protocols</a></dt><dt>fail-over, <a class="indexterm" href="2000users.html#id371136">Identity Management Needs</a>, <a class="indexterm" href="2000users.html#id371556">Implementation</a></dt><dt>failed, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>failed join, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id380589">IDMAP_RID with Winbind</a></dt><dt>failure, <a class="indexterm" href="DomApps.html#id400733">Samba Configuration</a></dt><dt>familiar, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>fatal problem, <a class="indexterm" href="HA.html#id403415">Samba Configuration</a></dt><dt>fear, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>fears, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>Fedora, <a class="indexterm" href="simple.html#id340728">Drafting Office</a></dt><dt>FHS, <a class="indexterm" href="appendix.html#id405157">Samba System File Location</a></dt><dt>file and print server, <a class="indexterm" href="DomApps.html#id401943">Questions and Answers</a></dt><dt>file and print service, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a></dt><dt>file caching, <a class="indexterm" href="HA.html#id403415">Samba Configuration</a>, <a class="indexterm" href="appendix.html#id408086">Opportunistic Locking Controls</a></dt><dt>File Hierarchy System (see FHS)</dt><dt>file locations, <a class="indexterm" href="appendix.html#id405157">Samba System File Location</a></dt><dt>file permissions, <a class="indexterm" href="appendix.html#id406519">The LDAP Account Manager</a></dt><dt>file server</dt><dd><dl><dt>read-only, <a class="indexterm" href="simple.html#id340790">Dissection and Discussion</a></dt></dl></dd><dt>file servers, <a class="indexterm" href="happy.html#id361454">Samba Server Implementation</a></dt><dt>file system, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dd><dl><dt>access control, <a class="indexterm" href="secure.html#id349099">Samba Configuration</a></dt><dt>Ext3, <a class="indexterm" href="simple.html#id340832">Implementation</a></dt><dt>permissions, <a class="indexterm" href="secure.html#id349099">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id355127">Configuration for Server: MASSIVE</a></dt></dl></dd><dt>file system security, <a class="indexterm" href="kerberos.html#id399251">Questions and Answers</a></dt><dt>filter, <a class="indexterm" href="kerberos.html#id397184">Share Access Controls</a></dt><dt>financial responsibility, <a class="indexterm" href="kerberos.html#id394729">Introduction</a></dt><dt>firewall, <a class="indexterm" href="secure.html#id347966">Technical Issues</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="kerberos.html#id394729">Introduction</a></dt><dt>fix, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a></dt><dt>flaws, <a class="indexterm" href="kerberos.html#id394729">Introduction</a></dt><dt>flexibility, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>flush</dt><dd><dl><dt>cache memory, <a class="indexterm" href="appendix.html#id408086">Opportunistic Locking Controls</a></dt></dl></dd><dt>folder redirection, <a class="indexterm" href="happy.html#id359614">Technical Issues</a>, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a>, <a class="indexterm" href="2000users.html#id374709">Questions and Answers</a></dt><dt>force group, <a class="indexterm" href="kerberos.html#id397932">Override Controls</a>, <a class="indexterm" href="kerberos.html#id399251">Questions and Answers</a></dt><dt>force user, <a class="indexterm" href="simple.html#id341464">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id397932">Override Controls</a>, <a class="indexterm" href="kerberos.html#id399251">Questions and Answers</a></dt><dt>forced settings, <a class="indexterm" href="kerberos.html#id397932">Override Controls</a></dt><dt>foreign, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>foreign SID, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>forwarded, <a class="indexterm" href="HA.html#id403161">Routed Networks</a></dt><dt>foundation members, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>Free Standards Group (see FSG)</dt><dt>free support, <a class="indexterm" href="ch14.html">Samba Support</a>, <a class="indexterm" href="ch14.html#id404300">Free Support</a></dt><dt>front-end, <a class="indexterm" href="HA.html#id402498">Dissection and Discussion</a></dt><dd><dl><dt>server, <a class="indexterm" href="HA.html#id403840">Distribute Network Load with MSDFS</a></dt></dl></dd><dt>frustration, <a class="indexterm" href="upgrades.html#id383639">Introduction</a></dt><dt>FSG, <a class="indexterm" href="appendix.html#id405157">Samba System File Location</a></dt><dt>FTP</dt><dd><dl><dt>proxy, <a class="indexterm" href="DomApps.html#id401943">Questions and Answers</a></dt></dl></dd><dt>full control, <a class="indexterm" href="kerberos.html#id397184">Share Access Controls</a>, <a class="indexterm" href="kerberos.html#id398771">Using MS Windows Explorer (File Manager)</a></dt><dt>fully qualified, <a class="indexterm" href="kerberos.html#id397648">Checkpoint Controls</a></dt><dt>functional differences, <a class="indexterm" href="upgrades.html#id383722">Cautions and Notes</a></dt></dl></div><div class="indexdiv"><h3>G</h3><dl><dt>generation, <a class="indexterm" href="upgrades.html#id383722">Cautions and Notes</a></dt><dt>Gentoo, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>getent, <a class="indexterm" href="happy.html#id364093">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id380589">IDMAP_RID with Winbind</a></dt><dt>getfacl, <a class="indexterm" href="kerberos.html#id398933">Setting Posix ACLs in UNIX/Linux</a></dt><dt>getgrnam, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a></dt><dt>getpwnam, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>getpwnam(), <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a></dt><dt>GID, <a class="indexterm" href="2000users.html#id371556">Implementation</a>, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a></dt><dt>Goettingen, <a class="indexterm" href="DomApps.html#id401943">Questions and Answers</a></dt><dt>government, <a class="indexterm" href="2000users.html#id371136">Identity Management Needs</a></dt><dt>GPL, <a class="indexterm" href="secure.html#id352560">Comments Regarding Software Terms of Use</a></dt><dt>group account, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>group management, <a class="indexterm" href="secure.html#id348344">Implementation</a></dt><dt>group mapping, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a></dt><dt>group membership, <a class="indexterm" href="small.html#id345178">Implementation</a>, <a class="indexterm" href="secure.html#id349099">Samba Configuration</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="kerberos.html#id398076">Share Point Directory and File Permissions</a></dt><dt>group names, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a></dt><dt>group policies, <a class="indexterm" href="ntmigration.html#id386514">Introduction</a></dt><dt>Group Policy, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dt>Group Policy editor, <a class="indexterm" href="happy.html#sbehap-locgrppol">The Local Group Policy</a></dt><dt>Group Policy Objects, <a class="indexterm" href="happy.html#sbehap-locgrppol">The Local Group Policy</a></dt><dt>groupadd, <a class="indexterm" href="simple.html#id341634">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="upgrades.html#id385275">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a></dt><dt>groupdel, <a class="indexterm" href="upgrades.html#id385275">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a></dt><dt>groupmem, <a class="indexterm" href="ntmigration.html#id387250">NT4 Migration Using LDAP Backend</a></dt><dt>groupmod, <a class="indexterm" href="upgrades.html#id385275">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a></dt><dt>GSS-API, <a class="indexterm" href="primer.html#id410194">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>guest account, <a class="indexterm" href="primer.html#id409948">Findings and Comments</a>, <a class="indexterm" href="primer.html#chap01conc">Dissection and Discussion</a>, <a class="indexterm" href="primer.html#id410820">Technical Issues</a>, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt></dl></div><div class="indexdiv"><h3>H</h3><dl><dt>hackers, <a class="indexterm" href="kerberos.html#id394729">Introduction</a></dt><dt>hardware prices, <a class="indexterm" href="HA.html#id403932">Hardware Problems</a></dt><dt>hardware problems, <a class="indexterm" href="HA.html#id403932">Hardware Problems</a></dt><dt>Heimdal, <a class="indexterm" href="DomApps.html#id400137">Implementation</a>, <a class="indexterm" href="DomApps.html#id400370">Kerberos Configuration</a></dt><dt>Heimdal Kerberos, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="kerberos.html#id396888">Kerberos Exposed</a></dt><dt>Heimdal kerberos, <a class="indexterm" href="unixclients.html#id381158">IDMAP Storage in LDAP using Winbind</a></dt><dt>help, <a class="indexterm" href="ch14.html#id404300">Free Support</a></dt><dt>helper agent, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>hesiod, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>hierarchy of control, <a class="indexterm" href="kerberos.html#id397519">Share Definition Controls</a></dt><dt>high availability, <a class="indexterm" href="happy.html#id359212">Dissection and Discussion</a></dt><dt>hire, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a></dt><dt>HKEY_CURRENT_USER, <a class="indexterm" href="happy.html#id360094">Roaming Profile Background</a></dt><dt>HKEY_LOCAL_MACHINE, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>HKEY_LOCAL_USER, <a class="indexterm" href="2000users.html#id374709">Questions and Answers</a></dt><dt>host announcement, <a class="indexterm" href="primer.html#id408414">Assignment Tasks</a>, <a class="indexterm" href="primer.html#id409382">Findings</a></dt><dt>hostname, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a></dt><dt>hosts, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a></dt><dt>HUB, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>Hybrid, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dt>hypothetical, <a class="indexterm" href="kerberos.html#id394729">Introduction</a></dt></dl></div><div class="indexdiv"><h3>I</h3><dl><dt>Idealx, <a class="indexterm" href="upgrades.html#id385275">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id387250">NT4 Migration Using LDAP Backend</a></dt><dd><dl><dt>smbldap-tools, <a class="indexterm" href="happy.html#sbeidealx">Install and Configure Idealx smbldap-tools Scripts</a>, <a class="indexterm" href="happy.html#id364093">LDAP Initialization and Creation of User and Group Accounts</a></dt></dl></dd><dt>identifiers, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a></dt><dt>identity, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id396888">Kerberos Exposed</a></dt><dd><dl><dt>management, <a class="indexterm" href="happy.html#id359614">Technical Issues</a></dt></dl></dd><dt>identity management, <a class="indexterm" href="Big500users.html#id353690">Technical Issues</a>, <a class="indexterm" href="2000users.html#id370476">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#id376189">Political Issues</a>, <a class="indexterm" href="nw4migration.html#id390913">Dissection and Discussion</a></dt><dt>Identity Management, <a class="indexterm" href="happy.html#id359212">Dissection and Discussion</a>, <a class="indexterm" href="2000users.html#id370835">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="2000users.html#id371136">Identity Management Needs</a></dt><dt>Identity management, <a class="indexterm" href="unixclients.html#id382025">UNIX/Linux Client Domain Member</a></dt><dt>Identity resolution, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id382025">UNIX/Linux Client Domain Member</a>, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a></dt><dt>Identity resolver, <a class="indexterm" href="DomApps.html#id401943">Questions and Answers</a></dt><dt>IDMAP, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#id380589">IDMAP_RID with Winbind</a></dt><dt>idmap backend, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a></dt><dt>IDMAP backend, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a></dt><dt>idmap gid, <a class="indexterm" href="unixclients.html#id380589">IDMAP_RID with Winbind</a></dt><dt>idmap uid, <a class="indexterm" href="unixclients.html#id380589">IDMAP_RID with Winbind</a></dt><dt>idmap_rid, <a class="indexterm" href="unixclients.html#id380589">IDMAP_RID with Winbind</a></dt><dt>IMAP, <a class="indexterm" href="nw4migration.html#id390984">Technical Issues</a></dt><dt>import, <a class="indexterm" href="ntmigration.html#id386802">Technical Issues</a></dt><dt>income, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a></dt><dt>independent expert, <a class="indexterm" href="kerberos.html#id394729">Introduction</a></dt><dt>inetd, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a></dt><dt>inetOrgPerson, <a class="indexterm" href="nw4migration.html#id390984">Technical Issues</a></dt><dt>inheritance, <a class="indexterm" href="kerberos.html#id398933">Setting Posix ACLs in UNIX/Linux</a></dt><dt>initGrps.sh, <a class="indexterm" href="small.html#id345178">Implementation</a>, <a class="indexterm" href="secure.html#id349099">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id355127">Configuration for Server: MASSIVE</a></dt><dt>initial credentials, <a class="indexterm" href="DomApps.html#id400370">Kerberos Configuration</a></dt><dt>inoperative, <a class="indexterm" href="ntmigration.html#id386640">Dissection and Discussion</a></dt><dt>install, <a class="indexterm" href="upgrades.html">Updating Samba-3</a></dt><dt>installation, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a></dt><dt>integrate, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a></dt><dt>integrity, <a class="indexterm" href="kerberos.html#id394729">Introduction</a>, <a class="indexterm" href="kerberos.html#id396888">Kerberos Exposed</a></dt><dt>inter-domain, <a class="indexterm" href="upgrades.html#id385275">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>inter-operability, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id399129">Key Points Learned</a>, <a class="indexterm" href="DomApps.html#id401943">Questions and Answers</a></dt><dt>interactive help, <a class="indexterm" href="ch14.html#id404300">Free Support</a></dt><dt>interdomain trusts, <a class="indexterm" href="2000users.html#id371136">Identity Management Needs</a></dt><dt>interfaces, <a class="indexterm" href="secure.html#id348344">Implementation</a></dt><dt>intermittent, <a class="indexterm" href="HA.html#id403932">Hardware Problems</a></dt><dt>internationalization, <a class="indexterm" href="upgrades.html#id384787">International Language Support</a></dt><dt>Internet Explorer, <a class="indexterm" href="DomApps.html#id399977">Technical Issues</a></dt><dt>Internet Information Server, <a class="indexterm" href="DomApps.html#id401943">Questions and Answers</a></dt><dt>interoperability, <a class="indexterm" href="happy.html#id359212">Dissection and Discussion</a></dt><dt>IP forwarding, <a class="indexterm" href="small.html#id345178">Implementation</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="Big500users.html#id355127">Configuration for Server: MASSIVE</a></dt><dt>IPC$, <a class="indexterm" href="primer.html#id409948">Findings and Comments</a></dt><dt>iptables, <a class="indexterm" href="secure.html#id347966">Technical Issues</a></dt><dt>IRC, <a class="indexterm" href="ch14.html#id404300">Free Support</a></dt><dt>isolated, <a class="indexterm" href="kerberos.html#id394729">Introduction</a></dt><dt>Italian, <a class="indexterm" href="DomApps.html#id401943">Questions and Answers</a></dt></dl></div><div class="indexdiv"><h3>J</h3><dl><dt>jobs, <a class="indexterm" href="kerberos.html#id394729">Introduction</a></dt><dt>joining a domain, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt></dl></div><div class="indexdiv"><h3>K</h3><dl><dt>KDC, <a class="indexterm" href="DomApps.html#id400370">Kerberos Configuration</a></dt><dt>Kerberos, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id394729">Introduction</a>, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id399129">Key Points Learned</a>, <a class="indexterm" href="DomApps.html#id399977">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id400137">Implementation</a>, <a class="indexterm" href="DomApps.html#id400370">Kerberos Configuration</a></dt><dd><dl><dt>Heimdal, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>interoperability, <a class="indexterm" href="kerberos.html#id396888">Kerberos Exposed</a></dt><dt>libraries, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>MIT, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>unspecified fields, <a class="indexterm" href="kerberos.html#id396888">Kerberos Exposed</a></dt></dl></dd><dt>kerberos, <a class="indexterm" href="kerberos.html#id396888">Kerberos Exposed</a></dt><dd><dl><dt>server, <a class="indexterm" href="kerberos.html#id396888">Kerberos Exposed</a></dt></dl></dd><dt>Kerberos ticket, <a class="indexterm" href="DomApps.html#id400733">Samba Configuration</a></dt><dt>kinit, <a class="indexterm" href="DomApps.html#id400370">Kerberos Configuration</a></dt><dt>Kixtart, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a></dt><dt>klist, <a class="indexterm" href="DomApps.html#id400370">Kerberos Configuration</a></dt><dt>krb5, <a class="indexterm" href="DomApps.html#id400137">Implementation</a></dt><dt>krb5.conf, <a class="indexterm" href="DomApps.html#id400370">Kerberos Configuration</a></dt></dl></div><div class="indexdiv"><h3>L</h3><dl><dt>LAM, <a class="indexterm" href="appendix.html#id406519">The LDAP Account Manager</a></dt><dd><dl><dt>configuration editor, <a class="indexterm" href="appendix.html#id406519">The LDAP Account Manager</a></dt><dt>configuration file, <a class="indexterm" href="appendix.html#id406519">The LDAP Account Manager</a></dt><dt>login screen, <a class="indexterm" href="appendix.html#id406519">The LDAP Account Manager</a></dt><dt>opening screen, <a class="indexterm" href="appendix.html#id406519">The LDAP Account Manager</a></dt><dt>profile, <a class="indexterm" href="appendix.html#id406519">The LDAP Account Manager</a></dt><dt>wizard, <a class="indexterm" href="appendix.html#id406519">The LDAP Account Manager</a></dt></dl></dd><dt>large domain, <a class="indexterm" href="unixclients.html#id380589">IDMAP_RID with Winbind</a></dt><dt>LDAP, <a class="indexterm" href="Big500users.html#id353690">Technical Issues</a>, <a class="indexterm" href="happy.html#id359084">Assignment Tasks</a>, <a class="indexterm" href="happy.html#id359212">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#id359614">Technical Issues</a>, <a class="indexterm" href="happy.html#id360669">Preliminary Advice: Dangers Can Be Avoided</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="2000users.html#id370394">Introduction</a>, <a class="indexterm" href="2000users.html#id370476">Dissection and Discussion</a>, <a class="indexterm" href="2000users.html#id371136">Identity Management Needs</a>, <a class="indexterm" href="2000users.html#id371556">Implementation</a>, <a class="indexterm" href="2000users.html#id374570">Key Points Learned</a>, <a class="indexterm" href="2000users.html#id374709">Questions and Answers</a>, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id385275">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id386589">Assignment Tasks</a>, <a class="indexterm" href="ntmigration.html#id386802">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id390913">Dissection and Discussion</a>, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a>, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dd><dl><dt>backend, <a class="indexterm" href="2000users.html#id371136">Identity Management Needs</a></dt><dt>database, <a class="indexterm" href="happy.html#id364093">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="2000users.html#id371136">Identity Management Needs</a>, <a class="indexterm" href="2000users.html#id374709">Questions and Answers</a>, <a class="indexterm" href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></dt><dt>directory, <a class="indexterm" href="happy.html#id358884">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="2000users.html#id371136">Identity Management Needs</a></dt><dt>fail-over, <a class="indexterm" href="2000users.html#id371556">Implementation</a></dt><dt>initial configuration, <a class="indexterm" href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></dt><dt>master, <a class="indexterm" href="2000users.html#id371136">Identity Management Needs</a></dt><dt>master/slave</dt><dd><dl><dt>background communication, <a class="indexterm" href="2000users.html#id374709">Questions and Answers</a></dt></dl></dd><dt>preload, <a class="indexterm" href="2000users.html#id371556">Implementation</a></dt><dt>schema, <a class="indexterm" href="upgrades.html#id385836">Updating from Samba Versions between 3.0.6 and 3.0.10</a></dt><dt>secure, <a class="indexterm" href="happy.html#id359614">Technical Issues</a></dt><dt>server, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a></dt><dt>slave, <a class="indexterm" href="2000users.html#id371136">Identity Management Needs</a></dt><dt>updates, <a class="indexterm" href="2000users.html#id371136">Identity Management Needs</a></dt></dl></dd><dt>ldap, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>LDAP Account Manager (see LAM)</dt><dt>LDAP backend, <a class="indexterm" href="ntmigration.html#id386802">Technical Issues</a></dt><dt>LDAP database, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a></dt><dt>LDAP Interchange Format (see LDIF)</dt><dt>LDAP server, <a class="indexterm" href="2000users.html#id371136">Identity Management Needs</a></dt><dt>LDAP-transfer-LDIF.txt, <a class="indexterm" href="2000users.html#id371556">Implementation</a></dt><dt>ldap.conf, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>ldapadd, <a class="indexterm" href="happy.html#id364093">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>ldapsam, <a class="indexterm" href="happy.html#id364093">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="2000users.html#id370476">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="upgrades.html#id385836">Updating from Samba Versions between 3.0.6 and 3.0.10</a>, <a class="indexterm" href="ntmigration.html#id386589">Assignment Tasks</a>, <a class="indexterm" href="DomApps.html">Integrating Additional Services</a></dt><dt>ldapsam backend, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>ldapsearch, <a class="indexterm" href="happy.html#id364093">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>LDIF, <a class="indexterm" href="happy.html#id359614">Technical Issues</a>, <a class="indexterm" href="2000users.html#id371556">Implementation</a>, <a class="indexterm" href="nw4migration.html#id390984">Technical Issues</a>, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a>, <a class="indexterm" href="appendix.html#id406053">Initialization of the LDAP Database</a></dt><dt>leadership, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>Lightweight Directory Access Protocol (see LDAP)</dt><dt>limit, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a></dt><dt>Linux desktop, <a class="indexterm" href="unixclients.html#id375489">Introduction</a></dt><dt>Linux Standards Base (see LSB)</dt><dt>LMB, <a class="indexterm" href="primer.html#id408760">Findings</a>, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dt>LMHOSTS, <a class="indexterm" href="HA.html#id403161">Routed Networks</a></dt><dt>load distribution, <a class="indexterm" href="HA.html#id403795">For Scalability, Use SAN-Based Storage on Samba Servers</a></dt><dt>local accounts, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a></dt><dt>Local Group Policy, <a class="indexterm" href="happy.html#id360094">Roaming Profile Background</a></dt><dt>Local Master Announcement, <a class="indexterm" href="primer.html#id409382">Findings</a></dt><dt>Local Master Browser (see LMB)</dt><dt>localhost, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="HA.html#id402984">Bad Hostnames</a></dt><dt>lock directory, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></dt><dt>locking</dt><dd><dl><dt>Application level, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>Client side, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>Server side, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt></dl></dd><dt>logging, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>login, <a class="indexterm" href="secure.html#id347966">Technical Issues</a></dt><dt>loglevel, <a class="indexterm" href="happy.html#id360837">Debugging LDAP</a></dt><dt>logon credentials, <a class="indexterm" href="DomApps.html#id401943">Questions and Answers</a></dt><dt>logon hours, <a class="indexterm" href="ntmigration.html#id386802">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id399129">Key Points Learned</a></dt><dt>logon machines, <a class="indexterm" href="ntmigration.html#id386802">Technical Issues</a></dt><dt>logon path, <a class="indexterm" href="secure.html#id348344">Implementation</a></dt><dt>logon process, <a class="indexterm" href="unixclients.html#id376274">Implementation</a></dt><dt>logon scrip, <a class="indexterm" href="secure.html#id349099">Samba Configuration</a></dt><dt>logon script, <a class="indexterm" href="secure.html#id348344">Implementation</a>, <a class="indexterm" href="happy.html#id359614">Technical Issues</a>, <a class="indexterm" href="happy.html#id368057">Preparation of Logon Scripts</a>, <a class="indexterm" href="ntmigration.html#id386802">Technical Issues</a></dt><dt>logon server, <a class="indexterm" href="2000users.html#id370835">The Nature of Windows Networking Protocols</a></dt><dt>logon services, <a class="indexterm" href="secure.html#id348344">Implementation</a></dt><dt>logon time, <a class="indexterm" href="happy.html#id359084">Assignment Tasks</a></dt><dt>logon traffic, <a class="indexterm" href="2000users.html#id370835">The Nature of Windows Networking Protocols</a></dt><dt>logon.kix, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a></dt><dt>loopback, <a class="indexterm" href="simple.html#validate1">Validation</a></dt><dt>low performance, <a class="indexterm" href="HA.html#id403932">Hardware Problems</a></dt><dt>lower-case, <a class="indexterm" href="ntmigration.html#id387125">Implementation</a></dt><dt>lpadmin, <a class="indexterm" href="simple.html#id341634">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id345178">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>LSB, <a class="indexterm" href="appendix.html#id405157">Samba System File Location</a></dt></dl></div><div class="indexdiv"><h3>M</h3><dl><dt>machine, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a></dt><dt>machine account, <a class="indexterm" href="happy.html#id358884">Regarding LDAP Directories and Windows Computer Accounts</a></dt><dt>machine accounts, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a></dt><dt>machine secret password, <a class="indexterm" href="Big500users.html#id353690">Technical Issues</a></dt><dt>MACHINE.SID, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a></dt><dt>mailing list, <a class="indexterm" href="ch14.html#id404300">Free Support</a></dt><dt>mailing lists, <a class="indexterm" href="ch14.html#id404300">Free Support</a></dt><dt>managed, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>management, <a class="indexterm" href="unixclients.html#id376189">Political Issues</a>, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a></dt><dd><dl><dt>group, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>User, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt></dl></dd><dt>mandatory profile, <a class="indexterm" href="happy.html#id359614">Technical Issues</a>, <a class="indexterm" href="happy.html#id367829">Configuring Profile Directories</a></dt><dt>Mandrake, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>mapped drives, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a></dt><dt>mapping, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id400370">Kerberos Configuration</a></dt><dd><dl><dt>consistent, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt></dl></dd><dt>Mars_NWE, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>master, <a class="indexterm" href="2000users.html#id370476">Dissection and Discussion</a></dt><dt>material, <a class="indexterm" href="appendix.html">A Collection of Useful Tidbits</a></dt><dt>memberUID, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a></dt><dt>memory requirements, <a class="indexterm" href="secure.html#id348190">Hardware Requirements</a></dt><dt>merge, <a class="indexterm" href="ntmigration.html#id386802">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a></dt><dt>merged, <a class="indexterm" href="ntmigration.html#id386802">Technical Issues</a></dt><dt>meta-directory, <a class="indexterm" href="2000users.html#id374709">Questions and Answers</a></dt><dt>meta-service, <a class="indexterm" href="kerberos.html#id399251">Questions and Answers</a></dt><dt>Microsoft Access, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>Microsoft Excel, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>Microsoft ISA, <a class="indexterm" href="DomApps.html#id399862">Assignment Tasks</a></dt><dt>Microsoft Management Console (see MMC)</dt><dt>Microsoft Office, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a>, <a class="indexterm" href="kerberos.html#id398076">Share Point Directory and File Permissions</a></dt><dt>Microsoft Outlook</dt><dd><dl><dt>PST files, <a class="indexterm" href="2000users.html#id374709">Questions and Answers</a></dt></dl></dd><dt>migrate, <a class="indexterm" href="upgrades.html">Updating Samba-3</a>, <a class="indexterm" href="ntmigration.html#id386802">Technical Issues</a></dt><dt>migration, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id345178">Implementation</a>, <a class="indexterm" href="happy.html#id359084">Assignment Tasks</a>, <a class="indexterm" href="ntmigration.html#id386514">Introduction</a>, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dd><dl><dt>objectives, <a class="indexterm" href="ntmigration.html#id386640">Dissection and Discussion</a></dt></dl></dd><dt>Migration speed, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a></dt><dt>mime type, <a class="indexterm" href="simple.html#id341634">Implementation</a>, <a class="indexterm" href="small.html#id345178">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id354601">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>mime types, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a></dt><dt>missing RPC's, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>MIT, <a class="indexterm" href="DomApps.html#id400137">Implementation</a>, <a class="indexterm" href="DomApps.html#id400370">Kerberos Configuration</a></dt><dt>MIT Kerberos, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="kerberos.html#id396888">Kerberos Exposed</a></dt><dt>MIT kerberos, <a class="indexterm" href="unixclients.html#id381158">IDMAP Storage in LDAP using Winbind</a></dt><dt>MIT KRB5, <a class="indexterm" href="DomApps.html#id400733">Samba Configuration</a></dt><dt>mixed mode, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>mixed-mode, <a class="indexterm" href="kerberos.html#id399251">Questions and Answers</a></dt><dt>MMC, <a class="indexterm" href="happy.html#id369268">Configure Delete Cached Profiles on Logout</a>, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id399251">Questions and Answers</a></dt><dt>mobile computing, <a class="indexterm" href="small.html#id344943">Dissection and Discussion</a></dt><dt>mobility, <a class="indexterm" href="2000users.html#id370722">Technical Issues</a></dt><dt>modularization, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>modules, <a class="indexterm" href="DomApps.html#id401943">Questions and Answers</a></dt><dt>MS Access</dt><dd><dl><dt>validate, <a class="indexterm" href="appendix.html#id407872">Microsoft Access</a></dt></dl></dd><dt>MS Outlook, <a class="indexterm" href="happy.html#id368985">Configuration of MS Outlook to Relocate PST File</a></dt><dd><dl><dt>PST, <a class="indexterm" href="happy.html#id368985">Configuration of MS Outlook to Relocate PST File</a></dt><dt>PST file, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>MS Windows Server 2003, <a class="indexterm" href="DomApps.html#id400137">Implementation</a></dt><dt>MS Word, <a class="indexterm" href="kerberos.html#id398076">Share Point Directory and File Permissions</a></dt><dt>MSDFS, <a class="indexterm" href="HA.html#id403840">Distribute Network Load with MSDFS</a></dt><dt>multi-subnet, <a class="indexterm" href="HA.html#id403161">Routed Networks</a></dt><dt>multi-user</dt><dd><dl><dt>access, <a class="indexterm" href="appendix.html#id407872">Microsoft Access</a></dt><dt>data access, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt></dl></dd><dt>multiple directories, <a class="indexterm" href="2000users.html#id371136">Identity Management Needs</a></dt><dt>multiple domain controllers, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>multiple group mappings, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a></dt><dt>mutual assistance, <a class="indexterm" href="ch14.html#id404300">Free Support</a></dt><dt>My Documents, <a class="indexterm" href="happy.html#id360094">Roaming Profile Background</a></dt><dt>My Network Places, <a class="indexterm" href="simple.html#id341634">Implementation</a></dt><dt>mysqlsam, <a class="indexterm" href="2000users.html#id371556">Implementation</a></dt></dl></div><div class="indexdiv"><h3>N</h3><dl><dt>name resolution, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a>, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a>, <a class="indexterm" href="primer.html#id408414">Assignment Tasks</a></dt><dd><dl><dt>Defective, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt></dl></dd><dt>name resolve order, <a class="indexterm" href="secure.html#id348344">Implementation</a></dt><dt>name service switch, <a class="indexterm" href="small.html#id345178">Implementation</a> (see NSS)</dt><dt>named, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="Big500users.html#id354601">Server Preparation: All Servers</a></dt><dt>NAT, <a class="indexterm" href="secure.html#id347966">Technical Issues</a></dt><dt>native, <a class="indexterm" href="kerberos.html#id399251">Questions and Answers</a></dt><dt>net</dt><dd><dl><dt>ads</dt><dd><dl><dt>info, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>join, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a>, <a class="indexterm" href="DomApps.html#id400733">Samba Configuration</a></dt><dt>status, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt></dl></dd><dt>getlocalsid, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a></dt><dt>group, <a class="indexterm" href="ntmigration.html#id389442">NT4 Migration Using tdbsam Backend</a></dt><dt>groupmap</dt><dd><dl><dt>add, <a class="indexterm" href="secure.html#id349099">Samba Configuration</a></dt><dt>list, <a class="indexterm" href="secure.html#id349099">Samba Configuration</a>, <a class="indexterm" href="happy.html#id364093">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>modify, <a class="indexterm" href="secure.html#id349099">Samba Configuration</a></dt></dl></dd><dt>rpc</dt><dd><dl><dt>info, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a></dt><dt>join, <a class="indexterm" href="Big500users.html#ch5-domsvrspec">Configuration Specific to Domain Member Servers: BLDG1, BLDG2</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id389442">NT4 Migration Using tdbsam Backend</a></dt><dt>vampire, <a class="indexterm" href="upgrades.html">Updating Samba-3</a>, <a class="indexterm" href="ntmigration.html#id389442">NT4 Migration Using tdbsam Backend</a></dt></dl></dd><dt>setlocalsid, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a></dt></dl></dd><dt>NetBIOS, <a class="indexterm" href="2000users.html#id370835">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a>, <a class="indexterm" href="HA.html#id402984">Bad Hostnames</a>, <a class="indexterm" href="HA.html#id403161">Routed Networks</a>, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dd><dl><dt>name cache, <a class="indexterm" href="2000users.html#id374709">Questions and Answers</a></dt><dt>name resolution</dt><dd><dl><dt>delays, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>Node Type, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt></dl></dd><dt>netbios</dt><dd><dl><dt>machine name, <a class="indexterm" href="upgrades.html#id384485">Change of hostname</a></dt></dl></dd><dt>netbios forwarding, <a class="indexterm" href="HA.html#id403325">Network Collisions</a></dt><dt>NetBIOS name, <a class="indexterm" href="DomApps.html#id400370">Kerberos Configuration</a></dt><dd><dl><dt>aliases, <a class="indexterm" href="2000users.html#id371136">Identity Management Needs</a></dt></dl></dd><dt>netbios name, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id384485">Change of hostname</a>, <a class="indexterm" href="HA.html#id402984">Bad Hostnames</a></dt><dt>NETLOGON, <a class="indexterm" href="happy.html#id360452">Using a Network Default User Profile</a>, <a class="indexterm" href="happy.html#id368268">Windows Client Configuration</a></dt><dt>netlogon, <a class="indexterm" href="2000users.html#id370835">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a></dt><dt>Netlogon, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dt>netmask, <a class="indexterm" href="simple.html#id340832">Implementation</a></dt><dt>Netware, <a class="indexterm" href="small.html">Small Office Networking</a></dt><dt>NetWare, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a>, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a></dt><dt>network</dt><dd><dl><dt>administrators, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>analyzer, <a class="indexterm" href="primer.html#id408414">Assignment Tasks</a></dt><dt>bandwidth, <a class="indexterm" href="2000users.html#id371136">Identity Management Needs</a>, <a class="indexterm" href="2000users.html#id374709">Questions and Answers</a></dt><dt>broadcast, <a class="indexterm" href="primer.html#id408364">Introduction</a></dt><dt>captures, <a class="indexterm" href="primer.html#id408228">Requirements and Notes</a></dt><dt>collisions, <a class="indexterm" href="HA.html#id403325">Network Collisions</a></dt><dt>load, <a class="indexterm" href="HA.html#id403325">Network Collisions</a></dt><dt>logon, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>logon scripts, <a class="indexterm" href="ntmigration.html#id386640">Dissection and Discussion</a></dt><dt>management, <a class="indexterm" href="kerberos.html#id394729">Introduction</a></dt><dt>multi-segment, <a class="indexterm" href="happy.html#id359008">Introduction</a></dt><dt>overload, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>performance, <a class="indexterm" href="HA.html#id403415">Samba Configuration</a></dt><dt>routed, <a class="indexterm" href="2000users.html#id370476">Dissection and Discussion</a></dt><dt>secure, <a class="indexterm" href="kerberos.html#id394729">Introduction</a></dt><dt>segment, <a class="indexterm" href="happy.html#id359212">Dissection and Discussion</a></dt><dt>services, <a class="indexterm" href="DomApps.html#id401943">Questions and Answers</a></dt><dt>sniffer, <a class="indexterm" href="primer.html#id408228">Requirements and Notes</a></dt><dt>timeout, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>timeouts, <a class="indexterm" href="HA.html#id403325">Network Collisions</a></dt><dt>trace, <a class="indexterm" href="primer.html#id408414">Assignment Tasks</a></dt><dt>traffic</dt><dd><dl><dt>observation, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt></dl></dd><dt>wide-area, <a class="indexterm" href="happy.html#id359212">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt></dl></dd><dt>Network Address Translation (see NAT)</dt><dt>network administrators, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>network attached storage (see NAS)</dt><dt>network bandwidth</dt><dd><dl><dt>utilization, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>Network Default Profile, <a class="indexterm" href="happy.html#id360094">Roaming Profile Background</a></dt><dt>network hardware</dt><dd><dl><dt>defective, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>network hygiene, <a class="indexterm" href="HA.html#id402498">Dissection and Discussion</a></dt><dt>network Identities, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a></dt><dt>network load factors, <a class="indexterm" href="Big500users.html#id353662">Dissection and Discussion</a></dt><dt>Network Neighborhood, <a class="indexterm" href="simple.html#validate1">Validation</a>, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>network segment, <a class="indexterm" href="HA.html#id403710">Use and Location of BDCs</a></dt><dt>network segments, <a class="indexterm" href="secure.html#id348190">Hardware Requirements</a></dt><dt>network share, <a class="indexterm" href="happy.html#id359084">Assignment Tasks</a></dt><dt>networking</dt><dd><dl><dt>client, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a></dt></dl></dd><dt>networking hardware</dt><dd><dl><dt>defective, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>networking protocols, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>next generation, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>NextFreeUnixId, <a class="indexterm" href="ntmigration.html#id387250">NT4 Migration Using LDAP Backend</a></dt><dt>NFS server, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></dt><dt>NICs, <a class="indexterm" href="HA.html#id403932">Hardware Problems</a></dt><dt>NIS, <a class="indexterm" href="happy.html#id364093">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="2000users.html#id371136">Identity Management Needs</a>, <a class="indexterm" href="2000users.html#id374709">Questions and Answers</a>, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id376189">Political Issues</a>, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a></dt><dt>nis, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>NIS schema, <a class="indexterm" href="2000users.html#id374709">Questions and Answers</a></dt><dt>NIS server, <a class="indexterm" href="2000users.html#id374709">Questions and Answers</a></dt><dt>NIS+, <a class="indexterm" href="2000users.html#id371136">Identity Management Needs</a></dt><dt>nisplus, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>NLM, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>nmap, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>nmbd, <a class="indexterm" href="small.html#id346626">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="upgrades.html#id386001">Replacing a Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id400733">Samba Configuration</a>, <a class="indexterm" href="appendix.html#id405549">Starting Samba</a></dt><dt>nobody, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a class="indexterm" href="primer.html#id409948">Findings and Comments</a></dt><dt>Novell, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a>, <a class="indexterm" href="nw4migration.html#id390707">Introduction</a></dt><dt>Novell SUSE SLES 9, <a class="indexterm" href="ntmigration.html#id387250">NT4 Migration Using LDAP Backend</a></dt><dt>NSS, <a class="indexterm" href="happy.html#id358884">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="happy.html#id359614">Technical Issues</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#id380589">IDMAP_RID with Winbind</a>, <a class="indexterm" href="unixclients.html#id382025">UNIX/Linux Client Domain Member</a>, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a>, <a class="indexterm" href="DomApps.html#id401255">NSS Configuration</a> (see same service switch)</dt><dt>nss_ldap, <a class="indexterm" href="happy.html#id358884">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="happy.html#id359614">Technical Issues</a>, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="happy.html#id364093">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#id381708">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a class="indexterm" href="upgrades.html#id386001">Replacing a Domain Member Server</a>, <a class="indexterm" href="ntmigration.html#id387250">NT4 Migration Using LDAP Backend</a></dt><dt>nt acl support, <a class="indexterm" href="simple.html#id341464">Dissection and Discussion</a></dt><dt>NT4 registry, <a class="indexterm" href="ntmigration.html#id386640">Dissection and Discussion</a></dt><dt>NTLM, <a class="indexterm" href="DomApps.html#id399977">Technical Issues</a></dt><dt>NTLM authentication daemon, <a class="indexterm" href="DomApps.html#id399977">Technical Issues</a></dt><dt>NTLMSSP, <a class="indexterm" href="DomApps.html#id401888">Key Points Learned</a>, <a class="indexterm" href="DomApps.html#id401943">Questions and Answers</a>, <a class="indexterm" href="primer.html#id410194">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>NTLMSSP_AUTH, <a class="indexterm" href="primer.html#id410194">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>ntlm_auth, <a class="indexterm" href="DomApps.html#id400733">Samba Configuration</a>, <a class="indexterm" href="DomApps.html#id401943">Questions and Answers</a></dt><dt>NTP, <a class="indexterm" href="DomApps.html#id400370">Kerberos Configuration</a></dt><dt>NTUSER.DAT, <a class="indexterm" href="happy.html#id360094">Roaming Profile Background</a>, <a class="indexterm" href="happy.html#id360364">Profile Changes</a>, <a class="indexterm" href="happy.html#id360452">Using a Network Default User Profile</a>, <a class="indexterm" href="2000users.html#id374709">Questions and Answers</a></dt><dt>NULL connection, <a class="indexterm" href="simple.html#validate1">Validation</a></dt><dt>NULL session, <a class="indexterm" href="primer.html#id409948">Findings and Comments</a></dt><dt>NULL-Session, <a class="indexterm" href="primer.html#id410692">Discussion</a></dt></dl></div><div class="indexdiv"><h3>O</h3><dl><dt>objectClass, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a></dt><dt>off-site storage, <a class="indexterm" href="kerberos.html#id394729">Introduction</a></dt><dt>Open Magazine, <a class="indexterm" href="unixclients.html">Adding Domain Member Servers and Clients</a></dt><dt>Open Source, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a></dt><dt>OpenLDAP, <a class="indexterm" href="happy.html#id359212">Dissection and Discussion</a>, <a class="indexterm" href="2000users.html#id370476">Dissection and Discussion</a>, <a class="indexterm" href="2000users.html#id374709">Questions and Answers</a>, <a class="indexterm" href="unixclients.html#id376189">Political Issues</a>, <a class="indexterm" href="nw4migration.html#id390984">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id394729">Introduction</a>, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id399129">Key Points Learned</a>, <a class="indexterm" href="appendix.html#id406519">The LDAP Account Manager</a></dt><dt>openldap, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>OpenOffice, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a></dt><dt>operating profiles, <a class="indexterm" href="appendix.html#id406519">The LDAP Account Manager</a></dt><dt>oplock break, <a class="indexterm" href="kerberos.html#id397932">Override Controls</a></dt><dt>oplocks, <a class="indexterm" href="HA.html#id403415">Samba Configuration</a></dt><dt>Oplocks</dt><dd><dl><dt>disabled, <a class="indexterm" href="appendix.html#id408086">Opportunistic Locking Controls</a></dt></dl></dd><dt>opportunistic</dt><dd><dl><dt>locking, <a class="indexterm" href="kerberos.html#id397932">Override Controls</a></dt></dl></dd><dt>opportunistic locking, <a class="indexterm" href="secure.html#id348344">Implementation</a>, <a class="indexterm" href="HA.html#id403415">Samba Configuration</a>, <a class="indexterm" href="appendix.html#id408011">Act! Database Sharing</a></dt><dt>optimized, <a class="indexterm" href="HA.html#id403415">Samba Configuration</a></dt><dt>organizational units, <a class="indexterm" href="appendix.html#id406519">The LDAP Account Manager</a></dt><dt>OS/2, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a></dt><dt>Outlook</dt><dd><dl><dt>PST, <a class="indexterm" href="happy.html#id368985">Configuration of MS Outlook to Relocate PST File</a></dt></dl></dd><dt>Outlook Address Book, <a class="indexterm" href="happy.html#id368985">Configuration of MS Outlook to Relocate PST File</a></dt><dt>Outlook Express, <a class="indexterm" href="secure.html#id348311">Political Issues</a>, <a class="indexterm" href="happy.html#id368985">Configuration of MS Outlook to Relocate PST File</a></dt><dt>over-ride, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>over-ride controls, <a class="indexterm" href="kerberos.html#id397932">Override Controls</a></dt><dt>over-rule, <a class="indexterm" href="kerberos.html#id397184">Share Access Controls</a>, <a class="indexterm" href="kerberos.html#id398771">Using MS Windows Explorer (File Manager)</a></dt><dt>overheads, <a class="indexterm" href="kerberos.html#id397932">Override Controls</a></dt><dt>ownership, <a class="indexterm" href="kerberos.html#id398076">Share Point Directory and File Permissions</a></dt></dl></div><div class="indexdiv"><h3>P</h3><dl><dt>package, <a class="indexterm" href="simple.html#id340832">Implementation</a></dt><dt>package names, <a class="indexterm" href="appendix.html#id405157">Samba System File Location</a></dt><dt>packages, <a class="indexterm" href="upgrades.html#id385712">Updating a Samba-3 Installation</a></dt><dt>PADL, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id381158">IDMAP Storage in LDAP using Winbind</a></dt><dt>PADL LDAP tools, <a class="indexterm" href="happy.html#id359614">Technical Issues</a></dt><dt>PADL Software, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>paid-for support, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>PAM, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="unixclients.html#id382025">UNIX/Linux Client Domain Member</a>, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a></dt><dt>pam_ldap, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>pam_ldap.so, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dt>pam_unix2.so, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dd><dl><dt>use_ldap, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt></dl></dd><dt>parameters, <a class="indexterm" href="upgrades.html#id385275">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>passdb backend, <a class="indexterm" href="secure.html#id348344">Implementation</a>, <a class="indexterm" href="Big500users.html">The 500-User Office</a>, <a class="indexterm" href="happy.html#id359212">Dissection and Discussion</a>, <a class="indexterm" href="2000users.html#id370476">Dissection and Discussion</a>, <a class="indexterm" href="2000users.html#id371556">Implementation</a>, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a>, <a class="indexterm" href="upgrades.html">Updating Samba-3</a>, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id385275">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="upgrades.html#id385836">Updating from Samba Versions between 3.0.6 and 3.0.10</a>, <a class="indexterm" href="ntmigration.html#id386589">Assignment Tasks</a>, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a></dt><dt>passdb.tdb, <a class="indexterm" href="ntmigration.html#id386802">Technical Issues</a></dt><dt>passwd, <a class="indexterm" href="simple.html#id341634">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="secure.html#id349099">Samba Configuration</a></dt><dt>password</dt><dd><dl><dt>backend, <a class="indexterm" href="small.html#id345178">Implementation</a>, <a class="indexterm" href="secure.html#id349099">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id355127">Configuration for Server: MASSIVE</a></dt></dl></dd><dt>password caching, <a class="indexterm" href="simple.html#id341634">Implementation</a></dt><dt>password change, <a class="indexterm" href="kerberos.html#id399129">Key Points Learned</a></dt><dt>password length, <a class="indexterm" href="primer.html#id409728">Simple Windows Client Connection Characteristics</a>, <a class="indexterm" href="primer.html#id410194">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>payroll, <a class="indexterm" href="nw4migration.html#id390707">Introduction</a></dt><dt>pdbedit, <a class="indexterm" href="happy.html#id364093">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a class="indexterm" href="ntmigration.html#id389442">NT4 Migration Using tdbsam Backend</a>, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a></dt><dt>PDC, <a class="indexterm" href="Big500users.html#id353583">Assignment Tasks</a>, <a class="indexterm" href="Big500users.html#id353690">Technical Issues</a>, <a class="indexterm" href="happy.html">Making Happy Users</a>, <a class="indexterm" href="happy.html#id359614">Technical Issues</a>, <a class="indexterm" href="happy.html#sbehap-locgrppol">The Local Group Policy</a>, <a class="indexterm" href="2000users.html#id370835">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id385275">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id387125">Implementation</a>, <a class="indexterm" href="ntmigration.html#id387250">NT4 Migration Using LDAP Backend</a>, <a class="indexterm" href="ntmigration.html#id389442">NT4 Migration Using tdbsam Backend</a>, <a class="indexterm" href="HA.html#id403710">Use and Location of BDCs</a></dt><dt>PDC/BDC ratio, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>PDF, <a class="indexterm" href="appendix.html#id406519">The LDAP Account Manager</a></dt><dt>performance, <a class="indexterm" href="happy.html#id359212">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id399251">Questions and Answers</a>, <a class="indexterm" href="HA.html">Performance, Reliability, and Availability</a>, <a class="indexterm" href="HA.html#id402421">Introduction</a>, <a class="indexterm" href="HA.html#id403325">Network Collisions</a></dt><dt>performance degradation, <a class="indexterm" href="kerberos.html#id397932">Override Controls</a>, <a class="indexterm" href="HA.html#id403415">Samba Configuration</a></dt><dt>Perl, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a>, <a class="indexterm" href="appendix.html#id406519">The LDAP Account Manager</a></dt><dt>permission, <a class="indexterm" href="kerberos.html#id398076">Share Point Directory and File Permissions</a></dt><dt>permissions, <a class="indexterm" href="simple.html#id341634">Implementation</a>, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id397184">Share Access Controls</a>, <a class="indexterm" href="kerberos.html#id397648">Checkpoint Controls</a>, <a class="indexterm" href="kerberos.html#id398076">Share Point Directory and File Permissions</a>, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dd><dl><dt>excessive, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>group, <a class="indexterm" href="kerberos.html#id398076">Share Point Directory and File Permissions</a></dt><dt>user, <a class="indexterm" href="kerberos.html#id398076">Share Point Directory and File Permissions</a></dt></dl></dd><dt>Permissions, <a class="indexterm" href="kerberos.html#id398494">Using the MMC Computer Management Interface</a></dt><dt>permits, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>permitted group, <a class="indexterm" href="kerberos.html#id398494">Using the MMC Computer Management Interface</a></dt><dt>PHP, <a class="indexterm" href="appendix.html#id406519">The LDAP Account Manager</a></dt><dt>PHP4, <a class="indexterm" href="appendix.html#id406519">The LDAP Account Manager</a></dt><dt>pile-driver, <a class="indexterm" href="kerberos.html#id397519">Share Definition Controls</a></dt><dt>ping, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>pitfalls, <a class="indexterm" href="appendix.html#id406519">The LDAP Account Manager</a></dt><dt>plain-text, <a class="indexterm" href="DomApps.html#id401943">Questions and Answers</a></dt><dt>Pluggable Authentication Modules (see PAM)</dt><dt>policy, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id394729">Introduction</a></dt><dt>poor performance, <a class="indexterm" href="HA.html#id402498">Dissection and Discussion</a></dt><dt>POP3, <a class="indexterm" href="nw4migration.html#id390984">Technical Issues</a></dt><dt>Posix, <a class="indexterm" href="simple.html#id341464">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#id359614">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id387125">Implementation</a>, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a>, <a class="indexterm" href="appendix.html#id406519">The LDAP Account Manager</a></dt><dt>POSIX, <a class="indexterm" href="happy.html#id358884">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a></dt><dt>Posix accounts, <a class="indexterm" href="happy.html#id364093">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a></dt><dt>Posix ACLs, <a class="indexterm" href="kerberos.html#id398445">Managing Windows 200x ACLs</a></dt><dt>PosixAccount, <a class="indexterm" href="happy.html#id364093">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>posixAccount, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a></dt><dt>Postfix, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a></dt><dt>Postscript, <a class="indexterm" href="happy.html#id360506">Installation of Printer Driver Auto-Download</a></dt><dt>powers, <a class="indexterm" href="kerberos.html#id397519">Share Definition Controls</a></dt><dt>practices, <a class="indexterm" href="kerberos.html#id394729">Introduction</a></dt><dt>precaution, <a class="indexterm" href="upgrades.html#id383639">Introduction</a></dt><dt>presence and leadership, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>price paid, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a></dt><dt>primary group, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="kerberos.html#id398076">Share Point Directory and File Permissions</a></dt><dt>principals, <a class="indexterm" href="kerberos.html#id396888">Kerberos Exposed</a></dt><dt>print filter, <a class="indexterm" href="small.html#id345178">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id354601">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>print queue, <a class="indexterm" href="simple.html#id341373">Charity Administration Office</a>, <a class="indexterm" href="simple.html#id341464">Dissection and Discussion</a></dt><dt>print spooler, <a class="indexterm" href="simple.html#id341373">Charity Administration Office</a></dt><dt>Print Test Page, <a class="indexterm" href="happy.html#id369439">Uploading Printer Drivers to Samba Servers</a></dt><dt>printcap name, <a class="indexterm" href="secure.html#id348344">Implementation</a></dt><dt>printer validation, <a class="indexterm" href="small.html#id346626">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>printers</dt><dd><dl><dt>Advanced, <a class="indexterm" href="happy.html#id369439">Uploading Printer Drivers to Samba Servers</a></dt><dt>Default Settings, <a class="indexterm" href="happy.html#id369439">Uploading Printer Drivers to Samba Servers</a></dt><dt>General, <a class="indexterm" href="happy.html#id369439">Uploading Printer Drivers to Samba Servers</a></dt><dt>Properties, <a class="indexterm" href="happy.html#id369439">Uploading Printer Drivers to Samba Servers</a></dt><dt>Security, <a class="indexterm" href="happy.html#id369439">Uploading Printer Drivers to Samba Servers</a></dt><dt>Sharing, <a class="indexterm" href="happy.html#id369439">Uploading Printer Drivers to Samba Servers</a></dt></dl></dd><dt>printing, <a class="indexterm" href="secure.html#id348344">Implementation</a></dt><dd><dl><dt>drag-and-drop, <a class="indexterm" href="happy.html#id360506">Installation of Printer Driver Auto-Download</a>, <a class="indexterm" href="happy.html#id369439">Uploading Printer Drivers to Samba Servers</a></dt><dt>dumb, <a class="indexterm" href="happy.html#id360506">Installation of Printer Driver Auto-Download</a></dt><dt>point-n-click, <a class="indexterm" href="happy.html#id360506">Installation of Printer Driver Auto-Download</a></dt><dt>raw, <a class="indexterm" href="simple.html#id341464">Dissection and Discussion</a></dt></dl></dd><dt>privacy, <a class="indexterm" href="2000users.html#id371136">Identity Management Needs</a></dt><dt>Privilege Attribute Certificates (see PAC)</dt><dt>privilege controls, <a class="indexterm" href="kerberos.html#id398076">Share Point Directory and File Permissions</a></dt><dt>privileged pipe, <a class="indexterm" href="DomApps.html#id400733">Samba Configuration</a></dt><dt>privileges, <a class="indexterm" href="2000users.html#id371136">Identity Management Needs</a>, <a class="indexterm" href="upgrades.html#id385909">Updating from Samba Versions after 3.0.6 to a Current Release</a>, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id397519">Share Definition Controls</a></dt><dt>problem report, <a class="indexterm" href="ch14.html#id404300">Free Support</a></dt><dt>problem resolution, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>product defects, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a></dt><dt>professional support, <a class="indexterm" href="ch14.html#id404300">Free Support</a></dt><dt>profile</dt><dd><dl><dt>default, <a class="indexterm" href="happy.html#id359084">Assignment Tasks</a></dt><dt>mandatory, <a class="indexterm" href="2000users.html#id370835">The Nature of Windows Networking Protocols</a></dt><dt>roaming, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>profile path, <a class="indexterm" href="ntmigration.html#id386802">Technical Issues</a></dt><dt>profile share, <a class="indexterm" href="secure.html#id348344">Implementation</a></dt><dt>profiles, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a></dt><dt>profiles share, <a class="indexterm" href="ntmigration.html#id386640">Dissection and Discussion</a></dt><dt>programmer, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a></dt><dt>project, <a class="indexterm" href="ch14.html#id404300">Free Support</a></dt><dt>project maintainers, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>Properties, <a class="indexterm" href="kerberos.html#id398494">Using the MMC Computer Management Interface</a></dt><dt>proprietary, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>protected, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>protection, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>protocol</dt><dd><dl><dt>negotiation, <a class="indexterm" href="2000users.html#id370835">The Nature of Windows Networking Protocols</a></dt></dl></dd><dt>protocol analysis, <a class="indexterm" href="primer.html#id408228">Requirements and Notes</a></dt><dt>protocols, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>provided services, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>proxy, <a class="indexterm" href="DomApps.html#id399862">Assignment Tasks</a>, <a class="indexterm" href="DomApps.html#id399977">Technical Issues</a></dt><dt>PST file, <a class="indexterm" href="happy.html#id368985">Configuration of MS Outlook to Relocate PST File</a></dt><dt>public specifications, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>purchase support, <a class="indexterm" href="ch14.html#id404300">Free Support</a></dt></dl></div><div class="indexdiv"><h3>Q</h3><dl><dt>Qbasic, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a></dt><dt>qualified problem, <a class="indexterm" href="ch14.html#id404300">Free Support</a></dt></dl></div><div class="indexdiv"><h3>R</h3><dl><dt>RAID, <a class="indexterm" href="secure.html#id348190">Hardware Requirements</a></dt><dt>RAID controllers, <a class="indexterm" href="HA.html#id403932">Hardware Problems</a></dt><dt>Raw Print Through, <a class="indexterm" href="happy.html#id360506">Installation of Printer Driver Auto-Download</a></dt><dt>raw printing, <a class="indexterm" href="small.html#id345178">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id354601">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>Rbase, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a></dt><dt>rcldap, <a class="indexterm" href="2000users.html#id371556">Implementation</a></dt><dt>realm, <a class="indexterm" href="unixclients.html#id380589">IDMAP_RID with Winbind</a>, <a class="indexterm" href="unixclients.html#id381158">IDMAP Storage in LDAP using Winbind</a>, <a class="indexterm" href="DomApps.html#id400370">Kerberos Configuration</a></dt><dt>recognize, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>record locking, <a class="indexterm" href="appendix.html#id407872">Microsoft Access</a></dt><dt>recursively, <a class="indexterm" href="kerberos.html#id398933">Setting Posix ACLs in UNIX/Linux</a></dt><dt>Red Hat, <a class="indexterm" href="simple.html#id340728">Drafting Office</a>, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>Red Hat Fedora Linux, <a class="indexterm" href="DomApps.html#id400733">Samba Configuration</a></dt><dt>Red Hat Linux, <a class="indexterm" href="simple.html#id341464">Dissection and Discussion</a>, <a class="indexterm" href="simple.html#AccountingOffice">Accounting Office</a>, <a class="indexterm" href="happy.html#id361454">Samba Server Implementation</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="2000users.html#id371556">Implementation</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id400137">Implementation</a>, <a class="indexterm" href="DomApps.html#id400733">Samba Configuration</a></dt><dt>redirected folders, <a class="indexterm" href="happy.html#id360094">Roaming Profile Background</a>, <a class="indexterm" href="2000users.html#id370835">The Nature of Windows Networking Protocols</a></dt><dt>refereed standards, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>regedit, <a class="indexterm" href="simple.html#id341634">Implementation</a></dt><dt>regedt32, <a class="indexterm" href="happy.html#id360364">Profile Changes</a>, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>registry, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a></dt><dd><dl><dt>keys</dt><dd><dl><dt>SAM, <a class="indexterm" href="ntmigration.html#id386640">Dissection and Discussion</a></dt><dt>SECURITY, <a class="indexterm" href="ntmigration.html#id386640">Dissection and Discussion</a></dt></dl></dd></dl></dd><dt>registry change, <a class="indexterm" href="kerberos.html#id399251">Questions and Answers</a></dt><dt>Registry Editor, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>registry hacks, <a class="indexterm" href="kerberos.html#id399251">Questions and Answers</a></dt><dt>registry keys, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>reimburse, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a></dt><dt>rejected, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="kerberos.html#id397184">Share Access Controls</a></dt><dt>rejoin, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a></dt><dt>reliability, <a class="indexterm" href="HA.html">Performance, Reliability, and Availability</a></dt><dt>remote announce, <a class="indexterm" href="HA.html#id403161">Routed Networks</a></dt><dt>remote browse sync, <a class="indexterm" href="HA.html#id403161">Routed Networks</a></dt><dt>remote procedure call (see RPC)</dt><dt>replicate, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a>, <a class="indexterm" href="HA.html#id403891">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></dt><dt>replicated, <a class="indexterm" href="2000users.html#id370476">Dissection and Discussion</a></dt><dt>requesting payment, <a class="indexterm" href="ch14.html#id404300">Free Support</a></dt><dt>resilient, <a class="indexterm" href="HA.html#id402949">Guidelines for Reliable Samba Operation</a></dt><dt>resolution, <a class="indexterm" href="upgrades.html#id386001">Replacing a Domain Member Server</a></dt><dt>resolve, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a>, <a class="indexterm" href="HA.html#id402984">Bad Hostnames</a></dt><dt>response, <a class="indexterm" href="unixclients.html#id380589">IDMAP_RID with Winbind</a></dt><dt>responsibility, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a></dt><dt>responsible, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>restrict anonymous, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>restricted export, <a class="indexterm" href="kerberos.html#id396888">Kerberos Exposed</a></dt><dt>Restrictive security, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>reverse DNS, <a class="indexterm" href="DomApps.html#id400370">Kerberos Configuration</a></dt><dt>rfc2307bis, <a class="indexterm" href="unixclients.html#id381708">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a></dt><dt>RID, <a class="indexterm" href="unixclients.html#id380589">IDMAP_RID with Winbind</a>, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a></dt><dt>risk, <a class="indexterm" href="secure.html#id347966">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id394729">Introduction</a></dt><dt>road-map, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dd><dl><dt>published, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt></dl></dd><dt>roaming profile, <a class="indexterm" href="happy.html#id359614">Technical Issues</a>, <a class="indexterm" href="happy.html#id360094">Roaming Profile Background</a>, <a class="indexterm" href="happy.html#id367829">Configuring Profile Directories</a>, <a class="indexterm" href="2000users.html#id370759">User Needs</a>, <a class="indexterm" href="2000users.html#id374709">Questions and Answers</a></dt><dt>roaming profiles, <a class="indexterm" href="secure.html#id347966">Technical Issues</a>, <a class="indexterm" href="secure.html#id348344">Implementation</a>, <a class="indexterm" href="happy.html#id360094">Roaming Profile Background</a></dt><dt>routed network, <a class="indexterm" href="HA.html#id403710">Use and Location of BDCs</a></dt><dt>router, <a class="indexterm" href="small.html#id345178">Implementation</a></dt><dt>routers, <a class="indexterm" href="2000users.html#id374709">Questions and Answers</a>, <a class="indexterm" href="HA.html#id403161">Routed Networks</a></dt><dt>RPC, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="kerberos.html#id396888">Kerberos Exposed</a></dt><dt>rpc, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a></dt><dt>rpcclient, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a></dt><dt>RPM, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="nw4migration.html#id390913">Dissection and Discussion</a></dt><dd><dl><dt>install, <a class="indexterm" href="simple.html#id340832">Implementation</a></dt></dl></dd><dt>rpm, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a class="indexterm" href="appendix.html#id405157">Samba System File Location</a></dt><dt>RPMs, <a class="indexterm" href="DomApps.html#id400733">Samba Configuration</a></dt><dt>rpms, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>rsync, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a>, <a class="indexterm" href="HA.html#id403891">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></dt><dt>rsyncd.conf, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a></dt><dt>run-time control files, <a class="indexterm" href="appendix.html#id405157">Samba System File Location</a></dt></dl></div><div class="indexdiv"><h3>S</h3><dl><dt>safe-guards, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>SAM, <a class="indexterm" href="ntmigration.html#id386640">Dissection and Discussion</a></dt><dt>samba, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dd><dl><dt>starting samba, <a class="indexterm" href="simple.html#id340832">Implementation</a></dt></dl></dd><dt>Samba, <a class="indexterm" href="DomApps.html#id400733">Samba Configuration</a></dt><dt>Samba accounts, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a></dt><dt>samba cluster, <a class="indexterm" href="HA.html#id402421">Introduction</a></dt><dt>samba control script, <a class="indexterm" href="appendix.html#id405549">Starting Samba</a></dt><dt>Samba Domain, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a></dt><dt>Samba Domain server, <a class="indexterm" href="kerberos.html#id398494">Using the MMC Computer Management Interface</a></dt><dt>Samba RPM Packages, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></dt><dt>Samba Tea, <a class="indexterm" href="DomApps.html#id400733">Samba Configuration</a></dt><dt>sambaDomainName, <a class="indexterm" href="ntmigration.html#id387250">NT4 Migration Using LDAP Backend</a></dt><dt>sambaGroupMapping, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a></dt><dt>SambaSAMAccount, <a class="indexterm" href="happy.html#id358884">Regarding LDAP Directories and Windows Computer Accounts</a></dt><dt>SambaSamAccount, <a class="indexterm" href="happy.html#id364093">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>sambaSamAccount, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a></dt><dt>SambaXP conference, <a class="indexterm" href="DomApps.html#id401943">Questions and Answers</a></dt><dt>SAN, <a class="indexterm" href="HA.html#id403795">For Scalability, Use SAN-Based Storage on Samba Servers</a></dt><dt>SAS, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a></dt><dt>scalability, <a class="indexterm" href="HA.html#id402421">Introduction</a></dt><dt>scalable, <a class="indexterm" href="2000users.html#id371136">Identity Management Needs</a></dt><dt>schannel, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id399129">Key Points Learned</a>, <a class="indexterm" href="kerberos.html#id399251">Questions and Answers</a></dt><dt>schema, <a class="indexterm" href="unixclients.html#id381708">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id385597">Samba-2.x with LDAP Support</a>, <a class="indexterm" href="upgrades.html#id385836">Updating from Samba Versions between 3.0.6 and 3.0.10</a></dt><dt>scripts, <a class="indexterm" href="appendix.html#id406519">The LDAP Account Manager</a></dt><dt>secondary group, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>secret, <a class="indexterm" href="kerberos.html#id396888">Kerberos Exposed</a></dt><dt>secrets.tdb, <a class="indexterm" href="happy.html#id359614">Technical Issues</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#sbeug1">Location of config files</a></dt><dt>secure, <a class="indexterm" href="kerberos.html#id394729">Introduction</a></dt><dt>secure account password, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a></dt><dt>secure connections, <a class="indexterm" href="appendix.html#id406519">The LDAP Account Manager</a></dt><dt>secure networking, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>secure networking protocols, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>security, <a class="indexterm" href="happy.html#id359614">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a>, <a class="indexterm" href="kerberos.html#id394729">Introduction</a>, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id398076">Share Point Directory and File Permissions</a>, <a class="indexterm" href="kerberos.html#id399251">Questions and Answers</a></dt><dd><dl><dt>identifier, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a></dt><dt>share mode, <a class="indexterm" href="simple.html#id341464">Dissection and Discussion</a></dt><dt>user mode, <a class="indexterm" href="simple.html#id343378">Dissection and Discussion</a></dt></dl></dd><dt>Security, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id398494">Using the MMC Computer Management Interface</a></dt><dt>Security Account Manager (see SAM)</dt><dt>security controls, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>security descriptors, <a class="indexterm" href="ntmigration.html#id386640">Dissection and Discussion</a></dt><dt>security fixes, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>security updates, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>SerNet, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id400733">Samba Configuration</a></dt><dt>server</dt><dd><dl><dt>domain member, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a></dt><dt>stand-alone, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a></dt></dl></dd><dt>service, <a class="indexterm" href="2000users.html#id371556">Implementation</a></dt><dd><dl><dt>smb</dt><dd><dl><dt>start, <a class="indexterm" href="Big500users.html#ch5-domsvrspec">Configuration Specific to Domain Member Servers: BLDG1, BLDG2</a></dt></dl></dd></dl></dd><dt>Service Packs, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a></dt><dt>services, <a class="indexterm" href="DomApps.html#id401888">Key Points Learned</a></dt><dt>services provided, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>session setup, <a class="indexterm" href="primer.html#id409728">Simple Windows Client Connection Characteristics</a>, <a class="indexterm" href="primer.html#id410194">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>Session Setup, <a class="indexterm" href="primer.html#id409728">Simple Windows Client Connection Characteristics</a></dt><dt>SessionSetUpAndX, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a></dt><dt>set primary group script, <a class="indexterm" href="upgrades.html#id385275">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>setfacl, <a class="indexterm" href="kerberos.html#id398933">Setting Posix ACLs in UNIX/Linux</a></dt><dt>severely degrade, <a class="indexterm" href="HA.html#id403415">Samba Configuration</a></dt><dt>SFU, <a class="indexterm" href="unixclients.html#id381980">IDMAP, Active Directory, and MS Services for UNIX 3.5</a></dt><dt>SGID, <a class="indexterm" href="simple.html#id341464">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id398076">Share Point Directory and File Permissions</a>, <a class="indexterm" href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></dt><dt>shadow-utils, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a></dt><dt>Share Access Controls, <a class="indexterm" href="kerberos.html#id397184">Share Access Controls</a></dt><dt>share ACLs, <a class="indexterm" href="kerberos.html#id399251">Questions and Answers</a></dt><dt>share definition, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>Share Definition</dt><dd><dl><dt>Controls, <a class="indexterm" href="kerberos.html#id397519">Share Definition Controls</a></dt></dl></dd><dt>share definition controls, <a class="indexterm" href="kerberos.html#id397519">Share Definition Controls</a>, <a class="indexterm" href="kerberos.html#id397648">Checkpoint Controls</a>, <a class="indexterm" href="kerberos.html#id398076">Share Point Directory and File Permissions</a>, <a class="indexterm" href="kerberos.html#id399251">Questions and Answers</a></dt><dt>share level access controls, <a class="indexterm" href="kerberos.html#id399251">Questions and Answers</a></dt><dt>share level ACL, <a class="indexterm" href="kerberos.html#id399251">Questions and Answers</a></dt><dt>Share Permissions, <a class="indexterm" href="kerberos.html#id397184">Share Access Controls</a></dt><dt>shared resource, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id398933">Setting Posix ACLs in UNIX/Linux</a></dt><dt>shares, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>SID, <a class="indexterm" href="secure.html#ch4wincfg">Windows Client Configuration</a>, <a class="indexterm" href="happy.html#id358884">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="2000users.html#id371136">Identity Management Needs</a>, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id380589">IDMAP_RID with Winbind</a>, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id384544">Change of Workgroup (Domain) Name</a>, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a>, <a class="indexterm" href="appendix.html#id406053">Initialization of the LDAP Database</a></dt><dt>side effects, <a class="indexterm" href="kerberos.html#id398445">Managing Windows 200x ACLs</a></dt><dt>Sign'n'seal, <a class="indexterm" href="kerberos.html#id399129">Key Points Learned</a>, <a class="indexterm" href="kerberos.html#id399251">Questions and Answers</a></dt><dt>silent return, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>simple, <a class="indexterm" href="HA.html#id402498">Dissection and Discussion</a></dt><dt>Single Sign-On (see SSO)</dt><dt>slapcat, <a class="indexterm" href="happy.html#id364093">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a></dt><dt>slapd, <a class="indexterm" href="happy.html#id360837">Debugging LDAP</a></dt><dt>slapd.conf, <a class="indexterm" href="ntmigration.html#id387250">NT4 Migration Using LDAP Backend</a></dt><dt>slave, <a class="indexterm" href="2000users.html#id370476">Dissection and Discussion</a></dt><dt>slow logon, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>slow network, <a class="indexterm" href="HA.html#id403932">Hardware Problems</a></dt><dt>slurpd, <a class="indexterm" href="2000users.html#id371556">Implementation</a>, <a class="indexterm" href="2000users.html#id374709">Questions and Answers</a></dt><dt>smart printing, <a class="indexterm" href="happy.html#id359212">Dissection and Discussion</a></dt><dt>SMB, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a></dt><dt>SMB passwords, <a class="indexterm" href="2000users.html#id371556">Implementation</a></dt><dt>SMB/CIFS, <a class="indexterm" href="DomApps.html#id401943">Questions and Answers</a></dt><dt>smbclient, <a class="indexterm" href="simple.html#validate1">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="happy.html#id364093">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="DomApps.html#id401943">Questions and Answers</a></dt><dt>smbd, <a class="indexterm" href="simple.html#validate1">Validation</a>, <a class="indexterm" href="simple.html#id341634">Implementation</a>, <a class="indexterm" href="small.html#id346626">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#sbeug1">Location of config files</a>, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="upgrades.html#id386001">Replacing a Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id400733">Samba Configuration</a>, <a class="indexterm" href="DomApps.html#id401943">Questions and Answers</a>, <a class="indexterm" href="appendix.html#id405549">Starting Samba</a></dt><dd><dl><dt>location of files, <a class="indexterm" href="appendix.html#id405157">Samba System File Location</a></dt></dl></dd><dt>smbfs, <a class="indexterm" href="HA.html#id402498">Dissection and Discussion</a></dt><dt>smbldap-groupadd, <a class="indexterm" href="happy.html#id364093">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a></dt><dt>smbldap-groupmod, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a></dt><dt>smbldap-passwd, <a class="indexterm" href="happy.html#id364093">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>smbldap-populate, <a class="indexterm" href="happy.html#id364093">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>smbldap-tools, <a class="indexterm" href="ntmigration.html#id387250">NT4 Migration Using LDAP Backend</a>, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a>, <a class="indexterm" href="appendix.html#id406519">The LDAP Account Manager</a></dt><dt>smbldap-tools updating, <a class="indexterm" href="ntmigration.html#id387250">NT4 Migration Using LDAP Backend</a></dt><dt>smbldap-useradd, <a class="indexterm" href="happy.html#id364093">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="2000users.html#id371556">Implementation</a></dt><dt>smbldap-usermod, <a class="indexterm" href="happy.html#id364093">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a></dt><dt>smbmnt, <a class="indexterm" href="HA.html#id402498">Dissection and Discussion</a></dt><dt>smbmount, <a class="indexterm" href="HA.html#id402498">Dissection and Discussion</a></dt><dt>smbpasswd, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id344988">Technical Issues</a>, <a class="indexterm" href="small.html#id345178">Implementation</a>, <a class="indexterm" href="secure.html#id347966">Technical Issues</a>, <a class="indexterm" href="secure.html#id349099">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id354601">Server Preparation: All Servers</a>, <a class="indexterm" href="Big500users.html#id355127">Configuration for Server: MASSIVE</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="happy.html#id364093">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a class="indexterm" href="2000users.html#id370476">Dissection and Discussion</a>, <a class="indexterm" href="2000users.html#id371556">Implementation</a>, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a>, <a class="indexterm" href="upgrades.html">Updating Samba-3</a>, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id385275">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id386802">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a>, <a class="indexterm" href="DomApps.html">Integrating Additional Services</a></dt><dt>smbumnt, <a class="indexterm" href="HA.html#id402498">Dissection and Discussion</a></dt><dt>smbumount, <a class="indexterm" href="HA.html#id402498">Dissection and Discussion</a></dt><dt>SMTP, <a class="indexterm" href="nw4migration.html#id390984">Technical Issues</a></dt><dt>snap-shot, <a class="indexterm" href="ntmigration.html#id386640">Dissection and Discussion</a></dt><dt>socket address, <a class="indexterm" href="HA.html#id403415">Samba Configuration</a></dt><dt>socket options, <a class="indexterm" href="HA.html#id403415">Samba Configuration</a></dt><dt>software, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a></dt><dt>solve, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a></dt><dt>source code, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a></dt><dt>SPNEGO, <a class="indexterm" href="primer.html#id410194">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>SQL, <a class="indexterm" href="2000users.html#id370476">Dissection and Discussion</a>, <a class="indexterm" href="2000users.html#id374709">Questions and Answers</a></dt><dt>Squid, <a class="indexterm" href="DomApps.html#id400137">Implementation</a>, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a class="indexterm" href="DomApps.html#id400733">Samba Configuration</a>, <a class="indexterm" href="DomApps.html#id401512">Squid Configuration</a></dt><dt>squid, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a class="indexterm" href="DomApps.html#id400733">Samba Configuration</a></dt><dt>Squid proxy, <a class="indexterm" href="DomApps.html#id399977">Technical Issues</a></dt><dt>SRVTOOLS.EXE, <a class="indexterm" href="secure.html#id348344">Implementation</a>, <a class="indexterm" href="happy.html#id367829">Configuring Profile Directories</a>, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id399251">Questions and Answers</a></dt><dt>SSL, <a class="indexterm" href="appendix.html#id406519">The LDAP Account Manager</a></dt><dt>stand-alone server, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a></dt><dt>starting CUPS, <a class="indexterm" href="simple.html#id341634">Implementation</a>, <a class="indexterm" href="small.html#id345178">Implementation</a>, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a>, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dt>starting dhcpd, <a class="indexterm" href="small.html#id345178">Implementation</a>, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a>, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dt>starting samba, <a class="indexterm" href="simple.html#id340832">Implementation</a>, <a class="indexterm" href="simple.html#id341634">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id345178">Implementation</a>, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a>, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dd><dl><dt>nmbd, <a class="indexterm" href="appendix.html#id405549">Starting Samba</a></dt><dt>smbd, <a class="indexterm" href="appendix.html#id405549">Starting Samba</a></dt><dt>winbindd, <a class="indexterm" href="appendix.html#id405549">Starting Samba</a></dt></dl></dd><dt>startingCUPS, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a></dt><dt>startup script, <a class="indexterm" href="appendix.html#id405549">Starting Samba</a></dt><dt>sticky bit, <a class="indexterm" href="small.html#id345178">Implementation</a></dt><dt>storage capacity, <a class="indexterm" href="secure.html#id348190">Hardware Requirements</a></dt><dt>strategic, <a class="indexterm" href="ntmigration.html#id386802">Technical Issues</a></dt><dt>strategy, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a></dt><dt>straw-man, <a class="indexterm" href="kerberos.html">Active Directory, Kerberos, and Security</a></dt><dt>strict sync, <a class="indexterm" href="HA.html#id403415">Samba Configuration</a></dt><dt>stripped, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></dt><dt>strong cryptography, <a class="indexterm" href="kerberos.html#id396888">Kerberos Exposed</a></dt><dt>subscription, <a class="indexterm" href="ch14.html#id404300">Free Support</a></dt><dt>SUID, <a class="indexterm" href="simple.html#id341464">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id399251">Questions and Answers</a>, <a class="indexterm" href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></dt><dt>Sun ONE Identity Server, <a class="indexterm" href="happy.html#id359212">Dissection and Discussion</a></dt><dt>super daemon, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a></dt><dt>support, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a>, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>survey, <a class="indexterm" href="unixclients.html">Adding Domain Member Servers and Clients</a></dt><dt>SUSE, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>SUSE Enterprise Linux Server, <a class="indexterm" href="simple.html#id341373">Charity Administration Office</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="DomApps.html#id400137">Implementation</a></dt><dt>SUSE Linux, <a class="indexterm" href="simple.html#id341464">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#id361454">Samba Server Implementation</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="2000users.html#id371556">Implementation</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id400137">Implementation</a>, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>SWAT, <a class="indexterm" href="appendix.html#id405157">Samba System File Location</a></dt><dt>sync always, <a class="indexterm" href="HA.html#id403415">Samba Configuration</a></dt><dt>synchronization, <a class="indexterm" href="DomApps.html#id400370">Kerberos Configuration</a>, <a class="indexterm" href="HA.html#id403795">For Scalability, Use SAN-Based Storage on Samba Servers</a></dt><dt>synchronize, <a class="indexterm" href="2000users.html#id370759">User Needs</a>, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a></dt><dt>synchronized, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a></dt><dt>syslog, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>system level logins, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a></dt><dt>system security, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt></dl></div><div class="indexdiv"><h3>T</h3><dl><dt>tattooing, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a></dt><dt>TCP/IP, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a></dt><dt>tdbdump, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="ntmigration.html#id387250">NT4 Migration Using LDAP Backend</a></dt><dt>tdbsam, <a class="indexterm" href="secure.html#id347966">Technical Issues</a>, <a class="indexterm" href="secure.html#id348344">Implementation</a>, <a class="indexterm" href="Big500users.html">The 500-User Office</a>, <a class="indexterm" href="happy.html#id359084">Assignment Tasks</a>, <a class="indexterm" href="2000users.html#id370476">Dissection and Discussion</a>, <a class="indexterm" href="2000users.html#id371556">Implementation</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id385275">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="upgrades.html#id385836">Updating from Samba Versions between 3.0.6 and 3.0.10</a>, <a class="indexterm" href="ntmigration.html#id386802">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a></dt><dt>testparm, <a class="indexterm" href="small.html#id346626">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="HA.html#id403415">Samba Configuration</a></dt><dt>ticket, <a class="indexterm" href="DomApps.html#id400733">Samba Configuration</a></dt><dt>time server, <a class="indexterm" href="secure.html#id348344">Implementation</a></dt><dt>Tivoli Directory Server, <a class="indexterm" href="happy.html#id359212">Dissection and Discussion</a></dt><dt>TLS, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a></dt><dt>token, <a class="indexterm" href="DomApps.html#id399977">Technical Issues</a></dt><dt>tool, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a></dt><dt>TOSHARG2, <a class="indexterm" href="simple.html#id341634">Implementation</a></dt><dt>track record, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a></dt><dt>traffic collisions, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>transaction processing, <a class="indexterm" href="2000users.html#id370476">Dissection and Discussion</a></dt><dt>transactional, <a class="indexterm" href="2000users.html#id374709">Questions and Answers</a></dt><dt>transfer, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a></dt><dt>translate, <a class="indexterm" href="kerberos.html#id398445">Managing Windows 200x ACLs</a></dt><dt>traverse, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt><dt>tree, <a class="indexterm" href="nw4migration.html#id390913">Dissection and Discussion</a></dt><dt>Tree Connect, <a class="indexterm" href="primer.html#id409728">Simple Windows Client Connection Characteristics</a></dt><dt>trust account, <a class="indexterm" href="happy.html#id358884">Regarding LDAP Directories and Windows Computer Accounts</a></dt><dt>trusted computing, <a class="indexterm" href="kerberos.html#id394729">Introduction</a></dt><dt>Trusted Domains, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a></dt><dt>trusted domains, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a></dt><dt>trusted third-party, <a class="indexterm" href="kerberos.html#id396888">Kerberos Exposed</a></dt><dt>trusting, <a class="indexterm" href="kerberos.html#id396888">Kerberos Exposed</a></dt><dt>turn-around time, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt></dl></div><div class="indexdiv"><h3>U</h3><dl><dt>UDP</dt><dd><dl><dt>broadcast, <a class="indexterm" href="HA.html#id403161">Routed Networks</a></dt></dl></dd><dt>UID, <a class="indexterm" href="simple.html#id341464">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#id358884">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="happy.html#id359614">Technical Issues</a>, <a class="indexterm" href="2000users.html#id371556">Implementation</a>, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a></dt><dt>un-join, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a></dt><dt>unauthorized activities, <a class="indexterm" href="kerberos.html#id396888">Kerberos Exposed</a></dt><dt>UNC name, <a class="indexterm" href="2000users.html#id374709">Questions and Answers</a></dt><dt>unencrypted, <a class="indexterm" href="appendix.html#id406519">The LDAP Account Manager</a></dt><dt>Unicast, <a class="indexterm" href="2000users.html#id370835">The Nature of Windows Networking Protocols</a></dt><dt>unicode, <a class="indexterm" href="upgrades.html#id384787">International Language Support</a></dt><dt>Universal Naming Convention (see UNC name)</dt><dt>UNIX, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a></dt><dd><dl><dt>groups, <a class="indexterm" href="small.html#id344988">Technical Issues</a>, <a class="indexterm" href="small.html#id345178">Implementation</a></dt></dl></dd><dt>UNIX accounts, <a class="indexterm" href="happy.html#id359614">Technical Issues</a></dt><dt>UNIX/Linux server, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>unix2dos, <a class="indexterm" href="secure.html#id349099">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id355127">Configuration for Server: MASSIVE</a></dt><dt>unknown, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>unsupported software, <a class="indexterm" href="ch14.html#id404499">Commercial Support</a></dt><dt>update, <a class="indexterm" href="upgrades.html#id383639">Introduction</a>, <a class="indexterm" href="upgrades.html#id383722">Cautions and Notes</a></dt><dt>updates, <a class="indexterm" href="kerberos.html#id394729">Introduction</a>, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>updating smbldap-tools, <a class="indexterm" href="ntmigration.html#id387250">NT4 Migration Using LDAP Backend</a></dt><dt>upgrade, <a class="indexterm" href="upgrades.html#id383639">Introduction</a>, <a class="indexterm" href="upgrades.html#id383722">Cautions and Notes</a>, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a></dt><dt>uppercase, <a class="indexterm" href="ntmigration.html#id387125">Implementation</a></dt><dt>user</dt><dd><dl><dt>management, <a class="indexterm" href="small.html#id345178">Implementation</a>, <a class="indexterm" href="secure.html#id349099">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id355127">Configuration for Server: MASSIVE</a></dt></dl></dd><dt>user account, <a class="indexterm" href="happy.html">Making Happy Users</a>, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>User and Group Controls, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>user credentials, <a class="indexterm" href="2000users.html#id371136">Identity Management Needs</a>, <a class="indexterm" href="unixclients.html#id382025">UNIX/Linux Client Domain Member</a></dt><dt>user errors, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a></dt><dt>user groups, <a class="indexterm" href="ch14.html#id404300">Free Support</a></dt><dt>user identities, <a class="indexterm" href="unixclients.html#id376274">Implementation</a></dt><dt>user logins, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a></dt><dt>user management, <a class="indexterm" href="secure.html#id348344">Implementation</a></dt><dt>User Manager, <a class="indexterm" href="ntmigration.html#id387250">NT4 Migration Using LDAP Backend</a></dt><dt>User Mode, <a class="indexterm" href="secure.html#id348344">Implementation</a>, <a class="indexterm" href="primer.html#id409728">Simple Windows Client Connection Characteristics</a>, <a class="indexterm" href="primer.html#id410194">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>useradd, <a class="indexterm" href="simple.html#id341634">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id345178">Implementation</a>, <a class="indexterm" href="secure.html#id349099">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id355127">Configuration for Server: MASSIVE</a>, <a class="indexterm" href="upgrades.html#id385275">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>userdel, <a class="indexterm" href="upgrades.html#id385275">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>usermod, <a class="indexterm" href="upgrades.html#id385275">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id387250">NT4 Migration Using LDAP Backend</a></dt><dt>username, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a></dt><dt>username map, <a class="indexterm" href="small.html#id345178">Implementation</a>, <a class="indexterm" href="secure.html#id349099">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id354601">Server Preparation: All Servers</a></dt><dt>UTF-8, <a class="indexterm" href="upgrades.html#id384787">International Language Support</a></dt><dt>utilities, <a class="indexterm" href="DomApps.html#id401943">Questions and Answers</a></dt></dl></div><div class="indexdiv"><h3>V</h3><dl><dt>valid users, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id397648">Checkpoint Controls</a>, <a class="indexterm" href="kerberos.html#id399251">Questions and Answers</a></dt><dt>validate, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id397648">Checkpoint Controls</a></dt><dt>validated, <a class="indexterm" href="2000users.html#id371136">Identity Management Needs</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="kerberos.html#id394729">Introduction</a></dt><dt>validation, <a class="indexterm" href="simple.html#validate1">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="DomApps.html#id401943">Questions and Answers</a></dt><dt>vampire, <a class="indexterm" href="ntmigration.html#id389822">Questions and Answers</a></dt><dt>vendor, <a class="indexterm" href="kerberos.html#id395330">Dissection and Discussion</a></dt><dt>vendors, <a class="indexterm" href="upgrades.html#id385712">Updating a Samba-3 Installation</a></dt><dt>VFS modules, <a class="indexterm" href="appendix.html#id405157">Samba System File Location</a></dt><dt>virus, <a class="indexterm" href="secure.html#id348344">Implementation</a></dt><dt>VPN, <a class="indexterm" href="2000users.html#id370419">Assignment Tasks</a></dt><dt>vulnerabilities, <a class="indexterm" href="kerberos.html#id394729">Introduction</a></dt></dl></div><div class="indexdiv"><h3>W</h3><dl><dt>wbinfo, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id400733">Samba Configuration</a></dt><dt>weakness, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a></dt><dt>web</dt><dd><dl><dt>caching, <a class="indexterm" href="DomApps.html#id399862">Assignment Tasks</a></dt><dt>proxying, <a class="indexterm" href="DomApps.html#id399862">Assignment Tasks</a></dt></dl></dd><dt>Web</dt><dd><dl><dt>proxy, <a class="indexterm" href="DomApps.html#id401943">Questions and Answers</a></dt><dd><dl><dt>access, <a class="indexterm" href="DomApps.html#id401888">Key Points Learned</a></dt></dl></dd></dl></dd><dt>Web browsers, <a class="indexterm" href="DomApps.html#id401888">Key Points Learned</a></dt><dt>WebClient, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>WHATSNEW.txt, <a class="indexterm" href="upgrades.html#id385597">Samba-2.x with LDAP Support</a></dt><dt>white-pages, <a class="indexterm" href="nw4migration.html#id390984">Technical Issues</a>, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a></dt><dt>wide-area, <a class="indexterm" href="2000users.html#id370759">User Needs</a>, <a class="indexterm" href="2000users.html#id371136">Identity Management Needs</a>, <a class="indexterm" href="2000users.html#id374570">Key Points Learned</a>, <a class="indexterm" href="2000users.html#id374709">Questions and Answers</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt><dt>wide-area network, <a class="indexterm" href="HA.html#id403710">Use and Location of BDCs</a>, <a class="indexterm" href="HA.html#id403891">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></dt><dt>winbind, <a class="indexterm" href="2000users.html#id371556">Implementation</a>, <a class="indexterm" href="unixclients.html#id375566">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id394729">Introduction</a>, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id399977">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id400733">Samba Configuration</a>, <a class="indexterm" href="DomApps.html#id401255">NSS Configuration</a></dt><dt>Winbind, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id395699">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id399129">Key Points Learned</a></dt><dt>winbind trusted domains only, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a></dt><dt>winbind use default domain, <a class="indexterm" href="kerberos.html#id397648">Checkpoint Controls</a></dt><dt>winbindd, <a class="indexterm" href="small.html#id346626">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="Big500users.html#id353690">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="upgrades.html#id385909">Updating from Samba Versions after 3.0.6 to a Current Release</a>, <a class="indexterm" href="upgrades.html#id386001">Replacing a Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id400733">Samba Configuration</a>, <a class="indexterm" href="DomApps.html#id401943">Questions and Answers</a>, <a class="indexterm" href="appendix.html#id405549">Starting Samba</a></dt><dt>winbindd_cache.tdb, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a></dt><dt>winbindd_idmap.tdb, <a class="indexterm" href="unixclients.html#id375589">Technical Issues</a></dt><dt>Windows, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a></dt><dd><dl><dt>client, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a></dt><dt>NT, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a></dt></dl></dd><dt>Windows 2000 ACLs, <a class="indexterm" href="kerberos.html#id398445">Managing Windows 200x ACLs</a></dt><dt>Windows 2003 Serve, <a class="indexterm" href="kerberos.html#id394729">Introduction</a></dt><dt>Windows 200x ACLs, <a class="indexterm" href="kerberos.html#id399251">Questions and Answers</a></dt><dt>Windows accounts, <a class="indexterm" href="happy.html#id359614">Technical Issues</a></dt><dt>Windows ACLs, <a class="indexterm" href="kerberos.html#id398933">Setting Posix ACLs in UNIX/Linux</a></dt><dt>Windows Address Book, <a class="indexterm" href="nw4migration.html#id391232">LDAP Server Configuration</a></dt><dt>Windows ADS Domain, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt><dt>Windows clients, <a class="indexterm" href="DomApps.html#id401943">Questions and Answers</a></dt><dt>Windows Explorer, <a class="indexterm" href="simple.html#validate1">Validation</a></dt><dt>Windows explorer, <a class="indexterm" href="DomApps.html#id401943">Questions and Answers</a></dt><dt>Windows security identifier (see SID)</dt><dt>Windows Servers, <a class="indexterm" href="kerberos.html#id394729">Introduction</a></dt><dt>Windows Services for UNIX (see SUS)</dt><dt>Windows XP, <a class="indexterm" href="small.html#id344898">Assignment Tasks</a></dt><dt>WINS, <a class="indexterm" href="simple.html#id341634">Implementation</a>, <a class="indexterm" href="small.html#id344988">Technical Issues</a>, <a class="indexterm" href="small.html#id345178">Implementation</a>, <a class="indexterm" href="secure.html#ch4wincfg">Windows Client Configuration</a>, <a class="indexterm" href="Big500users.html#id353690">Technical Issues</a>, <a class="indexterm" href="Big500users.html#ch5wincfg">Windows Client Configuration</a>, <a class="indexterm" href="2000users.html#id370835">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="2000users.html#id371136">Identity Management Needs</a>, <a class="indexterm" href="2000users.html#id374709">Questions and Answers</a>, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dd><dl><dt>lookup, <a class="indexterm" href="unixclients.html#id382565">Questions and Answers</a></dt><dt>name resolution, <a class="indexterm" href="HA.html#id403161">Routed Networks</a></dt><dt>server, <a class="indexterm" href="happy.html">Making Happy Users</a>, <a class="indexterm" href="HA.html#id403161">Routed Networks</a></dt></dl></dd><dt>WINS server, <a class="indexterm" href="Big500users.html">The 500-User Office</a>, <a class="indexterm" href="2000users.html#id374709">Questions and Answers</a></dt><dt>WINS serving, <a class="indexterm" href="secure.html#id348344">Implementation</a></dt><dt>wins support, <a class="indexterm" href="secure.html#id348344">Implementation</a></dt><dt>wins.dat, <a class="indexterm" href="2000users.html#id371136">Identity Management Needs</a>, <a class="indexterm" href="upgrades.html#id386001">Replacing a Domain Member Server</a></dt><dt>Wireshark, <a class="indexterm" href="primer.html#id408228">Requirements and Notes</a></dt><dt>wireshark, <a class="indexterm" href="primer.html#id408521">Exercises</a></dt><dt>Word, <a class="indexterm" href="kerberos.html#id398076">Share Point Directory and File Permissions</a></dt><dt>workgroup, <a class="indexterm" href="simple.html#id340832">Implementation</a>, <a class="indexterm" href="upgrades.html#id383812">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id384544">Change of Workgroup (Domain) Name</a></dt><dt>Workgroup Announcement, <a class="indexterm" href="primer.html#id409382">Findings</a></dt><dt>workstation, <a class="indexterm" href="unixclients.html#id376274">Implementation</a></dt><dt>wrapper, <a class="indexterm" href="DomApps.html#id401943">Questions and Answers</a></dt><dt>write lock, <a class="indexterm" href="appendix.html#id408086">Opportunistic Locking Controls</a></dt></dl></div><div class="indexdiv"><h3>X</h3><dl><dt>xinetd, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a></dt><dt>XML, <a class="indexterm" href="2000users.html#id370476">Dissection and Discussion</a></dt><dt>xmlsam, <a class="indexterm" href="2000users.html#id371556">Implementation</a></dt></dl></div><div class="indexdiv"><h3>Y</h3><dl><dt>YaST, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dt>Yellow Pages, <a class="indexterm" href="2000users.html#id371136">Identity Management Needs</a></dt><dt>yellow pages (see NIS)</dt></dl></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="go01.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> </td></tr><tr><td width="40%" align="left" valign="top">Glossary </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> </td></tr></table></div></body></html> -
branches/samba-3.0/docs/htmldocs/Samba3-ByExample/kerberos.html
r44 r134 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 11. Active Directory, Kerberos, and Security</title><link rel="stylesheet" href=" samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="RefSection.html" title="Part III. Reference Section"><link rel="next" href="DomApps.html" title="Chapter 12. Integrating Additional Services"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 11. Active Directory, Kerberos, and Security</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="RefSection.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="DomApps.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="kerberos"></a>Chapter 11. Active Directory, Kerberos, and Security</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="kerberos.html#id372607">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id373189">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id373203">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id373574">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#ch10expl">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id375060">Share Access Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id375395">Share Definition Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id375952">Share Point Directory and File Permissions</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id376321">Managing Windows 200x ACLs</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id377005">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id377127">Questions and Answers</a></span></dt></dl></div><p><a class="indexterm" name="id372556"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 11. Active Directory, Kerberos, and Security</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="RefSection.html" title="Part III. Reference Section"><link rel="next" href="DomApps.html" title="Chapter 12. Integrating Additional Services"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 11. Active Directory, Kerberos, and Security</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="RefSection.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="DomApps.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="kerberos"></a>Chapter 11. Active Directory, Kerberos, and Security</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="kerberos.html#id394729">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id395316">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id395330">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id395699">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#ch10expl">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id397184">Share Access Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id397519">Share Definition Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id398076">Share Point Directory and File Permissions</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id398445">Managing Windows 200x ACLs</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id399129">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id399251">Questions and Answers</a></span></dt></dl></div><p><a class="indexterm" name="id394678"></a> 2 2 By this point in the book, you have been exposed to many Samba-3 features and capabilities. 3 3 More importantly, if you have implemented the examples given, you are well on your way to becoming … … 5 5 practice, you likely have thought of improvements and scenarios with which you can experiment. You 6 6 are rather well plugged in to the many flexible ways Samba can be used. 7 </p><p><a class="indexterm" name="id3 72570"></a>7 </p><p><a class="indexterm" name="id394693"></a> 8 8 This is a book about Samba-3. Understandably, its intent is to present it in a positive light. 9 9 The casual observer might conclude that this book is one-eyed about Samba. It is what … … 14 14 decision. Criticism can be expected from the outside. Let's see how the interesting dynamic of 15 15 criticism develops with respect to Abmas. 16 </p><p><a class="indexterm" name="id3 72594"></a>16 </p><p><a class="indexterm" name="id394716"></a> 17 17 This chapter provides a shameless self-promotion of Samba-3. The objections raised were not pulled 18 18 out of thin air. They were drawn from comments made by Samba users and from criticism during … … 20 20 as possible that of the original. The case presented is a straw-man example that is designed to 21 21 permit each objection to be answered as it might occur in real life. 22 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 72607"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id372613"></a><a class="indexterm" name="id372621"></a><a class="indexterm" name="id372629"></a><a class="indexterm" name="id372637"></a><a class="indexterm" name="id372645"></a>22 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id394729"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id394736"></a><a class="indexterm" name="id394744"></a><a class="indexterm" name="id394752"></a><a class="indexterm" name="id394759"></a><a class="indexterm" name="id394767"></a> 23 23 Abmas is continuing its meteoric growth with yet further acquisitions. The investment community took 24 24 note of the spectacular projection of Abmas onto the global business stage. Abmas is building an … … 29 29 During the time that the acquisition was closing, the Video Rentals business upgraded its Windows 30 30 NT4-based network to Windows 2003 Server and Active Directory. 31 </p><p><a class="indexterm" name="id3 72662"></a>31 </p><p><a class="indexterm" name="id394785"></a> 32 32 You have accepted the fact that Abmas Video Rentals will use Microsoft Active Directory. 33 33 The IT team, led by Stan Soroka, is committed to Samba-3 and to maintaining a uniform technology platform. … … 36 36 technologies.</span>” This comment was made by one of Christine's staff as they were installing a new 37 37 Samba-3 server at the new business. 38 </p><p><a class="indexterm" name="id3 72681"></a><a class="indexterm" name="id372689"></a>38 </p><p><a class="indexterm" name="id394804"></a><a class="indexterm" name="id394812"></a> 39 39 Abmas Video Rentals' head of IT heard of this criticism. He was offended that a junior engineer 40 40 should make such a comment. He felt that he had to prepare in case he might be criticized for his 41 41 decision to use Active Directory. He decided he would defend his decision by hiring the services 42 of an outside security systems consultant to report<sup>[<a name="id3 72701" href="#ftn.id372701">12</a>]</sup> on his unit's operations42 of an outside security systems consultant to report<sup>[<a name="id394824" href="#ftn.id394824" class="footnote">12</a>]</sup> on his unit's operations 43 43 and to investigate the role of Samba at his site. Here are key extracts from this hypothetical 44 44 report: 45 </p><div class="blockquote"><blockquote class="blockquote"><p><a class="indexterm" name="id3 72710"></a><a class="indexterm" name="id372718"></a><a class="indexterm" name="id372726"></a><a class="indexterm" name="id372733"></a>45 </p><div class="blockquote"><blockquote class="blockquote"><p><a class="indexterm" name="id394832"></a><a class="indexterm" name="id394840"></a><a class="indexterm" name="id394848"></a><a class="indexterm" name="id394856"></a> 46 46 ... the implementation of Microsoft Active Directory at the Abmas Video Rentals, Bamingsham site, 47 47 has been examined. We find no evidence to support a notion that vulnerabilities exist at your site. … … 50 50 </p><p> 51 51 ... 52 </p><p><a class="indexterm" name="id3 72751"></a><a class="indexterm" name="id372763"></a><a class="indexterm" name="id372774"></a><a class="indexterm" name="id372782"></a><a class="indexterm" name="id372790"></a><a class="indexterm" name="id372798"></a>52 </p><p><a class="indexterm" name="id394874"></a><a class="indexterm" name="id394885"></a><a class="indexterm" name="id394896"></a><a class="indexterm" name="id394904"></a><a class="indexterm" name="id394912"></a><a class="indexterm" name="id394920"></a> 53 53 User and group accounts, and respective privileges, have been well thought out. File system shares are 54 54 appropriately secured. Backup and disaster recovery plans are well managed and validated regularly, and 55 55 effective off-site storage practices are considered to exceed industry norms. 56 </p><p><a class="indexterm" name="id3 72811"></a><a class="indexterm" name="id372819"></a><a class="indexterm" name="id372827"></a>56 </p><p><a class="indexterm" name="id394934"></a><a class="indexterm" name="id394942"></a><a class="indexterm" name="id394949"></a> 57 57 Your staff are justifiably concerned that the use of Samba may compromise their good efforts to maintain 58 58 a secure network. 59 </p><p><a class="indexterm" name="id3 72843"></a><a class="indexterm" name="id372850"></a><a class="indexterm" name="id372858"></a><a class="indexterm" name="id372866"></a>59 </p><p><a class="indexterm" name="id394965"></a><a class="indexterm" name="id394973"></a><a class="indexterm" name="id394981"></a><a class="indexterm" name="id394989"></a> 60 60 The recently installed Linux file and application server uses a tool called <code class="literal">winbind</code> 61 61 that is indiscriminate about security. All user accounts in Active Directory can be used to access data … … 64 64 to great lengths to set fine-grained controls that limit information access to those who need access. 65 65 It seems incongruous to us that Samba winbind should be permitted to be used considering that it voids this fine work. 66 </p><p><a class="indexterm" name="id3 72892"></a><a class="indexterm" name="id372900"></a><a class="indexterm" name="id372908"></a>66 </p><p><a class="indexterm" name="id395019"></a><a class="indexterm" name="id395027"></a><a class="indexterm" name="id395035"></a> 67 67 Graham Judd [head of network administration] has locked down the security of all systems and is following 68 68 the latest Microsoft guidelines. ... null session connections have been disabled ... the internal network … … 73 73 </p><p> 74 74 ... 75 </p><p><a class="indexterm" name="id3 72927"></a><a class="indexterm" name="id372935"></a><a class="indexterm" name="id372943"></a><a class="indexterm" name="id372951"></a>75 </p><p><a class="indexterm" name="id395054"></a><a class="indexterm" name="id395062"></a><a class="indexterm" name="id395070"></a><a class="indexterm" name="id395078"></a> 76 76 Regarding the use of Samba, we offer the following comments: Samba is in use in nearly half of 77 77 all sites we have surveyed. ... It is our opinion that Samba offers no better security than Microsoft … … 81 81 Samba is not at the full capabilities of Microsoft Windows NT4 server. Microsoft has moved well beyond that 82 82 with trusted computing initiatives that the Samba developers do not participate in. 83 </p><p><a class="indexterm" name="id3 72968"></a><a class="indexterm" name="id372976"></a><a class="indexterm" name="id372984"></a><a class="indexterm" name="id372992"></a><a class="indexterm" name="id373000"></a><a class="indexterm" name="id373007"></a><a class="indexterm" name="id373015"></a>83 </p><p><a class="indexterm" name="id395095"></a><a class="indexterm" name="id395103"></a><a class="indexterm" name="id395111"></a><a class="indexterm" name="id395119"></a><a class="indexterm" name="id395127"></a><a class="indexterm" name="id395134"></a><a class="indexterm" name="id395142"></a> 84 84 One wonders about the integrity of an open source program that is developed by a team of hackers 85 85 who cannot be held accountable for the flaws in their code. The sheer number of updates and bug 86 86 fixes they have released should ring alarm bells in any business. 87 </p><p><a class="indexterm" name="id3 73029"></a><a class="indexterm" name="id373037"></a><a class="indexterm" name="id373044"></a>87 </p><p><a class="indexterm" name="id395156"></a><a class="indexterm" name="id395164"></a><a class="indexterm" name="id395172"></a> 88 88 Another factor that should be considered is that buying Microsoft products and services helps to 89 89 provide employment in the IT industry. Samba and Open Source software place those jobs at risk. 90 </p></blockquote></div><p><a class="indexterm" name="id3 73057"></a><a class="indexterm" name="id373065"></a>90 </p></blockquote></div><p><a class="indexterm" name="id395184"></a><a class="indexterm" name="id395192"></a> 91 91 This is also a challenge to rise above the trouble spot. You call Stan's team together for a simple 92 92 discussion, but it gets further out of hand. When you return to your office, you find the following … … 101 101 across all systems. I concur with the desire to improve security. One of the new guys who is championing 102 102 the move to Kerberos was responsible for the comment that caused the embarrassment. 103 </p><p><a class="indexterm" name="id3 73096"></a><a class="indexterm" name="id373104"></a><a class="indexterm" name="id373111"></a><a class="indexterm" name="id373119"></a>103 </p><p><a class="indexterm" name="id395223"></a><a class="indexterm" name="id395231"></a><a class="indexterm" name="id395238"></a><a class="indexterm" name="id395246"></a> 104 104 I am experiencing difficulty in handling the sharp push for Kerberos. He claims that Kerberos, OpenLDAP, 105 105 plus Samba-3 will seamlessly replace Microsoft Active Directory. I am a little out of my depth with respect 106 106 to the feasibility of such a move, but have taken steps to pull both of them into line. With your consent, 107 107 I would like to hire the services of a well-known Samba consultant to set the record straight. 108 </p><p><a class="indexterm" name="id3 73134"></a><a class="indexterm" name="id373142"></a><a class="indexterm" name="id373150"></a><a class="indexterm" name="id373158"></a><a class="indexterm" name="id373166"></a><a class="indexterm" name="id373173"></a>108 </p><p><a class="indexterm" name="id395261"></a><a class="indexterm" name="id395269"></a><a class="indexterm" name="id395277"></a><a class="indexterm" name="id395285"></a><a class="indexterm" name="id395293"></a><a class="indexterm" name="id395300"></a> 109 109 I intend to use this report to answer the criticism raised and would like to establish a policy that we 110 110 will approve the use of Microsoft Windows Servers (and Active Directory) subject to all costs being covered … … 113 113 use of any centrally proposed standards, but make all noncompliance the financial responsibility of the 114 114 out-of-step division. Hopefully, this will encourage all divisions to walk with us and not alone. 115 </p></td><td width="10%" valign="top"> </td></tr><tr><td width="10%" valign="top"> </td><td colspan="2" align="right" valign="top">--<span class="attribution">Stan</span></td></tr></table></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 73189"></a>Assignment Tasks</h3></div></div></div><p>115 </p></td><td width="10%" valign="top"> </td></tr><tr><td width="10%" valign="top"> </td><td colspan="2" align="right" valign="top">--<span class="attribution">Stan</span></td></tr></table></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id395316"></a>Assignment Tasks</h3></div></div></div><p> 116 116 You agreed with Stan's recommendations and hired a consultant to help defuse the powder 117 117 keg. The consultant's task is to provide a tractable answer to each of the issues raised. The consultant must be able 118 118 to support his or her claims, keep emotions to the side, and answer technically. 119 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 73203"></a>Dissection and Discussion</h2></div></div></div><p><a class="indexterm" name="id373209"></a><a class="indexterm" name="id373217"></a><a class="indexterm" name="id373225"></a><a class="indexterm" name="id373233"></a><a class="indexterm" name="id373241"></a><a class="indexterm" name="id373249"></a><a class="indexterm" name="id373257"></a>119 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id395330"></a>Dissection and Discussion</h2></div></div></div><p><a class="indexterm" name="id395336"></a><a class="indexterm" name="id395344"></a><a class="indexterm" name="id395352"></a><a class="indexterm" name="id395360"></a><a class="indexterm" name="id395368"></a><a class="indexterm" name="id395376"></a><a class="indexterm" name="id395384"></a> 120 120 Samba-3 is a tool. No one is pounding your door to make you use Samba. That is a choice that you are free to 121 121 make or reject. It is likely that your decision to use Samba can greatly benefit your company. … … 125 125 money saved by not spending in the IT area can be spent elsewhere in the business. All money saved 126 126 or spent creates employment. 127 </p><p><a class="indexterm" name="id3 73273"></a><a class="indexterm" name="id373281"></a><a class="indexterm" name="id373289"></a><a class="indexterm" name="id373297"></a><a class="indexterm" name="id373305"></a>127 </p><p><a class="indexterm" name="id395400"></a><a class="indexterm" name="id395408"></a><a class="indexterm" name="id395416"></a><a class="indexterm" name="id395424"></a><a class="indexterm" name="id395432"></a> 128 128 In the long term, the use of Samba must be economically sustainable. In some situations, Samba is adopted 129 129 purely to provide file and print service interoperability on platforms that otherwise cannot provide … … 131 131 effect a reduction in the cost of providing IT services. Obviously, it is also used by some as an 132 132 alternative to the use of a Microsoft file and print serving platforms with no consideration of costs. 133 </p><p><a class="indexterm" name="id3 73320"></a><a class="indexterm" name="id373328"></a><a class="indexterm" name="id373336"></a><a class="indexterm" name="id373343"></a>133 </p><p><a class="indexterm" name="id395447"></a><a class="indexterm" name="id395455"></a><a class="indexterm" name="id395463"></a><a class="indexterm" name="id395470"></a> 134 134 It would be foolish to adopt a technology that might put any data or users at risk. Security affects 135 135 everyone. The Samba-Team is fully cognizant of the responsibility they have to their users. 136 136 The Samba documentation clearly reveals that full responsibility is accepted to fix anything 137 137 that is broken. 138 </p><p><a class="indexterm" name="id3 73357"></a><a class="indexterm" name="id373365"></a><a class="indexterm" name="id373373"></a><a class="indexterm" name="id373381"></a><a class="indexterm" name="id373392"></a><a class="indexterm" name="id373400"></a><a class="indexterm" name="id373408"></a><a class="indexterm" name="id373416"></a><a class="indexterm" name="id373424"></a><a class="indexterm" name="id373432"></a><a class="indexterm" name="id373439"></a>138 </p><p><a class="indexterm" name="id395484"></a><a class="indexterm" name="id395492"></a><a class="indexterm" name="id395500"></a><a class="indexterm" name="id395508"></a><a class="indexterm" name="id395519"></a><a class="indexterm" name="id395527"></a><a class="indexterm" name="id395535"></a><a class="indexterm" name="id395543"></a><a class="indexterm" name="id395551"></a><a class="indexterm" name="id395559"></a><a class="indexterm" name="id395566"></a> 139 139 There is a mistaken perception in the IT industry that commercial software providers are fully 140 140 accountable for the defects in products. Open Source software comes with no warranty, so it is … … 144 144 commercial software vendors are willingly accountable for product defects. In many cases, the 145 145 commercial vendor accepts liability only to reimburse the price paid for the software. 146 </p><p><a class="indexterm" name="id3 73462"></a><a class="indexterm" name="id373470"></a><a class="indexterm" name="id373477"></a><a class="indexterm" name="id373485"></a><a class="indexterm" name="id373493"></a><a class="indexterm" name="id373501"></a>146 </p><p><a class="indexterm" name="id395583"></a><a class="indexterm" name="id395591"></a><a class="indexterm" name="id395599"></a><a class="indexterm" name="id395607"></a><a class="indexterm" name="id395615"></a><a class="indexterm" name="id395623"></a> 147 147 The real issues that a consumer (like you) needs answered are What is the way of escape from technical 148 148 problems, and how long will it take? The average problem turnaround time in the Open Source community is 149 149 approximately 48 hours. What does the EULA offer? What is the track record in the commercial software 150 150 industry? What happens when your commercial vendor decides to cease providing support? 151 </p><p><a class="indexterm" name="id3 73516"></a><a class="indexterm" name="id373523"></a><a class="indexterm" name="id373531"></a><a class="indexterm" name="id373539"></a><a class="indexterm" name="id373547"></a><a class="indexterm" name="id373555"></a><a class="indexterm" name="id373562"></a>151 </p><p><a class="indexterm" name="id395641"></a><a class="indexterm" name="id395648"></a><a class="indexterm" name="id395656"></a><a class="indexterm" name="id395664"></a><a class="indexterm" name="id395672"></a><a class="indexterm" name="id395680"></a><a class="indexterm" name="id395688"></a> 152 152 Open Source software at least puts you in possession of the source code. This means that when 153 153 all else fails, you can hire a programmer to solve the problem. 154 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 73574"></a>Technical Issues</h3></div></div></div><p>154 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id395699"></a>Technical Issues</h3></div></div></div><p> 155 155 Each issue is now discussed and, where appropriate, example implementation steps are 156 156 provided. 157 </p><div class="variablelist"><dl><dt><span class="term">Winbind and Security</span></dt><dd><p><a class="indexterm" name="id3 73594"></a><a class="indexterm" name="id373601"></a><a class="indexterm" name="id373609"></a><a class="indexterm" name="id373621"></a><a class="indexterm" name="id373628"></a><a class="indexterm" name="id373636"></a><a class="indexterm" name="id373644"></a><a class="indexterm" name="id373652"></a><a class="indexterm" name="id373660"></a><a class="indexterm" name="id373668"></a>157 </p><div class="variablelist"><dl><dt><span class="term">Winbind and Security</span></dt><dd><p><a class="indexterm" name="id395719"></a><a class="indexterm" name="id395726"></a><a class="indexterm" name="id395734"></a><a class="indexterm" name="id395746"></a><a class="indexterm" name="id395754"></a><a class="indexterm" name="id395761"></a><a class="indexterm" name="id395769"></a><a class="indexterm" name="id395777"></a><a class="indexterm" name="id395785"></a><a class="indexterm" name="id395793"></a> 158 158 Windows network administrators may be dismayed to find that <code class="literal">winbind</code> 159 159 exposes all domain users so that they may use their domain account credentials to … … 161 161 UNIX/Linux server in their Network Neighborhood and can browse the shares on the 162 162 server seems to excite them further. 163 </p><p><a class="indexterm" name="id3 73688"></a><a class="indexterm" name="id373696"></a><a class="indexterm" name="id373704"></a><a class="indexterm" name="id373712"></a>163 </p><p><a class="indexterm" name="id395813"></a><a class="indexterm" name="id395821"></a><a class="indexterm" name="id395829"></a><a class="indexterm" name="id395837"></a> 164 164 <code class="literal">winbind</code> provides for the UNIX/Linux domain member server or 165 165 client, the same as one would obtain by adding a Microsoft Windows server or … … 167 167 and therefore requires handling a little differently from the familiar Windows systems. 168 168 One must recognize fear of the unknown. 169 </p><p><a class="indexterm" name="id3 73734"></a><a class="indexterm" name="id373742"></a><a class="indexterm" name="id373750"></a><a class="indexterm" name="id373758"></a><a class="indexterm" name="id373766"></a><a class="indexterm" name="id373777"></a>169 </p><p><a class="indexterm" name="id395857"></a><a class="indexterm" name="id395864"></a><a class="indexterm" name="id395872"></a><a class="indexterm" name="id395880"></a><a class="indexterm" name="id395888"></a><a class="indexterm" name="id395899"></a> 170 170 Windows network administrators need to recognize that <code class="literal">winbind</code> does 171 171 not, and cannot, override account controls set using the Active Directory management 172 172 tools. The control is the same. Have no fear. 173 </p><p><a class="indexterm" name="id3 73796"></a><a class="indexterm" name="id373804"></a><a class="indexterm" name="id373815"></a><a class="indexterm" name="id373823"></a><a class="indexterm" name="id373831"></a><a class="indexterm" name="id373839"></a><a class="indexterm" name="id373847"></a><a class="indexterm" name="id373855"></a><a class="indexterm" name="id373862"></a><a class="indexterm" name="id373870"></a>173 </p><p><a class="indexterm" name="id395918"></a><a class="indexterm" name="id395926"></a><a class="indexterm" name="id395937"></a><a class="indexterm" name="id395945"></a><a class="indexterm" name="id395953"></a><a class="indexterm" name="id395961"></a><a class="indexterm" name="id395969"></a><a class="indexterm" name="id395977"></a><a class="indexterm" name="id395985"></a><a class="indexterm" name="id395992"></a> 174 174 Where Samba and the ADS domain account information obtained through the use of 175 175 <code class="literal">winbind</code> permits access, by browsing or by the drive mapping to … … 178 178 on: 179 179 </p><div class="itemizedlist"><ul type="disc"><li><p>Shares themselves (i.e., the logical share itself)</p></li><li><p>The share definition in <code class="filename">smb.conf</code></p></li><li><p>The shared directories and files using UNIX permissions</p></li><li><p>Using Windows 2000 ACLs if the file system is POSIX enabled</p></li></ul></div><p> 180 Examples of each are given in <a href="kerberos.html#ch10expl" title="Implementation">???</a>.181 </p></dd><dt><span class="term">User and Group Controls</span></dt><dd><p><a class="indexterm" name="id3 73940"></a><a class="indexterm" name="id373947"></a><a class="indexterm" name="id373959"></a><a class="indexterm" name="id373970"></a><a class="indexterm" name="id373978"></a><a class="indexterm" name="id373986"></a><a class="indexterm" name="id373993"></a><a class="indexterm" name="id374001"></a><a class="indexterm" name="id374009"></a>180 Examples of each are given in <a class="link" href="kerberos.html#ch10expl" title="Implementation">“Implementation”</a>. 181 </p></dd><dt><span class="term">User and Group Controls</span></dt><dd><p><a class="indexterm" name="id396062"></a><a class="indexterm" name="id396070"></a><a class="indexterm" name="id396081"></a><a class="indexterm" name="id396092"></a><a class="indexterm" name="id396100"></a><a class="indexterm" name="id396108"></a><a class="indexterm" name="id396116"></a><a class="indexterm" name="id396123"></a><a class="indexterm" name="id396131"></a> 182 182 User and group management facilities as known in the Windows ADS environment may be 183 183 used to provide equivalent access control constraints or to provide equivalent … … 186 186 Windows 200x/XP. For example, access controls on a Samba server may be set within 187 187 the share definition in a manner for which Windows has no equivalent. 188 </p><p><a class="indexterm" name="id3 74029"></a><a class="indexterm" name="id374037"></a><a class="indexterm" name="id374045"></a><a class="indexterm" name="id374053"></a><a class="indexterm" name="id374064"></a><a class="indexterm" name="id374072"></a><a class="indexterm" name="id374080"></a>188 </p><p><a class="indexterm" name="id396147"></a><a class="indexterm" name="id396155"></a><a class="indexterm" name="id396162"></a><a class="indexterm" name="id396170"></a><a class="indexterm" name="id396182"></a><a class="indexterm" name="id396190"></a><a class="indexterm" name="id396197"></a> 189 189 In any serious analysis of system security, it is important to examine the safeguards 190 190 that remain when all other protective measures fail. An administrator may inadvertently … … 194 194 possible to guard against that by enforcing controls on the share definition itself. You 195 195 see a practical example of this a little later in this chapter. 196 </p><p><a class="indexterm" name="id3 74096"></a><a class="indexterm" name="id374104"></a>196 </p><p><a class="indexterm" name="id396214"></a><a class="indexterm" name="id396222"></a> 197 197 The report that is critical of Samba really ought to have exercised greater due 198 198 diligence: the real weakness is on the side of a Microsoft Windows environment. 199 </p></dd><dt><span class="term">Security Overall</span></dt><dd><p><a class="indexterm" name="id3 74124"></a>199 </p></dd><dt><span class="term">Security Overall</span></dt><dd><p><a class="indexterm" name="id396242"></a> 200 200 Samba is designed in such a manner that weaknesses inherent in the design of 201 201 Microsoft Windows networking ought not to expose the underlying UNIX/Linux file 202 202 system in any way. All software has potential defects, and Samba is no exception. 203 203 What matters more is how defects that are discovered get dealt with. 204 </p><p><a class="indexterm" name="id3 74138"></a><a class="indexterm" name="id374146"></a><a class="indexterm" name="id374154"></a><a class="indexterm" name="id374162"></a>204 </p><p><a class="indexterm" name="id396256"></a><a class="indexterm" name="id396264"></a><a class="indexterm" name="id396272"></a><a class="indexterm" name="id396280"></a> 205 205 The Samba Team totally agrees with the necessity to observe and fully implement 206 206 every security facility to provide a level of protection and security that is necessary … … 209 209 security be publicly condoned; yet this is the practice by many Windows network 210 210 administrators just to make happy users who have no notion of consequential risk. 211 </p><p><a class="indexterm" name="id3 74178"></a><a class="indexterm" name="id374186"></a><a class="indexterm" name="id374193"></a><a class="indexterm" name="id374201"></a><a class="indexterm" name="id374209"></a><a class="indexterm" name="id374217"></a><a class="indexterm" name="id374225"></a>211 </p><p><a class="indexterm" name="id396295"></a><a class="indexterm" name="id396303"></a><a class="indexterm" name="id396311"></a><a class="indexterm" name="id396319"></a><a class="indexterm" name="id396327"></a><a class="indexterm" name="id396335"></a><a class="indexterm" name="id396343"></a> 212 212 The report condemns Samba for releasing updates and security fixes, yet Microsoft 213 213 online updates need to be applied almost weekly. The answer to the criticism … … 215 215 user needs are being increasingly met or exceeded, and security updates are issued 216 216 with a short turnaround time. 217 </p><p><a class="indexterm" name="id3 74239"></a><a class="indexterm" name="id374247"></a><a class="indexterm" name="id374255"></a><a class="indexterm" name="id374263"></a><a class="indexterm" name="id374271"></a>217 </p><p><a class="indexterm" name="id396357"></a><a class="indexterm" name="id396365"></a><a class="indexterm" name="id396373"></a><a class="indexterm" name="id396381"></a><a class="indexterm" name="id396388"></a> 218 218 The release of Samba-4 is expected around late 2004 to early 2005 and involves a near 219 219 complete rewrite to permit extensive modularization and to prepare Samba for new … … 222 222 degree of dependability and on charter development consistent with published 223 223 roadmap projections. 224 </p><p><a class="indexterm" name="id3 74289"></a><a class="indexterm" name="id374297"></a><a class="indexterm" name="id374309"></a><a class="indexterm" name="id374320"></a><a class="indexterm" name="id374328"></a><a class="indexterm" name="id374336"></a><a class="indexterm" name="id374343"></a>224 </p><p><a class="indexterm" name="id396411"></a><a class="indexterm" name="id396419"></a><a class="indexterm" name="id396430"></a><a class="indexterm" name="id396441"></a><a class="indexterm" name="id396449"></a><a class="indexterm" name="id396457"></a><a class="indexterm" name="id396465"></a> 225 225 Not well published is the fact that Microsoft was a foundation member of 226 226 the Common Internet File System (CIFS) initiative, together with the participation … … 231 231 CIFS conferences and at the interoperability laboratories run concurrently with 232 232 them. 233 </p></dd><dt><span class="term">Cryptographic Controls (schannel, sign'n'seal)</span></dt><dd><p><a class="indexterm" name="id3 74368"></a><a class="indexterm" name="id374376"></a><a class="indexterm" name="id374383"></a>233 </p></dd><dt><span class="term">Cryptographic Controls (schannel, sign'n'seal)</span></dt><dd><p><a class="indexterm" name="id396489"></a><a class="indexterm" name="id396497"></a><a class="indexterm" name="id396505"></a> 234 234 The report correctly mentions that Samba did not support the most recent 235 235 <code class="constant">schannel</code> and <code class="constant">digital sign'n'seal</code> features … … 239 239 pathology report they reflect accurately (at best) status at a snapshot in time. 240 240 Meanwhile, the world moves on. 241 </p><p><a class="indexterm" name="id3 74409"></a><a class="indexterm" name="id374416"></a><a class="indexterm" name="id374424"></a><a class="indexterm" name="id374432"></a><a class="indexterm" name="id374440"></a><a class="indexterm" name="id374455"></a><a class="indexterm" name="id374463"></a>241 </p><p><a class="indexterm" name="id396531"></a><a class="indexterm" name="id396538"></a><a class="indexterm" name="id396546"></a><a class="indexterm" name="id396554"></a><a class="indexterm" name="id396562"></a><a class="indexterm" name="id396576"></a><a class="indexterm" name="id396584"></a> 242 242 It should be pointed out that had clear public specifications for the protocols 243 243 been published, it would have been much easier to implement these features and would have … … 247 247 and defensible standards is obvious to all and would have enabled more secure networking 248 248 for everyone. 249 </p><p><a class="indexterm" name="id3 74478"></a><a class="indexterm" name="id374486"></a>249 </p><p><a class="indexterm" name="id396600"></a><a class="indexterm" name="id396608"></a> 250 250 Critics of Samba often ignore fundamental problems that may plague (or may have plagued) 251 251 the users of Microsoft's products also. Those who are first to criticize Samba 252 252 for not rushing into release of <code class="constant">digital sign'n'seal</code> support 253 253 often dismiss the problems that Microsoft has 254 <a href="http://support.microsoft.com/default.aspx?kbid=321733" target="_top">acknowledged</a>254 <a class="ulink" href="http://support.microsoft.com/default.aspx?kbid=321733" target="_top">acknowledged</a> 255 255 and for which a fix was provided. In fact, 256 <a href="http://www.tangent-systems.com/support/delayedwrite.html" target="_top">Tangent Systems</a>256 <a class="ulink" href="http://www.tangent-systems.com/support/delayedwrite.html" target="_top">Tangent Systems</a> 257 257 have documented a significant problem with delays writes that can be connected with the 258 258 implementation of sign'n'seal. They provide a work-around that is not trivial for many 259 259 Windows networking sites. From notes such as this it is clear that there are benefits 260 260 from not rushing new technology out of the door too soon. 261 </p><p><a class="indexterm" name="id3 74519"></a><a class="indexterm" name="id374527"></a><a class="indexterm" name="id374535"></a><a class="indexterm" name="id374543"></a><a class="indexterm" name="id374551"></a><a class="indexterm" name="id374558"></a><a class="indexterm" name="id374566"></a><a class="indexterm" name="id374574"></a><a class="indexterm" name="id374582"></a>261 </p><p><a class="indexterm" name="id396641"></a><a class="indexterm" name="id396649"></a><a class="indexterm" name="id396656"></a><a class="indexterm" name="id396664"></a><a class="indexterm" name="id396672"></a><a class="indexterm" name="id396680"></a><a class="indexterm" name="id396688"></a><a class="indexterm" name="id396696"></a><a class="indexterm" name="id396704"></a> 262 262 One final comment is warranted. If companies want more secure networking protocols, 263 263 the most effective method by which this can be achieved is by users seeking … … 275 275 and yet by which they are made to interoperate in ways that the components do not 276 276 support. 277 </p><p><a class="indexterm" name="id3 74664"></a><a class="indexterm" name="id374675"></a><a class="indexterm" name="id374683"></a><a class="indexterm" name="id374691"></a><a class="indexterm" name="id374699"></a>277 </p><p><a class="indexterm" name="id396782"></a><a class="indexterm" name="id396793"></a><a class="indexterm" name="id396801"></a><a class="indexterm" name="id396809"></a><a class="indexterm" name="id396817"></a> 278 278 In order to make the popular request for Samba to be an Active Directory Server a 279 279 reality, it is necessary to add to OpenLDAP, Kerberos, as well as Samba, RPC calls … … 283 283 the Samba Team does not make it a priority to absorb Kerberos and LDAP functionality 284 284 into the Samba project, this dream request cannot become a reality. 285 </p><p><a class="indexterm" name="id3 74715"></a><a class="indexterm" name="id374723"></a><a class="indexterm" name="id374731"></a><a class="indexterm" name="id374742"></a><a class="indexterm" name="id374750"></a>285 </p><p><a class="indexterm" name="id396838"></a><a class="indexterm" name="id396846"></a><a class="indexterm" name="id396854"></a><a class="indexterm" name="id396865"></a><a class="indexterm" name="id396872"></a> 286 286 At this time, the integration of LDAP, Kerberos, and the missing RPCs is not on the 287 287 Samba development roadmap. If it is not on the published roadmap, it cannot be delivered … … 289 289 The Samba Team is most committed to permitting Samba to be a full ADS domain member 290 290 that is increasingly capable of being managed using Microsoft Windows MMC tools. 291 </p></dd></dl></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 74766"></a>Kerberos Exposed</h4></div></div></div><p><a class="indexterm" name="id374772"></a><a class="indexterm" name="id374780"></a><a class="indexterm" name="id374788"></a>291 </p></dd></dl></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id396888"></a>Kerberos Exposed</h4></div></div></div><p><a class="indexterm" name="id396895"></a><a class="indexterm" name="id396903"></a><a class="indexterm" name="id396911"></a> 292 292 Kerberos is a network authentication protocol that provides secure authentication for 293 293 client-server applications by using secret-key cryptography. Firewalls are an insufficient … … 295 295 traffic but cannot prevent network traffic that comes from authorized locations from 296 296 performing unauthorized activities. 297 </p><p><a class="indexterm" name="id3 74802"></a><a class="indexterm" name="id374810"></a><a class="indexterm" name="id374818"></a>297 </p><p><a class="indexterm" name="id396925"></a><a class="indexterm" name="id396933"></a><a class="indexterm" name="id396941"></a> 298 298 Kerberos was created by MIT as a solution to network security problems. The Kerberos protocol uses 299 299 strong cryptography so that a client can prove its identity to a server (and vice versa) across an … … 301 301 they can also encrypt all of their communications to assure privacy and data integrity as they go 302 302 about their business. 303 </p><p><a class="indexterm" name="id3 74833"></a><a class="indexterm" name="id374841"></a><a class="indexterm" name="id374849"></a><a class="indexterm" name="id374857"></a><a class="indexterm" name="id374868"></a>303 </p><p><a class="indexterm" name="id396956"></a><a class="indexterm" name="id396964"></a><a class="indexterm" name="id396972"></a><a class="indexterm" name="id396979"></a><a class="indexterm" name="id396991"></a> 304 304 Kerberos is a trusted third-party service. That means that there is a third party (the kerberos 305 305 server) that is trusted by all the entities on the network (users and services, usually called … … 308 308 trusting the kerberos server, users and services can authenticate each other. 309 309 </p><p> 310 <a class="indexterm" name="id3 74884"></a>311 <a class="indexterm" name="id3 74891"></a>312 <a class="indexterm" name="id3 74898"></a>310 <a class="indexterm" name="id397007"></a> 311 <a class="indexterm" name="id397014"></a> 312 <a class="indexterm" name="id397021"></a> 313 313 Kerberos was, until recently, a technology that was restricted from being exported from the United States. 314 314 For many years that hindered global adoption of more secure networking technologies both within the United States 315 315 and abroad. A free and unencumbered implementation of MIT Kerberos has been produced in Europe 316 and is available from the <a href="http://www.pdc.kth.se/heimdal/" target="_top">Royal Institute</a> of316 and is available from the <a class="ulink" href="http://www.pdc.kth.se/heimdal/" target="_top">Royal Institute</a> of 317 317 Technology (KTH), Sweden. It is known as the Heimdal Kerberos project. In recent times the U.S. government 318 318 has removed sanctions affecting the global distribution of MIT Kerberos. It is likely that there will be a … … 320 320 and use of Kerberos across the spectrum of the information technology industry. 321 321 </p><p> 322 <a class="indexterm" name="id3 74920"></a>322 <a class="indexterm" name="id397043"></a> 323 323 A storm has broken out concerning interoperability between MIT Kerberos and Microsofts' implementation 324 324 of it. For example, a 2002 325 <a href="http://www.idg.com.sg/idgwww.nsf/0/5DDA8D153A7505A748256BAB000D992A?OpenDocument" target="_top">IDG</a>326 report<sup>[<a name="id3 74937" href="#ftn.id374937">13</a>]</sup> by325 <a class="ulink" href="http://www.idg.com.sg/idgwww.nsf/0/5DDA8D153A7505A748256BAB000D992A?OpenDocument" target="_top">IDG</a> 326 report<sup>[<a name="id397060" href="#ftn.id397060" class="footnote">13</a>]</sup> by 327 327 states: 328 328 </p><div class="blockquote"><blockquote class="blockquote"><p> … … 332 332 use of the Kerberos authentication specification, not everyone agrees. 333 333 </p><p> 334 <a class="indexterm" name="id3 74958"></a>334 <a class="indexterm" name="id397081"></a> 335 335 Robert Short, vice president of Windows core technology at Microsoft, wrote in his direct testimony prepared 336 336 before his appearance that non-Microsoft operating systems can disregard the portion of the Kerberos version … … 340 340 that software developers could add their own authorization information, he said. 341 341 </p></blockquote></div><p> 342 <a class="indexterm" name="id3 74976"></a>343 <a class="indexterm" name="id3 74983"></a>342 <a class="indexterm" name="id397099"></a> 343 <a class="indexterm" name="id397106"></a> 344 344 It so happens that Microsoft Windows clients depend on and expect the contents of the <span class="emphasis"><em>unspecified 345 345 fields</em></span> in the Kerberos 5 communications data stream for their Windows interoperability, … … 351 351 </p><p> 352 352 Microsoft makes the following comment in a reference in a 353 <a href="http://www.microsoft.com/technet/itsolutions/interop/mgmt/kerberos.asp" target="_top">353 <a class="ulink" href="http://www.microsoft.com/technet/itsolutions/interop/mgmt/kerberos.asp" target="_top"> 354 354 technet</a> article: 355 </p><div class="blockquote"><blockquote class="blockquote"><p><a class="indexterm" name="id3 75016"></a><a class="indexterm" name="id375028"></a>355 </p><div class="blockquote"><blockquote class="blockquote"><p><a class="indexterm" name="id397135"></a><a class="indexterm" name="id397146"></a> 356 356 The DCE Security Services are also layered on the Kerberos protocol. DCE authentication services use RPC 357 357 representation of Kerberos protocol messages. In addition, DCE uses the authorization data field in Kerberos … … 363 363 </p></blockquote></div></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="ch10expl"></a>Implementation</h2></div></div></div><p> 364 364 The following procedures outline the implementation of the security measures discussed so far. 365 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 75060"></a>Share Access Controls</h3></div></div></div><p><a class="indexterm" name="id375067"></a><a class="indexterm" name="id375075"></a><a class="indexterm" name="id375082"></a>365 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id397184"></a>Share Access Controls</h3></div></div></div><p><a class="indexterm" name="id397191"></a><a class="indexterm" name="id397199"></a><a class="indexterm" name="id397207"></a> 366 366 Access control entries placed on the share itself act as a filter at the time a when CIFS/SMB client (such as 367 367 Windows XP Pro) attempts to make a connection to the Samba server. 368 </p><div class="procedure"><a name="id3 75094"></a><p class="title"><b>Procedure 11.1. Create/Edit/Delete Share ACLs</b></p><ol type="1"><li><p><a class="indexterm" name="id375104"></a><a class="indexterm" name="id375112"></a>368 </p><div class="procedure"><a name="id397218"></a><p class="title"><b>Procedure 11.1. Create/Edit/Delete Share ACLs</b></p><ol type="1"><li><p><a class="indexterm" name="id397228"></a><a class="indexterm" name="id397236"></a> 369 369 From a Windows 200x/XP Professional workstation, log on to the domain using the Domain Administrator 370 370 account (on Samba domains, this is usually the account called <code class="constant">root</code>). … … 375 375 In the left panel, 376 376 <span class="guimenu">[Right mouse menu item] Computer Management (Local)</span> → <span class="guimenuitem">Connect to another computer ...</span> → <span class="guimenuitem">Browse...</span> → <span class="guimenuitem">Advanced</span> → <span class="guimenuitem">Find Now</span>. In the lower panel, click on the name of the server you wish to 377 administer. Click <span class="guimenu">OK</span> → <span class="guimenuitem">OK</span> → <span class="guimenuitem">OK</span>.<a class="indexterm" name="id3 75232"></a>377 administer. Click <span class="guimenu">OK</span> → <span class="guimenuitem">OK</span> → <span class="guimenuitem">OK</span>.<a class="indexterm" name="id397356"></a> 378 378 In the left panel, the entry <span class="guimenu">Computer Management (Local)</span> should now reflect 379 379 the change made. For example, if the server you are administering is called <code class="constant">FRODO</code>, … … 381 381 </p></li><li><p> 382 382 In the left panel, click <span class="guimenu">Computer Management (FRODO)</span> → <span class="guimenuitem">[+] Shared Folders</span> → <span class="guimenuitem">Shares</span>. 383 </p></li><li><p><a class="indexterm" name="id3 75293"></a><a class="indexterm" name="id375301"></a>383 </p></li><li><p><a class="indexterm" name="id397418"></a><a class="indexterm" name="id397426"></a> 384 384 In the right panel, double-click on the share on which you wish to set/edit ACLs. This 385 385 will bring up the Properties panel. Click the <span class="guimenu">Share Permissions</span> tab. 386 </p></li><li><p><a class="indexterm" name="id3 75323"></a><a class="indexterm" name="id375331"></a><a class="indexterm" name="id375339"></a><a class="indexterm" name="id375347"></a><a class="indexterm" name="id375354"></a><a class="indexterm" name="id375362"></a>386 </p></li><li><p><a class="indexterm" name="id397447"></a><a class="indexterm" name="id397455"></a><a class="indexterm" name="id397463"></a><a class="indexterm" name="id397471"></a><a class="indexterm" name="id397479"></a><a class="indexterm" name="id397487"></a> 387 387 You may now edit/add/remove access control settings. Be very careful. Many problems have been 388 388 created by people who decided that everyone should be rejected but one particular group should … … 393 393 When you are done with editing, close all panels by clicking through the <span class="guimenu">OK</span> 394 394 buttons. 395 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 75395"></a>Share Definition Controls</h3></div></div></div><p><a class="indexterm" name="id375401"></a><a class="indexterm" name="id375413"></a><a class="indexterm" name="id375421"></a><a class="indexterm" name="id375428"></a><a class="indexterm" name="id375436"></a><a class="indexterm" name="id375444"></a>395 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id397519"></a>Share Definition Controls</h3></div></div></div><p><a class="indexterm" name="id397526"></a><a class="indexterm" name="id397537"></a><a class="indexterm" name="id397545"></a><a class="indexterm" name="id397553"></a><a class="indexterm" name="id397561"></a><a class="indexterm" name="id397568"></a> 396 396 Share-definition-based access controls can be used like a checkpoint or like a pile-driver. Just as a 397 397 checkpoint can be used to require someone who wants to get through to meet certain requirements, so … … 400 400 credential-related objectives, the user can be granted powers and privileges that would not normally be 401 401 available under default settings. 402 </p><p><a class="indexterm" name="id3 75460"></a><a class="indexterm" name="id375468"></a><a class="indexterm" name="id375476"></a><a class="indexterm" name="id375484"></a>402 </p><p><a class="indexterm" name="id397584"></a><a class="indexterm" name="id397592"></a><a class="indexterm" name="id397600"></a><a class="indexterm" name="id397608"></a> 403 403 It must be emphasized that the controls discussed here can act as a filter or give rights of passage 404 404 that act as a superstructure over normal directory and file access controls. However, share-level … … 406 406 share-level controls to get to the share-definition controls. The proper hierarchy of controls implemented 407 407 by Samba and Windows networking consists of: 408 </p><div class="orderedlist"><ol type="1"><li><p>Share-level ACLs</p></li><li><p>Share-definition controls</p></li><li><p>Directory and file permissions</p></li><li><p>Directory and file POSIX ACLs</p></li></ol></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 75528"></a>Checkpoint Controls</h4></div></div></div><p><a class="indexterm" name="id375535"></a>408 </p><div class="orderedlist"><ol type="1"><li><p>Share-level ACLs</p></li><li><p>Share-definition controls</p></li><li><p>Directory and file permissions</p></li><li><p>Directory and file POSIX ACLs</p></li></ol></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id397648"></a>Checkpoint Controls</h4></div></div></div><p><a class="indexterm" name="id397655"></a> 409 409 Consider the following extract from a <code class="filename">smb.conf</code> file defining the share called <code class="constant">Apps</code>: 410 410 </p><pre class="screen"> … … 417 417 This definition permits only those who are members of the group called <code class="constant">Employees</code> to 418 418 access the share. 419 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p><a class="indexterm" name="id3 75568"></a><a class="indexterm" name="id375579"></a><a class="indexterm" name="id375587"></a><a class="indexterm" name="id375595"></a><a class="indexterm" name="id375603"></a>419 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p><a class="indexterm" name="id397688"></a><a class="indexterm" name="id397700"></a><a class="indexterm" name="id397708"></a><a class="indexterm" name="id397716"></a><a class="indexterm" name="id397723"></a> 420 420 On domain member servers and clients, even when the <em class="parameter"><code>winbind use default domain</code></em> has 421 421 been specified, the use of domain accounts in security controls requires fully qualified domain specification, 422 for example, <a class=" indexterm" name="id375620"></a>valid users = @"MEGANET\Northern Engineers".422 for example, <a class="link" href="smb.conf.5.html#VALIDUSERS">valid users = @"MEGANET\Northern Engineers"</a>. 423 423 Note the necessity to use the double quotes to avoid having the space in the Windows group name interpreted as a 424 424 delimiter. 425 </p></div><p><a class="indexterm" name="id3 75630"></a><a class="indexterm" name="id375638"></a><a class="indexterm" name="id375646"></a>425 </p></div><p><a class="indexterm" name="id397755"></a><a class="indexterm" name="id397762"></a><a class="indexterm" name="id397770"></a> 426 426 If there is an ACL on the share itself to permit read/write access for all <code class="constant">Employees</code> 427 427 as well as read/write for the group <code class="constant">Doctors</code>, both groups are permitted through … … 429 429 the group <code class="constant">Doctors</code>, who is not also a member of the group <code class="constant">Employees</code>, 430 430 would immediately fail to validate. 431 </p><p><a class="indexterm" name="id3 75674"></a>431 </p><p><a class="indexterm" name="id397798"></a> 432 432 Consider another example. In this case, you want to permit all members of the group <code class="constant">Employees</code> 433 433 except the user <code class="constant">patrickj</code> to access the <code class="constant">Apps</code> share. This can be … … 442 442 invalid users = patrickj 443 443 </pre><p> 444 <a class="indexterm" name="id3 75711"></a>444 <a class="indexterm" name="id397835"></a> 445 445 Let us assume that you want to permit the user <code class="constant">gbshaw</code> to manage any file in the 446 446 UNIX/Linux file system directory <code class="filename">/data/apps</code>, but you do not want to grant any write … … 454 454 admin users = gbshaw 455 455 </pre><p> 456 <a class="indexterm" name="id3 75738"></a>456 <a class="indexterm" name="id397862"></a> 457 457 Now we have a set of controls that permits only <code class="constant">Employees</code> who are also members of 458 458 the group <code class="constant">Doctors</code>, excluding the user <code class="constant">patrickj</code>, to have … … 476 476 write list = peters 477 477 </pre><p> 478 <a class="indexterm" name="id3 75789"></a>478 <a class="indexterm" name="id397913"></a> 479 479 This is a particularly complex example at this point, but it begins to demonstrate the possibilities. 480 480 You should refer to the online manual page for the <code class="filename">smb.conf</code> file for more information regarding 481 481 the checkpoint controls that Samba implements. 482 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 75808"></a>Override Controls</h4></div></div></div><p><a class="indexterm" name="id375815"></a>482 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id397932"></a>Override Controls</h4></div></div></div><p><a class="indexterm" name="id397939"></a> 483 483 Override controls implemented by Samba permit actions like the adoption of a different identity 484 484 during file system operations, the forced overwriting of normal file and directory permissions, … … 498 498 force group = Mentors 499 499 </pre><p> 500 <a class="indexterm" name="id3 75852"></a><a class="indexterm" name="id375860"></a>500 <a class="indexterm" name="id397977"></a><a class="indexterm" name="id397984"></a> 501 501 That is all there is to it. Well, it is almost that simple. The downside of this method is that 502 502 users are logged onto the Windows client as themselves, and then immediately before accessing the … … 505 505 This imposes significant overhead on Samba. The alternative way to effectively achieve the same result 506 506 (but with lower system CPU overheads) is described next. 507 </p><p><a class="indexterm" name="id3 75876"></a><a class="indexterm" name="id375884"></a><a class="indexterm" name="id375892"></a><a class="indexterm" name="id375903"></a><a class="indexterm" name="id375911"></a>507 </p><p><a class="indexterm" name="id398000"></a><a class="indexterm" name="id398008"></a><a class="indexterm" name="id398016"></a><a class="indexterm" name="id398027"></a><a class="indexterm" name="id398035"></a> 508 508 The use of the <em class="parameter"><code>force user</code></em> or the <em class="parameter"><code>force group</code></em> may 509 509 also have a severe impact on system (particularly on Windows client) performance. If opportunistic … … 515 515 apparent performance degradation as the client continually attempts to reconnect to overcome the 516 516 effect of the lost <code class="constant">oplock break</code>, or time-out. 517 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 75952"></a>Share Point Directory and File Permissions</h3></div></div></div><p><a class="indexterm" name="id375958"></a><a class="indexterm" name="id375966"></a><a class="indexterm" name="id375974"></a><a class="indexterm" name="id375982"></a>517 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id398076"></a>Share Point Directory and File Permissions</h3></div></div></div><p><a class="indexterm" name="id398083"></a><a class="indexterm" name="id398091"></a><a class="indexterm" name="id398098"></a><a class="indexterm" name="id398106"></a> 518 518 Samba has been designed and implemented so that it respects as far as is feasible the security and 519 519 user privilege controls that are built into the UNIX/Linux operating system. Samba does nothing … … 523 523 from a basic UNIX training guide. Instead, one common example of a typical problem is used 524 524 to demonstrate the most effective solution referred to in the immediately preceding paragraph. 525 </p><p><a class="indexterm" name="id3 75999"></a><a class="indexterm" name="id376007"></a><a class="indexterm" name="id376015"></a>525 </p><p><a class="indexterm" name="id398123"></a><a class="indexterm" name="id398131"></a><a class="indexterm" name="id398139"></a> 526 526 One of the common issues that repeatedly pops up on the Samba mailing lists involves the saving of 527 527 Microsoft Office files (Word and Excel) to a network drive. Here is the typical sequence: … … 543 543 want to know when this “<span class="quote">bug</span>” will be fixed. The fact is, this is not a bug in Samba at all. 544 544 Here is the real sequence of what happens in this case. 545 </p><p><a class="indexterm" name="id3 76099"></a><a class="indexterm" name="id376107"></a><a class="indexterm" name="id376115"></a>545 </p><p><a class="indexterm" name="id398224"></a><a class="indexterm" name="id398232"></a><a class="indexterm" name="id398239"></a> 546 546 When the user saves a file, MS Word creates a new (temporary) file. This file is naturally owned 547 547 by the user who creates the file (<code class="constant">billc</code>) and has the permissions that follow … … 561 561 simple steps to create a share in which all files will consistently be owned by the same user and the 562 562 same group: 563 </p><div class="procedure"><a name="id3 76152"></a><p class="title"><b>Procedure 11.2. Using Directory Permissions to Force File User and Group Ownership</b></p><ol type="1"><li><p>563 </p><div class="procedure"><a name="id398276"></a><p class="title"><b>Procedure 11.2. Using Directory Permissions to Force File User and Group Ownership</b></p><ol type="1"><li><p> 564 564 Change your share definition so that it matches this pattern: 565 565 </p><pre class="screen"> … … 569 569 read only = No 570 570 </pre><p> 571 </p></li><li><p><a class="indexterm" name="id3 76176"></a><a class="indexterm" name="id376187"></a>571 </p></li><li><p><a class="indexterm" name="id398300"></a><a class="indexterm" name="id398311"></a> 572 572 Set consistent user and group permissions recursively down the directory tree as shown here: 573 573 </p><pre class="screen"> 574 574 <code class="prompt">root# </code> chown -R janetp.users /usr/data/finance 575 575 </pre><p> 576 </p></li><li><p><a class="indexterm" name="id3 76218"></a>576 </p></li><li><p><a class="indexterm" name="id398342"></a> 577 577 Set the files and directory permissions to be read/write for owner and group, and not accessible 578 578 to others (everyone), using the following command: … … 580 580 <code class="prompt">root# </code> chmod ug+rwx,o-rwx /usr/data/finance 581 581 </pre><p> 582 </p></li><li><p><a class="indexterm" name="id3 76245"></a>582 </p></li><li><p><a class="indexterm" name="id398369"></a> 583 583 Set the SGID (supergroup) bit on all directories from the top down. This means all files 584 584 can be created with the permissions of the group set on the directory. It means all users … … 590 590 </pre><p> 591 591 592 </p></li><li><p><a class="indexterm" name="id3 76282"></a><a class="indexterm" name="id376290"></a><a class="indexterm" name="id376298"></a>592 </p></li><li><p><a class="indexterm" name="id398406"></a><a class="indexterm" name="id398414"></a><a class="indexterm" name="id398422"></a> 593 593 Make sure all users that must have read/write access to the directory have 594 594 <code class="constant">finance</code> group membership as their primary group, 595 595 for example, the group they belong to in <code class="filename">/etc/passwd</code>. 596 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 76321"></a>Managing Windows 200x ACLs</h3></div></div></div><p><a class="indexterm" name="id376328"></a><a class="indexterm" name="id376335"></a><a class="indexterm" name="id376343"></a><a class="indexterm" name="id376351"></a>596 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id398445"></a>Managing Windows 200x ACLs</h3></div></div></div><p><a class="indexterm" name="id398452"></a><a class="indexterm" name="id398460"></a><a class="indexterm" name="id398468"></a><a class="indexterm" name="id398475"></a> 597 597 Samba must translate Windows 2000 ACLs to UNIX POSIX ACLs. This has some interesting side effects because 598 598 there is not a one-to-one equivalence between them. The as-close-as-possible ACLs match means … … 602 602 There are two possible ways to set ACLs on UNIX/Linux file systems from a Windows network workstation, 603 603 either via File Manager or via the Microsoft Management Console (MMC) Computer Management interface. 604 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 76370"></a>Using the MMC Computer Management Interface</h4></div></div></div><div class="procedure"><ol type="1"><li><p>604 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id398494"></a>Using the MMC Computer Management Interface</h4></div></div></div><div class="procedure"><ol type="1"><li><p> 605 605 From a Windows 200x/XP Professional workstation, log on to the domain using the Domain Administrator 606 606 account (on Samba domains, this is usually the account called <code class="constant">root</code>). … … 617 617 </p></li><li><p> 618 618 In the left panel, click <span class="guimenu">Computer Management (FRODO)</span> → <span class="guimenuitem">[+] Shared Folders</span> → <span class="guimenuitem">Shares</span>. 619 </p></li><li><p><a class="indexterm" name="id3 76547"></a><a class="indexterm" name="id376555"></a><a class="indexterm" name="id376562"></a><a class="indexterm" name="id376570"></a>619 </p></li><li><p><a class="indexterm" name="id398671"></a><a class="indexterm" name="id398679"></a><a class="indexterm" name="id398687"></a><a class="indexterm" name="id398695"></a> 620 620 In the right panel, double-click on the share on which you wish to set/edit ACLs. This 621 621 brings up the Properties panel. Click the <span class="guimenu">Security</span> tab. It is best … … 624 624 functionality under the <code class="constant">Permissions</code> tab can be utilized with respect 625 625 to a Samba domain server. 626 </p></li><li><p><a class="indexterm" name="id3 76607"></a><a class="indexterm" name="id376615"></a>626 </p></li><li><p><a class="indexterm" name="id398731"></a><a class="indexterm" name="id398739"></a> 627 627 You may now edit/add/remove access control settings. Be very careful. Many problems have been 628 628 created by people who decided that everyone should be rejected but one particular group should … … 633 633 When you are done with editing, close all panels by clicking through the <span class="guimenu">OK</span> 634 634 buttons until the last panel closes. 635 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 76647"></a>Using MS Windows Explorer (File Manager)</h4></div></div></div><p>635 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id398771"></a>Using MS Windows Explorer (File Manager)</h4></div></div></div><p> 636 636 The following alternative method may be used from a Windows workstation. In this example we work 637 637 with a domain called <code class="constant">MEGANET</code>, a server called <code class="constant">MASSIVE</code>, and a … … 641 641 Click <span class="guimenu">Start</span> → <span class="guimenuitem">[right-click] My Computer</span> → <span class="guimenuitem">Explore</span> → <span class="guimenuitem">[left panel] [+] My Network Places</span> → <span class="guimenuitem">[+] Entire Network</span> → <span class="guimenuitem">[+] Microsoft Windows Network</span> → <span class="guimenuitem">[+] Meganet</span> → <span class="guimenuitem">[+] Massive</span> → <span class="guimenuitem">[right-click] Apps</span> → <span class="guimenuitem">Properties</span> → <span class="guimenuitem">Security</span> → <span class="guimenuitem">Advanced</span>. This opens a panel that has four tabs. Only the functionality under the 642 642 <code class="constant">Permissions</code> tab can be utilized for a Samba domain server. 643 </p></li><li><p><a class="indexterm" name="id3 76768"></a><a class="indexterm" name="id376775"></a>643 </p></li><li><p><a class="indexterm" name="id398892"></a><a class="indexterm" name="id398900"></a> 644 644 You may now edit/add/remove access control settings. Be very careful. Many problems have been 645 645 created by people who decided that everyone should be rejected but one particular group should … … 650 650 When you are done with editing, close all panels by clicking through the <span class="guimenu">OK</span> 651 651 buttons until the last panel closes. 652 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 76809"></a>Setting Posix ACLs in UNIX/Linux</h4></div></div></div><p><a class="indexterm" name="id376816"></a><a class="indexterm" name="id376824"></a>652 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id398933"></a>Setting Posix ACLs in UNIX/Linux</h4></div></div></div><p><a class="indexterm" name="id398940"></a><a class="indexterm" name="id398948"></a> 653 653 Yet another alternative method for setting desired security settings on the shared resource files and 654 654 directories can be achieved by logging into UNIX/Linux and setting POSIX ACLs directly using command-line … … 673 673 other::r-x 674 674 </pre><p> 675 </p></li><li><p><a class="indexterm" name="id3 76892"></a>675 </p></li><li><p><a class="indexterm" name="id399016"></a> 676 676 You want to add permission for <code class="constant">AppsMgrs</code> to enable them to 677 677 manage the applications (apps) share. It is important to set the ACL recursively … … 696 696 </pre><p> 697 697 This confirms that the change of POSIX ACL permissions has been effective. 698 </p></li><li><p><a class="indexterm" name="id3 76942"></a><a class="indexterm" name="id376950"></a><a class="indexterm" name="id376958"></a><a class="indexterm" name="id376965"></a><a class="indexterm" name="id376973"></a>698 </p></li><li><p><a class="indexterm" name="id399066"></a><a class="indexterm" name="id399074"></a><a class="indexterm" name="id399082"></a><a class="indexterm" name="id399090"></a><a class="indexterm" name="id399098"></a> 699 699 It is highly recommended that you read the online manual page for the <code class="literal">setfacl</code> 700 700 and <code class="literal">getfacl</code> commands. This provides information regarding how to set/read the default 701 701 ACLs and how that may be propagated through the directory tree. In Windows ACLs terms, this is the equivalent 702 702 of setting <code class="constant">inheritance</code> properties. 703 </p></li></ol></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 77005"></a>Key Points Learned</h3></div></div></div><p>703 </p></li></ol></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id399129"></a>Key Points Learned</h3></div></div></div><p> 704 704 The mish-mash of issues were thrown together into one chapter because it seemed like a good idea. 705 705 Looking back, this chapter could be broken into two, but it's too late now. It has been done. 706 706 The highlights covered are as follows: 707 </p><div class="itemizedlist"><ul type="disc"><li><p><a class="indexterm" name="id3 77020"></a><a class="indexterm" name="id377028"></a><a class="indexterm" name="id377036"></a><a class="indexterm" name="id377043"></a>707 </p><div class="itemizedlist"><ul type="disc"><li><p><a class="indexterm" name="id399144"></a><a class="indexterm" name="id399152"></a><a class="indexterm" name="id399160"></a><a class="indexterm" name="id399168"></a> 708 708 Winbind honors and does not override account controls set in Active Directory. 709 709 This means that password change, logon hours, and so on, are (or soon will be) enforced … … 711 711 change is enforced. At this time, if logon hours expire, the user is not forcibly 712 712 logged off. That may be implemented at some later date. 713 </p></li><li><p><a class="indexterm" name="id3 77059"></a><a class="indexterm" name="id377067"></a>713 </p></li><li><p><a class="indexterm" name="id399183"></a><a class="indexterm" name="id399191"></a> 714 714 Sign'n'seal (plus schannel support) has been implemented in Samba-3. Beware of potential 715 715 problems acknowledged by Microsoft as having been fixed but reported by some as still 716 716 possibly an open issue. 717 </p></li><li><p><a class="indexterm" name="id3 77081"></a><a class="indexterm" name="id377089"></a><a class="indexterm" name="id377097"></a><a class="indexterm" name="id377104"></a>717 </p></li><li><p><a class="indexterm" name="id399205"></a><a class="indexterm" name="id399213"></a><a class="indexterm" name="id399221"></a><a class="indexterm" name="id399229"></a> 718 718 The combination of Kerberos 5, plus OpenLDAP, plus Samba, cannot replace Microsoft 719 719 Active Directory. The possibility to do this is not planned in the current Samba-3 … … 724 724 the four key methodologies was reviewed with specific reference to example deployment 725 725 techniques. 726 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 77127"></a>Questions and Answers</h2></div></div></div><p>727 </p><div class="qandaset"><dl><dt> <a href="kerberos.html#id3 77142">726 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id399251"></a>Questions and Answers</h2></div></div></div><p> 727 </p><div class="qandaset"><dl><dt> <a href="kerberos.html#id399266"> 728 728 Does Samba-3 require the Sign'n'seal registry hacks needed by Samba-2? 729 </a></dt><dt> <a href="kerberos.html#id3 77210">729 </a></dt><dt> <a href="kerberos.html#id399334"> 730 730 Does Samba-3 support Active Directory? 731 </a></dt><dt> <a href="kerberos.html#id3 77238">731 </a></dt><dt> <a href="kerberos.html#id399362"> 732 732 When Samba-3 is used with Active Directory, is it necessary to run mixed-mode operation, as was 733 733 necessary with Samba-2? 734 </a></dt><dt> <a href="kerberos.html#id3 77273">734 </a></dt><dt> <a href="kerberos.html#id399397"> 735 735 Is it safe to set share-level access controls in Samba? 736 </a></dt><dt> <a href="kerberos.html#id3 77300">736 </a></dt><dt> <a href="kerberos.html#id399424"> 737 737 Is it mandatory to set share ACLs to get a secure Samba-3 server? 738 </a></dt><dt> <a href="kerberos.html#id3 77372">738 </a></dt><dt> <a href="kerberos.html#id399496"> 739 739 The valid users did not work on the [homes]. 740 740 Has this functionality been restored yet? 741 </a></dt><dt> <a href="kerberos.html#id3 77431">741 </a></dt><dt> <a href="kerberos.html#id399559"> 742 742 Is the bias against use of the force user and force group 743 743 really warranted? 744 </a></dt><dt> <a href="kerberos.html#id3 77492">744 </a></dt><dt> <a href="kerberos.html#id399620"> 745 745 The example given for file and directory access control forces all files to be owned by one 746 746 particular user. I do not like that. Is there any way I can see who created the file? 747 </a></dt><dt> <a href="kerberos.html#id3 77536">747 </a></dt><dt> <a href="kerberos.html#id399664"> 748 748 In the book, “The Official Samba-3 HOWTO and Reference Guide”, you recommended use 749 749 of the Windows NT4 Server Manager (part of the SRVTOOLS.EXE) utility. Why 750 750 have you mentioned only the use of the Windows 200x/XP MMC Computer Management utility? 751 </a></dt><dt> <a href="kerberos.html#id3 77596">751 </a></dt><dt> <a href="kerberos.html#id399724"> 752 752 I tried to set valid users = @Engineers, but it does not work. My Samba 753 753 server is an Active Directory domain member server. Has this been fixed now? 754 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id3 77142"></a><a name="id377144"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id377147"></a><a class="indexterm" name="id377155"></a>754 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id399266"></a><a name="id399268"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id399272"></a><a class="indexterm" name="id399280"></a> 755 755 Does Samba-3 require the <code class="constant">Sign'n'seal</code> registry hacks needed by Samba-2? 756 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id3 77174"></a><a class="indexterm" name="id377182"></a><a class="indexterm" name="id377190"></a>756 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id399298"></a><a class="indexterm" name="id399306"></a><a class="indexterm" name="id399314"></a> 757 757 No. Samba-3 fully supports <code class="constant">Sign'n'seal</code> as well as <code class="constant">schannel</code> 758 758 operation. The registry change should not be applied when Samba-3 is used as a domain controller. 759 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 77210"></a><a name="id377212"></a></td><td align="left" valign="top"><p>759 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id399334"></a><a name="id399337"></a></td><td align="left" valign="top"><p> 760 760 Does Samba-3 support Active Directory? 761 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id3 77222"></a>761 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id399347"></a> 762 762 Yes. Samba-3 can be a fully participating native mode Active Directory client. Samba-3 does not 763 763 provide Active Directory services. It cannot be used to replace a Microsoft Active Directory 764 764 server implementation. Samba-3 can function as an Active Directory client (workstation) toolkit, 765 765 and it can function as an Active Directory domain member server. 766 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 77238"></a><a name="id377240"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id377243"></a>766 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id399362"></a><a name="id399364"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id399367"></a> 767 767 When Samba-3 is used with Active Directory, is it necessary to run mixed-mode operation, as was 768 768 necessary with Samba-2? 769 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id3 77259"></a>769 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id399383"></a> 770 770 No. Samba-3 can be used with NetBIOS over TCP/IP disabled, just as can be done with Windows 200x 771 771 Server and 200x/XPPro client products. It is no longer necessary to run mixed-mode operation, 772 772 because Samba-3 can join a native Windows 2003 Server ADS domain. 773 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 77273"></a><a name="id377275"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id377278"></a>773 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id399397"></a><a name="id399400"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id399403"></a> 774 774 Is it safe to set share-level access controls in Samba? 775 775 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 777 777 very mature technology. Not enough sites make use of this powerful capability, neither on 778 778 Windows server or with Samba servers. 779 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 77300"></a><a name="id377302"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id377305"></a>779 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id399424"></a><a name="id399426"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id399429"></a> 780 780 Is it mandatory to set share ACLs to get a secure Samba-3 server? 781 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id3 77320"></a><a class="indexterm" name="id377328"></a><a class="indexterm" name="id377336"></a><a class="indexterm" name="id377344"></a><a class="indexterm" name="id377352"></a>781 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id399444"></a><a class="indexterm" name="id399452"></a><a class="indexterm" name="id399460"></a><a class="indexterm" name="id399468"></a><a class="indexterm" name="id399476"></a> 782 782 No. Samba-3 honors UNIX/Linux file system security, supports Windows 200x ACLs, and provides 783 783 means of securing shares through share definition controls in the <code class="filename">smb.conf</code> file. The additional 784 784 support for share-level ACLs is like frosting on the cake. It adds to security but is not essential 785 785 to it. 786 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 77372"></a><a name="id377374"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id377378"></a>786 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id399496"></a><a name="id399499"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id399502"></a> 787 787 The <em class="parameter"><code>valid users</code></em> did not work on the <em class="parameter"><code>[homes]</code></em>. 788 788 Has this functionality been restored yet? 789 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id3 77404"></a>789 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id399529"></a> 790 790 Yes. This was fixed in Samba-3.0.2. The use of this parameter is strongly recommended as a safeguard 791 791 on the <em class="parameter"><code>[homes]</code></em> meta-service. The correct way to specify this is: 792 <a class=" indexterm" name="id377421"></a>valid users = %S.793 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 77431"></a><a name="id377433"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id377436"></a><a class="indexterm" name="id377444"></a><a class="indexterm" name="id377452"></a>792 <a class="link" href="smb.conf.5.html#VALIDUSERS">valid users = %S</a>. 793 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id399559"></a><a name="id399561"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id399564"></a><a class="indexterm" name="id399572"></a><a class="indexterm" name="id399580"></a> 794 794 Is the bias against use of the <em class="parameter"><code>force user</code></em> and <em class="parameter"><code>force group</code></em> 795 795 really warranted? 796 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id3 77479"></a>796 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id399606"></a> 797 797 There is no bias. There is a determination to recommend the right tool for the task at hand. 798 798 After all, it is better than putting users through performance problems, isn't it? 799 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 77492"></a><a name="id377494"></a></td><td align="left" valign="top"><p>799 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id399620"></a><a name="id399622"></a></td><td align="left" valign="top"><p> 800 800 The example given for file and directory access control forces all files to be owned by one 801 801 particular user. I do not like that. Is there any way I can see who created the file? 802 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id3 77506"></a>802 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id399634"></a> 803 803 Sure. You do not have to set the SUID bit on the directory. Simply execute the following command 804 804 to permit file ownership to be retained by the user who created it: … … 808 808 Note that this required no more than removing the <code class="constant">u</code> argument so that the 809 809 SUID bit is not set for the owner. 810 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 77536"></a><a name="id377538"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id377541"></a>810 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id399664"></a><a name="id399666"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id399669"></a> 811 811 In the book, “<span class="quote">The Official Samba-3 HOWTO and Reference Guide</span>”, you recommended use 812 812 of the Windows NT4 Server Manager (part of the <code class="filename">SRVTOOLS.EXE</code>) utility. Why 813 813 have you mentioned only the use of the Windows 200x/XP MMC Computer Management utility? 814 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id3 77567"></a><a class="indexterm" name="id377575"></a>814 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id399695"></a><a class="indexterm" name="id399702"></a> 815 815 Either tool can be used with equal effect. There is no benefit of one over the other, except that 816 816 the MMC utility is present on all Windows 200x/XP systems and does not require additional software … … 818 818 Samba-controlled domain, the only tool that permits that is the NT4 Domain User Manager, which 819 819 is provided as part of the <code class="filename">SRVTOOLS.EXE</code> utility. 820 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 77596"></a><a name="id377599"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id377602"></a><a class="indexterm" name="id377610"></a><a class="indexterm" name="id377618"></a>820 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id399724"></a><a name="id399726"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id399730"></a><a class="indexterm" name="id399737"></a><a class="indexterm" name="id399745"></a> 821 821 I tried to set <em class="parameter"><code>valid users = @Engineers</code></em>, but it does not work. My Samba 822 822 server is an Active Directory domain member server. Has this been fixed now? … … 824 824 The use of this parameter has always required the full specification of the domain account, for 825 825 example, <em class="parameter"><code>valid users = @"MEGANET2\Domain Admins"</code></em>. 826 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"></div><div class="footnote"><a href="http://199.105.191.226/Man/2699/020430msdoj/" target="_top"><sup>[<a name="ftn.id374937" href="#id374937">13</a>] </sup>ITWorld.com</a></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="RefSection.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="RefSection.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="DomApps.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Part III. Reference Section </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 12. Integrating Additional Services</td></tr></table></div></body></html>826 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"></div><div class="footnote"><a class="ulink" href="http://199.105.191.226/Man/2699/020430msdoj/" target="_top"><sup>[<a name="ftn.id397060" href="#id397060" class="ulink">13</a>] </sup>ITWorld.com</a></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="RefSection.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="RefSection.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="DomApps.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Part III. Reference Section </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 12. Integrating Additional Services</td></tr></table></div></body></html> -
branches/samba-3.0/docs/htmldocs/Samba3-ByExample/ntmigration.html
r44 r134 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 9. Migrating NT4 Domain to Samba-3</title><link rel="stylesheet" href=" samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="upgrades.html" title="Chapter 8. Updating Samba-3"><link rel="next" href="nw4migration.html" title="Chapter 10. Migrating NetWare Server to Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 9. Migrating NT4 Domain to Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="upgrades.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="nw4migration.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="ntmigration"></a>Chapter 9. Migrating NT4 Domain to Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ntmigration.html#id364185">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id364261">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id364312">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id364468">Technical Issues</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id364771">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id364791">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id364916">NT4 Migration Using LDAP Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id367204">NT4 Migration Using tdbsam Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id367537">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id367572">Questions and Answers</a></span></dt></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 9. Migrating NT4 Domain to Samba-3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="upgrades.html" title="Chapter 8. Updating Samba-3"><link rel="next" href="nw4migration.html" title="Chapter 10. Migrating NetWare Server to Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 9. Migrating NT4 Domain to Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="upgrades.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="nw4migration.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="ntmigration"></a>Chapter 9. Migrating NT4 Domain to Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ntmigration.html#id386514">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id386589">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id386640">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id386802">Technical Issues</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id387105">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id387125">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id387250">NT4 Migration Using LDAP Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id389442">NT4 Migration Using tdbsam Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id389787">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id389822">Questions and Answers</a></span></dt></dl></div><p> 2 2 Ever since Microsoft announced that it was discontinuing support for Windows 3 3 NT4, Samba users started to ask for detailed instructions on how to migrate … … 7 7 One wonders how many NT4 systems will be left in service by the time you read this 8 8 book though. 9 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 64185"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id364192"></a>9 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id386514"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id386520"></a> 10 10 Network administrators who want to migrate off a Windows NT4 environment know 11 11 one thing with certainty. They feel that NT4 has been abandoned, and they want … … 14 14 failure, and much more. 15 15 </p><p> 16 <a class="indexterm" name="id3 64207"></a>17 <a class="indexterm" name="id3 64213"></a>18 <a class="indexterm" name="id3 64223"></a>19 <a class="indexterm" name="id3 64232"></a>16 <a class="indexterm" name="id386535"></a> 17 <a class="indexterm" name="id386542"></a> 18 <a class="indexterm" name="id386551"></a> 19 <a class="indexterm" name="id386560"></a> 20 20 The migration from NT4 to Samba-3 can involve a number of factors, including 21 21 migration of data to another server, migration of network environment controls … … 23 23 accounts. 24 24 </p><p> 25 <a class="indexterm" name="id3 64246"></a>25 <a class="indexterm" name="id386575"></a> 26 26 It should be pointed out now that it is possible to migrate some systems from 27 27 a Windows NT4 domain environment to a Samba-3 domain environment. This is certainly … … 31 31 migration before an environment that is acceptable for immediate use 32 32 is obtained. 33 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 64261"></a>Assignment Tasks</h3></div></div></div><p>34 <a class="indexterm" name="id3 64268"></a>35 <a class="indexterm" name="id3 64275"></a>36 <a class="indexterm" name="id3 64282"></a>33 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id386589"></a>Assignment Tasks</h3></div></div></div><p> 34 <a class="indexterm" name="id386597"></a> 35 <a class="indexterm" name="id386604"></a> 36 <a class="indexterm" name="id386611"></a> 37 37 You are about to migrate an MS Windows NT4 domain accounts database to 38 38 a Samba-3 server. The Samba-3 server is using a … … 43 43 Your objective is to document the process of migrating user and group accounts 44 44 from several NT4 domains into a single Samba-3 LDAP backend database. 45 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 64312"></a>Dissection and Discussion</h2></div></div></div><p>46 <a class="indexterm" name="id3 64319"></a>47 <a class="indexterm" name="id3 64326"></a>48 <a class="indexterm" name="id3 64333"></a>49 <a class="indexterm" name="id3 64344"></a>50 <a class="indexterm" name="id3 64356"></a>51 <a class="indexterm" name="id3 64362"></a>45 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id386640"></a>Dissection and Discussion</h2></div></div></div><p> 46 <a class="indexterm" name="id386648"></a> 47 <a class="indexterm" name="id386654"></a> 48 <a class="indexterm" name="id386661"></a> 49 <a class="indexterm" name="id386672"></a> 50 <a class="indexterm" name="id386684"></a> 51 <a class="indexterm" name="id386691"></a> 52 52 The migration process takes a snapshot of information that is stored in the 53 53 Windows NT4 registry-based accounts database. That information resides in … … 55 55 <code class="constant">SAM</code> and <code class="constant">SECURITY</code>. 56 56 </p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p> 57 <a class="indexterm" name="id3 64384"></a>58 <a class="indexterm" name="id3 64391"></a>57 <a class="indexterm" name="id386713"></a> 58 <a class="indexterm" name="id386720"></a> 59 59 The Windows NT4 registry keys called <code class="constant">SAM</code> and <code class="constant">SECURITY</code> 60 60 are protected so that you cannot view the contents. If you change the security setting … … 62 62 do this unless you are willing to render your domain controller inoperative. 63 63 </p></div><p> 64 <a class="indexterm" name="id3 64413"></a>65 <a class="indexterm" name="id3 64422"></a>64 <a class="indexterm" name="id386739"></a> 65 <a class="indexterm" name="id386749"></a> 66 66 Before commencing an NT4 to Samba-3 migration, you should consider what your objectives are. 67 67 While in some cases it is possible simply to migrate an NT4 domain to a single Samba-3 server, … … 71 71 interact with the network environment. 72 72 </p><p> 73 <a class="indexterm" name="id3 64437"></a>74 <a class="indexterm" name="id3 64446"></a>75 <a class="indexterm" name="id3 64453"></a>73 <a class="indexterm" name="id386763"></a> 74 <a class="indexterm" name="id386772"></a> 75 <a class="indexterm" name="id386779"></a> 76 76 MS Windows NT4 was introduced some time around 1996. Many environments in which NT4 was deployed 77 77 have done little to keep the NT4 server environment up to date with more recent Windows releases, … … 84 84 real disruption to users, but rather, with due diligence and care, should make their network experience 85 85 a much happier one. 86 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 64468"></a>Technical Issues</h3></div></div></div><p>87 <a class="indexterm" name="id3 64476"></a>88 <a class="indexterm" name="id3 64483"></a>86 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id386802"></a>Technical Issues</h3></div></div></div><p> 87 <a class="indexterm" name="id386810"></a> 88 <a class="indexterm" name="id386816"></a> 89 89 Migration of an NT4 domain user and group database to Samba-3 involves a certain strategic 90 90 element. Many sites have asked for instructions regarding merging of multiple NT4 91 91 domains into one Samba-3 LDAP database. It seems that this is viewed as a significant 92 92 added value compared with the alternative of migration to Windows Server 200x and Active 93 Directory. The diagram in <a href="ntmigration.html#ch8-migration" title="Figure 9.1. Schematic Explaining the net rpc vampire Process">???</a> illustrates the effect of migration93 Directory. The diagram in <a class="link" href="ntmigration.html#ch8-migration" title="Figure 9.1. Schematic Explaining the net rpc vampire Process">“Schematic Explaining the net rpc vampire Process”</a> illustrates the effect of migration 94 94 from a Windows NT4 domain to a Samba domain. 95 95 </p><div class="figure"><a name="ch8-migration"></a><p class="title"><b>Figure 9.1. Schematic Explaining the <code class="literal">net rpc vampire</code> Process</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/ch8-migration.png" width="297" alt="Schematic Explaining the net rpc vampire Process"></div></div></div><br class="figure-break"><p> 96 <a class="indexterm" name="id3 64550"></a>97 <a class="indexterm" name="id3 64557"></a>96 <a class="indexterm" name="id386884"></a> 97 <a class="indexterm" name="id386891"></a> 98 98 If you want to merge multiple NT4 domain account databases into one Samba domain, 99 99 you must now dump the contents of the first migration and edit it as appropriate. Now clean … … 101 101 files. You must start each migration with a new database into which you merge your NT4 102 102 domains. 103 </p><p><a class="indexterm" name="id3 64575"></a>103 </p><p><a class="indexterm" name="id386908"></a> 104 104 At this point, you are ready to perform the second migration, following the same steps as 105 105 for the first. In other words, dump the database, edit it, and then you may merge the 106 106 dump for the first and second migrations. 107 </p><p><a class="indexterm" name="id3 64588"></a><a class="indexterm" name="id364596"></a><a class="indexterm" name="id364604"></a>107 </p><p><a class="indexterm" name="id386922"></a><a class="indexterm" name="id386929"></a><a class="indexterm" name="id386937"></a> 108 108 You must be careful. If you choose to migrate to an LDAP backend, your dump file 109 109 now contains the full account information, including the domain SID. The domain SID for each … … 111 111 portion of the account SIDs so that all are the same. 112 112 </p><p> 113 <a class="indexterm" name="id3 64618"></a>114 <a class="indexterm" name="id3 64625"></a>115 <a class="indexterm" name="id3 64632"></a>116 <a class="indexterm" name="id3 64639"></a>117 <a class="indexterm" name="id3 64646"></a>118 <a class="indexterm" name="id3 64652"></a>119 <a class="indexterm" name="id3 64659"></a>120 <a class="indexterm" name="id3 64666"></a>121 <a class="indexterm" name="id3 64673"></a>122 <a class="indexterm" name="id3 64680"></a>123 <a class="indexterm" name="id3 64686"></a>124 <a class="indexterm" name="id3 64693"></a>113 <a class="indexterm" name="id386952"></a> 114 <a class="indexterm" name="id386959"></a> 115 <a class="indexterm" name="id386966"></a> 116 <a class="indexterm" name="id386973"></a> 117 <a class="indexterm" name="id386979"></a> 118 <a class="indexterm" name="id386986"></a> 119 <a class="indexterm" name="id386993"></a> 120 <a class="indexterm" name="id387000"></a> 121 <a class="indexterm" name="id387007"></a> 122 <a class="indexterm" name="id387013"></a> 123 <a class="indexterm" name="id387020"></a> 124 <a class="indexterm" name="id387027"></a> 125 125 If you choose to use a tdbsam (<code class="filename">passdb.tdb</code>) backend file, your best choice 126 126 is to use <code class="literal">pdbedit</code> to export the contents of the tdbsam file into an … … 132 132 may be exported or imported into either a tdbsam (<code class="filename">passdb.tdb</code>) or 133 133 an LDAP backend. 134 </p><div class="figure"><a name="NT4DUM"></a><p class="title"><b>Figure 9.2. View of Accounts in NT4 Domain User Manager</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/UserMgrNT4.png" width="270" alt="View of Accounts in NT4 Domain User Manager"></div></div></div><br class="figure-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 64771"></a>Political Issues</h3></div></div></div><p>134 </p><div class="figure"><a name="NT4DUM"></a><p class="title"><b>Figure 9.2. View of Accounts in NT4 Domain User Manager</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/UserMgrNT4.png" width="270" alt="View of Accounts in NT4 Domain User Manager"></div></div></div><br class="figure-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id387105"></a>Political Issues</h3></div></div></div><p> 135 135 The merging of multiple Windows NT4-style domains into a single LDAP-backend-based Samba-3 136 136 domain may be seen by those who had power over them as a loss of prestige or a loss of … … 142 142 Samba-3 domain is to promote (sell) the action as one that reduces costs and delivers 143 143 greater network interoperability and manageability. 144 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 64791"></a>Implementation</h2></div></div></div><p>144 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id387125"></a>Implementation</h2></div></div></div><p> 145 145 From feedback on the Samba mailing lists, it seems that most Windows NT4 migrations 146 146 to Samba-3 are being performed using a new server or a new installation of a Linux or UNIX 147 147 server. If you contemplate doing this, please note that the steps that follow in this 148 148 chapter assume familiarity with the information that has been previously covered in this 149 book. You are particularly encouraged to be familiar with <a href="secure.html" title="Chapter 3. Secure Office Networking">???</a>,150 <a href="Big500users.html" title="Chapter 4. The 500-User Office">???</a> and <a href="happy.html" title="Chapter 5. Making Happy Users">???</a>.149 book. You are particularly encouraged to be familiar with <a class="link" href="secure.html" title="Chapter 3. Secure Office Networking">“Secure Office Networking”</a>, 150 <a class="link" href="Big500users.html" title="Chapter 4. The 500-User Office">“The 500-User Office”</a> and <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>. 151 151 </p><p> 152 152 We present here the steps and example output for two NT4 to Samba-3 domain migrations. The … … 156 156 </p><p> 157 157 Before proceeding to NT4 migration using either a tdbsam or ldapsam, it is most strongly recommended to 158 review <a href="Big500users.html#ch5-dnshcp-setup" title="Installation of DHCP, DNS, and Samba Control Files">???</a> for DNS and DHCP configuration. The importance of correctly158 review <a class="link" href="Big500users.html#ch5-dnshcp-setup" title="Installation of DHCP, DNS, and Samba Control Files">“Installation of DHCP, DNS, and Samba Control Files”</a> for DNS and DHCP configuration. The importance of correctly 159 159 functioning name resolution must be recognized. This applies equally for both hostname and NetBIOS names 160 160 (machine names, computer names, domain names, workgroup names ALL names!). … … 165 165 migration to either a tdbsam or an ldapsam backend. 166 166 </p></li><li><p> 167 <a class="indexterm" name="id3 64867"></a>168 <a class="indexterm" name="id3 64874"></a>169 <a class="indexterm" name="id3 64880"></a>167 <a class="indexterm" name="id387200"></a> 168 <a class="indexterm" name="id387207"></a> 169 <a class="indexterm" name="id387214"></a> 170 170 Clean up the source NT4 PDC. Delete all accounts that need not be migrated. 171 171 Delete all files that should not be migrated. Where possible, change NT group … … 175 175 </p></li><li><p> 176 176 Step through the migration process. 177 </p></li><li><p><a class="indexterm" name="id3 64898"></a>177 </p></li><li><p><a class="indexterm" name="id387232"></a> 178 178 Remove the NT4 PDC from the network. 179 179 </p></li><li><p> … … 182 182 </p></li></ul></div><p> 183 183 It may help to use the above outline as a pre-migration checklist. 184 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 64916"></a>NT4 Migration Using LDAP Backend</h3></div></div></div><p>184 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id387250"></a>NT4 Migration Using LDAP Backend</h3></div></div></div><p> 185 185 In this example, the migration is of an NT4 PDC to a Samba-3 PDC with an LDAP backend. The accounts about 186 to be migrated are shown in <a href="ntmigration.html#NT4DUM" title="Figure 9.2. View of Accounts in NT4 Domain User Manager">???</a>. In this example use is made of the186 to be migrated are shown in <a class="link" href="ntmigration.html#NT4DUM" title="Figure 9.2. View of Accounts in NT4 Domain User Manager">“View of Accounts in NT4 Domain User Manager”</a>. In this example use is made of the 187 187 smbldap-tools scripts to add the accounts that are migrated into the ldapsam passdb backend. 188 188 Four scripts are essential to the migration process. Other scripts will be required 189 189 for daily management, but these are not critical to migration. The critical scripts are dependant 190 on which passdb backend is being used. Refer to <a href="ntmigration.html#ch8-vampire" title="Table 9.1. Samba smb.conf Scripts Essential to Samba Operation">???</a> to see which scripts190 on which passdb backend is being used. Refer to <a class="link" href="ntmigration.html#ch8-vampire" title="Table 9.1. Samba smb.conf Scripts Essential to Samba Operation">“Samba smb.conf Scripts Essential to Samba Operation”</a> to see which scripts 191 191 must be provided so that the migration process can complete. 192 192 </p><p> … … 200 200 before commencing the following configuration steps. 201 201 </p></div><div class="table"><a name="ch8-vampire"></a><p class="title"><b>Table 9.1. Samba <code class="filename">smb.conf</code> Scripts Essential to Samba Operation</b></p><div class="table-contents"><table summary="Samba smb.conf Scripts Essential to Samba Operation" border="1"><colgroup><col align="left"><col align="center"><col align="center"></colgroup><thead><tr><th align="left">Entity</th><th align="center">ldapsam Script</th><th align="center">tdbsam Script</th></tr></thead><tbody><tr><td align="left">Add User Accounts</td><td align="center">smbldap-useradd</td><td align="center">useradd</td></tr><tr><td align="left">Delete User Accounts</td><td align="center">smbldap-userdel</td><td align="center">userdel</td></tr><tr><td align="left">Add Group Accounts</td><td align="center">smbldap-groupadd</td><td align="center">groupadd</td></tr><tr><td align="left">Delete Group Accounts</td><td align="center">smbldap-groupdel</td><td align="center">groupdel</td></tr><tr><td align="left">Add User to Group</td><td align="center">smbldap-groupmod</td><td align="center">usermod (See Note)</td></tr><tr><td align="left">Add Machine Accounts</td><td align="center">smbldap-useradd</td><td align="center">useradd</td></tr></tbody></table></div></div><br class="table-break"><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 202 <a class="indexterm" name="id3 65106"></a>203 <a class="indexterm" name="id3 65113"></a>204 <a class="indexterm" name="id3 65120"></a>202 <a class="indexterm" name="id387440"></a> 203 <a class="indexterm" name="id387447"></a> 204 <a class="indexterm" name="id387453"></a> 205 205 The UNIX/Linux <code class="literal">usermod</code> utility does not permit simple user addition to (or deletion 206 206 of users from) groups. This is a feature provided by the smbldap-tools scripts. If you want this … … 210 210 in the formal commands provided by Linux distributions (March 2004). 211 211 </p></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 212 <a class="indexterm" name="id3 65153"></a>212 <a class="indexterm" name="id387486"></a> 213 213 The <code class="literal">tdbdump</code> utility is a utility that you can build from the Samba source-code tree. Not all Linux binary distributions include this tool. If it is missing from your 214 214 Linux distribution, you will need to build this yourself or else forgo its use. 215 215 </p></div><p> 216 <a class="indexterm" name="id3 65171"></a>216 <a class="indexterm" name="id387504"></a> 217 217 Before starting the migration, all dead accounts were removed from the NT4 domain using the User Manager for Domains. 218 </p><div class="procedure"><a name="id3 65180"></a><p class="title"><b>Procedure 9.1. User Migration Steps</b></p><div class="example"><a name="sbent4smb"></a><p class="title"><b>Example 9.1. NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id365238"></a><em class="parameter"><code>workgroup = DAMNATION</code></em></td></tr><tr><td><a class="indexterm" name="id365250"></a><em class="parameter"><code>netbios name = MERLIN</code></em></td></tr><tr><td><a class="indexterm" name="id365263"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id365276"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id365288"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id365301"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id365313"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id365326"></a><em class="parameter"><code>smb ports = 139 445</code></em></td></tr><tr><td><a class="indexterm" name="id365338"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id365351"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id365364"></a><em class="parameter"><code>#delete user script = /opt/IDEALX/sbin/smbldap-userdel '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id365377"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id365390"></a><em class="parameter"><code>#delete group script = /opt/IDEALX/sbin/smbldap-groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id365403"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/ smbldap-groupmod -m '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id365416"></a><em class="parameter"><code>#delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id365429"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id365442"></a><em class="parameter"><code>add machine script = /opt/IDEALX/sbin/smbldap-useradd -w '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id365455"></a><em class="parameter"><code>logon script = scripts\logon.cmd</code></em></td></tr><tr><td><a class="indexterm" name="id365468"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id365481"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id365493"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id365506"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id365518"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id365531"></a><em class="parameter"><code>#wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id365543"></a><em class="parameter"><code>wins server = 192.168.123.124</code></em></td></tr><tr><td><a class="indexterm" name="id365556"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=terpstra-world,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id365569"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id365581"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id365594"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id365607"></a><em class="parameter"><code>ldap passwd sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id365619"></a><em class="parameter"><code>ldap suffix = dc=terpstra-world,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id365632"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id365644"></a><em class="parameter"><code>ldap timeout = 20</code></em></td></tr><tr><td><a class="indexterm" name="id365657"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id365670"></a><em class="parameter"><code>idmap backend = ldap:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id365682"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id365695"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id365707"></a><em class="parameter"><code>winbind nested groups = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id365720"></a><em class="parameter"><code>ea support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id365733"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbent4smb2"></a><p class="title"><b>Example 9.2. NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id365778"></a><em class="parameter"><code>comment = Application Data</code></em></td></tr><tr><td><a class="indexterm" name="id365791"></a><em class="parameter"><code>path = /data/home/apps</code></em></td></tr><tr><td><a class="indexterm" name="id365803"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id365825"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id365838"></a><em class="parameter"><code>path = /home/users/%U/Documents</code></em></td></tr><tr><td><a class="indexterm" name="id365850"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id365863"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id365875"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id365897"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id365909"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id365922"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id365934"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id365947"></a><em class="parameter"><code>use client driver = No</code></em></td></tr><tr><td><a class="indexterm" name="id365960"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id365981"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id365994"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id366006"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id366019"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id366040"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id366053"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id366066"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id366078"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id366100"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id366112"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id366125"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id366137"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id366159"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id366172"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbentslapd"></a><p class="title"><b>Example 9.3. NT4 Migration LDAP Server Configuration File: <code class="filename">/etc/openldap/slapd.conf</code> Part A</b></p><div class="example-contents"><pre class="screen">218 </p><div class="procedure"><a name="id387514"></a><p class="title"><b>Procedure 9.1. User Migration Steps</b></p><div class="example"><a name="sbent4smb"></a><p class="title"><b>Example 9.1. NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id387571"></a><em class="parameter"><code>workgroup = DAMNATION</code></em></td></tr><tr><td><a class="indexterm" name="id387583"></a><em class="parameter"><code>netbios name = MERLIN</code></em></td></tr><tr><td><a class="indexterm" name="id387594"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id387606"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id387618"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id387629"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id387641"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id387652"></a><em class="parameter"><code>smb ports = 139 445</code></em></td></tr><tr><td><a class="indexterm" name="id387664"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id387675"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id387687"></a><em class="parameter"><code>#delete user script = /opt/IDEALX/sbin/smbldap-userdel '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id387699"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id387711"></a><em class="parameter"><code>#delete group script = /opt/IDEALX/sbin/smbldap-groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id387723"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/ smbldap-groupmod -m '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id387735"></a><em class="parameter"><code>#delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id387747"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id387759"></a><em class="parameter"><code>add machine script = /opt/IDEALX/sbin/smbldap-useradd -w '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id387771"></a><em class="parameter"><code>logon script = scripts\logon.cmd</code></em></td></tr><tr><td><a class="indexterm" name="id387782"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id387794"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id387806"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id387817"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id387828"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id387840"></a><em class="parameter"><code>#wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id387851"></a><em class="parameter"><code>wins server = 192.168.123.124</code></em></td></tr><tr><td><a class="indexterm" name="id387863"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=terpstra-world,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id387875"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id387886"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id387898"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id387910"></a><em class="parameter"><code>ldap passwd sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id387921"></a><em class="parameter"><code>ldap suffix = dc=terpstra-world,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id387933"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id387944"></a><em class="parameter"><code>ldap timeout = 20</code></em></td></tr><tr><td><a class="indexterm" name="id387956"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id387967"></a><em class="parameter"><code>idmap backend = ldap:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id387979"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id387990"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id388002"></a><em class="parameter"><code>winbind nested groups = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id388013"></a><em class="parameter"><code>ea support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id388025"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbent4smb2"></a><p class="title"><b>Example 9.2. NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id388069"></a><em class="parameter"><code>comment = Application Data</code></em></td></tr><tr><td><a class="indexterm" name="id388081"></a><em class="parameter"><code>path = /data/home/apps</code></em></td></tr><tr><td><a class="indexterm" name="id388092"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id388113"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id388124"></a><em class="parameter"><code>path = /home/users/%U/Documents</code></em></td></tr><tr><td><a class="indexterm" name="id388136"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id388147"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id388159"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id388179"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id388191"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id388202"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id388214"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id388225"></a><em class="parameter"><code>use client driver = No</code></em></td></tr><tr><td><a class="indexterm" name="id388237"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id388257"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id388269"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id388280"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id388292"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id388312"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id388324"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id388335"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id388347"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id388367"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id388379"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id388390"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id388402"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id388422"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id388434"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbentslapd"></a><p class="title"><b>Example 9.3. NT4 Migration LDAP Server Configuration File: <code class="filename">/etc/openldap/slapd.conf</code> Part A</b></p><div class="example-contents"><pre class="screen"> 219 219 include /etc/openldap/schema/core.schema 220 220 include /etc/openldap/schema/cosine.schema … … 333 333 </pre></div></div><br class="example-break"><ol type="1"><li><p> 334 334 Configure the Samba <code class="filename">smb.conf</code> file to create a BDC. An example configuration is 335 given in <a href="ntmigration.html#sbent4smb" title="Example 9.1. NT4 Migration Samba-3 Server smb.conf Part: A">???</a>.335 given in <a class="link" href="ntmigration.html#sbent4smb" title="Example 9.1. NT4 Migration Samba-3 Server smb.conf Part: A">“NT4 Migration Samba-3 Server smb.conf Part: A”</a>. 336 336 The delete scripts are commented out so that during the process of migration 337 337 no account information can be deleted. 338 338 </p></li><li><p> 339 <a class="indexterm" name="id3 66191"></a>339 <a class="indexterm" name="id388452"></a> 340 340 Configure OpenLDAP in preparation for the migration. An example 341 <code class="filename">sladp.conf</code> file is shown in <a href="ntmigration.html#sbentslapd" title="Example 9.3. NT4 Migration LDAP Server Configuration File: /etc/openldap/slapd.conf Part A">???</a>.341 <code class="filename">sladp.conf</code> file is shown in <a class="link" href="ntmigration.html#sbentslapd" title="Example 9.3. NT4 Migration LDAP Server Configuration File: /etc/openldap/slapd.conf Part A">“NT4 Migration LDAP Server Configuration File: /etc/openldap/slapd.conf Part A”</a>. 342 342 The <code class="constant">rootpw</code> value is an encrypted password string that can 343 343 be obtained by executing the <code class="literal">slappasswd</code> command. 344 344 </p></li><li><p> 345 <a class="indexterm" name="id3 66289"></a>346 <a class="indexterm" name="id3 66296"></a>345 <a class="indexterm" name="id388551"></a> 346 <a class="indexterm" name="id388557"></a> 347 347 Install the PADL <code class="literal">nss_ldap</code> tool set, then configure the <code class="filename">/etc/ldap.conf</code> 348 as shown in <a href="ntmigration.html#sbrntldapconf" title="Example 9.5. NT4 Migration NSS LDAP File: /etc/ldap.conf">???</a>.349 </p></li><li><p> 350 <a class="indexterm" name="id3 66352"></a>348 as shown in <a class="link" href="ntmigration.html#sbrntldapconf" title="Example 9.5. NT4 Migration NSS LDAP File: /etc/ldap.conf">“NT4 Migration NSS LDAP File: /etc/ldap.conf”</a>. 349 </p></li><li><p> 350 <a class="indexterm" name="id388613"></a> 351 351 Edit the <code class="filename">/etc/nsswitch.conf</code> file so it has the entries shown 352 in <a href="ntmigration.html#sbentnss" title="Example 9.6. NT4 Migration NSS Control File: /etc/nsswitch.conf (Stage:1)">???</a>. Note that the LDAP entries have been commented out.352 in <a class="link" href="ntmigration.html#sbentnss" title="Example 9.6. NT4 Migration NSS Control File: /etc/nsswitch.conf (Stage:1)">“NT4 Migration NSS Control File: /etc/nsswitch.conf (Stage:1)”</a>. Note that the LDAP entries have been commented out. 353 353 This is deliberate. If these entries are active (not commented out), and the 354 354 <code class="filename">/etc/ldap.conf</code> file has been configured, when the LDAP server … … 393 393 </pre><p> 394 394 </p></li><li><p> 395 <a class="indexterm" name="id3 66500"></a>396 <a class="indexterm" name="id3 66506"></a>397 <a class="indexterm" name="id3 66513"></a>398 <a class="indexterm" name="id3 66520"></a>395 <a class="indexterm" name="id388761"></a> 396 <a class="indexterm" name="id388768"></a> 397 <a class="indexterm" name="id388774"></a> 398 <a class="indexterm" name="id388781"></a> 399 399 Install the Idealx <code class="literal">smbldap-tools</code> software package, following 400 the instructions given in <a href="happy.html#sbeidealx" title="Install and Configure Idealx smbldap-tools Scripts">???</a>. The resulting perl scripts400 the instructions given in <a class="link" href="happy.html#sbeidealx" title="Install and Configure Idealx smbldap-tools Scripts">“Install and Configure Idealx smbldap-tools Scripts”</a>. The resulting perl scripts 401 401 should be located in the <code class="filename">/opt/IDEALX/sbin</code> directory. 402 402 Change into that location, or wherever the scripts have been installed. Execute the … … 490 490 /etc/smbldap-tools/smbldap_bind.conf done. 491 491 </pre><p> 492 <a class="indexterm" name="id3 66615"></a>493 <a class="indexterm" name="id3 66622"></a>494 <a class="indexterm" name="id3 66629"></a>495 <a class="indexterm" name="id3 66636"></a>492 <a class="indexterm" name="id388877"></a> 493 <a class="indexterm" name="id388883"></a> 494 <a class="indexterm" name="id388890"></a> 495 <a class="indexterm" name="id388897"></a> 496 496 Note that the NT4 domain SID that was previously obtained was entered above. Also, 497 497 the sambaUnixIdPooldn object was specified as sambaDomainName=DAMNATION. This is … … 510 510 </p></li><li><p> 511 511 Edit the <code class="filename">/etc/nsswitch.conf</code> file so it has the entries shown in 512 <a href="ntmigration.html#sbentnss2" title="Example 9.7. NT4 Migration NSS Control File: /etc/nsswitch.conf (Stage:2)">???</a>. Note that the LDAP entries have now been uncommented.512 <a class="link" href="ntmigration.html#sbentnss2" title="Example 9.7. NT4 Migration NSS Control File: /etc/nsswitch.conf (Stage:2)">“NT4 Migration NSS Control File: /etc/nsswitch.conf (Stage:2)”</a>. Note that the LDAP entries have now been uncommented. 513 513 </p></li><li><p> 514 514 The LDAP management password must be installed into the <code class="filename">secrets.tdb</code> … … 546 546 This is expected behavior. 547 547 </p></li><li><p> 548 <a class="indexterm" name="id3 66775"></a>548 <a class="indexterm" name="id389036"></a> 549 549 Restart the LDAP server following initialization of the LDAP directory. Execute the 550 550 system control script provided on your system. The following steps can be used on … … 640 640 </pre><p> 641 641 Check the vampire log to confirm that only expected errors have been 642 reported. See <a href="ntmigration.html#sbevam1" title="Migration Log Validation">???</a>.642 reported. See <a class="link" href="ntmigration.html#sbevam1" title="Migration Log Validation">“Migration Log Validation”</a>. 643 643 </p></li><li><p> 644 644 The migration of user accounts can be quickly validated as follows: … … 713 713 across, set up privileges, and set share and file/directory access controls. 714 714 </p></li><li><p> 715 <a class="indexterm" name="id3 67029"></a>716 <a class="indexterm" name="id3 67036"></a>715 <a class="indexterm" name="id389291"></a> 716 <a class="indexterm" name="id389297"></a> 717 717 Edit the <code class="filename">smb.conf</code> file to reset the parameter 718 <a class=" indexterm" name="id367049"></a>domain master = Yesso that718 <a class="link" href="smb.conf.5.html#DOMAINMASTER">domain master = Yes</a> so that 719 719 the Samba server functions as a PDC for the purpose of migration. 720 720 Also, uncomment the deletion scripts so they will now be fully functional, … … 747 747 The configuration of Samba-3 BDC servers can be accomplished now or at any 748 748 convenient time in the future. Please refer to the carefully detailed process 749 for doing so is outlined in <a href="happy.html#sbehap-bldg1" title="Samba-3 BDC Configuration">???</a>.749 for doing so is outlined in <a class="link" href="happy.html#sbehap-bldg1" title="Samba-3 BDC Configuration">“Samba-3 BDC Configuration”</a>. 750 750 </p></li></ol></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="sbevam1"></a>Migration Log Validation</h4></div></div></div><p> 751 751 The following <code class="filename">vampire.log</code> file is typical of a valid migration. … … 842 842 Creating unix group: 'Users' 843 843 </pre><p> 844 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 67204"></a>NT4 Migration Using tdbsam Backend</h3></div></div></div><p>844 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id389442"></a>NT4 Migration Using tdbsam Backend</h3></div></div></div><p> 845 845 In this example, we change the domain name of the NT4 server from 846 846 <code class="constant">DRUGPREP</code> to <code class="constant">MEGANET</code> prior to the use … … 850 850 databases. These entries must therefore be present, and correct options specified, 851 851 in your <code class="filename">smb.conf</code> file, or else the migration does not work as it should. 852 </p><div class="procedure"><a name="id3 67248"></a><p class="title"><b>Procedure 9.2. Migration Steps Using tdbsam</b></p><ol type="1"><li><p>853 Prepare a Samba-3 server precisely per the instructions shown in <a href="Big500users.html" title="Chapter 4. The 500-User Office">???</a>.852 </p><div class="procedure"><a name="id389486"></a><p class="title"><b>Procedure 9.2. Migration Steps Using tdbsam</b></p><ol type="1"><li><p> 853 Prepare a Samba-3 server precisely per the instructions shown in <a class="link" href="Big500users.html" title="Chapter 4. The 500-User Office">“The 500-User Office”</a>. 854 854 Set the workgroup name to <code class="constant">MEGANET</code>. 855 </p></li><li><p><a class="indexterm" name="id3 67275"></a><a class="indexterm" name="id367282"></a>855 </p></li><li><p><a class="indexterm" name="id389513"></a><a class="indexterm" name="id389520"></a> 856 856 Edit the <code class="filename">smb.conf</code> file to temporarily change the parameter 857 <a class=" indexterm" name="id367298"></a>domain master = Noso857 <a class="link" href="smb.conf.5.html#DOMAINMASTER">domain master = No</a> so 858 858 the Samba server functions as a BDC for the purpose of migration. 859 859 </p></li><li><p> 860 860 Start Samba as you have done previously. 861 </p></li><li><p><a class="indexterm" name="id3 67318"></a>861 </p></li><li><p><a class="indexterm" name="id389559"></a> 862 862 Join the NT4 Domain as a BDC, as shown here: 863 863 </p><pre class="screen"> … … 865 865 Joined domain MEGANET. 866 866 </pre><p> 867 </p></li><li><p><a class="indexterm" name="id3 67351"></a>867 </p></li><li><p><a class="indexterm" name="id389593"></a> 868 868 You may vampire the accounts from the NT4 PDC by executing the command, as shown here: 869 869 </p><pre class="screen"> … … 905 905 SAM_DELTA_DOMAIN_INFO not handled 906 906 </pre><p> 907 </p></li><li><p><a class="indexterm" name="id3 67395"></a>907 </p></li><li><p><a class="indexterm" name="id389636"></a> 908 908 At this point, we can validate our migration. Let's look at the accounts 909 909 in the form in which they are seen in a smbpasswd file. This achieves that: … … 937 937 CF271B744F7A55AFDA277FF88D80C527:[UX ]:LCT-3E8B4270: 938 938 </pre><p> 939 </p></li><li><p><a class="indexterm" name="id3 67434"></a>939 </p></li><li><p><a class="indexterm" name="id389688"></a> 940 940 An expanded view of a user account entry shows more of what was 941 941 obtained from the NT4 PDC: … … 963 963 Password must change: Mon, 18 Jan 2038 20:14:07 GMT 964 964 </pre><p> 965 </p></li><li><p><a class="indexterm" name="id3 67468"></a>965 </p></li><li><p><a class="indexterm" name="id389715"></a> 966 966 The following command lists the long names of the groups that have been 967 967 imported (vampired) from the NT4 PDC: … … 980 980 </pre><p> 981 981 Everything looks well and in order. 982 </p></li><li><p><a class="indexterm" name="id3 67503"></a><a class="indexterm" name="id367511"></a>982 </p></li><li><p><a class="indexterm" name="id389750"></a><a class="indexterm" name="id389758"></a> 983 983 Edit the <code class="filename">smb.conf</code> file to reset the parameter 984 <a class=" indexterm" name="id367526"></a>domain master = Yesso984 <a class="link" href="smb.conf.5.html#DOMAINMASTER">domain master = Yes</a> so 985 985 the Samba server functions as a PDC for the purpose of migration. 986 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 67537"></a>Key Points Learned</h3></div></div></div><p>986 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id389787"></a>Key Points Learned</h3></div></div></div><p> 987 987 Migration of an NT4 PDC database to a Samba-3 PDC is possible. 988 988 </p><div class="itemizedlist"><ul type="disc"><li><p> … … 996 996 The net Samba-3 domain most likely requires some 997 997 administration and updating before going live. 998 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 67572"></a>Questions and Answers</h2></div></div></div><p>999 </p><div class="qandaset"><dl><dt> <a href="ntmigration.html#id3 67587">998 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id389822"></a>Questions and Answers</h2></div></div></div><p> 999 </p><div class="qandaset"><dl><dt> <a href="ntmigration.html#id389838"> 1000 1000 Why must I start each migration with a clean database? 1001 </a></dt><dt> <a href="ntmigration.html#id3 67623">1001 </a></dt><dt> <a href="ntmigration.html#id389874"> 1002 1002 Is it possible to set my domain SID to anything I like? 1003 </a></dt><dt> <a href="ntmigration.html#id3 67680">1003 </a></dt><dt> <a href="ntmigration.html#id389926"> 1004 1004 When using a tdbsam passdb backend, why must I have all domain user and group accounts 1005 1005 in /etc/passwd and /etc/group? 1006 </a></dt><dt> <a href="ntmigration.html#id3 67846">1006 </a></dt><dt> <a href="ntmigration.html#id390096"> 1007 1007 Why did you validate connectivity before attempting migration? 1008 </a></dt><dt> <a href="ntmigration.html#id3 67889">1008 </a></dt><dt> <a href="ntmigration.html#id390138"> 1009 1009 How would you merge 10 tdbsam-based domains into an LDAP database? 1010 </a></dt><dt> <a href="ntmigration.html#id3 68004">1010 </a></dt><dt> <a href="ntmigration.html#id390253"> 1011 1011 I want to change my domain name after I migrate all accounts from an NT4 domain to a 1012 1012 Samba-3 domain. Does it make any sense to migrate the machine accounts in that case? 1013 </a></dt><dt> <a href="ntmigration.html#id3 68075">1013 </a></dt><dt> <a href="ntmigration.html#id390325"> 1014 1014 After merging multiple NT4 domains into a Samba-3 domain, I lost all multiple group mappings. Why? 1015 </a></dt><dt> <a href="ntmigration.html#id3 68134">1015 </a></dt><dt> <a href="ntmigration.html#id390383"> 1016 1016 How can I reset group membership after loading the account information into the LDAP database? 1017 </a></dt><dt> <a href="ntmigration.html#id3 68166">1017 </a></dt><dt> <a href="ntmigration.html#id390415"> 1018 1018 What are the limits or constraints that apply to group names? 1019 </a></dt><dt> <a href="ntmigration.html#id3 68262">1019 </a></dt><dt> <a href="ntmigration.html#id390512"> 1020 1020 My Windows NT4 PDC has 323,000 user accounts. How long will it take to migrate them to a Samba-3 1021 1021 LDAP backend system using the vampire process? 1022 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id3 67587"></a><a name="id367589"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id367593"></a>1022 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id389838"></a><a name="id389840"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id389843"></a> 1023 1023 Why must I start each migration with a clean database? 1024 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id3 67608"></a>1024 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id389858"></a> 1025 1025 This is a recommendation that permits the data from each NT4 domain to 1026 1026 be kept separate until you are ready to merge them. Also, if you do not start with a clean database, … … 1029 1029 without undue errors and then to handle the merging of vampired data under 1030 1030 proper supervision. 1031 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 67623"></a><a name="id367626"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id367629"></a>1031 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id389874"></a><a name="id389876"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id389879"></a> 1032 1032 Is it possible to set my domain SID to anything I like? 1033 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id3 67644"></a><a class="indexterm" name="id367652"></a><a class="indexterm" name="id367659"></a>1033 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id389894"></a><a class="indexterm" name="id389902"></a><a class="indexterm" name="id389909"></a> 1034 1034 Yes, so long as the SID you create has the same structure as an autogenerated SID. 1035 1035 The typical SID looks like this: S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX, where … … 1038 1038 You may want to set the SID to one that is already in use somewhere on your network, 1039 1039 but that is a little different from straight out creating your own domain SID. 1040 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 67680"></a><a name="id367682"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id367685"></a><a class="indexterm" name="id367693"></a><a class="indexterm" name="id367701"></a><a class="indexterm" name="id367709"></a><a class="indexterm" name="id367717"></a><a class="indexterm" name="id367728"></a><a class="indexterm" name="id367739"></a>1040 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id389926"></a><a name="id389928"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id389931"></a><a class="indexterm" name="id389939"></a><a class="indexterm" name="id389947"></a><a class="indexterm" name="id389955"></a><a class="indexterm" name="id389963"></a><a class="indexterm" name="id389974"></a><a class="indexterm" name="id389985"></a> 1041 1041 When using a tdbsam passdb backend, why must I have all domain user and group accounts 1042 1042 in <code class="filename">/etc/passwd</code> and <code class="filename">/etc/group</code>? 1043 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id3 67770"></a><a class="indexterm" name="id367778"></a><a class="indexterm" name="id367785"></a><a class="indexterm" name="id367793"></a><a class="indexterm" name="id367801"></a><a class="indexterm" name="id367809"></a>1043 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id390016"></a><a class="indexterm" name="id390024"></a><a class="indexterm" name="id390031"></a><a class="indexterm" name="id390039"></a><a class="indexterm" name="id390047"></a><a class="indexterm" name="id390055"></a> 1044 1044 Samba-3 must be able to tie all user and group account SIDs to a UNIX UID or GID. Samba 1045 1045 does not fabricate the UNIX IDs from thin air, but rather requires them to be located … … 1056 1056 In short then, all UNIX and Windows networking accounts, both in tdbsam as well as in 1057 1057 LDAP, require UIDs/GIDs. 1058 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 67846"></a><a name="id367848"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id367852"></a><a class="indexterm" name="id367859"></a><a class="indexterm" name="id367867"></a>1058 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id390096"></a><a name="id390098"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id390101"></a><a class="indexterm" name="id390109"></a><a class="indexterm" name="id390117"></a> 1059 1059 Why did you validate connectivity before attempting migration? 1060 1060 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1062 1062 potential problems that may otherwise affect or impede account migration. I am always 1063 1063 mindful of the 4 P's of migration: Planning Prevents Poor Performance. 1064 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 67889"></a><a name="id367891"></a></td><td align="left" valign="top"><p>1064 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id390138"></a><a name="id390140"></a></td><td align="left" valign="top"><p> 1065 1065 How would you merge 10 tdbsam-based domains into an LDAP database? 1066 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id3 67901"></a><a class="indexterm" name="id367909"></a><a class="indexterm" name="id367917"></a><a class="indexterm" name="id367925"></a><a class="indexterm" name="id367933"></a><a class="indexterm" name="id367940"></a><a class="indexterm" name="id367948"></a><a class="indexterm" name="id367956"></a><a class="indexterm" name="id367964"></a><a class="indexterm" name="id367972"></a><a class="indexterm" name="id367979"></a>1066 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id390151"></a><a class="indexterm" name="id390159"></a><a class="indexterm" name="id390166"></a><a class="indexterm" name="id390174"></a><a class="indexterm" name="id390182"></a><a class="indexterm" name="id390190"></a><a class="indexterm" name="id390197"></a><a class="indexterm" name="id390205"></a><a class="indexterm" name="id390213"></a><a class="indexterm" name="id390221"></a><a class="indexterm" name="id390229"></a> 1067 1067 If you have 10 tdbsam Samba domains, there is considerable risk that there are a number of 1068 1068 accounts that have the same UNIX identifier (UID/GID). This means that you almost … … 1074 1074 you have migrated before handing over access to a user. After all, too many users with a bad 1075 1075 migration experience may threaten your career. 1076 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 68004"></a><a name="id368006"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id368009"></a><a class="indexterm" name="id368017"></a>1076 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id390253"></a><a name="id390256"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id390259"></a><a class="indexterm" name="id390267"></a> 1077 1077 I want to change my domain name after I migrate all accounts from an NT4 domain to a 1078 1078 Samba-3 domain. Does it make any sense to migrate the machine accounts in that case? 1079 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id3 68036"></a><a class="indexterm" name="id368044"></a><a class="indexterm" name="id368052"></a><a class="indexterm" name="id368060"></a>1079 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id390286"></a><a class="indexterm" name="id390294"></a><a class="indexterm" name="id390302"></a><a class="indexterm" name="id390310"></a> 1080 1080 I would recommend not to migrate the machine account. The machine accounts should still work, but there are registry entries 1081 1081 on each Windows NT4 and upward client that have a tattoo of the old domain name. If you 1082 1082 unjoin the domain and then rejoin the newly renamed Samba-3 domain, you can be certain to avoid 1083 1083 this tattooing effect. 1084 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 68075"></a><a name="id368077"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id368080"></a>1084 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id390325"></a><a name="id390327"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id390330"></a> 1085 1085 After merging multiple NT4 domains into a Samba-3 domain, I lost all multiple group mappings. Why? 1086 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id3 68096"></a><a class="indexterm" name="id368104"></a>1086 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id390345"></a><a class="indexterm" name="id390353"></a> 1087 1087 Samba-3 currently does not implement multiple group membership internally. If you use the Windows 1088 1088 NT4 Domain User Manager to manage accounts and you have an LDAP backend, the multiple group … … 1093 1093 and <code class="filename">/etc/group</code> information also. That is where the multiple group information 1094 1094 is most closely at your fingertips. 1095 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 68134"></a><a name="id368136"></a></td><td align="left" valign="top"><p>1095 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id390383"></a><a name="id390385"></a></td><td align="left" valign="top"><p> 1096 1096 How can I reset group membership after loading the account information into the LDAP database? 1097 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id3 68146"></a>1097 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id390396"></a> 1098 1098 You can use the NT4 Domain User Manager that can be downloaded from the Microsoft Web site. The 1099 1099 installation file is called <code class="filename">SRVTOOLS.EXE</code>. 1100 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 68166"></a><a name="id368168"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id368171"></a>1100 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id390415"></a><a name="id390417"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id390420"></a> 1101 1101 What are the limits or constraints that apply to group names? 1102 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id3 68186"></a><a class="indexterm" name="id368194"></a><a class="indexterm" name="id368202"></a><a class="indexterm" name="id368209"></a><a class="indexterm" name="id368217"></a><a class="indexterm" name="id368225"></a>1102 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id390435"></a><a class="indexterm" name="id390443"></a><a class="indexterm" name="id390451"></a><a class="indexterm" name="id390459"></a><a class="indexterm" name="id390467"></a><a class="indexterm" name="id390475"></a> 1103 1103 A Windows 200x group name can be up to 254 characters long, while in Windows NT4 the group 1104 1104 name is limited to 20 characters. Most UNIX systems limit this to 32 characters. Windows … … 1112 1112 or user account names. You have to experiment with your system to find what its 1113 1113 peculiarities are. 1114 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 68262"></a><a name="id368264"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id368267"></a>1114 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id390512"></a><a name="id390514"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id390517"></a> 1115 1115 My Windows NT4 PDC has 323,000 user accounts. How long will it take to migrate them to a Samba-3 1116 1116 LDAP backend system using the vampire process? … … 1121 1121 integer. UNIX/Linux systems that have a 32-bit UID/GID can easily handle this number of accounts. 1122 1122 Please check this carefully before you attempt to effect a migration using the vampire process. 1123 </p><p><a class="indexterm" name="id3 68291"></a>1123 </p><p><a class="indexterm" name="id390544"></a> 1124 1124 Migration speed depends much on the processor speed, the network speed, disk I/O capability, and 1125 1125 LDAP update overheads. On a dual processor AMD MP1600+ with 1 GB memory that was mirroring LDAP -
branches/samba-3.0/docs/htmldocs/Samba3-ByExample/nw4migration.html
r44 r134 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 10. Migrating NetWare Server to Samba-3</title><link rel="stylesheet" href=" samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="ntmigration.html" title="Chapter 9. Migrating NT4 Domain to Samba-3"><link rel="next" href="RefSection.html" title="Part III. Reference Section"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 10. Migrating NetWare Server to Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="ntmigration.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="RefSection.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="nw4migration"></a>Chapter 10. Migrating NetWare Server to Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="nw4migration.html#id368455">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id368561">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id368660">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id368732">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id368903">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id368911">NetWare Migration Using LDAP Backend</a></span></dt></dl></dd></dl></div><p>2 <a class="indexterm" name="id3 68324"></a>3 <a class="indexterm" name="id3 68330"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 10. Migrating NetWare Server to Samba-3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="ntmigration.html" title="Chapter 9. Migrating NT4 Domain to Samba-3"><link rel="next" href="RefSection.html" title="Part III. Reference Section"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 10. Migrating NetWare Server to Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="ntmigration.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="RefSection.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="nw4migration"></a>Chapter 10. Migrating NetWare Server to Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="nw4migration.html#id390707">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id390814">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id390913">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id390984">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id391152">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id391161">NetWare Migration Using LDAP Backend</a></span></dt></dl></dd></dl></div><p> 2 <a class="indexterm" name="id390578"></a> 3 <a class="indexterm" name="id390584"></a> 4 4 Novell is a company any seasoned IT manager has to admire. It has become increasingly 5 5 Linux-friendly and is emerging out of a deep regression that almost saw the company … … 9 9 Meanwhile, there can be no denying that Novell is a Linux company. 10 10 </p><p> 11 <a class="indexterm" name="id3 68348"></a>12 <a class="indexterm" name="id3 68355"></a>13 <a class="indexterm" name="id3 68362"></a>14 <a class="indexterm" name="id3 68369"></a>11 <a class="indexterm" name="id390598"></a> 12 <a class="indexterm" name="id390605"></a> 13 <a class="indexterm" name="id390612"></a> 14 <a class="indexterm" name="id390619"></a> 15 15 Whatever flavor of Linux is preferred in your environment, whether Red Hat, Debian, 16 16 Gentoo, Mandrake, or SUSE (Novell), the information in this chapter should be read with … … 18 18 in this chapter should provide something of value. 19 19 </p><p> 20 <a class="indexterm" name="id3 68382"></a>20 <a class="indexterm" name="id390631"></a> 21 21 Contributions to this chapter were made by Misty Stanley-Jones, a UNIX administrator of many 22 22 years who surfaced on the Samba mailing list with a barrage of questions and who 23 23 regularly helps other administrators to solve thorny Samba migration questions. 24 24 </p><p> 25 <a class="indexterm" name="id3 68394"></a>26 <a class="indexterm" name="id3 68401"></a>27 <a class="indexterm" name="id3 68407"></a>28 <a class="indexterm" name="id3 68414"></a>25 <a class="indexterm" name="id390644"></a> 26 <a class="indexterm" name="id390650"></a> 27 <a class="indexterm" name="id390657"></a> 28 <a class="indexterm" name="id390664"></a> 29 29 One wonders how many NetWare servers remain in active service. Many are being migrated 30 30 to Samba on Linux. Red Hat Linux, SUSE Linux 9.x, and SUSE Linux Enterprise Server 9 are … … 50 50 original documentation contributed by Misty, the Courier-IMAP package had been built 51 51 directly from the original source tarball. 52 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 68455"></a>Introduction</h2></div></div></div><p>53 <a class="indexterm" name="id3 68462"></a>52 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id390707"></a>Introduction</h2></div></div></div><p> 53 <a class="indexterm" name="id390715"></a> 54 54 Misty Stanley-Jones was recruited by Abmas to administer a network that had 55 55 not received much attention for some years and was much in need of a makeover. … … 65 65 drives, causing backup integrity problems 66 66 </p></li></ul></div></li></ul></div><p> 67 <a class="indexterm" name="id3 68550"></a>67 <a class="indexterm" name="id390803"></a> 68 68 At one point disk space had filled up to 100 percent, causing the payroll database 69 69 to become corrupt. This caused the accounting department to be down for over … … 71 71 server was created with very poor security and design considerations from 72 72 a discarded desktop PC. 73 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 68561"></a>Assignment Tasks</h3></div></div></div><p>73 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id390814"></a>Assignment Tasks</h3></div></div></div><p> 74 74 Misty has provided this summary of her migration experience in the hope 75 75 that it will help someone to avoid the challenges she faced. Perhaps her … … 80 80 it provides an overall approach to the implementation of a Samba-3 81 81 environment that is significantly divergent from that presented in 82 <a href="happy.html" title="Chapter 5. Making Happy Users">???</a>.82 <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>. 83 83 </p><p> 84 84 The complete removal of all site-specific information in order to produce … … 90 90 the overall information more useful to you. 91 91 </p><p> 92 <a class="indexterm" name="id3 68590"></a>92 <a class="indexterm" name="id390843"></a> 93 93 After management reviewed a cost-benefit report as well as an estimated 94 94 time-to-completion, approval was given proceed with the solution proposed. … … 112 112 The new system has operated for 6 months without problems. Over the past months 113 113 much attention has been focused on cleaning up desktops and user profiles. 114 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 68660"></a>Dissection and Discussion</h2></div></div></div><p>115 <a class="indexterm" name="id3 68668"></a>116 <a class="indexterm" name="id3 68675"></a>117 <a class="indexterm" name="id3 68682"></a>118 <a class="indexterm" name="id3 68688"></a>114 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id390913"></a>Dissection and Discussion</h2></div></div></div><p> 115 <a class="indexterm" name="id390921"></a> 116 <a class="indexterm" name="id390927"></a> 117 <a class="indexterm" name="id390934"></a> 118 <a class="indexterm" name="id390941"></a> 119 119 A decision to use LDAP was made even though I knew nothing about LDAP except that 120 120 I had been reading the book “<span class="quote">LDAP System Administration,</span>” by Gerald Carter. … … 122 122 and would provide centralized authentication and identity management. 123 123 </p><p> 124 <a class="indexterm" name="id3 68705"></a>125 <a class="indexterm" name="id3 68711"></a>126 <a class="indexterm" name="id3 68718"></a>124 <a class="indexterm" name="id390957"></a> 125 <a class="indexterm" name="id390964"></a> 126 <a class="indexterm" name="id390971"></a> 127 127 Building the LDAP database took a while and a lot of trial and error. Following 128 128 the guidance I obtained from “<span class="quote">LDAP System 129 129 Administration,</span>” I installed OpenLDAP (from RPM; later I compiled 130 130 a more current version from source) and built my initial LDAP tree. 131 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 68732"></a>Technical Issues</h3></div></div></div><p>132 <a class="indexterm" name="id3 68739"></a>133 <a class="indexterm" name="id3 68746"></a>134 <a class="indexterm" name="id3 68753"></a>135 <a class="indexterm" name="id3 68760"></a>136 <a class="indexterm" name="id3 68767"></a>137 <a class="indexterm" name="id3 68773"></a>138 <a class="indexterm" name="id3 68780"></a>139 <a class="indexterm" name="id3 68787"></a>140 <a class="indexterm" name="id3 68794"></a>131 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id390984"></a>Technical Issues</h3></div></div></div><p> 132 <a class="indexterm" name="id390992"></a> 133 <a class="indexterm" name="id390999"></a> 134 <a class="indexterm" name="id391006"></a> 135 <a class="indexterm" name="id391012"></a> 136 <a class="indexterm" name="id391019"></a> 137 <a class="indexterm" name="id391026"></a> 138 <a class="indexterm" name="id391033"></a> 139 <a class="indexterm" name="id391040"></a> 140 <a class="indexterm" name="id391046"></a> 141 141 The first challenge was to create a company white pages, followed by manually 142 142 entering everything from the printed company directory. This used only the inetOrgPerson … … 160 160 make them work. Instead, even though it is most inelegant, I wrote a simple script that did 161 161 what I needed. It is enclosed as a simple example to demonstrate that you do not need to be 162 a guru to make light of otherwise painful repetition. This file is listed in <a href="nw4migration.html#sbeamg" title="Example 10.1. A Rough Tool to Create an LDIF File from the System Account Files">???</a>.162 a guru to make light of otherwise painful repetition. This file is listed in <a class="link" href="nw4migration.html#sbeamg" title="Example 10.1. A Rough Tool to Create an LDIF File from the System Account Files">“A Rough Tool to Create an LDIF File from the System Account Files”</a>. 163 163 </p><div class="example"><a name="sbeamg"></a><p class="title"><b>Example 10.1. A Rough Tool to Create an LDIF File from the System Account Files</b></p><div class="example-contents"><pre class="screen"> 164 164 #!/bin/bash … … 189 189 the LDAP directory. The tools consist of a set of Perl scripts for migration of users, groups, 190 190 aliases, hosts, netgroups, networks, protocols, PRCs, and services from the existing ASCII text 191 files (or from a name service such as NIS). This too set can be obtained from the <a href="http://www.padl.com" target="_top">PADL Web site</a>.192 </p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 68903"></a>Implementation</h2></div></div></div><p>193 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 68911"></a>NetWare Migration Using LDAP Backend</h3></div></div></div><p>191 files (or from a name service such as NIS). This too set can be obtained from the <a class="ulink" href="http://www.padl.com" target="_top">PADL Web site</a>. 192 </p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id391152"></a>Implementation</h2></div></div></div><p> 193 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id391161"></a>NetWare Migration Using LDAP Backend</h3></div></div></div><p> 194 194 The following software must be installed on the SUSE Linux Enterprise Server to perform 195 195 this migration: … … 198 198 The configuration files used at Abmas are provided as a guide and should be modified 199 199 to meet needs at your site. 200 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 68982"></a>LDAP Server Configuration</h4></div></div></div><p>200 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id391232"></a>LDAP Server Configuration</h4></div></div></div><p> 201 201 The <code class="filename">/etc/openldap/slapd.conf</code> file Misty used is shown here: 202 202 </p><pre class="programlisting"> … … 363 363 </pre><p> 364 364 </p><p> 365 <a class="indexterm" name="id3 69093"></a>366 The <code class="filename">/etc/ldap.conf</code> file used is listed in <a href="nw4migration.html#ch8ldap" title="Example 10.2. NSS LDAP Control File /etc/ldap.conf">???</a>.365 <a class="indexterm" name="id391339"></a> 366 The <code class="filename">/etc/ldap.conf</code> file used is listed in <a class="link" href="nw4migration.html#ch8ldap" title="Example 10.2. NSS LDAP Control File /etc/ldap.conf">“NSS LDAP Control File /etc/ldap.conf”</a>. 367 367 </p><div class="example"><a name="ch8ldap"></a><p class="title"><b>Example 10.2. NSS LDAP Control File /etc/ldap.conf</b></p><div class="example-contents"><pre class="screen"> 368 368 # /etc/ldap.conf … … 417 417 </pre><p> 418 418 </p><p> 419 <a class="indexterm" name="id3 69173"></a>420 <a class="indexterm" name="id3 69179"></a>419 <a class="indexterm" name="id391409"></a> 420 <a class="indexterm" name="id391415"></a> 421 421 In my setup, users authenticate via PAM and NSS using LDAP-based accounts. 422 422 The configuration file that controls the behavior of the PAM <code class="literal">pam_unix2</code> 423 module is shown in <a href="nw4migration.html#sbepu2" title="Example 10.3. The PAM Control File /etc/security/pam_unix2.conf">???</a> file.423 module is shown in <a class="link" href="nw4migration.html#sbepu2" title="Example 10.3. The PAM Control File /etc/security/pam_unix2.conf">“The PAM Control File /etc/security/pam_unix2.conf”</a> file. 424 424 This works out of the box with the configuration files in this chapter. It 425 425 enables you to have no local accounts for users (it is highly advisable … … 459 459 password: use_ldap 460 460 session: none 461 </pre></div></div><br class="example-break"><a class="indexterm" name="id3 69231"></a><a class="indexterm" name="id369238"></a><a class="indexterm" name="id369245"></a><div class="itemizedlist"><ul type="disc"><li><p>461 </pre></div></div><br class="example-break"><a class="indexterm" name="id391476"></a><a class="indexterm" name="id391483"></a><a class="indexterm" name="id391490"></a><div class="itemizedlist"><ul type="disc"><li><p> 462 462 If your LDAP database goes down, nobody can authenticate except for root. 463 463 </p></li><li><p> … … 469 469 </p><p> 470 470 The following services authenticate using LDAP: 471 </p><a class="indexterm" name="id3 69278"></a><a class="indexterm" name="id369284"></a><a class="indexterm" name="id369291"></a><table class="simplelist" border="0" summary="Simple list"><tr><td><p>UNIX login/ssh</p></td></tr><tr><td><p>Postfix (SMTP)</p></td></tr><tr><td><p>Courier-IMAP/IMAPS/POP3/POP3S</p></td></tr></table><p>472 <a class="indexterm" name="id3 69319"></a>473 <a class="indexterm" name="id3 69326"></a>471 </p><a class="indexterm" name="id391523"></a><a class="indexterm" name="id391529"></a><a class="indexterm" name="id391536"></a><table class="simplelist" border="0" summary="Simple list"><tr><td><p>UNIX login/ssh</p></td></tr><tr><td><p>Postfix (SMTP)</p></td></tr><tr><td><p>Courier-IMAP/IMAPS/POP3/POP3S</p></td></tr></table><p> 472 <a class="indexterm" name="id391564"></a> 473 <a class="indexterm" name="id391571"></a> 474 474 Companywide white pages can be searched using an LDAP client 475 475 such as the one in the Windows Address Book. 476 476 </p><p> 477 <a class="indexterm" name="id3 69337"></a>478 <a class="indexterm" name="id3 69344"></a>477 <a class="indexterm" name="id391582"></a> 478 <a class="indexterm" name="id391589"></a> 479 479 Having gained a solid understanding of LDAP and a relatively workable LDAP tree 480 480 thus far, it was time to configure Samba. I compiled the latest stable Samba and 481 481 also installed the latest <code class="literal">smbldap-tools</code> from 482 <a href="http://idealx.com" target="_top">Idealx</a>.483 </p><p> 484 The Samba <code class="filename">smb.conf</code> file was configured as shown in <a href="nw4migration.html#ch8smbconf" title="Example 10.4. Samba Configuration File smb.conf Part A">???</a>.485 </p><div class="example"><a name="ch8smbconf"></a><p class="title"><b>Example 10.4. Samba Configuration File smb.conf Part A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id3 69411"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id369423"></a><em class="parameter"><code>netbios name = MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id369436"></a><em class="parameter"><code>server string = Corp File Server</code></em></td></tr><tr><td><a class="indexterm" name="id369448"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id369461"></a><em class="parameter"><code>pam password change = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id369474"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id369486"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id369499"></a><em class="parameter"><code>log file = /data/samba/log/%m.log</code></em></td></tr><tr><td><a class="indexterm" name="id369512"></a><em class="parameter"><code>name resolve order = wins host bcast</code></em></td></tr><tr><td><a class="indexterm" name="id369524"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id369537"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id369549"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id369562"></a><em class="parameter"><code>cups options = Raw</code></em></td></tr><tr><td><a class="indexterm" name="id369575"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id369588"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd -p "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id369600"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/smbldap-groupmod -m "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id369614"></a><em class="parameter"><code>delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id369627"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g "%g" "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id369640"></a><em class="parameter"><code>add machine script = /usr/local/sbin/smbldap-useradd -w "%m"</code></em></td></tr><tr><td><a class="indexterm" name="id369653"></a><em class="parameter"><code>logon script = logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id369666"></a><em class="parameter"><code>logon path = \\%L\profiles\%U\%a</code></em></td></tr><tr><td><a class="indexterm" name="id369678"></a><em class="parameter"><code>logon drive = H:</code></em></td></tr><tr><td><a class="indexterm" name="id369691"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id369703"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id369716"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id369728"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id369741"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id369754"></a><em class="parameter"><code>ldap idmap suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id369767"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id369779"></a><em class="parameter"><code>ldap passwd sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id369792"></a><em class="parameter"><code>ldap suffix = ou=MEGANET2,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id369805"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id369817"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id369830"></a><em class="parameter"><code>admin users = root, "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id369842"></a><em class="parameter"><code>printer admin = "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id369855"></a><em class="parameter"><code>force printername = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch8smbconf2"></a><p class="title"><b>Example 10.5. Samba Configuration File smb.conf Part B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id369895"></a><em class="parameter"><code>comment = Network logon service</code></em></td></tr><tr><td><a class="indexterm" name="id369908"></a><em class="parameter"><code>path = /data/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id369920"></a><em class="parameter"><code>write list = "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id369933"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id369954"></a><em class="parameter"><code>comment = Roaming Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id369967"></a><em class="parameter"><code>path = /data/samba/profiles/</code></em></td></tr><tr><td><a class="indexterm" name="id369980"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id369992"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id370005"></a><em class="parameter"><code>veto files = desktop.ini</code></em></td></tr><tr><td><a class="indexterm" name="id370018"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id370039"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id370052"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id370064"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id370077"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td><a class="indexterm" name="id370089"></a><em class="parameter"><code>veto files = desktop.ini</code></em></td></tr><tr><td><a class="indexterm" name="id370102"></a><em class="parameter"><code>hide files = desktop.ini</code></em></td></tr><tr><td><a class="indexterm" name="id370115"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[software]</code></em></td></tr><tr><td><a class="indexterm" name="id370136"></a><em class="parameter"><code>comment = Software for %a computers</code></em></td></tr><tr><td><a class="indexterm" name="id370149"></a><em class="parameter"><code>path = /data/samba/shares/software/%a</code></em></td></tr><tr><td><a class="indexterm" name="id370161"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[public]</code></em></td></tr><tr><td><a class="indexterm" name="id370183"></a><em class="parameter"><code>comment = Public Files</code></em></td></tr><tr><td><a class="indexterm" name="id370195"></a><em class="parameter"><code>path = /data/samba/shares/public</code></em></td></tr><tr><td><a class="indexterm" name="id370208"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id370221"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[PDF]</code></em></td></tr><tr><td><a class="indexterm" name="id370242"></a><em class="parameter"><code>comment = Location of documents printed to PDFCreator printer</code></em></td></tr><tr><td><a class="indexterm" name="id370255"></a><em class="parameter"><code>path = /data/samba/shares/pdf</code></em></td></tr><tr><td><a class="indexterm" name="id370268"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch8smbconf3"></a><p class="title"><b>Example 10.6. Samba Configuration File smb.conf Part C</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[EVERYTHING]</code></em></td></tr><tr><td><a class="indexterm" name="id370308"></a><em class="parameter"><code>comment = All shares</code></em></td></tr><tr><td><a class="indexterm" name="id370320"></a><em class="parameter"><code>path = /data/samba</code></em></td></tr><tr><td><a class="indexterm" name="id370333"></a><em class="parameter"><code>valid users = "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id370345"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[CDROM]</code></em></td></tr><tr><td><a class="indexterm" name="id370367"></a><em class="parameter"><code>comment = CD-ROM on MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id370379"></a><em class="parameter"><code>path = /mnt</code></em></td></tr><tr><td><a class="indexterm" name="id370392"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id370413"></a><em class="parameter"><code>comment = Printer Drivers Share</code></em></td></tr><tr><td><a class="indexterm" name="id370426"></a><em class="parameter"><code>path = /data/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id370439"></a><em class="parameter"><code>write list = root</code></em></td></tr><tr><td><a class="indexterm" name="id370451"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id370473"></a><em class="parameter"><code>comment = All Printers</code></em></td></tr><tr><td><a class="indexterm" name="id370485"></a><em class="parameter"><code>path = /data/samba/spool</code></em></td></tr><tr><td><a class="indexterm" name="id370498"></a><em class="parameter"><code>create mask = 0644</code></em></td></tr><tr><td><a class="indexterm" name="id370510"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id370523"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[acct_hp8500]</code></em></td></tr><tr><td><a class="indexterm" name="id370544"></a><em class="parameter"><code>comment = "Accounting Color Laser Printer"</code></em></td></tr><tr><td><a class="indexterm" name="id370557"></a><em class="parameter"><code>path = /data/samba/spool/private</code></em></td></tr><tr><td><a class="indexterm" name="id370570"></a><em class="parameter"><code>valid users = @acct, @acct_admin, @hr, "@Domain Admins",@Receptionist, dwayne, terri, danae, jerry</code></em></td></tr><tr><td><a class="indexterm" name="id370583"></a><em class="parameter"><code>create mask = 0644</code></em></td></tr><tr><td><a class="indexterm" name="id370596"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id370608"></a><em class="parameter"><code>copy = printers</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[plotter]</code></em></td></tr><tr><td><a class="indexterm" name="id370630"></a><em class="parameter"><code>comment = Engineering Plotter</code></em></td></tr><tr><td><a class="indexterm" name="id370642"></a><em class="parameter"><code>path = /data/samba/spool</code></em></td></tr><tr><td><a class="indexterm" name="id370655"></a><em class="parameter"><code>create mask = 0644</code></em></td></tr><tr><td><a class="indexterm" name="id370668"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id370680"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id370693"></a><em class="parameter"><code>copy = printers</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch8smbconf4"></a><p class="title"><b>Example 10.7. Samba Configuration File smb.conf Part D</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[APPS]</code></em></td></tr><tr><td><a class="indexterm" name="id370732"></a><em class="parameter"><code>path = /data/samba/shares/Apps</code></em></td></tr><tr><td><a class="indexterm" name="id370745"></a><em class="parameter"><code>force group = "Domain Users"</code></em></td></tr><tr><td><a class="indexterm" name="id370758"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[ACCT]</code></em></td></tr><tr><td><a class="indexterm" name="id370779"></a><em class="parameter"><code>path = /data/samba/shares/Accounting</code></em></td></tr><tr><td><a class="indexterm" name="id370792"></a><em class="parameter"><code>valid users = @acct, "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id370805"></a><em class="parameter"><code>force group = acct</code></em></td></tr><tr><td><a class="indexterm" name="id370817"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id370830"></a><em class="parameter"><code>create mask = 0660</code></em></td></tr><tr><td><a class="indexterm" name="id370842"></a><em class="parameter"><code>directory mask = 0770</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[ACCT_ADMIN]</code></em></td></tr><tr><td><a class="indexterm" name="id370864"></a><em class="parameter"><code>path = /data/samba/shares/Acct_Admin</code></em></td></tr><tr><td><a class="indexterm" name="id370876"></a><em class="parameter"><code>valid users = @âacct_adminâ</code></em></td></tr><tr><td><a class="indexterm" name="id370889"></a><em class="parameter"><code>force group = acct_admin</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[HR_PR]</code></em></td></tr><tr><td><a class="indexterm" name="id370911"></a><em class="parameter"><code>path = /data/samba/shares/HR_PR</code></em></td></tr><tr><td><a class="indexterm" name="id370924"></a><em class="parameter"><code>valid users = @hr, @acct_admin</code></em></td></tr><tr><td><a class="indexterm" name="id370936"></a><em class="parameter"><code>force group = hr</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[ENGR]</code></em></td></tr><tr><td><a class="indexterm" name="id370958"></a><em class="parameter"><code>path = /data/samba/shares/Engr</code></em></td></tr><tr><td><a class="indexterm" name="id370970"></a><em class="parameter"><code>valid users = @engr, @receptionist, @truss, "@Domain Admins", cheri</code></em></td></tr><tr><td><a class="indexterm" name="id370983"></a><em class="parameter"><code>force group = engr</code></em></td></tr><tr><td><a class="indexterm" name="id370996"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id371008"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[DATA]</code></em></td></tr><tr><td><a class="indexterm" name="id371030"></a><em class="parameter"><code>path = /data/samba/shares/DATA</code></em></td></tr><tr><td><a class="indexterm" name="id371043"></a><em class="parameter"><code>valid users = @engr, @receptionist, @truss, "@Domain Admins", cheri</code></em></td></tr><tr><td><a class="indexterm" name="id371056"></a><em class="parameter"><code>force group = engr</code></em></td></tr><tr><td><a class="indexterm" name="id371068"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id371081"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td><a class="indexterm" name="id371093"></a><em class="parameter"><code>copy = engr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch8smbconf5"></a><p class="title"><b>Example 10.8. Samba Configuration File smb.conf Part E</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[X]</code></em></td></tr><tr><td><a class="indexterm" name="id371133"></a><em class="parameter"><code>path = /data/samba/shares/X</code></em></td></tr><tr><td><a class="indexterm" name="id371145"></a><em class="parameter"><code>valid users = @engr, @acct</code></em></td></tr><tr><td><a class="indexterm" name="id371158"></a><em class="parameter"><code>force group = engr</code></em></td></tr><tr><td><a class="indexterm" name="id371171"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id371183"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td><a class="indexterm" name="id371196"></a><em class="parameter"><code>copy = engr</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[NETWORK]</code></em></td></tr><tr><td><a class="indexterm" name="id371217"></a><em class="parameter"><code>path = /data/samba/shares/network</code></em></td></tr><tr><td><a class="indexterm" name="id371230"></a><em class="parameter"><code>valid users = "@Domain Users"</code></em></td></tr><tr><td><a class="indexterm" name="id371242"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id371255"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td><a class="indexterm" name="id371268"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[UTILS]</code></em></td></tr><tr><td><a class="indexterm" name="id371289"></a><em class="parameter"><code>path = /data/samba/shares/Utils</code></em></td></tr><tr><td><a class="indexterm" name="id371302"></a><em class="parameter"><code>write list = "@Domain Admins"</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[SYS]</code></em></td></tr><tr><td><a class="indexterm" name="id371323"></a><em class="parameter"><code>path = /data/samba/shares/SYS</code></em></td></tr><tr><td><a class="indexterm" name="id371336"></a><em class="parameter"><code>valid users = chad</code></em></td></tr><tr><td><a class="indexterm" name="id371348"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id371361"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><p>486 <a class="indexterm" name="id3 71377"></a>487 <a class="indexterm" name="id3 71384"></a>488 <a class="indexterm" name="id3 71390"></a>482 <a class="ulink" href="http://idealx.com" target="_top">Idealx</a>. 483 </p><p> 484 The Samba <code class="filename">smb.conf</code> file was configured as shown in <a class="link" href="nw4migration.html#ch8smbconf" title="Example 10.4. Samba Configuration File smb.conf Part A">“Samba Configuration File smb.conf Part A”</a>. 485 </p><div class="example"><a name="ch8smbconf"></a><p class="title"><b>Example 10.4. Samba Configuration File smb.conf Part A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id391656"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id391667"></a><em class="parameter"><code>netbios name = MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id391678"></a><em class="parameter"><code>server string = Corp File Server</code></em></td></tr><tr><td><a class="indexterm" name="id391690"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id391702"></a><em class="parameter"><code>pam password change = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id391713"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id391725"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id391736"></a><em class="parameter"><code>log file = /data/samba/log/%m.log</code></em></td></tr><tr><td><a class="indexterm" name="id391748"></a><em class="parameter"><code>name resolve order = wins host bcast</code></em></td></tr><tr><td><a class="indexterm" name="id391760"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id391771"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id391783"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id391794"></a><em class="parameter"><code>cups options = Raw</code></em></td></tr><tr><td><a class="indexterm" name="id391806"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id391818"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd -p "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id391829"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/smbldap-groupmod -m "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id391842"></a><em class="parameter"><code>delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id391854"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g "%g" "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id391866"></a><em class="parameter"><code>add machine script = /usr/local/sbin/smbldap-useradd -w "%m"</code></em></td></tr><tr><td><a class="indexterm" name="id391878"></a><em class="parameter"><code>logon script = logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id391889"></a><em class="parameter"><code>logon path = \\%L\profiles\%U\%a</code></em></td></tr><tr><td><a class="indexterm" name="id391901"></a><em class="parameter"><code>logon drive = H:</code></em></td></tr><tr><td><a class="indexterm" name="id391912"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id391924"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id391935"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id391947"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id391958"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id391970"></a><em class="parameter"><code>ldap idmap suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id391982"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id391993"></a><em class="parameter"><code>ldap passwd sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id392005"></a><em class="parameter"><code>ldap suffix = ou=MEGANET2,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id392016"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id392028"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id392040"></a><em class="parameter"><code>admin users = root, "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id392051"></a><em class="parameter"><code>printer admin = "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id392063"></a><em class="parameter"><code>force printername = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch8smbconf2"></a><p class="title"><b>Example 10.5. Samba Configuration File smb.conf Part B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id392102"></a><em class="parameter"><code>comment = Network logon service</code></em></td></tr><tr><td><a class="indexterm" name="id392113"></a><em class="parameter"><code>path = /data/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id392125"></a><em class="parameter"><code>write list = "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id392136"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id392157"></a><em class="parameter"><code>comment = Roaming Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id392168"></a><em class="parameter"><code>path = /data/samba/profiles/</code></em></td></tr><tr><td><a class="indexterm" name="id392180"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id392191"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id392203"></a><em class="parameter"><code>veto files = desktop.ini</code></em></td></tr><tr><td><a class="indexterm" name="id392214"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id392235"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id392246"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id392258"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id392269"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td><a class="indexterm" name="id392281"></a><em class="parameter"><code>veto files = desktop.ini</code></em></td></tr><tr><td><a class="indexterm" name="id392292"></a><em class="parameter"><code>hide files = desktop.ini</code></em></td></tr><tr><td><a class="indexterm" name="id392304"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[software]</code></em></td></tr><tr><td><a class="indexterm" name="id392324"></a><em class="parameter"><code>comment = Software for %a computers</code></em></td></tr><tr><td><a class="indexterm" name="id392336"></a><em class="parameter"><code>path = /data/samba/shares/software/%a</code></em></td></tr><tr><td><a class="indexterm" name="id392348"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[public]</code></em></td></tr><tr><td><a class="indexterm" name="id392368"></a><em class="parameter"><code>comment = Public Files</code></em></td></tr><tr><td><a class="indexterm" name="id392380"></a><em class="parameter"><code>path = /data/samba/shares/public</code></em></td></tr><tr><td><a class="indexterm" name="id392391"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id392403"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[PDF]</code></em></td></tr><tr><td><a class="indexterm" name="id392423"></a><em class="parameter"><code>comment = Location of documents printed to PDFCreator printer</code></em></td></tr><tr><td><a class="indexterm" name="id392435"></a><em class="parameter"><code>path = /data/samba/shares/pdf</code></em></td></tr><tr><td><a class="indexterm" name="id392446"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch8smbconf3"></a><p class="title"><b>Example 10.6. Samba Configuration File smb.conf Part C</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[EVERYTHING]</code></em></td></tr><tr><td><a class="indexterm" name="id392485"></a><em class="parameter"><code>comment = All shares</code></em></td></tr><tr><td><a class="indexterm" name="id392497"></a><em class="parameter"><code>path = /data/samba</code></em></td></tr><tr><td><a class="indexterm" name="id392508"></a><em class="parameter"><code>valid users = "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id392520"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[CDROM]</code></em></td></tr><tr><td><a class="indexterm" name="id392540"></a><em class="parameter"><code>comment = CD-ROM on MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id392552"></a><em class="parameter"><code>path = /mnt</code></em></td></tr><tr><td><a class="indexterm" name="id392563"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id392584"></a><em class="parameter"><code>comment = Printer Drivers Share</code></em></td></tr><tr><td><a class="indexterm" name="id392595"></a><em class="parameter"><code>path = /data/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id392607"></a><em class="parameter"><code>write list = root</code></em></td></tr><tr><td><a class="indexterm" name="id392618"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id392639"></a><em class="parameter"><code>comment = All Printers</code></em></td></tr><tr><td><a class="indexterm" name="id392650"></a><em class="parameter"><code>path = /data/samba/spool</code></em></td></tr><tr><td><a class="indexterm" name="id392662"></a><em class="parameter"><code>create mask = 0644</code></em></td></tr><tr><td><a class="indexterm" name="id392673"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id392685"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[acct_hp8500]</code></em></td></tr><tr><td><a class="indexterm" name="id392705"></a><em class="parameter"><code>comment = "Accounting Color Laser Printer"</code></em></td></tr><tr><td><a class="indexterm" name="id392717"></a><em class="parameter"><code>path = /data/samba/spool/private</code></em></td></tr><tr><td><a class="indexterm" name="id392728"></a><em class="parameter"><code>valid users = @acct, @acct_admin, @hr, "@Domain Admins",@Receptionist, dwayne, terri, danae, jerry</code></em></td></tr><tr><td><a class="indexterm" name="id392741"></a><em class="parameter"><code>create mask = 0644</code></em></td></tr><tr><td><a class="indexterm" name="id392752"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id392764"></a><em class="parameter"><code>copy = printers</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[plotter]</code></em></td></tr><tr><td><a class="indexterm" name="id392784"></a><em class="parameter"><code>comment = Engineering Plotter</code></em></td></tr><tr><td><a class="indexterm" name="id392796"></a><em class="parameter"><code>path = /data/samba/spool</code></em></td></tr><tr><td><a class="indexterm" name="id392807"></a><em class="parameter"><code>create mask = 0644</code></em></td></tr><tr><td><a class="indexterm" name="id392819"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id392830"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id392842"></a><em class="parameter"><code>copy = printers</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch8smbconf4"></a><p class="title"><b>Example 10.7. Samba Configuration File smb.conf Part D</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[APPS]</code></em></td></tr><tr><td><a class="indexterm" name="id392880"></a><em class="parameter"><code>path = /data/samba/shares/Apps</code></em></td></tr><tr><td><a class="indexterm" name="id392892"></a><em class="parameter"><code>force group = "Domain Users"</code></em></td></tr><tr><td><a class="indexterm" name="id392904"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[ACCT]</code></em></td></tr><tr><td><a class="indexterm" name="id392924"></a><em class="parameter"><code>path = /data/samba/shares/Accounting</code></em></td></tr><tr><td><a class="indexterm" name="id392936"></a><em class="parameter"><code>valid users = @acct, "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id392947"></a><em class="parameter"><code>force group = acct</code></em></td></tr><tr><td><a class="indexterm" name="id392959"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id392970"></a><em class="parameter"><code>create mask = 0660</code></em></td></tr><tr><td><a class="indexterm" name="id392982"></a><em class="parameter"><code>directory mask = 0770</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[ACCT_ADMIN]</code></em></td></tr><tr><td><a class="indexterm" name="id393002"></a><em class="parameter"><code>path = /data/samba/shares/Acct_Admin</code></em></td></tr><tr><td><a class="indexterm" name="id393014"></a><em class="parameter"><code>valid users = @âacct_adminâ</code></em></td></tr><tr><td><a class="indexterm" name="id393026"></a><em class="parameter"><code>force group = acct_admin</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[HR_PR]</code></em></td></tr><tr><td><a class="indexterm" name="id393046"></a><em class="parameter"><code>path = /data/samba/shares/HR_PR</code></em></td></tr><tr><td><a class="indexterm" name="id393058"></a><em class="parameter"><code>valid users = @hr, @acct_admin</code></em></td></tr><tr><td><a class="indexterm" name="id393069"></a><em class="parameter"><code>force group = hr</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[ENGR]</code></em></td></tr><tr><td><a class="indexterm" name="id393090"></a><em class="parameter"><code>path = /data/samba/shares/Engr</code></em></td></tr><tr><td><a class="indexterm" name="id393101"></a><em class="parameter"><code>valid users = @engr, @receptionist, @truss, "@Domain Admins", cheri</code></em></td></tr><tr><td><a class="indexterm" name="id393113"></a><em class="parameter"><code>force group = engr</code></em></td></tr><tr><td><a class="indexterm" name="id393125"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id393136"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[DATA]</code></em></td></tr><tr><td><a class="indexterm" name="id393156"></a><em class="parameter"><code>path = /data/samba/shares/DATA</code></em></td></tr><tr><td><a class="indexterm" name="id393168"></a><em class="parameter"><code>valid users = @engr, @receptionist, @truss, "@Domain Admins", cheri</code></em></td></tr><tr><td><a class="indexterm" name="id393180"></a><em class="parameter"><code>force group = engr</code></em></td></tr><tr><td><a class="indexterm" name="id393191"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id393203"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td><a class="indexterm" name="id393214"></a><em class="parameter"><code>copy = engr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch8smbconf5"></a><p class="title"><b>Example 10.8. Samba Configuration File smb.conf Part E</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[X]</code></em></td></tr><tr><td><a class="indexterm" name="id393253"></a><em class="parameter"><code>path = /data/samba/shares/X</code></em></td></tr><tr><td><a class="indexterm" name="id393264"></a><em class="parameter"><code>valid users = @engr, @acct</code></em></td></tr><tr><td><a class="indexterm" name="id393276"></a><em class="parameter"><code>force group = engr</code></em></td></tr><tr><td><a class="indexterm" name="id393288"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id393299"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td><a class="indexterm" name="id393310"></a><em class="parameter"><code>copy = engr</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[NETWORK]</code></em></td></tr><tr><td><a class="indexterm" name="id393331"></a><em class="parameter"><code>path = /data/samba/shares/network</code></em></td></tr><tr><td><a class="indexterm" name="id393342"></a><em class="parameter"><code>valid users = "@Domain Users"</code></em></td></tr><tr><td><a class="indexterm" name="id393354"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id393366"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td><a class="indexterm" name="id393377"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[UTILS]</code></em></td></tr><tr><td><a class="indexterm" name="id393397"></a><em class="parameter"><code>path = /data/samba/shares/Utils</code></em></td></tr><tr><td><a class="indexterm" name="id393409"></a><em class="parameter"><code>write list = "@Domain Admins"</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[SYS]</code></em></td></tr><tr><td><a class="indexterm" name="id393430"></a><em class="parameter"><code>path = /data/samba/shares/SYS</code></em></td></tr><tr><td><a class="indexterm" name="id393441"></a><em class="parameter"><code>valid users = chad</code></em></td></tr><tr><td><a class="indexterm" name="id393453"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id393464"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><p> 486 <a class="indexterm" name="id393479"></a> 487 <a class="indexterm" name="id393486"></a> 488 <a class="indexterm" name="id393492"></a> 489 489 Most of these shares are only used by one company group, but they are required 490 490 because of some ancient Qbasic and Rbase applications were that written expecting 491 491 their own drive letters. 492 492 </p><p> 493 <a class="indexterm" name="id3 71402"></a>494 <a class="indexterm" name="id3 71409"></a>495 <a class="indexterm" name="id3 71416"></a>493 <a class="indexterm" name="id393504"></a> 494 <a class="indexterm" name="id393511"></a> 495 <a class="indexterm" name="id393518"></a> 496 496 Note: During the process of building the new server, I kept data files 497 497 up to date with the Novell server via use of <code class="literal">rsync</code>. … … 501 501 <code class="filename">rsyncd.conf</code> to share that mount point out to my 502 502 new server, and synchronized once an hour. The script I used to synchronize 503 is shown in <a href="nw4migration.html#sbersync" title="Example 10.9. Rsync Script">???</a>. The files exclusion list I used504 is shown in <a href="nw4migration.html#sbexcld" title="Example 10.10. Rsync Files Exclusion List /root/excludes.txt">???</a>. The reason I had to have the503 is shown in <a class="link" href="nw4migration.html#sbersync" title="Example 10.9. Rsync Script">“Rsync Script”</a>. The files exclusion list I used 504 is shown in <a class="link" href="nw4migration.html#sbexcld" title="Example 10.10. Rsync Files Exclusion List /root/excludes.txt">“Rsync Files Exclusion List /root/excludes.txt”</a>. The reason I had to have the 505 505 <code class="literal">rsync</code> daemon running on a system that could be 506 506 rebooted frequently is because <code class="constant">ncpfs</code> … … 560 560 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 561 561 The Idealx smbldap-tools package can be configured using a script called 562 <code class="literal">configure.pl</code> that is provided as part of the tool. See <a href="happy.html" title="Chapter 5. Making Happy Users">???</a>562 <code class="literal">configure.pl</code> that is provided as part of the tool. See <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a> 563 563 for an example of its use. Many administrators, like Misty, choose to do this manually 564 564 so as to maintain greater awareness of how the tool-chain works and possibly to avoid … … 568 568 relevant files, which are usually put into the directory 569 569 <code class="filename">/etc/smbldap-tools</code>. The main file, 570 <code class="filename">smbldap.conf</code> is shown in <a href="nw4migration.html#ch8ideal" title="Example 10.11. Idealx smbldap-tools Control File Part A">???</a>.570 <code class="filename">smbldap.conf</code> is shown in <a class="link" href="nw4migration.html#ch8ideal" title="Example 10.11. Idealx smbldap-tools Control File Part A">“Idealx smbldap-tools Control File Part A”</a>. 571 571 </p><div class="example"><a name="ch8ideal"></a><p class="title"><b>Example 10.11. Idealx smbldap-tools Control File Part A</b></p><div class="example-contents"><pre class="screen"> 572 572 ######### … … 740 740 smbpasswd="/usr/bin/smbpasswd" 741 741 </pre></div></div><br class="example-break"><p> 742 <a class="indexterm" name="id3 71746"></a>742 <a class="indexterm" name="id393860"></a> 743 743 Note: I chose not to take advantage of the TLS capability of this. 744 744 Eventually I may go back and tweak it. Also, I chose not to take advantage … … 814 814 </pre><p> 815 815 </p><p> 816 <a class="indexterm" name="id3 71820"></a>817 <a class="indexterm" name="id3 71827"></a>818 <a class="indexterm" name="id3 71834"></a>819 <a class="indexterm" name="id3 71841"></a>820 <a class="indexterm" name="id3 71847"></a>816 <a class="indexterm" name="id393934"></a> 817 <a class="indexterm" name="id393941"></a> 818 <a class="indexterm" name="id393948"></a> 819 <a class="indexterm" name="id393954"></a> 820 <a class="indexterm" name="id393961"></a> 821 821 With the LDAP directory now initialized, it was time to create the Windows and POSIX 822 822 (UNIX) group accounts as well as the mappings from Windows groups to UNIX groups. … … 826 826 try to do this by hand. 827 827 </p><p> 828 <a class="indexterm" name="id3 71866"></a>829 <a class="indexterm" name="id3 71873"></a>830 <a class="indexterm" name="id3 71880"></a>828 <a class="indexterm" name="id393980"></a> 829 <a class="indexterm" name="id393987"></a> 830 <a class="indexterm" name="id393994"></a> 831 831 After I had my group mappings in place, I added users to the groups (the users 832 832 don't really have to exist yet). I used the <code class="literal">smbldap-groupmod</code> … … 834 834 attributes to the group entries in LDAP. 835 835 </p><p> 836 <a class="indexterm" name="id3 71898"></a>837 <a class="indexterm" name="id3 71905"></a>838 <a class="indexterm" name="id3 71912"></a>836 <a class="indexterm" name="id394012"></a> 837 <a class="indexterm" name="id394019"></a> 838 <a class="indexterm" name="id394026"></a> 839 839 The most monumental task of all was adding the sambaSamAccount information to each 840 840 already existent posixAccount entry. I did it one at a time as I moved people onto … … 843 843 <code class="prompt">root# </code> smbldap-usermod -a -P username 844 844 </pre><p> 845 <a class="indexterm" name="id3 71932"></a>846 <a class="indexterm" name="id3 71939"></a>847 <a class="indexterm" name="id3 71946"></a>845 <a class="indexterm" name="id394046"></a> 846 <a class="indexterm" name="id394053"></a> 847 <a class="indexterm" name="id394059"></a> 848 848 I completed that step for every user after asking the person what his or her current 849 849 NetWare password was. The wiser way to have done it would probably have been to dump the … … 852 852 <code class="prompt">root# </code> slapcat > somefile.ldif 853 853 </pre><p> 854 <a class="indexterm" name="id3 71967"></a>855 <a class="indexterm" name="id3 71973"></a>854 <a class="indexterm" name="id394080"></a> 855 <a class="indexterm" name="id394087"></a> 856 856 Then update the LDIF file created by using a Perl script to parse and add the 857 857 appropriate attributes and objectClasses to each entry, followed by re-importing … … 934 934 </pre><p> 935 935 </p><p> 936 <a class="indexterm" name="id3 72066"></a>936 <a class="indexterm" name="id394178"></a> 937 937 So now I could log on with a test user from the machine w2kengrspare. It was all well and 938 938 good, but that user was in no groups yet and so had pretty boring access. I fixed that 939 939 by writing the login script! To write the login script, I used 940 <a href="http://www.kixtart.org" target="_top">Kixtart</a> because it will work940 <a class="ulink" href="http://www.kixtart.org" target="_top">Kixtart</a> because it will work 941 941 with every architecture of Windows, has an active and helpful user base, and was both 942 942 easier to learn and more powerful than the standard netlogon scripts I have seen. 943 943 I also did not have to do a logon script per user or per group. 944 944 </p><p> 945 <a class="indexterm" name="id3 72086"></a>945 <a class="indexterm" name="id394198"></a> 946 946 I downloaded Kixtart and put the following files in my netlogon share: 947 947 </p><pre class="screen"> … … 955 955 </pre><p> 956 956 </p><p> 957 <a class="indexterm" name="id3 72109"></a>957 <a class="indexterm" name="id394221"></a> 958 958 I then wrote the <code class="filename">logon.kix</code> file that is shown in 959 <a href="nw4migration.html#ch8kix" title="Example 10.15. Kixtart Control File File: logon.kix">???</a>. I chose to keep it all in one file, but it959 <a class="link" href="nw4migration.html#ch8kix" title="Example 10.15. Kixtart Control File File: logon.kix">“Kixtart Control File File: logon.kix”</a>. I chose to keep it all in one file, but it 960 960 can be split up and linked via include directives. 961 961 </p><div class="example"><a name="ch8kix"></a><p class="title"><b>Example 10.15. Kixtart Control File File: logon.kix</b></p><div class="example-contents"><pre class="screen"> … … 1138 1138 so it was easier to do it by hand. 1139 1139 </p><p> 1140 <a class="indexterm" name="id3 72323"></a>1140 <a class="indexterm" name="id394445"></a> 1141 1141 At this point I was able to add the users. This is the part that really falls 1142 1142 into upgrade. I moved the users over one group at a time, starting with the … … 1240 1240 and two runnable processes on the server. I have improved the security and 1241 1241 robustness of the system. I have also implemented 1242 <a href="http://www.clamav.net" target="_top">ClamAV</a> antivirus software,1242 <a class="ulink" href="http://www.clamav.net" target="_top">ClamAV</a> antivirus software, 1243 1243 which scans the entire Samba server for viruses every 2 hours and 1244 1244 quarantines them. I have found it much less problematic than our ancient -
branches/samba-3.0/docs/htmldocs/Samba3-ByExample/pr01.html
r39 r134 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>About the Cover Artwork</title><link rel="stylesheet" href=" samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="index.html" title="Samba-3 by Example"><link rel="next" href="pr02.html" title="Acknowledgments"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">About the Cover Artwork</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="index.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="pr02.html">Next</a></td></tr></table><hr></div><div class="preface" lang="en-US"><div class="titlepage"><div><div><h2 class="title"><a name="id275208"></a>About the Cover Artwork</h2></div></div></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>About the Cover Artwork</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="index.html" title="Samba-3 by Example"><link rel="next" href="pr02.html" title="Acknowledgments"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">About the Cover Artwork</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="index.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="pr02.html">Next</a></td></tr></table><hr></div><div class="preface" lang="en-US"><div class="titlepage"><div><div><h2 class="title"><a name="id330669"></a>About the Cover Artwork</h2></div></div></div><p> 2 2 The cover artwork of this book continues the freedom theme of the first 3 3 edition of “<span class="quote">Samba-3 by Example</span>”. The history of civilization -
branches/samba-3.0/docs/htmldocs/Samba3-ByExample/pr02.html
r39 r134 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Acknowledgments</title><link rel="stylesheet" href=" samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="pr01.html" title="About the Cover Artwork"><link rel="next" href="pr03.html" title="Foreword"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Acknowledgments</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="pr01.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="pr03.html">Next</a></td></tr></table><hr></div><div class="preface" lang="en-US"><div class="titlepage"><div><div><h2 class="title"><a name="id274575"></a>Acknowledgments</h2></div></div></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Acknowledgments</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="pr01.html" title="About the Cover Artwork"><link rel="next" href="pr03.html" title="Foreword"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Acknowledgments</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="pr01.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="pr03.html">Next</a></td></tr></table><hr></div><div class="preface" lang="en-US"><div class="titlepage"><div><div><h2 class="title"><a name="id297914"></a>Acknowledgments</h2></div></div></div><p> 2 2 <span class="emphasis"><em>Samba-3 by Example</em></span> would not have been written except 3 3 as a result of feedback provided by reviewers and readers of the book <span class="emphasis"><em>The -
branches/samba-3.0/docs/htmldocs/Samba3-ByExample/pr03.html
r39 r134 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Foreword</title><link rel="stylesheet" href=" samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="pr02.html" title="Acknowledgments"><link rel="next" href="preface.html" title="Preface"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Foreword</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="pr02.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="preface.html">Next</a></td></tr></table><hr></div><div class="preface" lang="en-US"><div class="titlepage"><div><div><h2 class="title"><a name="id275394"></a>Foreword</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="pr03.html#id275401">By John M. Weathersby, Executive Director, OSSI</a></span></dt></dl></div><div class="sect1" lang="en-US"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id275401"></a>By John M. Weathersby, Executive Director, OSSI</h2></div></div></div><div class="blockquote"><blockquote class="blockquote"><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Foreword</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="pr02.html" title="Acknowledgments"><link rel="next" href="preface.html" title="Preface"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Foreword</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="pr02.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="preface.html">Next</a></td></tr></table><hr></div><div class="preface" lang="en-US"><div class="titlepage"><div><div><h2 class="title"><a name="id298546"></a>Foreword</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="pr03.html#id298553">By John M. Weathersby, Executive Director, OSSI</a></span></dt></dl></div><div class="sect1" lang="en-US"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id298553"></a>By John M. Weathersby, Executive Director, OSSI</h2></div></div></div><div class="blockquote"><blockquote class="blockquote"><p> 2 2 The Open Source Software Institute (OSSI) is comprised of representatives from a broad spectrum of business and 3 3 non-business organizations that share a common interest in the promotion of development and implementation -
branches/samba-3.0/docs/htmldocs/Samba3-ByExample/preface.html
r44 r134 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Preface</title><link rel="stylesheet" href=" samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="pr03.html" title="Foreword"><link rel="next" href="ExNetworks.html" title="Part I. Example Network Configurations"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Preface</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="pr03.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="ExNetworks.html">Next</a></td></tr></table><hr></div><div class="preface" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="preface"></a>Preface</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="preface.html#id274305">Why Is This Book Necessary?</a></span></dt><dd><dl><dt><span class="sect2"><a href="preface.html#id274342">Samba 3.0.20 Update Edition</a></span></dt></dl></dd><dt><span class="sect1"><a href="preface.html#id274092">Prerequisites</a></span></dt><dt><span class="sect1"><a href="preface.html#id315668">Approach</a></span></dt><dt><span class="sect1"><a href="preface.html#id315719">Summary of Topics</a></span></dt><dt><span class="sect1"><a href="preface.html#id316343">Conventions Used</a></span></dt></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Preface</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="pr03.html" title="Foreword"><link rel="next" href="ExNetworks.html" title="Part I. Example Network Configurations"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Preface</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="pr03.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="ExNetworks.html">Next</a></td></tr></table><hr></div><div class="preface" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="preface"></a>Preface</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="preface.html#id298129">Why Is This Book Necessary?</a></span></dt><dd><dl><dt><span class="sect2"><a href="preface.html#id298166">Samba 3.0.20 Update Edition</a></span></dt></dl></dd><dt><span class="sect1"><a href="preface.html#id297715">Prerequisites</a></span></dt><dt><span class="sect1"><a href="preface.html#id339863">Approach</a></span></dt><dt><span class="sect1"><a href="preface.html#id339912">Summary of Topics</a></span></dt><dt><span class="sect1"><a href="preface.html#id340490">Conventions Used</a></span></dt></dl></div><p> 2 2 Network administrators live busy lives. We face distractions and pressures 3 3 that drive us to seek proven, working case scenarios that can be easily … … 34 34 services and applications such as OpenLDAP, DNS and DHCP, the need for which 35 35 can be met from other resources that are dedicated to the subject. 36 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2 74305"></a>Why Is This Book Necessary?</h2></div></div></div><p>36 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id298129"></a>Why Is This Book Necessary?</h2></div></div></div><p> 37 37 This book is the result of observations and feedback. The feedback from 38 38 the Samba-HOWTO-Collection has been positive and complimentary. There … … 54 54 on the CD-ROM. This book is descriptive, provides detailed diagrams, and 55 55 makes deployment of Samba-3 a breeze. 56 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2 74342"></a>Samba 3.0.20 Update Edition</h3></div></div></div><p>56 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id298166"></a>Samba 3.0.20 Update Edition</h3></div></div></div><p> 57 57 The Samba 3.0.x series has been remarkably popular. At the time this book first 58 58 went to print samba-3.0.2 was being released. There have been significant modifications … … 63 63 be reflected in future updates. 64 64 </p><p> 65 The changes shown in <a href="preface.html#pref-new" title="Table 1. Samba Changes 3.0.2 to 3.0.20">???</a> are incorporated in this update.65 The changes shown in <a class="link" href="preface.html#pref-new" title="Table 1. Samba Changes 3.0.2 to 3.0.20">“Samba Changes 3.0.2 to 3.0.20”</a> are incorporated in this update. 66 66 </p><div class="table"><a name="pref-new"></a><p class="title"><b>Table 1. Samba Changes 3.0.2 to 3.0.20</b></p><div class="table-contents"><table summary="Samba Changes 3.0.2 to 3.0.20" border="1"><colgroup><col align="left"><col align="justify"></colgroup><thead><tr><th align="left"> 67 67 <p> … … 127 127 be delegated to normal user accounts or to groups of users. 128 128 </p> 129 </td></tr></tbody></table></div></div><br class="table-break"></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2 74092"></a>Prerequisites</h2></div></div></div><p>129 </td></tr></tbody></table></div></div><br class="table-break"></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id297715"></a>Prerequisites</h2></div></div></div><p> 130 130 This book is not a tutorial on UNIX or Linux administration. UNIX and Linux 131 131 training is best obtained from books dedicated to the subject. This book … … 140 140 may need to refer to administrative guides or manuals for your operating system 141 141 platform to find what is the best method to achieve what the text of this book describes. 142 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 15668"></a>Approach</h2></div></div></div><p>142 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id339863"></a>Approach</h2></div></div></div><p> 143 143 The first chapter deals with some rather thorny network analysis issues. Do not be 144 144 put off by this. The information you glean, even without a detailed understanding … … 168 168 Each chapter has a set of questions and answers to help you to 169 169 to understand and digest key attributes of the solutions presented. 170 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 15719"></a>Summary of Topics</h2></div></div></div><p>170 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id339912"></a>Summary of Topics</h2></div></div></div><p> 171 171 The contents of this second edition of <span class="emphasis"><em>Samba-3 by Example</em></span> 172 172 have been rearranged based on feedback from purchasers of the first edition. … … 280 280 overheads and yet get better control of the network? 281 281 </p><p> 282 This chapter has been contributed by Mark Taylor <code class="email"><<a href="mailto:mark.taylor@siriusit.co.uk">mark.taylor@siriusit.co.uk</a>></code>282 This chapter has been contributed by Mark Taylor <code class="email"><<a class="email" href="mailto:mark.taylor@siriusit.co.uk">mark.taylor@siriusit.co.uk</a>></code> 283 283 and is based on a live site. For further information regarding this example case, 284 284 please contact Mark directly. … … 365 365 a file and print server to create a connection over which file and print 366 366 operations may take place. 367 </p></dd></dl></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 16343"></a>Conventions Used</h2></div></div></div><p>367 </p></dd></dl></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id340490"></a>Conventions Used</h2></div></div></div><p> 368 368 The following notation conventions are used throughout this book: 369 369 </p><div class="itemizedlist"><ul type="disc"><li><p> -
branches/samba-3.0/docs/htmldocs/Samba3-ByExample/primer.html
r44 r134 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 16. Networking Primer</title><link rel="stylesheet" href=" samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits"><link rel="next" href="gpl.html" title="Appendix A. GNU General Public License"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 16. Networking Primer</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="appendix.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="gpl.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="primer"></a>Chapter 16. Networking Primer</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="primer.html#id386080">Requirements and Notes</a></span></dt><dt><span class="sect1"><a href="primer.html#id386216">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id386266">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#id386373">Exercises</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id386486">Single-Machine Broadcast Activity</a></span></dt><dt><span class="sect2"><a href="primer.html#secondmachine">Second Machine Startup Broadcast Interaction</a></span></dt><dt><span class="sect2"><a href="primer.html#id387580">Simple Windows Client Connection Characteristics</a></span></dt><dt><span class="sect2"><a href="primer.html#id388041">Windows 200x/XP Client Interaction with Samba-3</a></span></dt><dt><span class="sect2"><a href="primer.html#id388566">Conclusions to Exercises</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01conc">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id388668">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01qa">Questions and Answers</a></span></dt></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 16. Networking Primer</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits"><link rel="next" href="apa.html" title="Appendix A. GNU General Public License version 3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 16. Networking Primer</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="appendix.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="apa.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="primer"></a>Chapter 16. Networking Primer</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="primer.html#id408228">Requirements and Notes</a></span></dt><dt><span class="sect1"><a href="primer.html#id408364">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id408414">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#id408521">Exercises</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id408634">Single-Machine Broadcast Activity</a></span></dt><dt><span class="sect2"><a href="primer.html#secondmachine">Second Machine Startup Broadcast Interaction</a></span></dt><dt><span class="sect2"><a href="primer.html#id409728">Simple Windows Client Connection Characteristics</a></span></dt><dt><span class="sect2"><a href="primer.html#id410194">Windows 200x/XP Client Interaction with Samba-3</a></span></dt><dt><span class="sect2"><a href="primer.html#id410719">Conclusions to Exercises</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01conc">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id410820">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01qa">Questions and Answers</a></span></dt></dl></div><p> 2 2 You are about to use the equivalent of a microscope to look at the information 3 3 that runs through the veins of a Windows network. We do more to observe the information than … … 9 9 Samba can be configured with a minimum of complexity. Simplicity should be mastered 10 10 before you get too deeply into complexities. Let's get moving: we have work to do. 11 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id 386080"></a>Requirements and Notes</h2></div></div></div><p>11 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id408228"></a>Requirements and Notes</h2></div></div></div><p> 12 12 Successful completion of this primer requires two Microsoft Windows 9x/Me Workstations 13 13 as well as two Microsoft Windows XP Professional Workstations, each equipped with an Ethernet 14 14 card connected using a hub. Also required is one additional server (either Windows 15 15 NT4 Server, Windows 2000 Server, or a Samba-3 on UNIX/Linux server) running a network 16 sniffer and analysis application ( etherealis a good choice). All work should be undertaken16 sniffer and analysis application (Wireshark is a good choice). All work should be undertaken 17 17 on a quiet network where there is no other traffic. It is best to use a dedicated hub 18 18 with only the machines under test connected at the time of the exercises. 19 </p><p><a class="indexterm" name="id 386095"></a>20 Ethereal has become the network protocol analyzer of choice for many network administrators.21 You may find more information regarding this tool from the 22 <a href="http://www.ethereal.com" target="_top">Ethereal</a> Web site. Ethereal installation23 files for Windows may be obtained from the Ethereal Web site. Ethereal is provided with24 SUSE and Red Hat Linux distributions, as well as with many other Linux distributions. It may 25 not be installed on your system by default. If it is not installed, you may also need 26 to install the <code class="literal">libpcap </code> software before you can install or use Ethereal.27 Please refer to the instructions for your operating system or to the Ethereal Web site28 for information regarding the installation and operation of Ethereal.29 </p><p> 30 To obtain <code class="literal"> ethereal</code> for your system, please visit the Ethereal31 <a href="http://www.ethereal.com/download.html#binaries" target="_top">download site</a>.19 </p><p><a class="indexterm" name="id408243"></a> 20 Wireshark (formerly Ethereal) has become the network protocol analyzer of choice for many network administrators. 21 You may find more information regarding this tool from the 22 <a class="ulink" href="http://www.wireshark.org" target="_top">Wireshark</a> Web site. Wireshark installation 23 files for Windows may be obtained from the Wireshark Web site. Wireshark is provided with 24 SUSE and Red Hat Linux distributions, as well as with many other Linux distributions. It may 25 not be installed on your system by default. If it is not installed, you may also need 26 to install the <code class="literal">libpcap</code> software before you can install or use Wireshark. 27 Please refer to the instructions for your operating system or to the Wireshark Web site 28 for information regarding the installation and operation of Wireshark. 29 </p><p> 30 To obtain <code class="literal">Wireshark</code> for your system, please visit the Wireshark 31 <a class="ulink" href="http://www.wireshark.org/download.html" target="_top">download site</a>. 32 32 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 33 33 The successful completion of this chapter requires that you capture network traffic 34 using <code class="literal"> Ethereal</code>. It is recommended that you use a hub, not an34 using <code class="literal">Wireshark</code>. It is recommended that you use a hub, not an 35 35 Ethernet switch. It is necessary for the device used to act as a repeater, not as a 36 36 filter. Ethernet switches may filter out traffic that is not directed at the machine 37 37 that is used to monitor traffic; this would not allow you to complete the projects. 38 38 </p></div><p> 39 <a class="indexterm" name="id 386154"></a>39 <a class="indexterm" name="id408302"></a> 40 40 Do not worry too much if you do not have access to all this equipment; network captures 41 41 from the exercises are provided on the enclosed CD-ROM. This makes it possible to dive directly 42 42 into the analytical part of the exercises if you so desire. 43 </p><p><a class="indexterm" name="id 386168"></a><a class="indexterm" name="id386179"></a>44 Please do not be alarmed at the use of a high-powered analysis tool ( Ethereal) in this45 primer. We expose you only to a minimum of detail necessary to complete 43 </p><p><a class="indexterm" name="id408315"></a><a class="indexterm" name="id408327"></a> 44 Please do not be alarmed at the use of a high-powered analysis tool (Wireshark) in this 45 primer. We expose you only to a minimum of detail necessary to complete 46 46 the exercises. If you choose to use any other network sniffer and protocol 47 47 analysis tool, be advised that it may not allow you to examine the contents of 48 48 recently added security protocols used by Windows 200x/XP. 49 49 </p><p> 50 You could just skim through the exercises and try to absorb the key points made. 51 The exercises provide all the information necessary to convince the die-hard network 52 engineer. You possibly do not require so much convincing and may just want to move on, 53 in which case you should at least read <a href="primer.html#chap01conc" title="Dissection and Discussion">???</a>.54 </p><p> 55 <a href="primer.html#chap01qa" title="Questions and Answers">???</a> also provides useful information50 You could just skim through the exercises and try to absorb the key points made. 51 The exercises provide all the information necessary to convince the die-hard network 52 engineer. You possibly do not require so much convincing and may just want to move on, 53 in which case you should at least read <a class="link" href="primer.html#chap01conc" title="Dissection and Discussion">“Dissection and Discussion”</a>. 54 </p><p> 55 <a class="link" href="primer.html#chap01qa" title="Questions and Answers">“Questions and Answers”</a> also provides useful information 56 56 that may help you to avoid significantly time-consuming networking problems. 57 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id 386216"></a>Introduction</h2></div></div></div><p>57 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id408364"></a>Introduction</h2></div></div></div><p> 58 58 The purpose of this chapter is to create familiarity with key aspects of Microsoft Windows 59 network computing. If you want a solid technical grounding, do not gloss over these exercises. 60 The points covered are recurrent issues on the Samba mailing lists. 61 </p><p><a class="indexterm" name="id 386228"></a>59 network computing. If you want a solid technical grounding, do not gloss over these exercises. 60 The points covered are recurrent issues on the Samba mailing lists. 61 </p><p><a class="indexterm" name="id408376"></a> 62 62 You can see from these exercises that Windows networking involves quite a lot of network 63 63 broadcast traffic. You can look into the contents of some packets, but only to see … … 75 75 Edition</em></span> (TOSHARG2) Chapter 9, “<span class="quote">Network Browsing,</span>” and Chapter 3, 76 76 “<span class="quote">Server Types and Security Modes.</span>” 77 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 386266"></a>Assignment Tasks</h3></div></div></div><p><a class="indexterm" name="id386273"></a>77 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id408414"></a>Assignment Tasks</h3></div></div></div><p><a class="indexterm" name="id408421"></a> 78 78 You are about to witness how Microsoft Windows computer networking functions. The 79 79 exercises step through identification of how a client machine establishes a … … 81 81 each other (i.e., how browsing works) and how the two key types of user identification 82 82 (share mode security and user mode security) are affected. 83 </p><p><a class="indexterm" name="id 386287"></a>83 </p><p><a class="indexterm" name="id408435"></a> 84 84 The networking protocols used by MS Windows networking when working with Samba 85 85 use TCP/IP as the transport protocol. The protocols that are specific to Windows 86 networking are encapsulated in TCP/IP. The network analyzer we use ( Ethereal)86 networking are encapsulated in TCP/IP. The network analyzer we use (Wireshark) 87 87 is able to show you the contents of the TCP/IP packets (or messages). 88 </p><div class="procedure"><a name="chap01tasks"></a><p class="title"><b>Procedure 16.1. Diagnostic Tasks</b></p><ol type="1"><li><p><a class="indexterm" name="id 386318"></a><a class="indexterm" name="id386329"></a><a class="indexterm" name="id386337"></a>88 </p><div class="procedure"><a name="chap01tasks"></a><p class="title"><b>Procedure 16.1. Diagnostic Tasks</b></p><ol type="1"><li><p><a class="indexterm" name="id408465"></a><a class="indexterm" name="id408477"></a><a class="indexterm" name="id408485"></a> 89 89 Examine network traces to witness SMB broadcasts, host announcements, 90 90 and name resolution processes. … … 96 96 Review traces of network logons for a Windows 9x/Me client as well as 97 97 a domain logon for a Windows XP Professional client. 98 </p></li></ol></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id 386373"></a>Exercises</h2></div></div></div><p>99 <a class="indexterm" name="id 386381"></a>98 </p></li></ol></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id408521"></a>Exercises</h2></div></div></div><p> 99 <a class="indexterm" name="id408529"></a> 100 100 You are embarking on a course of discovery. The first part of the exercise requires 101 101 two MS Windows 9x/Me systems. We called one machine <code class="constant">WINEPRESSME</code> and the 102 102 other <code class="constant">MILGATE98</code>. Each needs an IP address; we used <code class="literal">10.1.1.10</code> 103 103 and <code class="literal">10.1.1.11</code>. The test machines need to be networked via a <span class="emphasis"><em>hub</em></span>. A UNIX/Linux 104 machine is required to run <code class="literal"> Ethereal</code> to enable the network activity to be captured.104 machine is required to run <code class="literal">Wireshark</code> to enable the network activity to be captured. 105 105 It is important that the machine from which network activity is captured must not interfere with 106 106 the operation of the Windows workstations. It is helpful for this machine to be passive (does not … … 112 112 Choose a workgroup name (MIDEARTH) for each exercise. 113 113 </p><p> 114 <a class="indexterm" name="id 386463"></a>114 <a class="indexterm" name="id408611"></a> 115 115 The network captures provided on the CD-ROM included with this book were captured using <code class="constant">Ethereal</code> 116 version <code class="literal">0.10.6</code>. A later version suffices without problems , but an earlier version may not116 version <code class="literal">0.10.6</code>. A later version suffices without problems (i.e. you should be using Wireshark), but an earlier version may not 117 117 expose all the information needed. Each capture file has been decoded and listed as a trace file. A summary of all 118 118 packets has also been included. This makes it possible for you to do all the studying you like without the need to … … 120 120 that can be derived from this book really does warrant your taking sufficient time to practice each exercise with 121 121 care and attention to detail. 122 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 386486"></a>Single-Machine Broadcast Activity</h3></div></div></div><p>122 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id408634"></a>Single-Machine Broadcast Activity</h3></div></div></div><p> 123 123 In this section, we start a single Windows 9x/Me machine, then monitor network activity for 30 minutes. 124 </p><div class="procedure"><a name="id 386496"></a><p class="title"><b>Procedure 16.2. Monitoring Windows 9x Steps</b></p><ol type="1"><li><p>125 Start the machine from which network activity will be monitored (using <code class="literal"> ethereal</code>).126 Launch <code class="literal"> ethereal</code>, click124 </p><div class="procedure"><a name="id408644"></a><p class="title"><b>Procedure 16.2. Monitoring Windows 9x Steps</b></p><ol type="1"><li><p> 125 Start the machine from which network activity will be monitored (using <code class="literal">Wireshark</code>). 126 Launch <code class="literal">Wireshark</code>, click 127 127 <span class="guimenu">Capture</span> → <span class="guimenuitem">Start</span>. 128 128 </p><p> 129 Click the following: 129 Click the following: 130 130 </p><div class="orderedlist"><ol type="1"><li><p>Update list of packets in real time</p></li><li><p>Automatic scrolling in live capture</p></li><li><p>Enable MAC name resolution</p></li><li><p>Enable network name resolution</p></li><li><p>Enable transport name resolution</p></li></ol></div><p> 131 131 Click <span class="guibutton">OK</span>. … … 135 135 </p></li><li><p> 136 136 At the conclusion of 30 minutes, stop the capture. Save the capture to a file so you can go back to it later. 137 Leave this machine running in preparation for the task in <a href="primer.html#secondmachine" title="Second Machine Startup Broadcast Interaction">???</a>.137 Leave this machine running in preparation for the task in <a class="link" href="primer.html#secondmachine" title="Second Machine Startup Broadcast Interaction">“Second Machine Startup Broadcast Interaction”</a>. 138 138 </p></li><li><p> 139 139 Analyze the capture. Identify each discrete message type that was captured. Note what transport protocol 140 140 was used. Identify the timing between messages of identical types. 141 </p></li></ol></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id 386612"></a>Findings</h4></div></div></div><p>142 The summary of the first 10 minutes of the packet capture should look like <a href="primer.html#pktcap01" title="Figure 16.1. Windows Me Broadcasts The First 10 Minutes">???</a>.143 A screenshot of a later stage of the same capture is shown in <a href="primer.html#pktcap02" title="Figure 16.2. Windows Me Later Broadcast Sample">???</a>.144 </p><div class="figure"><a name="pktcap01"></a><p class="title"><b>Figure 16.1. Windows Me Broadcasts The First 10 Minutes</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/WINREPRESSME-Capture.png" width="216" alt="Windows Me Broadcasts The First 10 Minutes"></div></div></div><br class="figure-break"><div class="figure"><a name="pktcap02"></a><p class="title"><b>Figure 16.2. Windows Me Later Broadcast Sample</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/WINREPRESSME-Capture2.png" width="226.8" alt="Windows Me Later Broadcast Sample"></div></div></div><br class="figure-break"><p><a class="indexterm" name="id 386725"></a><a class="indexterm" name="id386736"></a>145 Broadcast messages observed are shown in <a href="primer.html#capsstats01" title="Table 16.1. Windows Me Startup Broadcast Capture Statistics">???</a>.141 </p></li></ol></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id408760"></a>Findings</h4></div></div></div><p> 142 The summary of the first 10 minutes of the packet capture should look like <a class="link" href="primer.html#pktcap01" title="Figure 16.1. Windows Me Broadcasts The First 10 Minutes">“Windows Me Broadcasts The First 10 Minutes”</a>. 143 A screenshot of a later stage of the same capture is shown in <a class="link" href="primer.html#pktcap02" title="Figure 16.2. Windows Me Later Broadcast Sample">“Windows Me Later Broadcast Sample”</a>. 144 </p><div class="figure"><a name="pktcap01"></a><p class="title"><b>Figure 16.1. Windows Me Broadcasts The First 10 Minutes</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/WINREPRESSME-Capture.png" width="216" alt="Windows Me Broadcasts The First 10 Minutes"></div></div></div><br class="figure-break"><div class="figure"><a name="pktcap02"></a><p class="title"><b>Figure 16.2. Windows Me Later Broadcast Sample</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/WINREPRESSME-Capture2.png" width="226.8" alt="Windows Me Later Broadcast Sample"></div></div></div><br class="figure-break"><p><a class="indexterm" name="id408873"></a><a class="indexterm" name="id408884"></a> 145 Broadcast messages observed are shown in <a class="link" href="primer.html#capsstats01" title="Table 16.1. Windows Me Startup Broadcast Capture Statistics">“Windows Me Startup Broadcast Capture Statistics”</a>. 146 146 Actual observations vary a little, but not by much. 147 147 Early in the startup process, the Windows Me machine broadcasts its name for two reasons: 148 148 first to ensure that its name would not result in a name clash, and second to establish its 149 149 presence with the Local Master Browser (LMB). 150 </p><div class="table"><a name="capsstats01"></a><p class="title"><b>Table 16.1. Windows Me Startup Broadcast Capture Statistics</b></p><div class="table-contents"><table summary="Windows Me Startup Broadcast Capture Statistics" border="1"><colgroup><col align="left"><col align="center"><col align="center"><col align="left"></colgroup><thead><tr><th align="left">Message</th><th align="center">Type</th><th align="center">Num</th><th align="left">Notes</th></tr></thead><tbody><tr><td align="left">WINEPRESSME<00></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.6 sec apart</td></tr><tr><td align="left">WINEPRESSME<03></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.6 sec apart</td></tr><tr><td align="left">WINEPRESSME<20></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<00></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1d></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1e></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1b></td><td align="center">Qry</td><td align="center">84</td><td align="left">300 sec apart at stable operation</td></tr><tr><td align="left">__MSBROWSE__</td><td align="center">Reg</td><td align="center">8</td><td align="left">Registered after winning election to Browse Master</td></tr><tr><td align="left">JHT<03></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 x 2. This is the name of the user that logged onto Windows</td></tr><tr><td align="left">Host Announcement WINEPRESSME</td><td align="center">Ann</td><td align="center">2</td><td align="left">Observed at 10 sec</td></tr><tr><td align="left">Domain/Workgroup Announcement MIDEARTH</td><td align="center">Ann</td><td align="center">18</td><td align="left">300 sec apart at stable operation</td></tr><tr><td align="left">Local Master Announcement WINEPRESSME</td><td align="center">Ann</td><td align="center">18</td><td align="left">300 sec apart at stable operation</td></tr><tr><td align="left">Get Backup List Request</td><td align="center">Qry</td><td align="center">12</td><td align="left">6 x 2 early in startup, 0.5 sec apart</td></tr><tr><td align="left">Browser Election Request</td><td align="center">Ann</td><td align="center">10</td><td align="left">5 x 2 early in startup</td></tr><tr><td align="left">Request Announcement WINEPRESSME</td><td align="center">Ann</td><td align="center">4</td><td align="left">Early in startup</td></tr></tbody></table></div></div><br class="table-break"><p><a class="indexterm" name="id 387071"></a><a class="indexterm" name="id387079"></a>150 </p><div class="table"><a name="capsstats01"></a><p class="title"><b>Table 16.1. Windows Me Startup Broadcast Capture Statistics</b></p><div class="table-contents"><table summary="Windows Me Startup Broadcast Capture Statistics" border="1"><colgroup><col align="left"><col align="center"><col align="center"><col align="left"></colgroup><thead><tr><th align="left">Message</th><th align="center">Type</th><th align="center">Num</th><th align="left">Notes</th></tr></thead><tbody><tr><td align="left">WINEPRESSME<00></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.6 sec apart</td></tr><tr><td align="left">WINEPRESSME<03></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.6 sec apart</td></tr><tr><td align="left">WINEPRESSME<20></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<00></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1d></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1e></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1b></td><td align="center">Qry</td><td align="center">84</td><td align="left">300 sec apart at stable operation</td></tr><tr><td align="left">__MSBROWSE__</td><td align="center">Reg</td><td align="center">8</td><td align="left">Registered after winning election to Browse Master</td></tr><tr><td align="left">JHT<03></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 x 2. This is the name of the user that logged onto Windows</td></tr><tr><td align="left">Host Announcement WINEPRESSME</td><td align="center">Ann</td><td align="center">2</td><td align="left">Observed at 10 sec</td></tr><tr><td align="left">Domain/Workgroup Announcement MIDEARTH</td><td align="center">Ann</td><td align="center">18</td><td align="left">300 sec apart at stable operation</td></tr><tr><td align="left">Local Master Announcement WINEPRESSME</td><td align="center">Ann</td><td align="center">18</td><td align="left">300 sec apart at stable operation</td></tr><tr><td align="left">Get Backup List Request</td><td align="center">Qry</td><td align="center">12</td><td align="left">6 x 2 early in startup, 0.5 sec apart</td></tr><tr><td align="left">Browser Election Request</td><td align="center">Ann</td><td align="center">10</td><td align="left">5 x 2 early in startup</td></tr><tr><td align="left">Request Announcement WINEPRESSME</td><td align="center">Ann</td><td align="center">4</td><td align="left">Early in startup</td></tr></tbody></table></div></div><br class="table-break"><p><a class="indexterm" name="id409219"></a><a class="indexterm" name="id409227"></a> 151 151 From the packet trace, it should be noted that no messages were propagated over TCP/IP; 152 152 all messages employed UDP/IP. When steady-state operation has been achieved, there is a cycle 153 153 of various announcements, re-election of a browse master, and name queries. These create 154 154 the symphony of announcements by which network browsing is made possible. 155 </p><p><a class="indexterm" name="id 387093"></a>155 </p><p><a class="indexterm" name="id409241"></a> 156 156 For detailed information regarding the precise behavior of the CIFS/SMB protocols, 157 157 refer to the book “<span class="quote">Implementing CIFS: The Common Internet File System,</span>” … … 160 160 At this time, the machine you used to capture the single-system startup trace should still be running. 161 161 The objective of this task is to identify the interaction of two machines in respect to broadcast activity. 162 </p><div class="procedure"><a name="id 387125"></a><p class="title"><b>Procedure 16.3. Monitoring of Second Machine Activity</b></p><ol type="1"><li><p>163 On the machine from which network activity will be monitored (using <code class="literal"> ethereal</code>),164 launch <code class="literal"> ethereal</code> and click162 </p><div class="procedure"><a name="id409273"></a><p class="title"><b>Procedure 16.3. Monitoring of Second Machine Activity</b></p><ol type="1"><li><p> 163 On the machine from which network activity will be monitored (using <code class="literal">Wireshark</code>), 164 launch <code class="literal">Wireshark</code> and click 165 165 <span class="guimenu">Capture</span> → <span class="guimenuitem">Start</span>. 166 166 </p><p> 167 Click: 167 Click: 168 168 </p><div class="orderedlist"><ol type="1"><li><p>Update list of packets in real time</p></li><li><p>Automatic scrolling in live capture</p></li><li><p>Enable MAC name resolution</p></li><li><p>Enable network name resolution</p></li><li><p>Enable transport name resolution</p></li></ol></div><p> 169 169 Click <span class="guibutton">OK</span>. … … 177 177 Analyze the capture trace, taking note of the transport protocols used, the types of messages observed, 178 178 and what interaction took place between the two machines. Leave both machines running for the next task. 179 </p></li></ol></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id 387234"></a>Findings</h4></div></div></div><p>180 <a href="primer.html#capsstats02" title="Table 16.2. Second Machine (Windows 98) Capture Statistics">???</a> summarizes capture statistics observed. As in the previous case,179 </p></li></ol></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id409382"></a>Findings</h4></div></div></div><p> 180 <a class="link" href="primer.html#capsstats02" title="Table 16.2. Second Machine (Windows 98) Capture Statistics">“Second Machine (Windows 98) Capture Statistics”</a> summarizes capture statistics observed. As in the previous case, 181 181 all announcements used UDP/IP broadcasts. Also, as was observed with the last example, the second 182 182 Windows 9x/Me machine broadcasts its name on startup to ensure that there exists no name clash … … 185 185 “<span class="quote">Implementing CIFS: The Common Internet File System.</span>” 186 186 </p><div class="table"><a name="capsstats02"></a><p class="title"><b>Table 16.2. Second Machine (Windows 98) Capture Statistics</b></p><div class="table-contents"><table summary="Second Machine (Windows 98) Capture Statistics" border="1"><colgroup><col align="left"><col align="center"><col align="center"><col align="left"></colgroup><thead><tr><th align="left">Message</th><th align="center">Type</th><th align="center">Num</th><th align="left">Notes</th></tr></thead><tbody><tr><td align="left">MILGATE98<00></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.6 sec apart</td></tr><tr><td align="left">MILGATE98<03></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.6 sec apart</td></tr><tr><td align="left">MILGATE98<20></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<00></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1d></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1e></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1b></td><td align="center">Qry</td><td align="center">18</td><td align="left">900 sec apart at stable operation</td></tr><tr><td align="left">JHT<03></td><td align="center">Reg</td><td align="center">2</td><td align="left">This is the name of the user that logged onto Windows</td></tr><tr><td align="left">Host Announcement MILGATE98</td><td align="center">Ann</td><td align="center">14</td><td align="left">Every 120 sec</td></tr><tr><td align="left">Domain/Workgroup Announcement MIDEARTH</td><td align="center">Ann</td><td align="center">6</td><td align="left">900 sec apart at stable operation</td></tr><tr><td align="left">Local Master Announcement WINEPRESSME</td><td align="center">Ann</td><td align="center">6</td><td align="left">Insufficient detail to determine frequency</td></tr></tbody></table></div></div><br class="table-break"><p> 187 <a class="indexterm" name="id 387506"></a>188 <a class="indexterm" name="id 387513"></a>189 <a class="indexterm" name="id 387520"></a>187 <a class="indexterm" name="id409654"></a> 188 <a class="indexterm" name="id409661"></a> 189 <a class="indexterm" name="id409668"></a> 190 190 Observation of the contents of Host Announcements, Domain/Workgroup Announcements, 191 191 and Local Master Announcements is instructive. These messages convey a significant 192 192 level of detail regarding the nature of each machine that is on the network. An example 193 dissection of a Host Announcement is given in <a href="primer.html#hostannounce" title="Figure 16.3. Typical Windows 9x/Me Host Announcement">???</a>.194 </p><div class="figure"><a name="hostannounce"></a><p class="title"><b>Figure 16.3. Typical Windows 9x/Me Host Announcement</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/HostAnnouncment.png" width="221.4" alt="Typical Windows 9x/Me Host Announcement"></div></div></div><br class="figure-break"></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 387580"></a>Simple Windows Client Connection Characteristics</h3></div></div></div><p>193 dissection of a Host Announcement is given in <a class="link" href="primer.html#hostannounce" title="Figure 16.3. Typical Windows 9x/Me Host Announcement">“Typical Windows 9x/Me Host Announcement”</a>. 194 </p><div class="figure"><a name="hostannounce"></a><p class="title"><b>Figure 16.3. Typical Windows 9x/Me Host Announcement</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/HostAnnouncment.png" width="221.4" alt="Typical Windows 9x/Me Host Announcement"></div></div></div><br class="figure-break"></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id409728"></a>Simple Windows Client Connection Characteristics</h3></div></div></div><p> 195 195 The purpose of this exercise is to discover how Microsoft Windows clients create (establish) 196 196 connections with remote servers. The methodology involves analysis of a key aspect of how 197 197 Windows clients access remote servers: the session setup protocol. 198 </p><div class="procedure"><a name="id 387592"></a><p class="title"><b>Procedure 16.4. Client Connection Exploration Steps</b></p><ol type="1"><li><p>198 </p><div class="procedure"><a name="id409740"></a><p class="title"><b>Procedure 16.4. Client Connection Exploration Steps</b></p><ol type="1"><li><p> 199 199 Configure a Windows 9x/Me machine (MILGATE98) with a share called <code class="constant">Stuff</code>. 200 200 Create a <em class="parameter"><code>Full Access</code></em> control password on this share. … … 206 206 machines using a user name (JHT) of your choice. Wait approximately 2 minutes before proceeding. 207 207 </p></li><li><p> 208 Start ethereal(or the network sniffer of your choice).208 Start Wireshark (or the network sniffer of your choice). 209 209 </p></li><li><p> 210 210 From the WINEPRESSME machine, right-click <span class="guimenu">Network Neighborhood</span>, select 211 <span class="guimenuitem">Explore</span>, select 211 <span class="guimenuitem">Explore</span>, select 212 212 <span class="guimenuitem">My Network Places</span> → <span class="guimenuitem">Entire Network</span> → <span class="guimenuitem">MIDEARTH</span> → <span class="guimenuitem">MILGATE98</span> → <span class="guimenuitem">Stuff</span>. 213 213 Enter the password you set for the <code class="constant">Full Control</code> mode for the … … 217 217 Save the captured data in case it is needed for later analysis. 218 218 </p></li><li><p> 219 <a class="indexterm" name="id 387716"></a>219 <a class="indexterm" name="id409864"></a> 220 220 From the top of the packets captured, scan down to locate the first packet that has 221 interpreted as <code class="constant">Session Setup AndX, User: anonymous; Tree Connect AndX, 221 interpreted as <code class="constant">Session Setup AndX, User: anonymous; Tree Connect AndX, 222 222 Path: \\MILGATE98\IPC$</code>. 223 </p></li><li><p><a class="indexterm" name="id 387733"></a><a class="indexterm" name="id387741"></a>223 </p></li><li><p><a class="indexterm" name="id409881"></a><a class="indexterm" name="id409889"></a> 224 224 In the dissection (analysis) panel, expand the <code class="constant">SMB, Session Setup AndX Request, 225 225 and Tree Connect AndX Request</code>. Examine both operations. Identify the name of … … 231 231 that was targeted at the <code class="constant">\\MILGATE98\IPC$</code> service. 232 232 </p></li><li><p> 233 <a class="indexterm" name="id 387782"></a>234 <a class="indexterm" name="id 387788"></a>233 <a class="indexterm" name="id409930"></a> 234 <a class="indexterm" name="id409937"></a> 235 235 Dissect this packet as per the previous one. This packet should have a password length 236 236 of 24 (characters) and should have a password field, the contents of which is a 237 237 long hexadecimal number. Observe the name in the Account field. This is a User Mode 238 238 session setup packet. 239 </p></li></ol></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id 387800"></a>Findings and Comments</h4></div></div></div><p>240 <a class="indexterm" name="id 387808"></a>241 The <code class="constant">IPC$</code> share serves a vital purpose<sup>[<a name="id 387819" href="#ftn.id387819">15</a>]</sup>242 in SMB/CIFS-based networking. A Windows client connects to this resource to obtain the list of 239 </p></li></ol></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id409948"></a>Findings and Comments</h4></div></div></div><p> 240 <a class="indexterm" name="id409956"></a> 241 The <code class="constant">IPC$</code> share serves a vital purpose<sup>[<a name="id409967" href="#ftn.id409967" class="footnote">15</a>]</sup> 242 in SMB/CIFS-based networking. A Windows client connects to this resource to obtain the list of 243 243 resources that are available on the server. The server responds with the shares and print queues that 244 244 are available. In most but not all cases, the connection is made with a <code class="constant">NULL</code> 245 245 username and a <code class="constant">NULL</code> password. 246 246 </p><p> 247 <a class="indexterm" name="id 387836"></a>247 <a class="indexterm" name="id409984"></a> 248 248 The two packets examined are material evidence of how Windows clients may 249 249 interoperate with Samba. Samba requires every connection setup to be authenticated using … … 252 252 account. 253 253 </p><p> 254 <a class="indexterm" name="id 387853"></a><a class="indexterm" name="id387859"></a>255 <a class="indexterm" name="id 387868"></a>254 <a class="indexterm" name="id410001"></a><a class="indexterm" name="id410007"></a> 255 <a class="indexterm" name="id410016"></a> 256 256 Samba has a special name for the <code class="constant">NULL</code>, or empty, user account: 257 it calls it the <a class=" indexterm" name="id387879"></a>guest account. The257 it calls it the <a class="link" href="smb.conf.5.html#GUESTACCOUNT">guest account</a>. The 258 258 default value of this parameter is <code class="constant">nobody</code>; however, this can be 259 259 changed to map the function of the guest account to any other UNIX identity. Some 260 260 UNIX administrators prefer to map this account to the system default anonymous 261 261 FTP account. A sample NULL Session Setup AndX packet dissection is shown in 262 <a href="primer.html#nullconnect" title="Figure 16.4. Typical Windows 9x/Me NULL SessionSetUp AndX Request">???</a>.262 <a class="link" href="primer.html#nullconnect" title="Figure 16.4. Typical Windows 9x/Me NULL SessionSetUp AndX Request">“Typical Windows 9x/Me NULL SessionSetUp AndX Request”</a>. 263 263 </p><div class="figure"><a name="nullconnect"></a><p class="title"><b>Figure 16.4. Typical Windows 9x/Me NULL SessionSetUp AndX Request</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/NullConnect.png" width="221.4" alt="Typical Windows 9x/Me NULL SessionSetUp AndX Request"></div></div></div><br class="figure-break"><p> 264 <a class="indexterm" name="id 387943"></a>265 <a class="indexterm" name="id 387950"></a>266 <a class="indexterm" name="id 387956"></a>264 <a class="indexterm" name="id410095"></a> 265 <a class="indexterm" name="id410102"></a> 266 <a class="indexterm" name="id410109"></a> 267 267 When a UNIX/Linux system does not have a <code class="constant">nobody</code> user account 268 268 (<code class="filename">/etc/passwd</code>), the operation of the <code class="constant">NULL</code> … … 270 270 fail. This breaks all ability to browse the Samba server and is a common 271 271 problem reported on the Samba mailing list. A sample User Mode session setup AndX 272 is shown in <a href="primer.html#userconnect" title="Figure 16.5. Typical Windows 9x/Me User SessionSetUp AndX Request">???</a>.272 is shown in <a class="link" href="primer.html#userconnect" title="Figure 16.5. Typical Windows 9x/Me User SessionSetUp AndX Request">“Typical Windows 9x/Me User SessionSetUp AndX Request”</a>. 273 273 </p><div class="figure"><a name="userconnect"></a><p class="title"><b>Figure 16.5. Typical Windows 9x/Me User SessionSetUp AndX Request</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/UserConnect.png" width="221.4" alt="Typical Windows 9x/Me User SessionSetUp AndX Request"></div></div></div><br class="figure-break"><p> 274 <a class="indexterm" name="id 388029"></a>274 <a class="indexterm" name="id410182"></a> 275 275 The User Mode connection packet contains the account name and the domain name. 276 276 The password is provided in Microsoft encrypted form, and its length is shown 277 277 as 24 characters. This is the length of Microsoft encrypted passwords. 278 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 388041"></a>Windows 200x/XP Client Interaction with Samba-3</h3></div></div></div><p>278 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id410194"></a>Windows 200x/XP Client Interaction with Samba-3</h3></div></div></div><p> 279 279 By now you may be asking, “<span class="quote">Why did you choose to work with Windows 9x/Me?</span>” 280 280 </p><p> … … 291 291 a domain member of either a Samba-controlled domain or a Windows NT4 or 200x Active Directory domain. 292 292 Here we do not provide details for how to configure this, as full coverage is provided earlier in this book. 293 </p><div class="procedure"><a name="id 388076"></a><p class="title"><b>Procedure 16.5. Steps to Explore Windows XP Pro Connection Set-up</b></p><ol type="1"><li><p>294 Start your domain controller. Also, start the ethereal monitoring machine, launch ethereal,293 </p><div class="procedure"><a name="id410228"></a><p class="title"><b>Procedure 16.5. Steps to Explore Windows XP Pro Connection Set-up</b></p><ol type="1"><li><p> 294 Start your domain controller. Also, start the Wireshark monitoring machine, launch Wireshark, 295 295 and then wait for the next step to complete. 296 296 </p></li><li><p> 297 297 Start the Windows XP Client and wait 5 minutes before proceeding. 298 298 </p></li><li><p> 299 On the machine from which network activity will be monitored (using <code class="literal"> ethereal</code>),300 launch <code class="literal"> ethereal</code> and click299 On the machine from which network activity will be monitored (using <code class="literal">Wireshark</code>), 300 launch <code class="literal">Wireshark</code> and click 301 301 <span class="guimenu">Capture</span> → <span class="guimenuitem">Start</span>. 302 302 </p><p> … … 305 305 Click <span class="guibutton">OK</span>. 306 306 </p></li><li><p> 307 On the Windows XP Professional client, press <span class="guimenu">Ctrl-Alt-Delete</span> to bring 307 On the Windows XP Professional client, press <span class="guimenu">Ctrl-Alt-Delete</span> to bring 308 308 up the domain logon screen. Log in using valid credentials for a domain user account. 309 309 </p></li><li><p> … … 314 314 <code class="constant">Frodo</code>, and we have connected to a share called <code class="constant">data</code>. 315 315 </p></li><li><p> 316 Stop the capture on the <code class="literal"> ethereal</code> monitoring machine. Be sure to save the captured data316 Stop the capture on the <code class="literal">Wireshark</code> monitoring machine. Be sure to save the captured data 317 317 to a file so that you can refer to it again later. 318 318 </p></li><li><p> … … 320 320 in this chapter. 321 321 </p></li><li><p> 322 <a class="indexterm" name="id 388290"></a>323 <a class="indexterm" name="id 388296"></a>322 <a class="indexterm" name="id410442"></a> 323 <a class="indexterm" name="id410449"></a> 324 324 From the top of the packets captured, scan down to locate the first packet that has 325 325 interpreted as <code class="constant">Session Setup AndX Request, NTLMSSP_AUTH</code>. 326 326 </p></li><li><p> 327 <a class="indexterm" name="id 388315"></a>328 <a class="indexterm" name="id 388322"></a>329 <a class="indexterm" name="id 388328"></a>327 <a class="indexterm" name="id410467"></a> 328 <a class="indexterm" name="id410474"></a> 329 <a class="indexterm" name="id410481"></a> 330 330 In the dissection (analysis) panel, expand the <code class="constant">SMB, Session Setup AndX Request</code>. 331 331 Expand the packet decode information, beginning at the <code class="constant">Security Blob:</code> … … 333 333 keys. This should reveal that this is a <code class="constant">NULL</code> session setup packet. 334 334 The <code class="constant">User name: NULL</code> so indicates. An example decode is shown in 335 <a href="primer.html#XPCap01" title="Figure 16.6. Typical Windows XP NULL Session Setup AndX Request">???</a>.335 <a class="link" href="primer.html#XPCap01" title="Figure 16.6. Typical Windows XP NULL Session Setup AndX Request">“Typical Windows XP NULL Session Setup AndX Request”</a>. 336 336 </p></li><li><p> 337 337 Return to the packet capture sequence. There will be a number of packets that have been … … 339 339 has been decoded as <code class="constant">Session Setup AndX Request, NTLMSSP_AUTH</code>. 340 340 </p></li><li><p> 341 <a class="indexterm" name="id 388386"></a>341 <a class="indexterm" name="id410538"></a> 342 342 In the dissection (analysis) panel, expand the <code class="constant">SMB, Session Setup AndX Request</code>. 343 343 Expand the packet decode information, beginning at the <code class="constant">Security Blob:</code> … … 345 345 keys. This should reveal that this is a <code class="constant">User Mode</code> session setup packet. 346 346 The <code class="constant">User name: jht</code> so indicates. An example decode is shown in 347 <a href="primer.html#XPCap02" title="Figure 16.7. Typical Windows XP User Session Setup AndX Request">???</a>. In this case the user name was <code class="constant">jht</code>. This packet347 <a class="link" href="primer.html#XPCap02" title="Figure 16.7. Typical Windows XP User Session Setup AndX Request">“Typical Windows XP User Session Setup AndX Request”</a>. In this case the user name was <code class="constant">jht</code>. This packet 348 348 decode includes the <code class="constant">Lan Manager Response:</code> and the <code class="constant">NTLM Response:</code>. 349 349 The values of these two parameters are the Microsoft encrypted password hashes: respectively, the LanMan 350 350 password and then the NT (case-preserving) password hash. 351 351 </p></li><li><p> 352 <a class="indexterm" name="id 388440"></a>353 <a class="indexterm" name="id 388447"></a>352 <a class="indexterm" name="id410593"></a> 353 <a class="indexterm" name="id410600"></a> 354 354 The passwords are 24-character hexadecimal numbers. This packet confirms that this is a User Mode 355 355 session setup packet. 356 </p></li></ol></div><div class="figure"><a name="XPCap01"></a><p class="title"><b>Figure 16.6. Typical Windows XP NULL Session Setup AndX Request</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/WindowsXP-NullConnection.png" width="270" alt="Typical Windows XP NULL Session Setup AndX Request"></div></div></div><br class="figure-break"><div class="figure"><a name="XPCap02"></a><p class="title"><b>Figure 16.7. Typical Windows XP User Session Setup AndX Request</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/WindowsXP-UserConnection.png" width="270" alt="Typical Windows XP User Session Setup AndX Request"></div></div></div><br class="figure-break"><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id 388539"></a>Discussion</h4></div></div></div><p><a class="indexterm" name="id388546"></a>356 </p></li></ol></div><div class="figure"><a name="XPCap01"></a><p class="title"><b>Figure 16.6. Typical Windows XP NULL Session Setup AndX Request</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/WindowsXP-NullConnection.png" width="270" alt="Typical Windows XP NULL Session Setup AndX Request"></div></div></div><br class="figure-break"><div class="figure"><a name="XPCap02"></a><p class="title"><b>Figure 16.7. Typical Windows XP User Session Setup AndX Request</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/WindowsXP-UserConnection.png" width="270" alt="Typical Windows XP User Session Setup AndX Request"></div></div></div><br class="figure-break"><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id410692"></a>Discussion</h4></div></div></div><p><a class="indexterm" name="id410699"></a> 357 357 This exercise demonstrates that, while the specific protocol for the Session Setup AndX is handled 358 358 in a more sophisticated manner by recent MS Windows clients, the underlying rules or principles 359 remain the same. Thus it is demonstrated that MS Windows XP Professional clients still use a 359 remain the same. Thus it is demonstrated that MS Windows XP Professional clients still use a 360 360 <code class="constant">NULL-Session</code> connection to query and locate resources on an advanced network 361 361 technology server (one using Windows NT4/200x or Samba). It also demonstrates that an authenticated 362 362 connection must be made before resources can be used. 363 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 388566"></a>Conclusions to Exercises</h3></div></div></div><p>363 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id410719"></a>Conclusions to Exercises</h3></div></div></div><p> 364 364 In summary, the following points have been established in this chapter: 365 365 </p><div class="itemizedlist"><ul type="disc"><li><p> … … 367 367 </p></li><li><p> 368 368 Network browsing protocols query information stored on browse masters that manage 369 information provided by NetBIOS Name Registrations and by way of ongoing host 369 information provided by NetBIOS Name Registrations and by way of ongoing host 370 370 announcements and workgroup announcements. 371 371 </p></li><li><p> … … 380 380 databases in concurrent deployment. Refer to <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 10, “<span class="quote">Account Information Databases.</span>” 381 381 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="chap01conc"></a>Dissection and Discussion</h2></div></div></div><p> 382 <a class="indexterm" name="id 388644"></a>382 <a class="indexterm" name="id410797"></a> 383 383 The exercises demonstrate the use of the <code class="constant">guest</code> account, the way that 384 384 MS Windows clients and servers resolve computer names to a TCP/IP address, and how connections … … 387 387 Those wishing background information regarding NetBIOS name types should refer to 388 388 the Microsoft knowledgebase article 389 <a href="http://support.microsoft.com/support/kb/articles/Q102/78/8.asp" target="_top">Q102878.</a>390 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 388668"></a>Technical Issues</h3></div></div></div><p>391 <a class="indexterm" name="id 388676"></a>389 <a class="ulink" href="http://support.microsoft.com/support/kb/articles/Q102/78/8.asp" target="_top">Q102878.</a> 390 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id410820"></a>Technical Issues</h3></div></div></div><p> 391 <a class="indexterm" name="id410828"></a> 392 392 Network browsing involves SMB broadcast announcements, SMB enumeration requests, 393 393 connections to the <code class="constant">IPC$</code> share, share enumerations, and SMB connection … … 397 397 The questions and answers given in this section are designed to highlight important aspects of Microsoft 398 398 Windows networking. 399 </p><div class="qandaset"><dl><dt> <a href="primer.html#id 388717">399 </p><div class="qandaset"><dl><dt> <a href="primer.html#id410870"> 400 400 What is the significance of the MIDEARTH<1b> type query? 401 </a></dt><dt> <a href="primer.html#id 388760">401 </a></dt><dt> <a href="primer.html#id410912"> 402 402 What is the significance of the MIDEARTH<1d> type name registration? 403 </a></dt><dt> <a href="primer.html#id 388826">403 </a></dt><dt> <a href="primer.html#id410979"> 404 404 What is the role and significance of the <01><02>__MSBROWSE__<02><01> 405 405 name registration? 406 </a></dt><dt> <a href="primer.html#id 388854">406 </a></dt><dt> <a href="primer.html#id411007"> 407 407 What is the significance of the MIDEARTH<1e> type name registration? 408 </a></dt><dt> <a href="primer.html#id 388881">408 </a></dt><dt> <a href="primer.html#id411034"> 409 409 410 410 What is the significance of the guest account in smb.conf? 411 </a></dt><dt> <a href="primer.html#id 388948">411 </a></dt><dt> <a href="primer.html#id411104"> 412 412 Is it possible to reduce network broadcast activity with Samba-3? 413 </a></dt><dt> <a href="primer.html#id 389046">413 </a></dt><dt> <a href="primer.html#id411206"> 414 414 Can I just use plain-text passwords with Samba? 415 </a></dt><dt> <a href="primer.html#id 389122">415 </a></dt><dt> <a href="primer.html#id411281"> 416 416 What parameter in the smb.conf file is used to enable the use of encrypted passwords? 417 </a></dt><dt> <a href="primer.html#id 389161">417 </a></dt><dt> <a href="primer.html#id411320"> 418 418 Is it necessary to specify encrypt passwords = Yes 419 419 when Samba-3 is configured as a domain member? 420 </a></dt><dt> <a href="primer.html#id 389185">420 </a></dt><dt> <a href="primer.html#id411350"> 421 421 Is it necessary to specify a guest account when Samba-3 is configured 422 422 as a domain member server? 423 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id 388717"></a><a name="id388720"></a></td><td align="left" valign="top"><p>423 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id410870"></a><a name="id410872"></a></td><td align="left" valign="top"><p> 424 424 What is the significance of the MIDEARTH<1b> type query? 425 425 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 426 <a class="indexterm" name="id 388731"></a>427 <a class="indexterm" name="id 388740"></a>426 <a class="indexterm" name="id410884"></a> 427 <a class="indexterm" name="id410893"></a> 428 428 This is a broadcast announcement by which the Windows machine is attempting to 429 429 locate a Domain Master Browser (DMB) in the event that it might exist on the network. 430 430 Refer to <span class="emphasis"><em>TOSHARG2,</em></span> Chapter 9, Section 9.7, “<span class="quote">Technical Overview of Browsing,</span>” 431 431 for details regarding the function of the DMB and its role in network browsing. 432 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 388760"></a><a name="id388762"></a></td><td align="left" valign="top"><p>432 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id410912"></a><a name="id410914"></a></td><td align="left" valign="top"><p> 433 433 What is the significance of the MIDEARTH<1d> type name registration? 434 434 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 435 <a class="indexterm" name="id 388773"></a>436 <a class="indexterm" name="id 388782"></a>435 <a class="indexterm" name="id410926"></a> 436 <a class="indexterm" name="id410935"></a> 437 437 This name registration records the machine IP addresses of the LMBs. 438 438 Network clients can query this name type to obtain a list of browser servers from the … … 452 452 </p></li><li><p> 453 453 The IP address of the LMB on the local segment 454 </p></li></ul></div></td></tr><tr class="question"><td align="left" valign="top"><a name="id 388826"></a><a name="id388829"></a></td><td align="left" valign="top"><p>454 </p></li></ul></div></td></tr><tr class="question"><td align="left" valign="top"><a name="id410979"></a><a name="id410981"></a></td><td align="left" valign="top"><p> 455 455 What is the role and significance of the <01><02>__MSBROWSE__<02><01> 456 456 name registration? 457 457 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 458 <a class="indexterm" name="id 388842"></a>458 <a class="indexterm" name="id410994"></a> 459 459 This name is registered by the browse master to broadcast and receive domain announcements. 460 460 Its scope is limited to the local network segment, or subnet. By querying this name type, 461 461 master browsers on networks that have multiple domains can find the names of master browsers 462 462 for each domain. 463 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 388854"></a><a name="id388856"></a></td><td align="left" valign="top"><p>463 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id411007"></a><a name="id411009"></a></td><td align="left" valign="top"><p> 464 464 What is the significance of the MIDEARTH<1e> type name registration? 465 465 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 466 <a class="indexterm" name="id 388868"></a>466 <a class="indexterm" name="id411020"></a> 467 467 This name is registered by all browse masters in a domain or workgroup. The registration 468 468 name type is known as the Browser Election Service. Master browsers register themselves 469 469 with this name type so that DMBs can locate them to perform cross-subnet 470 470 browse list updates. This name type is also used to initiate elections for Master Browsers. 471 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 388881"></a><a name="id388883"></a></td><td align="left" valign="top"><p>472 <a class="indexterm" name="id 388888"></a>471 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id411034"></a><a name="id411036"></a></td><td align="left" valign="top"><p> 472 <a class="indexterm" name="id411040"></a> 473 473 What is the significance of the <em class="parameter"><code>guest account</code></em> in smb.conf? 474 474 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 482 482 Samba operation. Either the operating system must have an account called <code class="constant">nobody</code> 483 483 or there must be an entry in the <code class="filename">smb.conf</code> file with a valid UNIX account, such as 484 <a class=" indexterm" name="id388938"></a>guest account = ftp.485 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 388948"></a><a name="id388950"></a></td><td align="left" valign="top"><p>484 <a class="link" href="smb.conf.5.html#GUESTACCOUNT">guest account = ftp</a>. 485 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id411104"></a><a name="id411106"></a></td><td align="left" valign="top"><p> 486 486 Is it possible to reduce network broadcast activity with Samba-3? 487 487 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 488 <a class="indexterm" name="id 388962"></a>489 <a class="indexterm" name="id 388968"></a>490 Yes, there are two ways to do this. The first involves use of WINS (See <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 9, 488 <a class="indexterm" name="id411118"></a> 489 <a class="indexterm" name="id411124"></a> 490 Yes, there are two ways to do this. The first involves use of WINS (See <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 9, 491 491 Section 9.5, “<span class="quote">WINS The Windows Inter-networking Name Server</span>”); the 492 492 alternate method involves disabling the use of NetBIOS over TCP/IP. This second method requires 493 493 a correctly configured DNS server (see <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 9, Section 9.3, “<span class="quote">Discussion</span>”). 494 494 </p><p> 495 <a class="indexterm" name="id 388998"></a>496 <a class="indexterm" name="id 389005"></a>497 <a class="indexterm" name="id 389014"></a>498 The use of WINS reduces network broadcast traffic. The reduction is greatest when all network 499 clients are configured to operate in <em class="parameter"><code>Hybrid Mode</code></em>. This can be effected through 500 use of DHCP to set the NetBIOS node type to type 8 for all network clients. Additionally, it is 501 beneficial to configure Samba to use <a class=" indexterm" name="id389030"></a>name resolve order = wins host cast.495 <a class="indexterm" name="id411154"></a> 496 <a class="indexterm" name="id411161"></a> 497 <a class="indexterm" name="id411170"></a> 498 The use of WINS reduces network broadcast traffic. The reduction is greatest when all network 499 clients are configured to operate in <em class="parameter"><code>Hybrid Mode</code></em>. This can be effected through 500 use of DHCP to set the NetBIOS node type to type 8 for all network clients. Additionally, it is 501 beneficial to configure Samba to use <a class="link" href="smb.conf.5.html#NAMERESOLVEORDER">name resolve order = wins host cast</a>. 502 502 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 503 503 Use of SMB without NetBIOS is possible only on Windows 200x/XP Professional clients and servers, as 504 504 well as with Samba-3. 505 </p></div></td></tr><tr class="question"><td align="left" valign="top"><a name="id 389046"></a><a name="id389048"></a></td><td align="left" valign="top"><p>505 </p></div></td></tr><tr class="question"><td align="left" valign="top"><a name="id411206"></a><a name="id411208"></a></td><td align="left" valign="top"><p> 506 506 Can I just use plain-text passwords with Samba? 507 507 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 517 517 the connection automatically. Users need to log off and then log on again. Plain-text password support 518 518 may interfere with recent enhancements that are part of the Microsoft move toward a more secure computing 519 environment. 520 </p><p> 521 Samba-3 supports Microsoft encrypted passwords. Be advised not to reintroduce plain-text password handling. 519 environment. 520 </p><p> 521 Samba-3 supports Microsoft encrypted passwords. Be advised not to reintroduce plain-text password handling. 522 522 Just create user accounts by running <code class="literal">smbpasswd -a 'username'</code> 523 523 </p><p> … … 526 526 PDC/BDC to provide Windows user and group accounts, the <em class="parameter"><code>idmap uid, idmap gid</code></em> ranges 527 527 set in the <code class="filename">smb.conf</code> file provide the local UID/GIDs needed for local identity management purposes. 528 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 389122"></a><a name="id389124"></a></td><td align="left" valign="top"><p>528 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id411281"></a><a name="id411283"></a></td><td align="left" valign="top"><p> 529 529 What parameter in the <code class="filename">smb.conf</code> file is used to enable the use of encrypted passwords? 530 530 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 531 531 The parameter in the <code class="filename">smb.conf</code> file that controls this behavior is known as <em class="parameter"><code>encrypt 532 532 passwords</code></em>. The default setting for this in Samba-3 is <code class="constant">Yes (Enabled)</code>. 533 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 389161"></a><a name="id389163"></a></td><td align="left" valign="top"><p>534 Is it necessary to specify <a class=" indexterm" name="id389168"></a>encrypt passwords = Yes533 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id411320"></a><a name="id411323"></a></td><td align="left" valign="top"><p> 534 Is it necessary to specify <a class="link" href="smb.conf.5.html#ENCRYPTPASSWORDS">encrypt passwords = Yes</a> 535 535 when Samba-3 is configured as a domain member? 536 536 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 537 537 No. This is the default behavior. 538 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 389185"></a><a name="id389188"></a></td><td align="left" valign="top"><p>538 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id411350"></a><a name="id411352"></a></td><td align="left" valign="top"><p> 539 539 Is it necessary to specify a <em class="parameter"><code>guest account</code></em> when Samba-3 is configured 540 540 as a domain member server? … … 542 542 Yes. This is a local function on the server. The default setting is to use the UNIX account 543 543 <code class="constant">nobody</code>. If this account does not exist on the UNIX server, then it is 544 necessary to provide a <a class=" indexterm" name="id389210"></a>guest account = an_account,544 necessary to provide a <a class="link" href="smb.conf.5.html#GUESTACCOUNT">guest account = an_account</a>, 545 545 where <code class="constant">an_account</code> is a valid local UNIX user account. 546 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id387819" href="#id387819">15</a>] </sup>TOSHARG2, Sect 4.5.1</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="appendix.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="RefSection.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="gpl.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 15. A Collection of Useful Tidbits </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Appendix A. GNU General Public License</td></tr></table></div></body></html> 546 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id409967" href="#id409967" class="para">15</a>] </sup>TOSHARG2, Sect 4.5.1</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="appendix.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="RefSection.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="apa.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 15. A Collection of Useful Tidbits </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Appendix A. 547 <acronym class="acronym">GNU</acronym> General Public License version 3 548 </td></tr></table></div></body></html> -
branches/samba-3.0/docs/htmldocs/Samba3-ByExample/secure.html
r44 r134 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 3. Secure Office Networking</title><link rel="stylesheet" href=" samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="small.html" title="Chapter 2. Small Office Networking"><link rel="next" href="Big500users.html" title="Chapter 4. The 500-User Office"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 3. Secure Office Networking</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="small.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="Big500users.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="secure"></a>Chapter 3. Secure Office Networking</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="secure.html#id324364">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id324404">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id324626">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id324638">Technical Issues</a></span></dt><dt><span class="sect2"><a href="secure.html#id325007">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id325041">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#ch4bsc">Basic System Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id325866">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4ptrcfg">Printer Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4valid">Validation</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4appscfg">Application Share Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id330151">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id330204">Questions and Answers</a></span></dt></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 3. Secure Office Networking</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="small.html" title="Chapter 2. Small Office Networking"><link rel="next" href="Big500users.html" title="Chapter 4. The 500-User Office"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 3. Secure Office Networking</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="small.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="Big500users.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="secure"></a>Chapter 3. Secure Office Networking</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="secure.html#id347711">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id347745">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id347954">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id347966">Technical Issues</a></span></dt><dt><span class="sect2"><a href="secure.html#id348311">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id348344">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#ch4bsc">Basic System Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id349099">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4ptrcfg">Printer Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4valid">Validation</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4appscfg">Application Share Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id353060">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id353113">Questions and Answers</a></span></dt></dl></div><p> 2 2 Congratulations, your Samba networking skills are developing nicely. You started out 3 with three simple networks in <a href="simple.html" title="Chapter 1. No-Frills Samba Servers">???</a>, and then in <a href="small.html" title="Chapter 2. Small Office Networking">???</a>3 with three simple networks in <a class="link" href="simple.html" title="Chapter 1. No-Frills Samba Servers">“No-Frills Samba Servers”</a>, and then in <a class="link" href="small.html" title="Chapter 2. Small Office Networking">“Small Office Networking”</a> 4 4 you designed and built a network that provides a high degree of flexibility, integrity, 5 5 and dependability. It was enough for the basic needs each was designed to fulfill. In … … 12 12 To avoid confusion, this book is all about Samba-3. Let's get the exercises in this 13 13 chapter underway. 14 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 24364"></a>Introduction</h2></div></div></div><p>14 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id347711"></a>Introduction</h2></div></div></div><p> 15 15 You have made Mr. Meany a very happy man. Recently he paid you a fat bonus for work 16 16 well done. It is one year since the last network upgrade. You have been quite busy. … … 41 41 about your move, she almost resigned, although she was reassured that a new manager would 42 42 be hired to run Information Technology, and she would be responsible only for operations. 43 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 24404"></a>Assignment Tasks</h3></div></div></div><p>43 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id347745"></a>Assignment Tasks</h3></div></div></div><p> 44 44 You promised the staff Internet services including Web browsing, electronic mail, virus 45 45 protection, and a company Web site. Christine is eager to help turn the vision into … … 59 59 and a 10 Mb/sec ethernet port. You registered the domain 60 60 <code class="constant">abmas.us</code>, and the Internet Service Provider (ISP) is supplying 61 secondary DNS. Information furnished by your ISP is shown in <a href="secure.html#chap4netid" title="Table 3.1. Abmas.US ISP Information">???</a>.61 secondary DNS. Information furnished by your ISP is shown in <a class="link" href="secure.html#chap4netid" title="Table 3.1. Abmas.US ISP Information">“Abmas.US ISP Information”</a>. 62 62 </p><p> 63 63 It is of paramount priority that under no circumstances will Samba offer … … 84 84 some problems with desktop computers and software installation into the new users' 85 85 desktop profiles. 86 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 24626"></a>Dissection and Discussion</h2></div></div></div><p>86 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id347954"></a>Dissection and Discussion</h2></div></div></div><p> 87 87 Many of the conclusions you draw here are obvious. Some requirements are not very clear 88 88 or may simply be your means of drawing the most out of Samba-3. Much can be done more simply … … 90 90 users. This means that some functionality will be overdesigned for the current 130-user 91 91 environment. 92 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 24638"></a>Technical Issues</h3></div></div></div><p>92 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id347966"></a>Technical Issues</h3></div></div></div><p> 93 93 In this exercise we use a 24-bit subnet mask for the two local networks. This, 94 94 of course, limits our network to a maximum of 253 usable IP addresses. The network … … 98 98 in the 172.16.0.0/16 range. This is done in subsequent chapters. 99 99 </p><p> 100 <a class="indexterm" name="id3 24653"></a>101 <a class="indexterm" name="id3 24660"></a>100 <a class="indexterm" name="id347981"></a> 101 <a class="indexterm" name="id347987"></a> 102 102 The high growth rates projected are a good reason to use the <code class="constant">tdbsam</code> 103 103 passdb backend. The use of <code class="constant">smbpasswd</code> for the backend may result in … … 105 105 are not available with the older, flat ASCII-based <code class="constant">smbpasswd</code> database. 106 106 </p><p> 107 <a class="indexterm" name="id3 24687"></a>107 <a class="indexterm" name="id348012"></a> 108 108 The proposed network design uses a single server to act as an Internet services host for 109 109 electronic mail, Web serving, remote administrative access via SSH, … … 118 118 directly connected to the Internet. 119 119 </p><p> 120 <a class="indexterm" name="id3 24707"></a>121 <a class="indexterm" name="id3 24714"></a>122 <a class="indexterm" name="id3 24720"></a>123 <a class="indexterm" name="id3 24729"></a>120 <a class="indexterm" name="id348031"></a> 121 <a class="indexterm" name="id348037"></a> 122 <a class="indexterm" name="id348043"></a> 123 <a class="indexterm" name="id348052"></a> 124 124 You know that your ISP is providing full firewall services, but you cannot rely on that. 125 125 Always assume that human error will occur, so be prepared by using Linux firewall facilities … … 132 132 covered except insofar as this affects Samba-3. 133 133 </p><p> 134 <a class="indexterm" name="id3 24754"></a>134 <a class="indexterm" name="id348075"></a> 135 135 Notebook computers are configured to use a network login when in the office and a 136 136 local account to log in while away from the office. Users store all work done in … … 142 142 records. 143 143 </p><p> 144 <a class="indexterm" name="id3 24769"></a>144 <a class="indexterm" name="id348095"></a> 145 145 All applications are served from the central server from a share called <code class="constant">apps</code>. 146 146 Microsoft Office XP Professional and OpenOffice 1.1.0 will be installed using a network … … 149 149 locally installed applications on a need-to-have basis only. 150 150 </p><p> 151 <a class="indexterm" name="id3 24786"></a>151 <a class="indexterm" name="id348112"></a> 152 152 The introduction of roaming profiles support means that users can move between 153 153 desktop computer systems without constraint while retaining full access to their data. 154 154 The desktop travels with them as they move. 155 155 </p><p> 156 <a class="indexterm" name="id3 24798"></a>156 <a class="indexterm" name="id348123"></a> 157 157 The DNS server implementation must now address both internal and external 158 158 needs. You forward DNS lookups to your ISP-provided server as well as the 159 159 <code class="constant">abmas.us</code> external secondary DNS server. 160 160 </p><p> 161 <a class="indexterm" name="id3 24813"></a>162 <a class="indexterm" name="id3 24820"></a>163 <a class="indexterm" name="id3 24829"></a>164 Compared with the DHCP server configuration in <a href="small.html" title="Chapter 2. Small Office Networking">???</a>, <a href="small.html#dhcp01" title="Example 2.2. Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf">???</a>, the161 <a class="indexterm" name="id348137"></a> 162 <a class="indexterm" name="id348144"></a> 163 <a class="indexterm" name="id348152"></a> 164 Compared with the DHCP server configuration in <a class="link" href="small.html" title="Chapter 2. Small Office Networking">“Small Office Networking”</a>, <a class="link" href="small.html#dhcp01" title="Example 2.2. Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf">“Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf”</a>, the 165 165 configuration used in this example has to deal with the presence of an Internet connection. 166 166 The scope set for it ensures that no DHCP services will be offered on the external … … 185 185 then clone that configuration, using Norton Ghost, to all workstations. Each machine is 186 186 identical, so this should pose no problem. 187 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 24872"></a>Hardware Requirements</h4></div></div></div><p>188 <a class="indexterm" name="id3 24879"></a>187 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id348190"></a>Hardware Requirements</h4></div></div></div><p> 188 <a class="indexterm" name="id348198"></a> 189 189 This server runs a considerable number of services. From similarly configured Linux 190 190 installations, the approximate calculated memory requirements are as shown in 191 <a href="secure.html#ch4memoryest" title="Example 3.1. Estimation of Memory Requirements">???</a>.191 <a class="link" href="secure.html#ch4memoryest" title="Example 3.1. Estimation of Memory Requirements">“Estimation of Memory Requirements”</a>. 192 192 193 193 </p><div class="example"><a name="ch4memoryest"></a><p class="title"><b>Example 3.1. Estimation of Memory Requirements</b></p><div class="example-contents"><pre class="screen"> … … 214 214 compromise in this area. 215 215 </p><p> 216 <a class="indexterm" name="id3 24923"></a>216 <a class="indexterm" name="id348237"></a> 217 217 Aggregate input/output loads should be considered for sizing network configuration as 218 218 well as disk subsystems. For network bandwidth calculations, one would typically use an … … 223 223 switched ports. 224 224 </p><p> 225 <a class="indexterm" name="id3 24942"></a>226 <a class="indexterm" name="id3 24949"></a>225 <a class="indexterm" name="id348252"></a> 226 <a class="indexterm" name="id348258"></a> 227 227 Considering the choice of 1 Gb Ethernet interfaces for the two local network segments, 228 228 the aggregate network I/O capacity will be 2100 Mb/sec (about 230 MB/sec), an I/O … … 238 238 deliver I/O rates of at least 100 MB/sec. 239 239 </p><p> 240 Disk storage requirements may be calculated as shown in <a href="secure.html#ch4diskest" title="Example 3.2. Estimation of Disk Storage Requirements">???</a>.240 Disk storage requirements may be calculated as shown in <a class="link" href="secure.html#ch4diskest" title="Example 3.2. Estimation of Disk Storage Requirements">“Estimation of Disk Storage Requirements”</a>. 241 241 242 242 </p><div class="example"><a name="ch4diskest"></a><p class="title"><b>Example 3.2. Estimation of Disk Storage Requirements</b></p><div class="example-contents"><pre class="screen"> … … 256 256 Recommended Storage: 908 GBytes 257 257 </pre></div></div><p><br class="example-break"> 258 <a class="indexterm" name="id3 24995"></a>258 <a class="indexterm" name="id348300"></a> 259 259 The preferred storage capacity should be approximately 1 Terabyte. Use of RAID level 5 260 260 with two hot spare drives would require an 8-drive by 200 GB capacity per drive array. 261 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 25007"></a>Political Issues</h3></div></div></div><p>261 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id348311"></a>Political Issues</h3></div></div></div><p> 262 262 Your industry is coming under increasing accountability pressures. Increased paranoia 263 263 is necessary so you can demonstrate that you have acted with due diligence. You must … … 268 268 gives you greater control over software licensing. 269 269 </p><p> 270 <a class="indexterm" name="id3 25025"></a>270 <a class="indexterm" name="id348329"></a> 271 271 You are well aware that the current configuration results in some performance issues 272 272 as the size of the desktop profile grows. Given that users use Microsoft Outlook 273 273 Express, you know that the storage implications of the <code class="constant">.PST</code> file 274 274 is something that needs to be addressed later. 275 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 25041"></a>Implementation</h2></div></div></div><p>276 <a href="secure.html#ch04net" title="Figure 3.1. Abmas Network Topology 130 Users">???</a> demonstrates the overall design of the network that you will implement.275 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id348344"></a>Implementation</h2></div></div></div><p> 276 <a class="link" href="secure.html#ch04net" title="Figure 3.1. Abmas Network Topology 130 Users">“Abmas Network Topology 130 Users”</a> demonstrates the overall design of the network that you will implement. 277 277 </p><p> 278 278 The information presented here assumes that you are already familiar with many basic steps. … … 289 289 The Domain name is set to <code class="constant">PROMISES</code>. 290 290 </p></li><li><p> 291 <a class="indexterm" name="id3 25100"></a>292 <a class="indexterm" name="id3 25107"></a>293 <a class="indexterm" name="id3 25114"></a>291 <a class="indexterm" name="id348394"></a> 292 <a class="indexterm" name="id348400"></a> 293 <a class="indexterm" name="id348406"></a> 294 294 Ethernet interface <code class="constant">eth0</code> is attached to the Internet connection 295 295 and is externally exposed. This interface is explicitly not available for Samba to use. … … 299 299 <em class="parameter"><code>bind interfaces only</code></em> entry. 300 300 </p></li><li><p> 301 <a class="indexterm" name="id3 25147"></a>302 <a class="indexterm" name="id3 25154"></a>303 <a class="indexterm" name="id3 25161"></a>301 <a class="indexterm" name="id348437"></a> 302 <a class="indexterm" name="id348443"></a> 303 <a class="indexterm" name="id348449"></a> 304 304 The <em class="parameter"><code>passdb backend</code></em> parameter specifies the creation and use 305 305 of the <code class="constant">tdbsam</code> password backend. This is a binary database that 306 306 has excellent scalability for a large number of user account entries. 307 307 </p></li><li><p> 308 <a class="indexterm" name="id3 25183"></a>309 <a class="indexterm" name="id3 25190"></a>310 <a class="indexterm" name="id3 25196"></a>311 WINS serving is enabled by the <a class=" indexterm" name="id325204"></a>wins support = Yes,308 <a class="indexterm" name="id348469"></a> 309 <a class="indexterm" name="id348476"></a> 310 <a class="indexterm" name="id348482"></a> 311 WINS serving is enabled by the <a class="link" href="smb.conf.5.html#WINSSUPPORT">wins support = Yes</a>, 312 312 and name resolution is set to use it by means of the 313 <a class=" indexterm" name="id325211"></a>name resolve order = wins bcast hostsentry.314 </p></li><li><p> 315 <a class="indexterm" name="id3 25223"></a>313 <a class="link" href="smb.conf.5.html#NAMERESOLVEORDER">name resolve order = wins bcast hosts</a> entry. 314 </p></li><li><p> 315 <a class="indexterm" name="id348507"></a> 316 316 The Samba server is configured for use by Windows clients as a time server. 317 317 </p></li><li><p> 318 <a class="indexterm" name="id3 25235"></a>319 <a class="indexterm" name="id3 25242"></a>320 <a class="indexterm" name="id3 25248"></a>318 <a class="indexterm" name="id348519"></a> 319 <a class="indexterm" name="id348525"></a> 320 <a class="indexterm" name="id348531"></a> 321 321 Samba is configured to directly interface with CUPS via the direct internal interface 322 322 that is provided by CUPS libraries. This is achieved with the 323 <a class=" indexterm" name="id325257"></a>printing = CUPSas well as the324 <a class=" indexterm" name="id325264"></a>printcap name = CUPSentries.325 </p></li><li><p> 326 <a class="indexterm" name="id3 25275"></a>327 <a class="indexterm" name="id3 25282"></a>328 <a class="indexterm" name="id3 25289"></a>323 <a class="link" href="smb.conf.5.html#PRINTING">printing = CUPS</a> as well as the 324 <a class="link" href="smb.conf.5.html#PRINTCAPNAME">printcap name = CUPS</a> entries. 325 </p></li><li><p> 326 <a class="indexterm" name="id348558"></a> 327 <a class="indexterm" name="id348564"></a> 328 <a class="indexterm" name="id348570"></a> 329 329 External interface scripts are provided to enable Samba to interface smoothly to 330 330 essential operating system functions for user and group management. This is important … … 333 333 are provided as part of the <code class="filename">SRVTOOLS.EXE</code> toolkit that can be 334 334 downloaded from the Microsoft FTP 335 <a href="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE" target="_top">site</a>.336 </p></li><li><p> 337 <a class="indexterm" name="id3 25316"></a>335 <a class="ulink" href="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE" target="_top">site</a>. 336 </p></li><li><p> 337 <a class="indexterm" name="id348595"></a> 338 338 The <code class="filename">smb.conf</code> file specifies that the Samba server will operate in (default) <em class="parameter"><code> 339 security = user</code></em> mode<sup>[<a name="id3 25335" href="#ftn.id325335">5</a>]</sup>339 security = user</code></em> mode<sup>[<a name="id348612" href="#ftn.id348612" class="footnote">5</a>]</sup> 340 340 (User Mode). 341 341 </p></li><li><p> 342 <a class="indexterm" name="id3 25353"></a>343 <a class="indexterm" name="id3 25360"></a>342 <a class="indexterm" name="id348628"></a> 343 <a class="indexterm" name="id348635"></a> 344 344 Domain logon services as well as a Domain logon script are specified. The logon script 345 345 will be used to add robustness to the overall network configuration. 346 346 </p></li><li><p> 347 <a class="indexterm" name="id3 25372"></a>348 <a class="indexterm" name="id3 25379"></a>349 <a class="indexterm" name="id3 25386"></a>347 <a class="indexterm" name="id348647"></a> 348 <a class="indexterm" name="id348653"></a> 349 <a class="indexterm" name="id348659"></a> 350 350 Roaming profiles are enabled through the specification of the parameter, 351 <a class=" indexterm" name="id325393"></a>logon path = \\%L\profiles\%U. The value of this parameter translates the351 <a class="link" href="smb.conf.5.html#LOGONPATH">logon path = \\%L\profiles\%U</a>. The value of this parameter translates the 352 352 <code class="constant">%L</code> to the name by which the Samba server is called by the client (for this 353 353 configuration, it translates to the name <code class="constant">DIAMOND</code>), and the <code class="constant">%U</code> … … 357 357 requirement is when a profile is created for group use. 358 358 </p></li><li><p> 359 <a class="indexterm" name="id3 25420"></a>360 <a class="indexterm" name="id3 25426"></a>359 <a class="indexterm" name="id348691"></a> 360 <a class="indexterm" name="id348698"></a> 361 361 Precautionary veto is effected for particular Windows file names that have been targeted by 362 362 virus-related activity. Additionally, Microsoft Office files are vetoed from opportunistic locking … … 386 386 The following sections cover each step in logical and defined detail. 387 387 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch4bsc"></a>Basic System Configuration</h3></div></div></div><p> 388 <a class="indexterm" name="id3 25511"></a>388 <a class="indexterm" name="id348775"></a> 389 389 The preparation in this section assumes that your SUSE Enterprise Linux Server 8.0 system has been 390 390 freshly installed. It prepares basic files so that the system is ready for comprehensive 391 operation in line with the network diagram shown in <a href="secure.html#ch04net" title="Figure 3.1. Abmas Network Topology 130 Users">???</a>.392 </p><div class="procedure"><a name="id3 25526"></a><p class="title"><b>Procedure 3.1. Server Configuration Steps</b></p><ol type="1"><li><p>393 <a class="indexterm" name="id3 25537"></a>391 operation in line with the network diagram shown in <a class="link" href="secure.html#ch04net" title="Figure 3.1. Abmas Network Topology 130 Users">“Abmas Network Topology 130 Users”</a>. 392 </p><div class="procedure"><a name="id348789"></a><p class="title"><b>Procedure 3.1. Server Configuration Steps</b></p><ol type="1"><li><p> 393 <a class="indexterm" name="id348799"></a> 394 394 Using the UNIX/Linux system tools, name the server <code class="constant">server.abmas.us</code>. 395 395 Verify that your hostname is correctly set by running: … … 404 404 </pre><p> 405 405 </p></li><li><p> 406 <a class="indexterm" name="id3 25579"></a>407 <a class="indexterm" name="id3 25586"></a>406 <a class="indexterm" name="id348836"></a> 407 <a class="indexterm" name="id348843"></a> 408 408 Edit your <code class="filename">/etc/hosts</code> file to include the primary names and addresses 409 409 of all network interfaces that are on the host server. This is necessary so that during … … 426 426 192.168.2.30 hplj6f.abmas.biz hplj6f 427 427 </pre><p> 428 <a class="indexterm" name="id3 25634"></a>429 <a class="indexterm" name="id3 25641"></a>430 <a class="indexterm" name="id3 25648"></a>428 <a class="indexterm" name="id348887"></a> 429 <a class="indexterm" name="id348894"></a> 430 <a class="indexterm" name="id348900"></a> 431 431 The printer entries are not necessary if <code class="literal">named</code> is started prior to 432 432 startup of <code class="literal">cupsd</code>, the CUPS daemon. 433 433 </p></li><li><p> 434 <a class="indexterm" name="id3 25674"></a>435 <a class="indexterm" name="id3 25681"></a>436 <a class="indexterm" name="id3 25687"></a>434 <a class="indexterm" name="id348923"></a> 435 <a class="indexterm" name="id348929"></a> 436 <a class="indexterm" name="id348935"></a> 437 437 The host server is acting as a router between the two internal network segments as well 438 438 as for all Internet access. This necessitates that IP forwarding be enabled. This can be … … 443 443 To ensure that your kernel is capable of IP forwarding during configuration, you may 444 444 wish to execute that command manually also. This setting permits the Linux system to 445 act as a router.<sup>[<a name="id3 25710" href="#ftn.id325710">6</a>]</sup>446 </p></li><li><p> 447 <a class="indexterm" name="id3 25722"></a>448 <a class="indexterm" name="id3 25729"></a>445 act as a router.<sup>[<a name="id348957" href="#ftn.id348957" class="footnote">6</a>]</sup> 446 </p></li><li><p> 447 <a class="indexterm" name="id348968"></a> 448 <a class="indexterm" name="id348975"></a> 449 449 Installation of a basic firewall and NAT facility is necessary. 450 450 The following script can be installed in the <code class="filename">/usr/local/sbin</code> 451 451 directory. It is executed from the <code class="filename">/etc/rc.d/boot.local</code> startup 452 452 script. In your case, this script is called <code class="filename">abmas-netfw.sh</code>. The 453 script contents are shown in <a href="secure.html#ch4natfw" title="Example 3.3. NAT Firewall Configuration Script">???</a>.453 script contents are shown in <a class="link" href="secure.html#ch4natfw" title="Example 3.3. NAT Firewall Configuration Script">“NAT Firewall Configuration Script”</a>. 454 454 455 455 </p><div class="example"><a name="ch4natfw"></a><p class="title"><b>Example 3.3. NAT Firewall Configuration Script</b></p><div class="example-contents"><pre class="screen"> … … 525 525 </pre><p> 526 526 </p></li></ol></div><p> 527 <a class="indexterm" name="id3 25846"></a>527 <a class="indexterm" name="id349080"></a> 528 528 The server is now ready for Samba configuration. During the validation step, you remove 529 529 the entry for the Samba server <code class="constant">diamond</code> from the <code class="filename">/etc/hosts</code> 530 530 file. This is done after you are satisfied that DNS-based name resolution is functioning correctly. 531 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 25866"></a>Samba Configuration</h3></div></div></div><p>531 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id349099"></a>Samba Configuration</h3></div></div></div><p> 532 532 When you have completed this section, the Samba server is ready for testing and validation; 533 533 however, testing and validation have to wait until DHCP, DNS, and printing (CUPS) services have 534 534 been configured. 535 </p><div class="procedure"><a name="id3 25877"></a><p class="title"><b>Procedure 3.2. Samba Configuration Steps</b></p><ol type="1"><li><p>535 </p><div class="procedure"><a name="id349109"></a><p class="title"><b>Procedure 3.2. Samba Configuration Steps</b></p><ol type="1"><li><p> 536 536 Install the Samba-3 binary RPM from the Samba-Team FTP site. Assuming that the binary 537 537 RPM file is called <code class="filename">samba-3.0.20-1.i386.rpm</code>, one way to install this … … 544 544 refer to the operating system manufacturer's documentation for guidance. 545 545 </p></li><li><p> 546 Install the <code class="filename">smb.conf</code> file shown in <a href="secure.html#promisnet" title="Example 3.4. 130 User Network with tdbsam [globals] Section">???</a>, <a href="secure.html#promisnetsvca" title="Example 3.5. 130 User Network with tdbsam Services Section Part A">???</a>,547 and <a href="secure.html#promisnetsvcb" title="Example 3.6. 130 User Network with tdbsam Services Section Part B">???</a>. Concatenate (join) all three files to make a single <code class="filename">smb.conf</code>546 Install the <code class="filename">smb.conf</code> file shown in <a class="link" href="secure.html#promisnet" title="Example 3.4. 130 User Network with tdbsam [globals] Section">“130 User Network with tdbsam [globals] Section”</a>, <a class="link" href="secure.html#promisnetsvca" title="Example 3.5. 130 User Network with tdbsam Services Section Part A">“130 User Network with tdbsam Services Section Part A”</a>, 547 and <a class="link" href="secure.html#promisnetsvcb" title="Example 3.6. 130 User Network with tdbsam Services Section Part B">“130 User Network with tdbsam Services Section Part B”</a>. Concatenate (join) all three files to make a single <code class="filename">smb.conf</code> 548 548 file. The final, fully qualified path for this file should be <code class="filename">/etc/samba/smb.conf</code>. 549 549 550 </p><div class="example"><a name="promisnet"></a><p class="title"><b>Example 3.4. 130 User Network with <span class="emphasis"><em>tdbsam</em></span> [globals] Section</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id3 25993"></a><em class="parameter"><code>workgroup = PROMISES</code></em></td></tr><tr><td><a class="indexterm" name="id326005"></a><em class="parameter"><code>netbios name = DIAMOND</code></em></td></tr><tr><td><a class="indexterm" name="id326018"></a><em class="parameter"><code>interfaces = eth1, eth2, lo</code></em></td></tr><tr><td><a class="indexterm" name="id326030"></a><em class="parameter"><code>bind interfaces only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id326043"></a><em class="parameter"><code>passdb backend = tdbsam</code></em></td></tr><tr><td><a class="indexterm" name="id326056"></a><em class="parameter"><code>pam password change = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id326068"></a><em class="parameter"><code>passwd program = /usr/bin/passwd %u</code></em></td></tr><tr><td><a class="indexterm" name="id326081"></a><em class="parameter"><code>passwd chat = *New*Password* %n\n *Re-enter*new*password*%n\n *Password*changed*</code></em></td></tr><tr><td><a class="indexterm" name="id326094"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id326107"></a><em class="parameter"><code>unix password sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id326119"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id326132"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id326144"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id326157"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id326170"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id326182"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id326195"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id326207"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id326220"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id326232"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id326245"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id326258"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id326271"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id326284"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -G '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id326297"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /tmp '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id326310"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id326322"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id326335"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id326348"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id326361"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id326373"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id326386"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id326398"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id326411"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id326423"></a><em class="parameter"><code>utmp = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id326436"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id326448"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id326461"></a><em class="parameter"><code>cups options = Raw</code></em></td></tr><tr><td><a class="indexterm" name="id326473"></a><em class="parameter"><code>veto files = /*.eml/*.nws/*.{*}/</code></em></td></tr><tr><td><a class="indexterm" name="id326486"></a><em class="parameter"><code>veto oplock files = /*.doc/*.xls/*.mdb/</code></em></td></tr></table></div></div><p><br class="example-break">551 552 </p><div class="example"><a name="promisnetsvca"></a><p class="title"><b>Example 3.5. 130 User Network with <span class="emphasis"><em>tdbsam</em></span> Services Section Part A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id3 26530"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id326542"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id326555"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id326567"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id326589"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id326602"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id326614"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id326627"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id326639"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id326652"></a><em class="parameter"><code>default devmode = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id326664"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id326686"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id326698"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id326711"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id326724"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id326745"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id326758"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id326770"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id326783"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id326804"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id326817"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id326829"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><p><br class="example-break">553 554 </p><div class="example"><a name="promisnetsvcb"></a><p class="title"><b>Example 3.6. 130 User Network with <span class="emphasis"><em>tdbsam</em></span> Services Section Part B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id3 26872"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id326885"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id326898"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id326919"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id326932"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id326944"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id326966"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id326978"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id326991"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id327003"></a><em class="parameter"><code>admin users = bjordan</code></em></td></tr></table></div></div><p><br class="example-break">555 </p></li><li><p> 556 <a class="indexterm" name="id3 27024"></a><a class="indexterm" name="id327029"></a>550 </p><div class="example"><a name="promisnet"></a><p class="title"><b>Example 3.4. 130 User Network with <span class="emphasis"><em>tdbsam</em></span> [globals] Section</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id349208"></a><em class="parameter"><code>workgroup = PROMISES</code></em></td></tr><tr><td><a class="indexterm" name="id349219"></a><em class="parameter"><code>netbios name = DIAMOND</code></em></td></tr><tr><td><a class="indexterm" name="id349229"></a><em class="parameter"><code>interfaces = eth1, eth2, lo</code></em></td></tr><tr><td><a class="indexterm" name="id349240"></a><em class="parameter"><code>bind interfaces only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id349250"></a><em class="parameter"><code>passdb backend = tdbsam</code></em></td></tr><tr><td><a class="indexterm" name="id349260"></a><em class="parameter"><code>pam password change = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id349271"></a><em class="parameter"><code>passwd program = /usr/bin/passwd %u</code></em></td></tr><tr><td><a class="indexterm" name="id349281"></a><em class="parameter"><code>passwd chat = *New*Password* %n\n *Re-enter*new*password*%n\n *Password*changed*</code></em></td></tr><tr><td><a class="indexterm" name="id349292"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id349303"></a><em class="parameter"><code>unix password sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id349313"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id349324"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id349334"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id349344"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id349355"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id349365"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id349376"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id349386"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id349396"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id349407"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id349417"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id349428"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id349438"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id349448"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -G '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id349459"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /tmp '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id349470"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id349481"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id349491"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id349502"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id349512"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id349522"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id349533"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id349543"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id349554"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id349564"></a><em class="parameter"><code>utmp = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id349574"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id349585"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id349595"></a><em class="parameter"><code>cups options = Raw</code></em></td></tr><tr><td><a class="indexterm" name="id349606"></a><em class="parameter"><code>veto files = /*.eml/*.nws/*.{*}/</code></em></td></tr><tr><td><a class="indexterm" name="id349616"></a><em class="parameter"><code>veto oplock files = /*.doc/*.xls/*.mdb/</code></em></td></tr></table></div></div><p><br class="example-break"> 551 552 </p><div class="example"><a name="promisnetsvca"></a><p class="title"><b>Example 3.5. 130 User Network with <span class="emphasis"><em>tdbsam</em></span> Services Section Part A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id349654"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id349664"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id349675"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id349685"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id349704"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id349714"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id349725"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id349735"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id349745"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id349756"></a><em class="parameter"><code>default devmode = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id349766"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id349785"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id349795"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id349806"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id349816"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id349835"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id349845"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id349856"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id349866"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id349885"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id349895"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id349906"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><p><br class="example-break"> 553 554 </p><div class="example"><a name="promisnetsvcb"></a><p class="title"><b>Example 3.6. 130 User Network with <span class="emphasis"><em>tdbsam</em></span> Services Section Part B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id349944"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id349954"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id349964"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id349983"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id349994"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id350004"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id350023"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id350033"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id350044"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id350054"></a><em class="parameter"><code>admin users = bjordan</code></em></td></tr></table></div></div><p><br class="example-break"> 555 </p></li><li><p> 556 <a class="indexterm" name="id350072"></a><a class="indexterm" name="id350077"></a> 557 557 Add the <code class="constant">root</code> user to the password backend as follows: 558 558 </p><pre class="screen"> … … 567 567 without considerable trouble. 568 568 </p></li><li><p> 569 <a class="indexterm" name="id3 27073"></a>569 <a class="indexterm" name="id350117"></a> 570 570 Create the username map file to permit the <code class="constant">root</code> account to be called 571 571 <code class="constant">Administrator</code> from the Windows network environment. To do this, create … … 594 594 </pre><p> 595 595 </p></li><li><p> 596 <a class="indexterm" name="id3 27111"></a>597 <a class="indexterm" name="id3 27118"></a>598 <a class="indexterm" name="id3 27129"></a>599 <a class="indexterm" name="id3 27140"></a>600 Create and map Windows Domain Groups to UNIX groups. A sample script is provided in <a href="small.html" title="Chapter 2. Small Office Networking">???</a>,601 <a href="small.html#initGrps" title="Example 2.1. Script to Map Windows NT Groups to UNIX Groups">???</a>. Create a file containing this script. We called ours596 <a class="indexterm" name="id350152"></a> 597 <a class="indexterm" name="id350158"></a> 598 <a class="indexterm" name="id350169"></a> 599 <a class="indexterm" name="id350179"></a> 600 Create and map Windows Domain Groups to UNIX groups. A sample script is provided in <a class="link" href="small.html" title="Chapter 2. Small Office Networking">“Small Office Networking”</a>, 601 <a class="link" href="small.html#initGrps" title="Example 2.1. Script to Map Windows NT Groups to UNIX Groups">“Script to Map Windows NT Groups to UNIX Groups”</a>. Create a file containing this script. We called ours 602 602 <code class="filename">/etc/samba/initGrps.sh</code>. Set this file so it can be executed, 603 603 and then execute the script. Sample output should be as follows: 604 604 605 </p><div class="example"><a name="ch4initGrps"></a><p class="title"><b>Example 3.7. Script to Map Windows NT Groups to UNIX Groups</b></p><div class="example-contents"><a class="indexterm" name="id3 27181"></a><pre class="screen">605 </p><div class="example"><a name="ch4initGrps"></a><p class="title"><b>Example 3.7. Script to Map Windows NT Groups to UNIX Groups</b></p><div class="example-contents"><a class="indexterm" name="id350213"></a><pre class="screen"> 606 606 #!/bin/bash 607 607 # … … 656 656 </pre><p> 657 657 </p></li><li><p> 658 <a class="indexterm" name="id3 27240"></a>659 <a class="indexterm" name="id3 27247"></a>660 <a class="indexterm" name="id3 27254"></a>661 <a class="indexterm" name="id3 27260"></a>662 <a class="indexterm" name="id3 27267"></a>663 <a class="indexterm" name="id3 27274"></a>664 <a class="indexterm" name="id3 27283"></a>658 <a class="indexterm" name="id350270"></a> 659 <a class="indexterm" name="id350276"></a> 660 <a class="indexterm" name="id350282"></a> 661 <a class="indexterm" name="id350288"></a> 662 <a class="indexterm" name="id350295"></a> 663 <a class="indexterm" name="id350301"></a> 664 <a class="indexterm" name="id350309"></a> 665 665 There is one preparatory step without which you will not have a working Samba 666 666 network environment. You must add an account for each network user. … … 687 687 You do of course use a valid user login ID in place of <em class="parameter"><code>username</code></em>. 688 688 </p></li><li><p> 689 <a class="indexterm" name="id3 27390"></a>690 <a class="indexterm" name="id3 27399"></a>691 <a class="indexterm" name="id3 27408"></a>689 <a class="indexterm" name="id350406"></a> 690 <a class="indexterm" name="id350414"></a> 691 <a class="indexterm" name="id350423"></a> 692 692 Using the preferred tool for your UNIX system, add each user to the UNIX groups created 693 693 previously as necessary. File system access control will be based on UNIX group membership. … … 698 698 file system partition using appropriate system tools. 699 699 </p></li><li><p> 700 <a class="indexterm" name="id3 27445"></a>700 <a class="indexterm" name="id350457"></a> 701 701 Create the top-level file storage directories for data and applications as follows: 702 702 </p><pre class="screen"> … … 739 739 </pre><p> 740 740 </p></li><li><p> 741 <a class="indexterm" name="id3 27647"></a>742 <a class="indexterm" name="id3 27653"></a>743 <a class="indexterm" name="id3 27660"></a>741 <a class="indexterm" name="id350631"></a> 742 <a class="indexterm" name="id350637"></a> 743 <a class="indexterm" name="id350644"></a> 744 744 Create a logon script. It is important that each line is correctly terminated with 745 745 a carriage return and line-feed combination (i.e., DOS encoding). The following procedure … … 761 761 foundational to Internet access as well as to trouble-free operation of local networking. When 762 762 you have completed this section, the server should be ready for solid duty operation. 763 </p><div class="procedure"><a name="id3 27727"></a><p class="title"><b>Procedure 3.3. DHCP and DNS Server Configuration Steps</b></p><ol type="1"><li><p>764 <a class="indexterm" name="id3 27738"></a>763 </p><div class="procedure"><a name="id350702"></a><p class="title"><b>Procedure 3.3. DHCP and DNS Server Configuration Steps</b></p><ol type="1"><li><p> 764 <a class="indexterm" name="id350713"></a> 765 765 Create a file called <code class="filename">/etc/dhcpd.conf</code> with the contents as 766 shown in <a href="secure.html#prom-dhcp" title="Example 3.8. DHCP Server Configuration File /etc/dhcpd.conf">???</a>.766 shown in <a class="link" href="secure.html#prom-dhcp" title="Example 3.8. DHCP Server Configuration File /etc/dhcpd.conf">“DHCP Server Configuration File /etc/dhcpd.conf”</a>. 767 767 768 768 </p><div class="example"><a name="prom-dhcp"></a><p class="title"><b>Example 3.8. DHCP Server Configuration File <code class="filename">/etc/dhcpd.conf</code></b></p><div class="example-contents"><pre class="screen"> … … 813 813 </pre></div></div><p><br class="example-break"> 814 814 </p></li><li><p> 815 <a class="indexterm" name="id3 27812"></a>815 <a class="indexterm" name="id350767"></a> 816 816 Create a file called <code class="filename">/etc/named.conf</code> that has the combined contents 817 of the <a href="secure.html#ch4namedcfg" title="Example 3.9. DNS Master Configuration File /etc/named.conf Master Section">???</a>, <a href="secure.html#ch4namedvarfwd" title="Example 3.10. DNS Master Configuration File /etc/named.conf Forward Lookup Definition Section">???</a>, and818 <a href="secure.html#ch4namedvarrev" title="Example 3.11. DNS Master Configuration File /etc/named.conf Reverse Lookup Definition Section">???</a> files that are concatenated (merged) in this817 of the <a class="link" href="secure.html#ch4namedcfg" title="Example 3.9. DNS Master Configuration File /etc/named.conf Master Section">“DNS Master Configuration File /etc/named.conf Master Section”</a>, <a class="link" href="secure.html#ch4namedvarfwd" title="Example 3.10. DNS Master Configuration File /etc/named.conf Forward Lookup Definition Section">“DNS Master Configuration File /etc/named.conf Forward Lookup Definition Section”</a>, and 818 <a class="link" href="secure.html#ch4namedvarrev" title="Example 3.11. DNS Master Configuration File /etc/named.conf Reverse Lookup Definition Section">“DNS Master Configuration File /etc/named.conf Reverse Lookup Definition Section”</a> files that are concatenated (merged) in this 819 819 specific order. 820 820 </p></li><li><p> 821 Create the files shown in their respective directories as shown in <a href="secure.html#namedrscfiles" title="Table 3.2. DNS (named) Resource Files">DNS821 Create the files shown in their respective directories as shown in <a class="link" href="secure.html#namedrscfiles" title="Table 3.2. DNS (named) Resource Files">DNS 822 822 (named) Resource Files</a>. 823 823 824 </p><div class="table"><a name="namedrscfiles"></a><p class="title"><b>Table 3.2. DNS (named) Resource Files</b></p><div class="table-contents"><table summary="DNS (named) Resource Files" border="1"><colgroup><col align="left"><col align="left"></colgroup><thead><tr><th align="left">Reference</th><th align="left">File Location</th></tr></thead><tbody><tr><td align="left"><a href="appendix.html#loopback" title="Example 15.3. DNS Localhost Forward Zone File: /var/lib/named/localhost.zone">???</a></td><td align="left">/var/lib/named/localhost.zone</td></tr><tr><td align="left"><a href="appendix.html#dnsloopy" title="Example 15.4. DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone">???</a></td><td align="left">/var/lib/named/127.0.0.zone</td></tr><tr><td align="left"><a href="appendix.html#roothint" title="Example 15.5. DNS Root Name Server Hint File: /var/lib/named/root.hint">???</a></td><td align="left">/var/lib/named/root.hint</td></tr><tr><td align="left"><a href="secure.html#abmasbiz" title="Example 3.14. DNS Abmas.biz Forward Zone File">???</a></td><td align="left">/var/lib/named/master/abmas.biz.hosts</td></tr><tr><td align="left"><a href="secure.html#abmasus" title="Example 3.15. DNS Abmas.us Forward Zone File">???</a></td><td align="left">/var/lib/named/abmas.us.hosts</td></tr><tr><td align="left"><a href="secure.html#eth1zone" title="Example 3.12. DNS 192.168.1 Reverse Zone File">???</a></td><td align="left">/var/lib/named/192.168.1.0.rev</td></tr><tr><td align="left"><a href="secure.html#eth2zone" title="Example 3.13. DNS 192.168.2 Reverse Zone File">???</a></td><td align="left">/var/lib/named/192.168.2.0.rev</td></tr></tbody></table></div></div><p><br class="table-break">825 826 </p><div class="example"><a name="ch4namedcfg"></a><p class="title"><b>Example 3.9. DNS Master Configuration File <code class="filename">/etc/named.conf</code> Master Section</b></p><div class="example-contents"><a class="indexterm" name="id3 28017"></a><pre class="screen">824 </p><div class="table"><a name="namedrscfiles"></a><p class="title"><b>Table 3.2. DNS (named) Resource Files</b></p><div class="table-contents"><table summary="DNS (named) Resource Files" border="1"><colgroup><col align="left"><col align="left"></colgroup><thead><tr><th align="left">Reference</th><th align="left">File Location</th></tr></thead><tbody><tr><td align="left"><a class="link" href="appendix.html#loopback" title="Example 15.3. DNS Localhost Forward Zone File: /var/lib/named/localhost.zone">“DNS Localhost Forward Zone File: /var/lib/named/localhost.zone”</a></td><td align="left">/var/lib/named/localhost.zone</td></tr><tr><td align="left"><a class="link" href="appendix.html#dnsloopy" title="Example 15.4. DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone">“DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone”</a></td><td align="left">/var/lib/named/127.0.0.zone</td></tr><tr><td align="left"><a class="link" href="appendix.html#roothint" title="Example 15.5. DNS Root Name Server Hint File: /var/lib/named/root.hint">“DNS Root Name Server Hint File: /var/lib/named/root.hint”</a></td><td align="left">/var/lib/named/root.hint</td></tr><tr><td align="left"><a class="link" href="secure.html#abmasbiz" title="Example 3.14. DNS Abmas.biz Forward Zone File">“DNS Abmas.biz Forward Zone File”</a></td><td align="left">/var/lib/named/master/abmas.biz.hosts</td></tr><tr><td align="left"><a class="link" href="secure.html#abmasus" title="Example 3.15. DNS Abmas.us Forward Zone File">“DNS Abmas.us Forward Zone File”</a></td><td align="left">/var/lib/named/abmas.us.hosts</td></tr><tr><td align="left"><a class="link" href="secure.html#eth1zone" title="Example 3.12. DNS 192.168.1 Reverse Zone File">“DNS 192.168.1 Reverse Zone File”</a></td><td align="left">/var/lib/named/192.168.1.0.rev</td></tr><tr><td align="left"><a class="link" href="secure.html#eth2zone" title="Example 3.13. DNS 192.168.2 Reverse Zone File">“DNS 192.168.2 Reverse Zone File”</a></td><td align="left">/var/lib/named/192.168.2.0.rev</td></tr></tbody></table></div></div><p><br class="table-break"> 825 826 </p><div class="example"><a name="ch4namedcfg"></a><p class="title"><b>Example 3.9. DNS Master Configuration File <code class="filename">/etc/named.conf</code> Master Section</b></p><div class="example-contents"><a class="indexterm" name="id350938"></a><pre class="screen"> 827 827 ### 828 828 # Abmas Biz DNS Control File … … 1009 1009 1010 1010 </p></li><li><p> 1011 <a class="indexterm" name="id3 28181"></a><a class="indexterm" name="id328187"></a>1011 <a class="indexterm" name="id351093"></a><a class="indexterm" name="id351098"></a> 1012 1012 All DNS name resolution should be handled locally. To ensure that the server is configured 1013 1013 correctly to handle this, edit <code class="filename">/etc/resolv.conf</code> to have the following … … 1018 1018 nameserver 123.45.54.23 1019 1019 </pre><p> 1020 <a class="indexterm" name="id3 28209"></a>1020 <a class="indexterm" name="id351119"></a> 1021 1021 This instructs the name resolver function (when configured correctly) to ask the DNS server 1022 1022 that is running locally to resolve names to addresses. In the event that the local name server … … 1024 1024 purely local names to IP addresses. 1025 1025 </p></li><li><p> 1026 <a class="indexterm" name="id3 28228"></a>1026 <a class="indexterm" name="id351137"></a> 1027 1027 The final step is to edit the <code class="filename">/etc/nsswitch.conf</code> file. 1028 1028 This file controls the operation of the various resolver libraries that are part of the Linux … … 1043 1043 submitted to it. In other words, our configuration turns CUPS into a raw-mode print queue. This means that 1044 1044 the correct printer driver must be installed on all clients. 1045 </p><div class="procedure"><a name="id3 28275"></a><p class="title"><b>Procedure 3.4. Printer Configuration Steps</b></p><ol type="1"><li><p>1045 </p><div class="procedure"><a name="id351180"></a><p class="title"><b>Procedure 3.4. Printer Configuration Steps</b></p><ol type="1"><li><p> 1046 1046 Configure each printer to be a DHCP client, carefully following the manufacturer's guidelines. 1047 1047 </p></li><li><p> … … 1050 1050 port as necessary in the following example commands. 1051 1051 This allows the CUPS spooler to print using raw mode protocols. 1052 <a class="indexterm" name="id3 28297"></a>1053 <a class="indexterm" name="id3 28304"></a>1052 <a class="indexterm" name="id351201"></a> 1053 <a class="indexterm" name="id351207"></a> 1054 1054 </p></li><li><p> 1055 <a class="indexterm" name="id3 28317"></a><a class="indexterm" name="id328325"></a>1055 <a class="indexterm" name="id351220"></a><a class="indexterm" name="id351227"></a> 1056 1056 Configure the CUPS Print Queues as follows: 1057 1057 </p><pre class="screen"> … … 1061 1061 <code class="prompt">root# </code> lpadmin -p hplj6f -v socket://hplj6f.abmas.biz:9100 -E 1062 1062 </pre><p> 1063 <a class="indexterm" name="id3 28365"></a>1063 <a class="indexterm" name="id351268"></a> 1064 1064 This creates the necessary print queues with no assigned print filter. 1065 </p></li><li><p><a class="indexterm" name="id3 28379"></a>1065 </p></li><li><p><a class="indexterm" name="id351281"></a> 1066 1066 Print queues may not be enabled at creation. Use <code class="literal">lpc stat</code> to check 1067 1067 the status of the print queues and, if necessary, make certain that the queues you have … … 1073 1073 <code class="prompt">root# </code> /usr/bin/enable hplj6f 1074 1074 </pre><p> 1075 </p></li><li><p><a class="indexterm" name="id3 28431"></a>1075 </p></li><li><p><a class="indexterm" name="id351333"></a> 1076 1076 Even though your print queues may be enabled, it is still possible that they 1077 1077 are not accepting print jobs. A print queue services incoming printing … … 1085 1085 </pre><p> 1086 1086 </p></li><li><p> 1087 <a class="indexterm" name="id3 28478"></a>1088 <a class="indexterm" name="id3 28485"></a>1089 <a class="indexterm" name="id3 28492"></a>1087 <a class="indexterm" name="id351381"></a> 1088 <a class="indexterm" name="id351387"></a> 1089 <a class="indexterm" name="id351394"></a> 1090 1090 Edit the file <code class="filename">/etc/cups/mime.convs</code> to uncomment the line: 1091 1091 </p><pre class="screen"> … … 1093 1093 </pre><p> 1094 1094 </p></li><li><p> 1095 <a class="indexterm" name="id3 28518"></a>1095 <a class="indexterm" name="id351420"></a> 1096 1096 Edit the file <code class="filename">/etc/cups/mime.types</code> to uncomment the line: 1097 1097 </p><pre class="screen"> … … 1106 1106 The UNIX system print queues have been configured and are ready for validation testing. 1107 1107 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="procstart"></a>Process Startup Configuration</h3></div></div></div><p> 1108 <a class="indexterm" name="id3 28580"></a>1108 <a class="indexterm" name="id351482"></a> 1109 1109 There are two essential steps to process startup configuration. First, the process 1110 1110 must be configured so that it automatically restarts each time the server … … 1115 1115 necessary start or kill script is run. 1116 1116 </p><p> 1117 <a class="indexterm" name="id3 28611"></a>1118 <a class="indexterm" name="id3 28618"></a>1119 <a class="indexterm" name="id3 28625"></a>1120 <a class="indexterm" name="id3 28631"></a>1121 <a class="indexterm" name="id3 28638"></a>1117 <a class="indexterm" name="id351513"></a> 1118 <a class="indexterm" name="id351520"></a> 1119 <a class="indexterm" name="id351527"></a> 1120 <a class="indexterm" name="id351534"></a> 1121 <a class="indexterm" name="id351540"></a> 1122 1122 In the event that a service is not run as a daemon, but via the internetworking 1123 1123 super daemon (<code class="literal">inetd</code> or <code class="literal">xinetd</code>), then the <code class="literal">chkconfig</code> … … 1130 1130 Use the standard system tool to configure each service to restart 1131 1131 automatically at every system reboot. For example, 1132 <a class="indexterm" name="id3 28685"></a>1132 <a class="indexterm" name="id351587"></a> 1133 1133 </p><pre class="screen"> 1134 1134 <code class="prompt">root# </code> chkconfig dhpcd on … … 1138 1138 </pre><p> 1139 1139 </p></li><li><p> 1140 <a class="indexterm" name="id3 28728"></a>1141 <a class="indexterm" name="id3 28735"></a>1142 <a class="indexterm" name="id3 28742"></a>1140 <a class="indexterm" name="id351630"></a> 1141 <a class="indexterm" name="id351637"></a> 1142 <a class="indexterm" name="id351644"></a> 1143 1143 Now start each service to permit the system to be validated. 1144 1144 Execute each of the following in the sequence shown: … … 1151 1151 </pre><p> 1152 1152 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch4valid"></a>Validation</h3></div></div></div><p> 1153 <a class="indexterm" name="id3 28794"></a>1153 <a class="indexterm" name="id351696"></a> 1154 1154 Complex networking problems are most often caused by simple things that are poorly or incorrectly 1155 1155 configured. The validation process adopted here should be followed carefully; it is the result of the … … 1161 1161 Later in this book you learn how to make users happier. For now, it is enough to learn to 1162 1162 validate. Let's get on with it. 1163 </p><div class="procedure"><a name="id3 28809"></a><p class="title"><b>Procedure 3.5. Server Validation Steps</b></p><ol type="1"><li><p>1164 <a class="indexterm" name="id3 28820"></a>1163 </p><div class="procedure"><a name="id351711"></a><p class="title"><b>Procedure 3.5. Server Validation Steps</b></p><ol type="1"><li><p> 1164 <a class="indexterm" name="id351722"></a> 1165 1165 One of the most important facets of Samba configuration is to ensure that 1166 1166 name resolution functions correctly. You can check name resolution … … 1188 1188 is working. 1189 1189 </p></li><li><p> 1190 <a class="indexterm" name="id3 28885"></a>1190 <a class="indexterm" name="id351783"></a> 1191 1191 So far, your installation is going particularly well. In this step we validate 1192 1192 DNS server and name resolution operation. Using your favorite UNIX system editor, … … 1197 1197 </pre><p> 1198 1198 </p></li><li><p> 1199 <a class="indexterm" name="id3 28915"></a>1199 <a class="indexterm" name="id351813"></a> 1200 1200 Before you test DNS operation, it is a good idea to verify that the DNS server 1201 1201 is running by executing the following: … … 1211 1211 </pre><p> 1212 1212 This means that we are ready to check DNS operation. Do so by executing: 1213 <a class="indexterm" name="id3 28939"></a>1213 <a class="indexterm" name="id351837"></a> 1214 1214 </p><pre class="screen"> 1215 1215 <code class="prompt">root# </code> ping diamond … … 1227 1227 sleeth1.abmas.biz has address 192.168.1.1 1228 1228 </pre><p> 1229 <a class="indexterm" name="id3 28973"></a>1229 <a class="indexterm" name="id351871"></a> 1230 1230 You may now remove the entry called <code class="constant">diamond</code> from the 1231 1231 <code class="filename">/etc/hosts</code> file. It does not hurt to leave it there, 1232 1232 but its removal reduces the number of administrative steps for this name. 1233 1233 </p></li><li><p> 1234 <a class="indexterm" name="id3 28998"></a>1234 <a class="indexterm" name="id351896"></a> 1235 1235 WINS is a great way to resolve NetBIOS names to their IP address. You can test 1236 1236 the operation of WINS by starting <code class="literal">nmbd</code> (manually or by way 1237 of the Samba startup method shown in <a href="secure.html#procstart" title="Process Startup Configuration">???</a>). You must edit1237 of the Samba startup method shown in <a class="link" href="secure.html#procstart" title="Process Startup Configuration">“Process Startup Configuration”</a>). You must edit 1238 1238 the <code class="filename">/etc/nsswitch.conf</code> file so that the <code class="constant">hosts</code> 1239 1239 entry is as follows: … … 1243 1243 The next step is to make certain that Samba is running using <code class="literal">ps ax | grep mbd</code>. 1244 1244 The <code class="literal">nmbd</code> daemon will provide the WINS name resolution service when the 1245 <code class="filename">smb.conf</code> file <em class="parameter"><code></code></em> parameter <a class=" indexterm" name="id329058"></a>wins support = Yeshas been specified. Having validated that Samba is operational,1245 <code class="filename">smb.conf</code> file <em class="parameter"><code></code></em> parameter <a class="link" href="smb.conf.5.html#WINSSUPPORT">wins support = Yes</a> has been specified. Having validated that Samba is operational, 1246 1246 excute the following: 1247 1247 </p><pre class="screen"> … … 1251 1251 64 bytes from 192.168.1.1: icmp_seq=2 ttl=64 time=0.479 ms 1252 1252 </pre><p> 1253 <a class="indexterm" name="id3 29078"></a>1253 <a class="indexterm" name="id351980"></a> 1254 1254 Now that you can relax with the knowledge that all three major forms of name 1255 1255 resolution to IP address resolution are working, edit the <code class="filename">/etc/nsswitch.conf</code> … … 1272 1272 comes when you try to add the first DHCP client to the network. 1273 1273 </p></li><li><p> 1274 <a class="indexterm" name="id3 29131"></a>1274 <a class="indexterm" name="id352033"></a> 1275 1275 This is a good point at which to start validating Samba operation. You are 1276 1276 content that name resolution is working for basic TCP/IP needs. Let's move on. … … 1344 1344 Clear away all errors before proceeding. 1345 1345 </p></li><li><p> 1346 <a class="indexterm" name="id3 29182"></a>1347 <a class="indexterm" name="id3 29188"></a>1348 <a class="indexterm" name="id3 29195"></a>1349 <a class="indexterm" name="id3 29202"></a>1346 <a class="indexterm" name="id352099"></a> 1347 <a class="indexterm" name="id352106"></a> 1348 <a class="indexterm" name="id352112"></a> 1349 <a class="indexterm" name="id352119"></a> 1350 1350 Check that the Samba server is running: 1351 1351 </p><pre class="screen"> … … 1360 1360 </pre><p> 1361 1361 The <code class="literal">winbindd</code> daemon is running in split mode (normal), so there are also 1362 two instances<sup>[<a name="id3 29230" href="#ftn.id329230">7</a>]</sup> of it.1362 two instances<sup>[<a name="id352147" href="#ftn.id352147" class="footnote">7</a>]</sup> of it. 1363 1363 </p></li><li><p> 1364 <a class="indexterm" name="id3 29258"></a>1365 <a class="indexterm" name="id3 29265"></a>1364 <a class="indexterm" name="id352175"></a> 1365 <a class="indexterm" name="id352182"></a> 1366 1366 Check that an anonymous connection can be made to the Samba server: 1367 1367 </p><pre class="screen"> … … 1395 1395 a <code class="constant">NULL</code> password. 1396 1396 </p></li><li><p> 1397 <a class="indexterm" name="id3 29313"></a>1398 <a class="indexterm" name="id3 29319"></a>1399 <a class="indexterm" name="id3 29326"></a>1397 <a class="indexterm" name="id352230"></a> 1398 <a class="indexterm" name="id352237"></a> 1399 <a class="indexterm" name="id352244"></a> 1400 1400 Verify that each printer has the IP address assigned in the DHCP server configuration file. 1401 1401 The easiest way to do this is to ping the printer name. Immediately after the ping response … … 1412 1412 hplj6a (192.168.1.30) at 00:03:47:CB:81:E0 [ether] on eth0 1413 1413 </pre><p> 1414 <a class="indexterm" name="id3 29367"></a>1414 <a class="indexterm" name="id352285"></a> 1415 1415 The MAC address <code class="constant">00:03:47:CB:81:E0</code> matches that specified for the 1416 1416 IP address from which the printer has responded and with the entry for it in the 1417 1417 <code class="filename">/etc/dhcpd.conf</code> file. Repeat this for each printer configured. 1418 1418 </p></li><li><p> 1419 <a class="indexterm" name="id3 29394"></a>1419 <a class="indexterm" name="id352311"></a> 1420 1420 Make an authenticated connection to the server using the <code class="literal">smbclient</code> tool: 1421 1421 </p><pre class="screen"> … … 1436 1436 </pre><p> 1437 1437 </p></li><li><p> 1438 <a class="indexterm" name="id3 29438"></a>1438 <a class="indexterm" name="id352355"></a> 1439 1439 Your new server is connected to an Internet-accessible connection. Before you start 1440 1440 your firewall, you should run a port scanner against your system. You should repeat that 1441 1441 after the firewall has been started. This helps you understand to what extent the 1442 1442 server may be vulnerable to external attack. One way you can do this is by using an 1443 external service, such as the <a href="http://www.dslreports.com/scan" target="_top">DSL Reports</a>1443 external service, such as the <a class="ulink" href="http://www.dslreports.com/scan" target="_top">DSL Reports</a> 1444 1444 tools. Alternately, if you can gain root-level access to a remote 1445 1445 UNIX/Linux system that has the <code class="literal">nmap</code> tool, you can run the following: … … 1511 1511 </pre><p> 1512 1512 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch4appscfg"></a>Application Share Configuration</h3></div></div></div><p> 1513 <a class="indexterm" name="id3 29522"></a>1514 <a class="indexterm" name="id3 29529"></a>1513 <a class="indexterm" name="id352434"></a> 1514 <a class="indexterm" name="id352441"></a> 1515 1515 The use of an application server is a key mechanism by which desktop administration overheads 1516 1516 can be reduced. Check the application manual for your software to identify how best to … … 1533 1533 of work files on the local workstation. 1534 1534 </p></li></ul></div><p> 1535 <a class="indexterm" name="id3 29572"></a>1535 <a class="indexterm" name="id352484"></a> 1536 1536 A common application deployed in this environment is an office suite. 1537 1537 Enterprise editions of Microsoft Office XP Professional can be administratively installed … … 1550 1550 local disk space. In the latter case, when the applications are used, they load over the network. 1551 1551 </p><p> 1552 <a class="indexterm" name="id3 29600"></a>1553 <a class="indexterm" name="id3 29606"></a>1552 <a class="indexterm" name="id352512"></a> 1553 <a class="indexterm" name="id352518"></a> 1554 1554 Microsoft Office Service Packs can be unpacked to update an administrative share. This makes 1555 1555 it possible to update MS Office XP Professional for all users from a single installation … … 1560 1560 editing or by way of configuration options inside each Office XP Professional application. 1561 1561 </p><p> 1562 <a class="indexterm" name="id3 29624"></a>1562 <a class="indexterm" name="id352536"></a> 1563 1563 OpenOffice.Org OpenOffice Version 1.1.0 can be installed locally. It can also 1564 1564 be installed to run off a network share. The latter is a most desirable solution for office-bound … … 1573 1573 share point. The full administrative OpenOffice share takes approximately 150 MB of disk 1574 1574 space. 1575 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 29651"></a>Comments Regarding Software Terms of Use</h4></div></div></div><p>1575 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id352560"></a>Comments Regarding Software Terms of Use</h4></div></div></div><p> 1576 1576 Many single-user products can be installed into an administrative share, but 1577 1577 personal versions of products such as Microsoft Office XP Professional do not permit this. … … 1597 1597 please do not use the software. 1598 1598 </p><p> 1599 <a class="indexterm" name="id3 29686"></a>1599 <a class="indexterm" name="id352595"></a> 1600 1600 Samba is provided under the terms of the GNU GPL Version 2, a copy of which is provided 1601 1601 with the source code. … … 1608 1608 be done with notebook computers as long as they are identical or sufficiently similar. 1609 1609 </p><div class="procedure"><a name="sbewinclntprep"></a><p class="title"><b>Procedure 3.6. Windows Client Configuration Procedure</b></p><ol type="1"><li><p> 1610 <a class="indexterm" name="id3 29729"></a>1611 <a class="indexterm" name="id3 29736"></a>1610 <a class="indexterm" name="id352638"></a> 1611 <a class="indexterm" name="id352645"></a> 1612 1612 Install MS Windows XP Professional. During installation, configure the client to use DHCP for 1613 1613 TCP/IP protocol configuration. DHCP configures all Windows clients to use the WINS Server … … 1617 1617 username <code class="constant">root</code> and the SMB password you assigned to this account. 1618 1618 A detailed step-by-step procedure for joining a Windows 200x/XP Professional client to 1619 a Windows Domain is given in <a href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">???</a>, <a href="appendix.html#domjoin" title="Joining a Domain: Windows 200x/XP Professional">???</a>.1619 a Windows Domain is given in <a class="link" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">“A Collection of Useful Tidbits”</a>, <a class="link" href="appendix.html#domjoin" title="Joining a Domain: Windows 200x/XP Professional">“Joining a Domain: Windows 200x/XP Professional”</a>. 1620 1620 Reboot the machine as prompted and then log on using the Domain Administrator account 1621 1621 (<code class="constant">root</code>). … … 1642 1642 preparation procedure below. 1643 1643 </p></li><li><p> 1644 <a class="indexterm" name="id3 29860"></a>1644 <a class="indexterm" name="id352769"></a> 1645 1645 When you are satisfied that the staging systems are complete, use the appropriate procedure to 1646 1646 remove the client from the domain. Reboot the system and then log on as the local administrator … … 1651 1651 machine to a network share on the server. 1652 1652 </p></li><li><p> 1653 <a class="indexterm" name="id3 29885"></a>1654 <a class="indexterm" name="id3 29894"></a>1653 <a class="indexterm" name="id352794"></a> 1654 <a class="indexterm" name="id352803"></a> 1655 1655 You may now replicate the image to the target machines using the appropriate Norton Ghost 1656 1656 procedure. Make sure to use the procedure that ensures each machine has a unique … … 1658 1658 </p></li><li><p> 1659 1659 Log on to the machine as the local Administrator (the only option), and join the machine to 1660 the Domain, following the procedure set out in <a href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">???</a>, <a href="appendix.html#domjoin" title="Joining a Domain: Windows 200x/XP Professional">???</a>. The system is now1660 the Domain, following the procedure set out in <a class="link" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">“A Collection of Useful Tidbits”</a>, <a class="link" href="appendix.html#domjoin" title="Joining a Domain: Windows 200x/XP Professional">“Joining a Domain: Windows 200x/XP Professional”</a>. The system is now 1661 1661 ready for the user to log on, provided you have created a network logon account for that 1662 1662 user, of course. … … 1687 1687 Repeat the printer installation steps above for both HP LaserJet 6 printers 1688 1688 as well as for both QMS Magicolor laser printers. 1689 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 30151"></a>Key Points Learned</h3></div></div></div><p>1689 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id353060"></a>Key Points Learned</h3></div></div></div><p> 1690 1690 How do you feel? You have built a capable network, a truly ambitious project. 1691 1691 Future network updates can be handled by … … 1710 1710 client in order to effect improved standardization of desktops and to reduce 1711 1711 the costs of network management. 1712 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 30204"></a>Questions and Answers</h2></div></div></div><p>1713 </p><div class="qandaset"><dl><dt>1. <a href="secure.html#id3 30220">1712 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id353113"></a>Questions and Answers</h2></div></div></div><p> 1713 </p><div class="qandaset"><dl><dt>1. <a href="secure.html#id353129"> 1714 1714 What is the maximum number of account entries that the tdbsam 1715 1715 passdb backend can handle? 1716 </a></dt><dt>2. <a href="secure.html#id3 30273">1716 </a></dt><dt>2. <a href="secure.html#id353182"> 1717 1717 Would Samba operate any better if the OS level is set to a value higher than 35? 1718 </a></dt><dt>3. <a href="secure.html#id3 30292">1718 </a></dt><dt>3. <a href="secure.html#id353201"> 1719 1719 Why in this example have you provided UNIX group to Windows Group mappings for only Domain Groups? 1720 </a></dt><dt>4. <a href="secure.html#id3 30312">1720 </a></dt><dt>4. <a href="secure.html#id353221"> 1721 1721 Why has a path been specified in the IPC$ share? 1722 </a></dt><dt>5. <a href="secure.html#id3 30337">1722 </a></dt><dt>5. <a href="secure.html#id353246"> 1723 1723 Why does the smb.conf file in this exercise include an entry for smb ports? 1724 </a></dt><dt>6. <a href="secure.html#id3 30378">1724 </a></dt><dt>6. <a href="secure.html#id353286"> 1725 1725 What is the difference between a print queue and a printer? 1726 </a></dt><dt>7. <a href="secure.html#id3 30405">1726 </a></dt><dt>7. <a href="secure.html#id353314"> 1727 1727 Can all MS Windows application software be installed onto an application server share? 1728 </a></dt><dt>8. <a href="secure.html#id3 30426">1728 </a></dt><dt>8. <a href="secure.html#id353334"> 1729 1729 Why use dynamic DNS (DDNS)? 1730 </a></dt><dt>9. <a href="secure.html#id3 30444">1730 </a></dt><dt>9. <a href="secure.html#id353352"> 1731 1731 Why would you use WINS as well as DNS-based name resolution? 1732 </a></dt><dt>10. <a href="secure.html#id3 30514">1732 </a></dt><dt>10. <a href="secure.html#id353422"> 1733 1733 What are the major benefits of using an application server? 1734 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id3 30220"></a><a name="id330222"></a><b>1.</b></td><td align="left" valign="top"><p>1734 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id353129"></a><a name="id353131"></a><p><b>1.</b></p></td><td align="left" valign="top"><p> 1735 1735 What is the maximum number of account entries that the <em class="parameter"><code>tdbsam</code></em> 1736 1736 passdb backend can handle? … … 1758 1758 not provide a mechanism for replicating tdbsam data so it can be used by a BDC. The 1759 1759 limitation of 250 users per tdbsam is predicated only on the need for replication, 1760 not on the limits<sup>[<a name="id3 30264" href="#ftn.id330264">8</a>]</sup> of the tdbsam backend itself.1761 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 30273"></a><a name="id330275"></a><b>2.</b></td><td align="left" valign="top"><p>1760 not on the limits<sup>[<a name="id353173" href="#ftn.id353173" class="footnote">8</a>]</sup> of the tdbsam backend itself. 1761 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id353182"></a><a name="id353184"></a><p><b>2.</b></p></td><td align="left" valign="top"><p> 1762 1762 Would Samba operate any better if the OS level is set to a value higher than 35? 1763 1763 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1765 1765 of 35 already assures Samba of precedence over MS Windows products in browser elections. There is 1766 1766 no gain to be had from setting this higher. 1767 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 30292"></a><a name="id330294"></a><b>3.</b></td><td align="left" valign="top"><p>1767 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id353201"></a><a name="id353203"></a><p><b>3.</b></p></td><td align="left" valign="top"><p> 1768 1768 Why in this example have you provided UNIX group to Windows Group mappings for only Domain Groups? 1769 1769 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1771 1771 a later date Samba may make use of Windows Local Groups, as well as of the Active Directory special 1772 1772 Groups. Proper operation requires Domain Groups to be mapped to valid UNIX groups. 1773 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 30312"></a><a name="id330314"></a><b>4.</b></td><td align="left" valign="top"><p>1773 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id353221"></a><a name="id353223"></a><p><b>4.</b></p></td><td align="left" valign="top"><p> 1774 1774 Why has a path been specified in the <em class="parameter"><code>IPC$</code></em> share? 1775 1775 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1777 1777 obtain access to the file system, it does so at a location that presents least risk. Under normal operation 1778 1778 this type of paranoid step should not be necessary. The use of this parameter should not be necessary. 1779 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 30337"></a><a name="id330339"></a><b>5.</b></td><td align="left" valign="top"><p>1780 Why does the <code class="filename">smb.conf</code> file in this exercise include an entry for <a class=" indexterm" name="id330350"></a>smb ports?1779 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id353246"></a><a name="id353248"></a><p><b>5.</b></p></td><td align="left" valign="top"><p> 1780 Why does the <code class="filename">smb.conf</code> file in this exercise include an entry for <a class="link" href="smb.conf.5.html#SMBPORTS">smb ports</a>? 1781 1781 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 1782 1782 The default order by which Samba-3 attempts to communicate with MS Windows clients is via port 445 (the TCP port … … 1786 1786 The result of this is improved network performance. Where Samba-3 is installed as an Active Directory Domain 1787 1787 member, the default behavior is highly beneficial and should not be changed. 1788 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 30378"></a><a name="id330380"></a><b>6.</b></td><td align="left" valign="top"><p>1788 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id353286"></a><a name="id353288"></a><p><b>6.</b></p></td><td align="left" valign="top"><p> 1789 1789 What is the difference between a print queue and a printer? 1790 1790 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1800 1800 and the job is then submitted to a sequential print queue where the job is stored until 1801 1801 the printer is ready to receive the job. 1802 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 30405"></a><a name="id330408"></a><b>7.</b></td><td align="left" valign="top"><p>1802 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id353314"></a><a name="id353316"></a><p><b>7.</b></p></td><td align="left" valign="top"><p> 1803 1803 Can all MS Windows application software be installed onto an application server share? 1804 1804 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1808 1808 Professional do not permit installation to an application server share and can be installed 1809 1809 and used only to/from a local workstation hard disk. 1810 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 30426"></a><a name="id330428"></a><b>8.</b></td><td align="left" valign="top"><p>1810 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id353334"></a><a name="id353336"></a><p><b>8.</b></p></td><td align="left" valign="top"><p> 1811 1811 Why use dynamic DNS (DDNS)? 1812 1812 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1814 1814 network clients that are not NetBIOS-enabled, and thus cannot use WINS, to locate 1815 1815 Windows clients via DNS. 1816 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 30444"></a><a name="id330446"></a><b>9.</b></td><td align="left" valign="top"><p>1816 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id353352"></a><a name="id353354"></a><p><b>9.</b></p></td><td align="left" valign="top"><p> 1817 1817 Why would you use WINS as well as DNS-based name resolution? 1818 1818 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1822 1822 expression that may be up to 1024 characters in length and that represents an IP address. 1823 1823 A NetBIOS name is always 16 characters long. The 16<sup>th</sup> character 1824 is a name type indicator. A specific name type is registered<sup>[<a name="id3 30478" href="#ftn.id330478">9</a>]</sup> for each1824 is a name type indicator. A specific name type is registered<sup>[<a name="id353386" href="#ftn.id353386" class="footnote">9</a>]</sup> for each 1825 1825 type of service that is provided by the Windows server or client and that may be registered 1826 1826 where a WINS server is in use. … … 1837 1837 </p><p> 1838 1838 Windows 200x Active Directory requires the registration in the DNS zone for the domain it 1839 controls of service locator<sup>[<a name="id3 30504" href="#ftn.id330504">10</a>]</sup> records1839 controls of service locator<sup>[<a name="id353412" href="#ftn.id353412" class="footnote">10</a>]</sup> records 1840 1840 that Windows clients and servers will use to locate Kerberos and LDAP services. ADS also 1841 1841 requires the registration of special records that are called global catalog (GC) entries 1842 1842 and site entries by which domain controllers and other essential ADS servers may be located. 1843 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 30514"></a><a name="id330516"></a><b>10.</b></td><td align="left" valign="top"><p>1843 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id353422"></a><a name="id353425"></a><p><b>10.</b></p></td><td align="left" valign="top"><p> 1844 1844 What are the major benefits of using an application server? 1845 1845 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1848 1848 one location for all major applications used. This results in faster update roll-outs and 1849 1849 significantly better application usage control. 1850 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id3 25335" href="#id325335">5</a>] </sup>See <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 3.1850 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id348612" href="#id348612" class="para">5</a>] </sup>See <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 3. 1851 1851 This is necessary so that Samba can act as a Domain Controller (PDC); see 1852 <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 4, for additional information.</p></div><div class="footnote"><p><sup>[<a name="ftn.id3 25710" href="#id325710">6</a>] </sup>You may want to do the echo command last and include1853 "0" in the init scripts, since it opens up your network for a short time.</p></div><div class="footnote"><p><sup>[<a name="ftn.id3 29230" href="#id329230">7</a>] </sup>For more information regarding winbindd, see <span class="emphasis"><em>TOSHARG2</em></span>,1852 <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 4, for additional information.</p></div><div class="footnote"><p><sup>[<a name="ftn.id348957" href="#id348957" class="para">6</a>] </sup>You may want to do the echo command last and include 1853 "0" in the init scripts, since it opens up your network for a short time.</p></div><div class="footnote"><p><sup>[<a name="ftn.id352147" href="#id352147" class="para">7</a>] </sup>For more information regarding winbindd, see <span class="emphasis"><em>TOSHARG2</em></span>, 1854 1854 Chapter 23, Section 23.3. The single instance of <code class="literal">smbd</code> is normal. One additional 1855 1855 <code class="literal">smbd</code> slave process is spawned for each SMB/CIFS client 1856 connection.</p></div><div class="footnote"><p><sup>[<a name="ftn.id3 30264" href="#id330264">8</a>] </sup>Bench tests have shown that tdbsam is a very1856 connection.</p></div><div class="footnote"><p><sup>[<a name="ftn.id353173" href="#id353173" class="para">8</a>] </sup>Bench tests have shown that tdbsam is a very 1857 1857 effective database technology. There is surprisingly little performance loss even 1858 with over 4000 users.</p></div><div class="footnote"><p><sup>[<a name="ftn.id3 30478" href="#id330478">9</a>] </sup>1859 See <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 9, for more information.</p></div><div class="footnote"><p><sup>[<a name="ftn.id3 30504" href="#id330504">10</a>] </sup>See TOSHARG2, Chapter 9, Section 9.3.3.</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="small.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="ExNetworks.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="Big500users.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 2. Small Office Networking </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 4. The 500-User Office</td></tr></table></div></body></html>1858 with over 4000 users.</p></div><div class="footnote"><p><sup>[<a name="ftn.id353386" href="#id353386" class="para">9</a>] </sup> 1859 See <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 9, for more information.</p></div><div class="footnote"><p><sup>[<a name="ftn.id353412" href="#id353412" class="para">10</a>] </sup>See TOSHARG2, Chapter 9, Section 9.3.3.</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="small.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="ExNetworks.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="Big500users.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 2. Small Office Networking </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 4. The 500-User Office</td></tr></table></div></body></html> -
branches/samba-3.0/docs/htmldocs/Samba3-ByExample/simple.html
r44 r134 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 1. No-Frills Samba Servers</title><link rel="stylesheet" href=" samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="next" href="small.html" title="Chapter 2. Small Office Networking"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 1. No-Frills Samba Servers</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="ExNetworks.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="small.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="simple"></a>Chapter 1. No-Frills Samba Servers</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="simple.html#id316528">Introduction</a></span></dt><dt><span class="sect1"><a href="simple.html#id316559">Assignment Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="simple.html#id316598">Drafting Office</a></span></dt><dt><span class="sect2"><a href="simple.html#id317306">Charity Administration Office</a></span></dt><dt><span class="sect2"><a href="simple.html#AccountingOffice">Accounting Office</a></span></dt></dl></dd><dt><span class="sect1"><a href="simple.html#id320818">Questions and Answers</a></span></dt></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 1. No-Frills Samba Servers</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="next" href="small.html" title="Chapter 2. Small Office Networking"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 1. No-Frills Samba Servers</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="ExNetworks.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="small.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="simple"></a>Chapter 1. No-Frills Samba Servers</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="simple.html#id340660">Introduction</a></span></dt><dt><span class="sect1"><a href="simple.html#id340690">Assignment Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="simple.html#id340728">Drafting Office</a></span></dt><dt><span class="sect2"><a href="simple.html#id341373">Charity Administration Office</a></span></dt><dt><span class="sect2"><a href="simple.html#AccountingOffice">Accounting Office</a></span></dt></dl></dd><dt><span class="sect1"><a href="simple.html#id344496">Questions and Answers</a></span></dt></dl></div><p> 2 2 This is the start of the real journey toward the successful deployment of Samba. For some this chapter 3 3 is the end of the road because their needs will have been adequately met. For others, this chapter is … … 5 5 example configurations of, for the greater part, complete networking solutions. The intent of this book 6 6 is to help you to get your Samba installation working with the least amount of pain and aggravation. 7 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 16528"></a>Introduction</h2></div></div></div><p>7 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id340660"></a>Introduction</h2></div></div></div><p> 8 8 This chapter lays the groundwork for understanding the basics of Samba operation. 9 9 Instead of a bland technical discussion, each principle is demonstrated by way of a 10 real-world scenario for which a working solution<sup>[<a name="id3 16538" href="#ftn.id316538">1</a>]</sup> is fully described.10 real-world scenario for which a working solution<sup>[<a name="id340669" href="#ftn.id340669" class="footnote">1</a>]</sup> is fully described. 11 11 </p><p> 12 12 The practical exercises take you on a journey through a drafting office, a charity administration … … 18 18 you should aim to be a Samba expert, so do attempt to find better solutions and try them as you work your 19 19 way through the examples. 20 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 16559"></a>Assignment Tasks</h2></div></div></div><p>20 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id340690"></a>Assignment Tasks</h2></div></div></div><p> 21 21 Each case presented highlights different aspects of Windows networking for which a simple 22 22 Samba-based solution can be provided. Each has subtly different requirements taken from real-world cases. … … 29 29 </p><p> 30 30 Let's get started. 31 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 16598"></a>Drafting Office</h3></div></div></div><p>31 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id340728"></a>Drafting Office</h3></div></div></div><p> 32 32 Our fictitious company is called <span class="emphasis"><em>Abmas Design, Inc.</em></span> This is a three-person 33 33 computer-aided design (CAD) business that often has more work than can be handled. The … … 39 39 plans from each machine. The files available from the server must remain read-only. 40 40 Anyone should be able to access the plans at any time and without barriers or difficulty. 41 </p><p><a class="indexterm" name="id3 16618"></a>42 <a class="indexterm" name="id3 16625"></a>41 </p><p><a class="indexterm" name="id340747"></a> 42 <a class="indexterm" name="id340753"></a> 43 43 Mr. Bob Jordan has asked you to install the new server as economically as possible. The central 44 44 server has a Pentium-IV 1.6GHz CPU, 768MB RAM, a 20GB IDE boot drive, a 160GB IDE second disk 45 45 to store plans, and a 100-base-T Ethernet card. You have already installed Red Hat Fedora CoreX and 46 46 have upgraded Samba to version 3.0.20 using the RPM package that is provided from the Samba 47 <a href="http://www.samba.org" target="_top">FTP</a> sites. (Note: Fedora CoreX indicates your favorite47 <a class="ulink" href="http://www.samba.org" target="_top">FTP</a> sites. (Note: Fedora CoreX indicates your favorite 48 48 version.) 49 </p><p><a class="indexterm" name="id3 16647"></a>49 </p><p><a class="indexterm" name="id340774"></a> 50 50 The four permanent drafting machines (Microsoft Windows workstations) have attached printers 51 51 and plotters that are shared on a peer-to-peer basis by any and all network users. The intent … … 56 56 machine. The office works best with this arrangement and does not want to change anything. 57 57 Old habits are too ingrained. 58 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 16663"></a>Dissection and Discussion</h4></div></div></div><p>59 <a class="indexterm" name="id3 16671"></a>58 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id340790"></a>Dissection and Discussion</h4></div></div></div><p> 59 <a class="indexterm" name="id340797"></a> 60 60 The requirements for this server installation demand simplicity. An anonymous read-only 61 61 file server adequately meets all needs. The network consultant determines how … … 64 64 </p><p> 65 65 It is not necessary to have specific users on the server. The site has a method for storing 66 all design files (plans). Each plan is stored in a directory that is named YYYYWW,<sup>[<a name="id3 16688" href="#ftn.id316688">2</a>]</sup> where66 all design files (plans). Each plan is stored in a directory that is named YYYYWW,<sup>[<a name="id340813" href="#ftn.id340813" class="footnote">2</a>]</sup> where 67 67 YYYY is the year, and WW is the week of the year. This arrangement allows work to be stored 68 68 by week of year to preserve the filing technique the site is familiar with. … … 74 74 demanding the disk space that would be needed if a duplicate file copy were to be stored. 75 75 The share containing the plans is called <span class="emphasis"><em>Plans</em></span>. 76 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 16708"></a>Implementation</h4></div></div></div><p>76 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id340832"></a>Implementation</h4></div></div></div><p> 77 77 It is assumed that the server is fully installed and ready for installation and 78 78 configuration of Samba 3.0.20 and any support files needed. All TCP/IP addresses … … 80 80 <code class="constant">192.168.1.1</code> and the netmask is <code class="constant">255.255.255.0</code>. 81 81 The hostname of the server used is <code class="constant">server</code>. 82 </p><div class="procedure"><a name="id3 16730"></a><p class="title"><b>Procedure 1.1. Samba Server Configuration</b></p><ol type="1"><li><p>82 </p><div class="procedure"><a name="id340853"></a><p class="title"><b>Procedure 1.1. Samba Server Configuration</b></p><ol type="1"><li><p> 83 83 Download the Samba-3 RPM packages for Red Hat Fedora Core2 from the Samba 84 <a href="http://www.samba.org" target="_top">FTP servers.</a>85 </p></li><li><p> 86 <a class="indexterm" name="id3 16754"></a>87 <a class="indexterm" name="id3 16763"></a>84 <a class="ulink" href="http://www.samba.org" target="_top">FTP servers.</a> 85 </p></li><li><p> 86 <a class="indexterm" name="id340876"></a> 87 <a class="indexterm" name="id340884"></a> 88 88 Install the RPM package using either the Red Hat Linux preferred GUI 89 89 tool or the <code class="literal">rpm</code>: … … 101 101 and execute, and the group and everyone else to read and execute only. 102 102 </p><p> 103 <a class="indexterm" name="id3 16824"></a>103 <a class="indexterm" name="id340940"></a> 104 104 Use Red Hat Linux system tools (refer to Red Hat instructions) 105 105 to format the 160GB hard drive with a suitable file system. An Ext3 file system … … 107 107 directory as the mount point. 108 108 </p></li><li><p> 109 Install the <code class="filename">smb.conf</code> file shown in <a href="simple.html#draft-smbconf" title="Example 1.1. Drafting Office smb.conf File">???</a> in the109 Install the <code class="filename">smb.conf</code> file shown in <a class="link" href="simple.html#draft-smbconf" title="Example 1.1. Drafting Office smb.conf File">“Drafting Office smb.conf File”</a> in the 110 110 <code class="filename">/etc/samba</code> directory. 111 111 112 </p><div class="example"><a name="draft-smbconf"></a><p class="title"><b>Example 1.1. Drafting Office <code class="filename">smb.conf</code> File</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global Parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id3 16899"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id316911"></a><em class="parameter"><code>security = SHARE</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[Plans]</code></em></td></tr><tr><td><a class="indexterm" name="id316933"></a><em class="parameter"><code>path = /plans</code></em></td></tr><tr><td><a class="indexterm" name="id316945"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id316958"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr></table></div></div><p><br class="example-break">113 </p></li><li><p> 114 <a class="indexterm" name="id3 16978"></a>112 </p><div class="example"><a name="draft-smbconf"></a><p class="title"><b>Example 1.1. Drafting Office <code class="filename">smb.conf</code> File</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global Parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id341005"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id341016"></a><em class="parameter"><code>security = SHARE</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[Plans]</code></em></td></tr><tr><td><a class="indexterm" name="id341035"></a><em class="parameter"><code>path = /plans</code></em></td></tr><tr><td><a class="indexterm" name="id341045"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id341055"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr></table></div></div><p><br class="example-break"> 113 </p></li><li><p> 114 <a class="indexterm" name="id341073"></a> 115 115 Verify that the <code class="filename">/etc/hosts</code> file contains the following entry: 116 116 </p><pre class="screen"> … … 119 119 120 120 </p></li><li><p> 121 <a class="indexterm" name="id3 17004"></a>122 <a class="indexterm" name="id3 17013"></a>123 <a class="indexterm" name="id3 17020"></a>121 <a class="indexterm" name="id341096"></a> 122 <a class="indexterm" name="id341104"></a> 123 <a class="indexterm" name="id341111"></a> 124 124 Use the standard system tool to start Samba and to configure it to restart 125 125 automatically at every system reboot. For example, … … 128 128 <code class="prompt">root# </code> /etc/rc.d/init.d/smb restart 129 129 </pre><p> 130 </p></li></ol></div><div class="procedure"><a name="id3 17047"></a><p class="title"><b>Procedure 1.2. Windows Client Configuration</b></p><ol type="1"><li><p>130 </p></li></ol></div><div class="procedure"><a name="id341136"></a><p class="title"><b>Procedure 1.2. Windows Client Configuration</b></p><ol type="1"><li><p> 131 131 Make certain that all clients are set to the same network address range as 132 132 used for the Samba server. For example, one client might have an IP 133 133 address 192.168.1.10. 134 134 </p></li><li><p> 135 <a class="indexterm" name="id3 17067"></a>135 <a class="indexterm" name="id341154"></a> 136 136 Ensure that the netmask used on the Windows clients matches that used 137 137 for the Samba server. All clients must have the same netmask, such as 138 138 255.255.255.0. 139 139 </p></li><li><p> 140 <a class="indexterm" name="id3 17082"></a>140 <a class="indexterm" name="id341168"></a> 141 141 Set the workgroup name on all clients to <code class="constant">MIDEARTH</code>. 142 142 </p></li><li><p> … … 146 146 and that it is possible to open that share to reveal its contents. 147 147 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="validate1"></a>Validation</h4></div></div></div><p> 148 <a class="indexterm" name="id3 17131"></a>148 <a class="indexterm" name="id341212"></a> 149 149 The first priority in validating the new Samba configuration should be to check 150 150 that Samba answers on the loop-back interface. Then it is time to check that Samba … … 152 152 server. 153 153 </p><div class="procedure"><ol type="1"><li><p> 154 <a class="indexterm" name="id3 17148"></a>155 <a class="indexterm" name="id3 17155"></a>156 <a class="indexterm" name="id3 17162"></a>154 <a class="indexterm" name="id341229"></a> 155 <a class="indexterm" name="id341235"></a> 156 <a class="indexterm" name="id341242"></a> 157 157 To check the ability to access the <code class="literal">smbd</code> daemon 158 158 services, execute the following: … … 173 173 MIDEARTH SERVER 174 174 </pre><p> 175 <a class="indexterm" name="id3 17191"></a>176 <a class="indexterm" name="id3 17198"></a>175 <a class="indexterm" name="id341267"></a> 176 <a class="indexterm" name="id341274"></a> 177 177 This indicates that Samba is able to respond on the loopback interface to 178 178 a NULL connection. The <em class="parameter"><code>-U%</code></em> means send an empty … … 189 189 <em class="parameter"><code>guest account</code></em> for all connections. 190 190 </p></li><li><p> 191 <a class="indexterm" name="id3 17246"></a>192 <a class="indexterm" name="id3 17252"></a>191 <a class="indexterm" name="id341318"></a> 192 <a class="indexterm" name="id341325"></a> 193 193 From the Windows 9x/Me client, launch Windows Explorer: 194 194 <span class="guiicon">[Desktop: right-click] Network Neighborhood</span>+<span class="guimenu">Explore</span> → <span class="guimenuitem">[Left Panel] [+] Entire Network</span> → <span class="guimenuitem">[Left Panel] [+] Server</span> → <span class="guimenuitem">[Left Panel] [+] Plans</span>. In the right panel you should see the files and directories 195 195 (folders) that are in the <span class="guiicon">Plans</span> share. 196 </p></li></ol></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 17306"></a>Charity Administration Office</h3></div></div></div><p>196 </p></li></ol></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id341373"></a>Charity Administration Office</h3></div></div></div><p> 197 197 The fictitious charity organization is called <span class="emphasis"><em>Abmas Vision NL</em></span>. This office 198 198 has five networked computers. Staff are all volunteers, staff changes are frequent. … … 217 217 file share. 218 218 </p><p> 219 <a class="indexterm" name="id3 17353"></a>220 <a class="indexterm" name="id3 17360"></a>219 <a class="indexterm" name="id341418"></a> 220 <a class="indexterm" name="id341424"></a> 221 221 Printer handling in Samba results in a significant level of confusion. Samba presents to the 222 222 MS Windows client only a print queue. The Samba <code class="literal">smbd</code> process passes a … … 232 232 used on this network. 233 233 </p><p> 234 <a class="indexterm" name="id3 17386"></a>234 <a class="indexterm" name="id341450"></a> 235 235 The central server was donated by a local computer store. It is a dual processor Pentium-III 236 236 server, has 1GB RAM, a 3-Ware IDE RAID Controller that has four 200GB IDE hard drives, and a … … 243 243 to the printers was accepted. You have supplied SUSE Enterprise Linux Server 9 and 244 244 have upgraded Samba to version 3.0.20. 245 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 17402"></a>Dissection and Discussion</h4></div></div></div><p>246 <a class="indexterm" name="id3 17410"></a>247 <a class="indexterm" name="id3 17416"></a>248 <a class="indexterm" name="id3 17423"></a>249 <a class="indexterm" name="id3 17430"></a>245 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id341464"></a>Dissection and Discussion</h4></div></div></div><p> 246 <a class="indexterm" name="id341472"></a> 247 <a class="indexterm" name="id341478"></a> 248 <a class="indexterm" name="id341484"></a> 249 <a class="indexterm" name="id341491"></a> 250 250 This installation demands simplicity. Frequent turnover of volunteer staff indicates that 251 251 a network environment that requires users to logon might be problematic. It is suggested that the … … 259 259 an inadvertent ACL from overriding actual file permissions. 260 260 </p><p> 261 <a class="indexterm" name="id3 17467"></a>262 <a class="indexterm" name="id3 17474"></a>263 <a class="indexterm" name="id3 17481"></a>261 <a class="indexterm" name="id341523"></a> 262 <a class="indexterm" name="id341529"></a> 263 <a class="indexterm" name="id341536"></a> 264 264 This organization is a prime candidate for Share Mode security. The <em class="parameter"><code>force user</code></em> 265 265 allows all files to be owned by the same user and group. In addition, it would not hurt to 266 266 set SUID and set SGID shared directories. This means that all new files that are created, no matter 267 267 who creates it, are owned by the owner or group of the directory in which they are created. 268 For further information regarding the significance of the SUID/SGID settings, see <a href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">???</a>, <a href="appendix.html#ch12-SUIDSGID" title="Effect of Setting File and Directory SUID/SGID Permissions Explained">???</a>.269 </p><p> 270 <a class="indexterm" name="id3 17515"></a>271 <a class="indexterm" name="id3 17522"></a>272 <a class="indexterm" name="id3 17531"></a>273 <a class="indexterm" name="id3 17538"></a>268 For further information regarding the significance of the SUID/SGID settings, see <a class="link" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">“A Collection of Useful Tidbits”</a>, <a class="link" href="appendix.html#ch12-SUIDSGID" title="Effect of Setting File and Directory SUID/SGID Permissions Explained">“Effect of Setting File and Directory SUID/SGID Permissions Explained”</a>. 269 </p><p> 270 <a class="indexterm" name="id341564"></a> 271 <a class="indexterm" name="id341571"></a> 272 <a class="indexterm" name="id341579"></a> 273 <a class="indexterm" name="id341585"></a> 274 274 All client workstations print to a print queue on the server. This ensures that print jobs 275 275 continue to print in the event that a user shuts down the workstation immediately after … … 278 278 that CUPS has become the leading UNIX printing technology. 279 279 </p><p> 280 <a class="indexterm" name="id3 17552"></a>280 <a class="indexterm" name="id341599"></a> 281 281 The print queues are set up as <code class="constant">Raw</code> devices, which means that CUPS will 282 282 not do intelligent print processing, and vendor-supplied drivers must be installed locally on the … … 298 298 really is just a print queue. The name of the print queue is representative of 299 299 the device to which the print spooler delivers print jobs. 300 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 17589"></a>Implementation</h4></div></div></div><p>300 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id341634"></a>Implementation</h4></div></div></div><p> 301 301 It is assumed that the server is fully installed and ready for configuration of 302 302 Samba 3.0.20 and for necessary support files. All TCP/IP addresses should be hard-coded. 303 303 In our case, the IP address of the Samba server is 192.168.1.1 and the netmask is 304 304 255.255.255.0. The hostname of the server used is <code class="constant">server</code>. 305 The office network is built as shown in <a href="simple.html#charitynet" title="Figure 1.1. Charity Administration Office Network">???</a>.306 </p><div class="figure"><a name="charitynet"></a><p class="title"><b>Figure 1.1. Charity Administration Office Network</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/Charity-Network.png" width="432" alt="Charity Administration Office Network"></div></div></div><br class="figure-break"><div class="procedure"><a name="id3 17651"></a><p class="title"><b>Procedure 1.3. Samba Server Configuration</b></p><ol type="1"><li><p>307 <a class="indexterm" name="id3 17662"></a>305 The office network is built as shown in <a class="link" href="simple.html#charitynet" title="Figure 1.1. Charity Administration Office Network">“Charity Administration Office Network”</a>. 306 </p><div class="figure"><a name="charitynet"></a><p class="title"><b>Figure 1.1. Charity Administration Office Network</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/Charity-Network.png" width="432" alt="Charity Administration Office Network"></div></div></div><br class="figure-break"><div class="procedure"><a name="id341689"></a><p class="title"><b>Procedure 1.3. Samba Server Configuration</b></p><ol type="1"><li><p> 307 <a class="indexterm" name="id341699"></a> 308 308 Create a group account for office file storage: 309 309 </p><pre class="screen"> … … 311 311 </pre><p> 312 312 </p></li><li><p> 313 <a class="indexterm" name="id3 17687"></a>314 <a class="indexterm" name="id3 17694"></a>313 <a class="indexterm" name="id341722"></a> 314 <a class="indexterm" name="id341728"></a> 315 315 Create a user account for office file storage: 316 316 </p><pre class="screen"> … … 329 329 The resulting drive has a capacity of approximately 500GB of usable space. 330 330 </p></li><li><p> 331 <a class="indexterm" name="id3 17736"></a>331 <a class="indexterm" name="id341767"></a> 332 332 Create a mount point for the file system that can be used to store all data files. 333 333 Create a directory called <code class="filename">/data</code>: … … 361 361 /data/officefiles/misc 362 362 </pre><p> 363 <a class="indexterm" name="id3 17847"></a>363 <a class="indexterm" name="id341866"></a> 364 364 The <code class="literal">chown</code> operation sets the owner to the user <code class="constant">abmas</code> 365 365 and the group to <code class="constant">office</code> on all directories just created. It recursively … … 369 369 created. Any new directories created still have the same owner, group, and permissions as the 370 370 directory they are in. This should eliminate all permissions-based file access problems. For 371 more information on this subject, refer to TOSHARG2<sup>[<a name="id3 17872" href="#ftn.id317872">3</a>]</sup> or refer371 more information on this subject, refer to TOSHARG2<sup>[<a name="id341889" href="#ftn.id341889" class="footnote">3</a>]</sup> or refer 372 372 to the UNIX man page for the <code class="literal">chmod</code> and the <code class="literal">chown</code> commands. 373 373 </p></li><li><p> 374 Install the <code class="filename">smb.conf</code> file shown in <a href="simple.html#charity-smbconfnew" title="Example 1.2. Charity Administration Office smb.conf New-style File">???</a> in the374 Install the <code class="filename">smb.conf</code> file shown in <a class="link" href="simple.html#charity-smbconfnew" title="Example 1.2. Charity Administration Office smb.conf New-style File">“Charity Administration Office smb.conf New-style File”</a> in the 375 375 <code class="filename">/etc/samba</code> directory. This newer <code class="filename">smb.conf</code> file uses user-mode security 376 376 and is more suited to the mode of operation of Samba-3 than the older share-mode security … … 378 378 </p><p> 379 379 Note: If you want to use the older-style configuration that uses share-mode security, you 380 can install the file shown in <a href="simple.html#charity-smbconf" title="Example 1.3. Charity Administration Office smb.conf Old-style File">???</a> in the380 can install the file shown in <a class="link" href="simple.html#charity-smbconf" title="Example 1.3. Charity Administration Office smb.conf Old-style File">“Charity Administration Office smb.conf Old-style File”</a> in the 381 381 <code class="filename">/etc/samba</code> directory. 382 382 </p></li><li><p> 383 <a class="indexterm" name="id3 17945"></a>383 <a class="indexterm" name="id341951"></a> 384 384 We must ensure that the <code class="literal">smbd</code> can resolve the name of the Samba 385 385 server to its IP address. Verify that the <code class="filename">/etc/hosts</code> file … … 389 389 </pre><p> 390 390 </p></li><li><p> 391 Configure the printers with the IP address as shown in <a href="simple.html#charitynet" title="Figure 1.1. Charity Administration Office Network">???</a>.391 Configure the printers with the IP address as shown in <a class="link" href="simple.html#charitynet" title="Figure 1.1. Charity Administration Office Network">“Charity Administration Office Network”</a>. 392 392 Follow the instructions in the manufacturer's manual to permit printing to port 9100 393 393 so that the CUPS spooler can print using raw mode protocols. 394 394 </p></li><li><p> 395 <a class="indexterm" name="id3 17991"></a>395 <a class="indexterm" name="id341993"></a> 396 396 Configure the CUPS Print Queues: 397 397 </p><pre class="screen"> … … 401 401 This creates the necessary print queues with no assigned print filter. 402 402 </p></li><li><p> 403 <a class="indexterm" name="id3 18024"></a>404 <a class="indexterm" name="id3 18031"></a>405 <a class="indexterm" name="id3 18038"></a>403 <a class="indexterm" name="id342022"></a> 404 <a class="indexterm" name="id342028"></a> 405 <a class="indexterm" name="id342034"></a> 406 406 Edit the file <code class="filename">/etc/cups/mime.convs</code> to uncomment the line: 407 407 </p><pre class="screen"> … … 409 409 </pre><p> 410 410 </p></li><li><p> 411 <a class="indexterm" name="id3 18064"></a>411 <a class="indexterm" name="id342058"></a> 412 412 Edit the file <code class="filename">/etc/cups/mime.types</code> to uncomment the line: 413 413 </p><pre class="screen"> … … 415 415 </pre><p> 416 416 </p></li><li><p> 417 <a class="indexterm" name="id3 18089"></a>417 <a class="indexterm" name="id342081"></a> 418 418 Use the standard system tool to start Samba and CUPS to configure them to restart 419 419 automatically at every system reboot. For example, 420 420 </p><p> 421 <a class="indexterm" name="id3 18100"></a>422 <a class="indexterm" name="id3 18107"></a>423 <a class="indexterm" name="id3 18114"></a>421 <a class="indexterm" name="id342091"></a> 422 <a class="indexterm" name="id342098"></a> 423 <a class="indexterm" name="id342104"></a> 424 424 </p><pre class="screen"> 425 425 <code class="prompt">root# </code> chkconfig smb on … … 428 428 <code class="prompt">root# </code> /etc/rc.d/init.d/cups restart 429 429 </pre><p> 430 </p></li></ol></div><div class="example"><a name="charity-smbconfnew"></a><p class="title"><b>Example 1.2. Charity Administration Office <code class="filename">smb.conf</code> New-style File</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global Parameters - Newer Configuration</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id3 18186"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id318198"></a><em class="parameter"><code>printing = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id318211"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id318223"></a><em class="parameter"><code>map to guest = Bad User</code></em></td></tr><tr><td><a class="indexterm" name="id318236"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id318248"></a><em class="parameter"><code>wins support = yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[FTMFILES]</code></em></td></tr><tr><td><a class="indexterm" name="id318270"></a><em class="parameter"><code>comment = Funds Tracking & Management Files</code></em></td></tr><tr><td><a class="indexterm" name="id318283"></a><em class="parameter"><code>path = /data/ftmfiles</code></em></td></tr><tr><td><a class="indexterm" name="id318295"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id318308"></a><em class="parameter"><code>force user = abmas</code></em></td></tr><tr><td><a class="indexterm" name="id318320"></a><em class="parameter"><code>force group = office</code></em></td></tr><tr><td><a class="indexterm" name="id318333"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id318345"></a><em class="parameter"><code>nt acl support = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[office]</code></em></td></tr><tr><td><a class="indexterm" name="id318367"></a><em class="parameter"><code>comment = General Office Files</code></em></td></tr><tr><td><a class="indexterm" name="id318380"></a><em class="parameter"><code>path = /data/officefiles</code></em></td></tr><tr><td><a class="indexterm" name="id318392"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id318405"></a><em class="parameter"><code>force user = abmas</code></em></td></tr><tr><td><a class="indexterm" name="id318417"></a><em class="parameter"><code>force group = office</code></em></td></tr><tr><td><a class="indexterm" name="id318430"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id318442"></a><em class="parameter"><code>nt acl support = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id318464"></a><em class="parameter"><code>comment = Print Temporary Spool Configuration</code></em></td></tr><tr><td><a class="indexterm" name="id318477"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id318489"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id318502"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id318514"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id318527"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="charity-smbconf"></a><p class="title"><b>Example 1.3. Charity Administration Office <code class="filename">smb.conf</code> Old-style File</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global Parameters - Older Style Configuration</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id318573"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id318586"></a><em class="parameter"><code>security = SHARE</code></em></td></tr><tr><td><a class="indexterm" name="id318598"></a><em class="parameter"><code>printing = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id318611"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id318623"></a><em class="parameter"><code>disable spoolss = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id318636"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id318649"></a><em class="parameter"><code>wins support = yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[FTMFILES]</code></em></td></tr><tr><td><a class="indexterm" name="id318670"></a><em class="parameter"><code>comment = Funds Tracking & Management Files</code></em></td></tr><tr><td><a class="indexterm" name="id318683"></a><em class="parameter"><code>path = /data/ftmfiles</code></em></td></tr><tr><td><a class="indexterm" name="id318695"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id318708"></a><em class="parameter"><code>force user = abmas</code></em></td></tr><tr><td><a class="indexterm" name="id318720"></a><em class="parameter"><code>force group = office</code></em></td></tr><tr><td><a class="indexterm" name="id318733"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id318746"></a><em class="parameter"><code>nt acl support = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[office]</code></em></td></tr><tr><td><a class="indexterm" name="id318767"></a><em class="parameter"><code>comment = General Office Files</code></em></td></tr><tr><td><a class="indexterm" name="id318780"></a><em class="parameter"><code>path = /data/officefiles</code></em></td></tr><tr><td><a class="indexterm" name="id318792"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id318805"></a><em class="parameter"><code>force user = abmas</code></em></td></tr><tr><td><a class="indexterm" name="id318817"></a><em class="parameter"><code>force group = office</code></em></td></tr><tr><td><a class="indexterm" name="id318830"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id318842"></a><em class="parameter"><code>nt acl support = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id318864"></a><em class="parameter"><code>comment = Print Temporary Spool Configuration</code></em></td></tr><tr><td><a class="indexterm" name="id318877"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id318889"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id318902"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id318914"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id318927"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="procedure"><a name="id318940"></a><p class="title"><b>Procedure 1.4. Windows Client Configuration</b></p><ol type="1"><li><p>431 Configure clients to the network settings shown in <a href="simple.html#charitynet" title="Figure 1.1. Charity Administration Office Network">???</a>.430 </p></li></ol></div><div class="example"><a name="charity-smbconfnew"></a><p class="title"><b>Example 1.2. Charity Administration Office <code class="filename">smb.conf</code> New-style File</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global Parameters - Newer Configuration</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id342168"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id342178"></a><em class="parameter"><code>printing = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id342188"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id342199"></a><em class="parameter"><code>map to guest = Bad User</code></em></td></tr><tr><td><a class="indexterm" name="id342209"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id342220"></a><em class="parameter"><code>wins support = yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[FTMFILES]</code></em></td></tr><tr><td><a class="indexterm" name="id342238"></a><em class="parameter"><code>comment = Funds Tracking & Management Files</code></em></td></tr><tr><td><a class="indexterm" name="id342249"></a><em class="parameter"><code>path = /data/ftmfiles</code></em></td></tr><tr><td><a class="indexterm" name="id342259"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id342270"></a><em class="parameter"><code>force user = abmas</code></em></td></tr><tr><td><a class="indexterm" name="id342280"></a><em class="parameter"><code>force group = office</code></em></td></tr><tr><td><a class="indexterm" name="id342290"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id342301"></a><em class="parameter"><code>nt acl support = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[office]</code></em></td></tr><tr><td><a class="indexterm" name="id342320"></a><em class="parameter"><code>comment = General Office Files</code></em></td></tr><tr><td><a class="indexterm" name="id342330"></a><em class="parameter"><code>path = /data/officefiles</code></em></td></tr><tr><td><a class="indexterm" name="id342340"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id342351"></a><em class="parameter"><code>force user = abmas</code></em></td></tr><tr><td><a class="indexterm" name="id342361"></a><em class="parameter"><code>force group = office</code></em></td></tr><tr><td><a class="indexterm" name="id342372"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id342382"></a><em class="parameter"><code>nt acl support = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id342401"></a><em class="parameter"><code>comment = Print Temporary Spool Configuration</code></em></td></tr><tr><td><a class="indexterm" name="id342411"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id342422"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id342432"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id342442"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id342453"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="charity-smbconf"></a><p class="title"><b>Example 1.3. Charity Administration Office <code class="filename">smb.conf</code> Old-style File</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global Parameters - Older Style Configuration</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id342494"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id342504"></a><em class="parameter"><code>security = SHARE</code></em></td></tr><tr><td><a class="indexterm" name="id342514"></a><em class="parameter"><code>printing = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id342525"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id342535"></a><em class="parameter"><code>disable spoolss = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id342546"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id342556"></a><em class="parameter"><code>wins support = yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[FTMFILES]</code></em></td></tr><tr><td><a class="indexterm" name="id342575"></a><em class="parameter"><code>comment = Funds Tracking & Management Files</code></em></td></tr><tr><td><a class="indexterm" name="id342585"></a><em class="parameter"><code>path = /data/ftmfiles</code></em></td></tr><tr><td><a class="indexterm" name="id342596"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id342606"></a><em class="parameter"><code>force user = abmas</code></em></td></tr><tr><td><a class="indexterm" name="id342616"></a><em class="parameter"><code>force group = office</code></em></td></tr><tr><td><a class="indexterm" name="id342627"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id342637"></a><em class="parameter"><code>nt acl support = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[office]</code></em></td></tr><tr><td><a class="indexterm" name="id342656"></a><em class="parameter"><code>comment = General Office Files</code></em></td></tr><tr><td><a class="indexterm" name="id342666"></a><em class="parameter"><code>path = /data/officefiles</code></em></td></tr><tr><td><a class="indexterm" name="id342677"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id342687"></a><em class="parameter"><code>force user = abmas</code></em></td></tr><tr><td><a class="indexterm" name="id342698"></a><em class="parameter"><code>force group = office</code></em></td></tr><tr><td><a class="indexterm" name="id342708"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id342718"></a><em class="parameter"><code>nt acl support = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id342737"></a><em class="parameter"><code>comment = Print Temporary Spool Configuration</code></em></td></tr><tr><td><a class="indexterm" name="id342748"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id342758"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id342768"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id342779"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id342789"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="procedure"><a name="id342801"></a><p class="title"><b>Procedure 1.4. Windows Client Configuration</b></p><ol type="1"><li><p> 431 Configure clients to the network settings shown in <a class="link" href="simple.html#charitynet" title="Figure 1.1. Charity Administration Office Network">“Charity Administration Office Network”</a>. 432 432 </p></li><li><p> 433 433 Ensure that the netmask used on the Windows clients matches that used … … 435 435 <code class="constant">255.255.255.0</code>. 436 436 </p></li><li><p> 437 <a class="indexterm" name="id3 18976"></a>437 <a class="indexterm" name="id342833"></a> 438 438 On all Windows clients, set the WINS Server address to <code class="constant">192.168.1.1</code>, 439 439 the IP address of the server. … … 441 441 Set the workgroup name on all clients to <code class="constant">MIDEARTH</code>. 442 442 </p></li><li><p> 443 <a class="indexterm" name="id3 19005"></a>443 <a class="indexterm" name="id342859"></a> 444 444 Install the “<span class="quote">Client for Microsoft Networks.</span>” Ensure that the only option 445 445 enabled in its properties is the option “<span class="quote">Logon and restore network connections.</span>” … … 448 448 system, then log on using any username and password you choose. 449 449 </p></li><li><p> 450 <a class="indexterm" name="id3 19040"></a>450 <a class="indexterm" name="id342892"></a> 451 451 Verify on each client that the machine called <code class="constant">SERVER</code> 452 452 is visible in <span class="guimenu">My Network Places</span>, that it is … … 454 454 and that it is possible to open that share to reveal its contents. 455 455 </p></li><li><p> 456 <a class="indexterm" name="id3 19071"></a>457 <a class="indexterm" name="id3 19077"></a>456 <a class="indexterm" name="id342919"></a> 457 <a class="indexterm" name="id342925"></a> 458 458 Disable password caching on all Windows 9x/Me machines using the registry change file 459 shown in <a href="simple.html#MEreg" title="Example 1.4. Windows Me Registry Edit File: Disable Password Caching">???</a>. Be sure to remove all files that have the459 shown in <a class="link" href="simple.html#MEreg" title="Example 1.4. Windows Me Registry Edit File: Disable Password Caching">“Windows Me Registry Edit File: Disable Password Caching”</a>. Be sure to remove all files that have the 460 460 <code class="filename">PWL</code> extension that are in the <code class="filename">C:\WINDOWS</code> 461 461 directory. … … 533 533 handing the newly configured network over to the Charity Administration Office 534 534 for production use. 535 </p></li></ol></div></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 19497"></a>Validation</h4></div></div></div><p>536 Use the same validation process as was followed in <a href="simple.html#validate1" title="Validation">???</a>.535 </p></li></ol></div></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id343306"></a>Validation</h4></div></div></div><p> 536 Use the same validation process as was followed in <a class="link" href="simple.html#validate1" title="Validation">“Validation”</a>. 537 537 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="AccountingOffice"></a>Accounting Office</h3></div></div></div><p> 538 538 Abmas Accounting is a 40-year-old family-run business. There are nine permanent … … 552 552 on the server. 553 553 </p><p> 554 <a class="indexterm" name="id3 19546"></a>554 <a class="indexterm" name="id343354"></a> 555 555 The new server will run Red Hat Fedora Core2. You should install Samba-3.0.20 and 556 556 copy all files from the old system to the new one. The existing Windows NT4 server has a parallel … … 562 562 He believes that Windows for Workgroups 3.11 was “<span class="quote">the best server Microsoft ever sold 563 563 </span>” and that Windows NT and 2000 are “<span class="quote">too fang-dangled complex!</span>” 564 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 19572"></a>Dissection and Discussion</h4></div></div></div><p>565 <a class="indexterm" name="id3 19580"></a>564 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id343378"></a>Dissection and Discussion</h4></div></div></div><p> 565 <a class="indexterm" name="id343386"></a> 566 566 The requirements of this network installation are not unusual. The staff are not interested in the 567 567 details of networking. Passwords are never changed. In this example solution, we demonstrate the use … … 580 580 </p><p> 581 581 The core information regarding the users, their passwords, the directory share point, and the 582 share name is given in <a href="simple.html#acctingnet" title="Table 1.1. Accounting Office Network Information">???</a>. The overall network topology is shown in583 <a href="simple.html#acctingnet2" title="Figure 1.2. Accounting Office Network Topology">???</a>. All machines have been configured as indicated prior to the582 share name is given in <a class="link" href="simple.html#acctingnet" title="Table 1.1. Accounting Office Network Information">“Accounting Office Network Information”</a>. The overall network topology is shown in 583 <a class="link" href="simple.html#acctingnet2" title="Figure 1.2. Accounting Office Network Topology">“Accounting Office Network Topology”</a>. All machines have been configured as indicated prior to the 584 584 start of Samba configuration. The following prescriptive steps may now commence. 585 </p><div class="figure"><a name="acctingnet2"></a><p class="title"><b>Figure 1.2. Accounting Office Network Topology</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/AccountingNetwork.png" width="459" alt="Accounting Office Network Topology"></div></div></div><br class="figure-break"><div class="table"><a name="acctingnet"></a><p class="title"><b>Table 1.1. Accounting Office Network Information</b></p><div class="table-contents"><table summary="Accounting Office Network Information" border="1"><colgroup><col align="left"><col align="left"><col align="left"><col align="left"><col align="left"><col align="left"></colgroup><thead><tr><th align="left">User</th><th align="left">Login-ID</th><th align="left">Password</th><th align="left">Share Name</th><th align="left">Directory</th><th align="left">Wkst</th></tr></thead><tbody><tr><td align="left">Alan Meany</td><td align="left">alan</td><td align="left">alm1961</td><td align="left">alan</td><td align="left">/data</td><td align="left">PC1</td></tr><tr><td align="left">James Meany</td><td align="left">james</td><td align="left">jimm1962</td><td align="left">james</td><td align="left">/data/james</td><td align="left">PC2</td></tr><tr><td align="left">Jeannie Meany</td><td align="left">jeannie</td><td align="left">jema1965</td><td align="left">jeannie</td><td align="left">/data/jeannie</td><td align="left">PC3</td></tr><tr><td align="left">Suzy Millicent</td><td align="left">suzy</td><td align="left">suzy1967</td><td align="left">suzy</td><td align="left">/data/suzy</td><td align="left">PC4</td></tr><tr><td align="left">Ursula Jenning</td><td align="left">ujen</td><td align="left">ujen1974</td><td align="left">ursula</td><td align="left">/data/ursula</td><td align="left">PC5</td></tr><tr><td align="left">Peter Pan</td><td align="left">peter</td><td align="left">pete1984</td><td align="left">peter</td><td align="left">/data/peter</td><td align="left">PC6</td></tr><tr><td align="left">Dale Roland</td><td align="left">dale</td><td align="left">dale1986</td><td align="left">dale</td><td align="left">/data/dale</td><td align="left">PC7</td></tr><tr><td align="left">Bertrand E Paoletti</td><td align="left">eric</td><td align="left">eric1993</td><td align="left">eric</td><td align="left">/data/eric</td><td align="left">PC8</td></tr><tr><td align="left">Russell Lewis</td><td align="left">russ</td><td align="left">russ2001</td><td align="left">russell</td><td align="left">/data/russell</td><td align="left">PC9</td></tr></tbody></table></div></div><br class="table-break"><div class="procedure"><a name="id3 19964"></a><p class="title"><b>Procedure 1.5. Migration from Windows NT4 Workstation System to Samba-3</b></p><ol type="1"><li><p><a class="indexterm" name="id319975"></a>585 </p><div class="figure"><a name="acctingnet2"></a><p class="title"><b>Figure 1.2. Accounting Office Network Topology</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/AccountingNetwork.png" width="459" alt="Accounting Office Network Topology"></div></div></div><br class="figure-break"><div class="table"><a name="acctingnet"></a><p class="title"><b>Table 1.1. Accounting Office Network Information</b></p><div class="table-contents"><table summary="Accounting Office Network Information" border="1"><colgroup><col align="left"><col align="left"><col align="left"><col align="left"><col align="left"><col align="left"></colgroup><thead><tr><th align="left">User</th><th align="left">Login-ID</th><th align="left">Password</th><th align="left">Share Name</th><th align="left">Directory</th><th align="left">Wkst</th></tr></thead><tbody><tr><td align="left">Alan Meany</td><td align="left">alan</td><td align="left">alm1961</td><td align="left">alan</td><td align="left">/data</td><td align="left">PC1</td></tr><tr><td align="left">James Meany</td><td align="left">james</td><td align="left">jimm1962</td><td align="left">james</td><td align="left">/data/james</td><td align="left">PC2</td></tr><tr><td align="left">Jeannie Meany</td><td align="left">jeannie</td><td align="left">jema1965</td><td align="left">jeannie</td><td align="left">/data/jeannie</td><td align="left">PC3</td></tr><tr><td align="left">Suzy Millicent</td><td align="left">suzy</td><td align="left">suzy1967</td><td align="left">suzy</td><td align="left">/data/suzy</td><td align="left">PC4</td></tr><tr><td align="left">Ursula Jenning</td><td align="left">ujen</td><td align="left">ujen1974</td><td align="left">ursula</td><td align="left">/data/ursula</td><td align="left">PC5</td></tr><tr><td align="left">Peter Pan</td><td align="left">peter</td><td align="left">pete1984</td><td align="left">peter</td><td align="left">/data/peter</td><td align="left">PC6</td></tr><tr><td align="left">Dale Roland</td><td align="left">dale</td><td align="left">dale1986</td><td align="left">dale</td><td align="left">/data/dale</td><td align="left">PC7</td></tr><tr><td align="left">Bertrand E Paoletti</td><td align="left">eric</td><td align="left">eric1993</td><td align="left">eric</td><td align="left">/data/eric</td><td align="left">PC8</td></tr><tr><td align="left">Russell Lewis</td><td align="left">russ</td><td align="left">russ2001</td><td align="left">russell</td><td align="left">/data/russell</td><td align="left">PC9</td></tr></tbody></table></div></div><br class="table-break"><div class="procedure"><a name="id343742"></a><p class="title"><b>Procedure 1.5. Migration from Windows NT4 Workstation System to Samba-3</b></p><ol type="1"><li><p><a class="indexterm" name="id343753"></a> 586 586 Rename the old server from <code class="constant">CASHPOOL</code> to <code class="constant">STABLE</code> 587 587 by logging onto the console as the <code class="constant">Administrator</code>. Restart the machine … … 594 594 Samba FTP site. 595 595 </p></li><li><p> 596 <a class="indexterm" name="id3 20021"></a>597 <a class="indexterm" name="id3 20028"></a>596 <a class="indexterm" name="id343795"></a> 597 <a class="indexterm" name="id343801"></a> 598 598 Add a group account for the office to use. Execute the following: 599 599 </p><pre class="screen"> … … 601 601 </pre><p> 602 602 </p></li><li><p> 603 Install the <code class="filename">smb.conf</code> file shown<sup>[<a name="id3 20060" href="#ftn.id320060">4</a>]</sup>604 in <a href="simple.html#acctconf" title="Example 1.5. Accounting Office Network smb.conf Old Style Configuration File">???</a>.605 </p></li><li><p> 606 <a class="indexterm" name="id3 20096"></a>607 <a class="indexterm" name="id3 20103"></a>608 <a class="indexterm" name="id3 20110"></a>609 For each user who uses this system (see <a href="simple.html#acctingnet" title="Table 1.1. Accounting Office Network Information">???</a>),603 Install the <code class="filename">smb.conf</code> file shown<sup>[<a name="id343830" href="#ftn.id343830" class="footnote">4</a>]</sup> 604 in <a class="link" href="simple.html#acctconf" title="Example 1.5. Accounting Office Network smb.conf Old Style Configuration File">“Accounting Office Network smb.conf Old Style Configuration File”</a>. 605 </p></li><li><p> 606 <a class="indexterm" name="id343861"></a> 607 <a class="indexterm" name="id343867"></a> 608 <a class="indexterm" name="id343873"></a> 609 For each user who uses this system (see <a class="link" href="simple.html#acctingnet" title="Table 1.1. Accounting Office Network Information">“Accounting Office Network Information”</a>), 610 610 execute the following: 611 611 </p><pre class="screen"> … … 621 621 </pre><p> 622 622 </p></li><li><p> 623 <a class="indexterm" name="id3 20158"></a>623 <a class="indexterm" name="id343916"></a> 624 624 Create the directory structure for the file shares by executing the following: 625 625 </p><pre class="screen"> … … 636 636 The data storage structure is now prepared for use. 637 637 </p></li><li><p> 638 <a class="indexterm" name="id3 20209"></a>638 <a class="indexterm" name="id343962"></a> 639 639 Configure the CUPS Print Queues: 640 640 </p><pre class="screen"> … … 643 643 This creates the necessary print queues with no assigned print filter. 644 644 </p></li><li><p> 645 <a class="indexterm" name="id3 20235"></a>646 <a class="indexterm" name="id3 20242"></a>645 <a class="indexterm" name="id343986"></a> 646 <a class="indexterm" name="id343992"></a> 647 647 Edit the file <code class="filename">/etc/cups/mime.convs</code> to uncomment the line: 648 648 </p><pre class="screen"> … … 650 650 </pre><p> 651 651 </p></li><li><p> 652 <a class="indexterm" name="id3 20268"></a>653 <a class="indexterm" name="id3 20274"></a>652 <a class="indexterm" name="id344015"></a> 653 <a class="indexterm" name="id344022"></a> 654 654 Edit the file <code class="filename">/etc/cups/mime.types</code> to uncomment the line: 655 655 </p><pre class="screen"> … … 657 657 </pre><p> 658 658 </p></li><li><p> 659 <a class="indexterm" name="id3 20300"></a>659 <a class="indexterm" name="id344045"></a> 660 660 Use the standard system tool to start Samba and CUPS to configure them to restart 661 661 automatically at every system reboot. For example, 662 662 </p><p> 663 <a class="indexterm" name="id3 20312"></a>664 <a class="indexterm" name="id3 20318"></a>665 <a class="indexterm" name="id3 20325"></a>663 <a class="indexterm" name="id344055"></a> 664 <a class="indexterm" name="id344062"></a> 665 <a class="indexterm" name="id344068"></a> 666 666 </p><pre class="screen"> 667 667 <code class="prompt">root# </code> chkconfig smb on … … 708 708 For this, you should make sure all applications, including printing, work before asking the 709 709 customer to test drive the new network. 710 </p></li></ol></div><div class="example"><a name="acctconf"></a><p class="title"><b>Example 1.5. Accounting Office Network <code class="filename">smb.conf</code> Old Style Configuration File</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id3 20561"></a><em class="parameter"><code>workgroup = BILLMORE</code></em></td></tr><tr><td><a class="indexterm" name="id320574"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id320586"></a><em class="parameter"><code>disable spoolss = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id320599"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id320611"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[files]</code></em></td></tr><tr><td><a class="indexterm" name="id320633"></a><em class="parameter"><code>comment = Work area files</code></em></td></tr><tr><td><a class="indexterm" name="id320646"></a><em class="parameter"><code>path = /data/%U</code></em></td></tr><tr><td><a class="indexterm" name="id320658"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[master]</code></em></td></tr><tr><td><a class="indexterm" name="id320680"></a><em class="parameter"><code>comment = Master work area files</code></em></td></tr><tr><td><a class="indexterm" name="id320692"></a><em class="parameter"><code>path = /data</code></em></td></tr><tr><td><a class="indexterm" name="id320705"></a><em class="parameter"><code>valid users = alan</code></em></td></tr><tr><td><a class="indexterm" name="id320717"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id320739"></a><em class="parameter"><code>comment = Print Temporary Spool Configuration</code></em></td></tr><tr><td><a class="indexterm" name="id320752"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id320764"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id320777"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id320789"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id320802"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id320818"></a>Questions and Answers</h2></div></div></div><p>710 </p></li></ol></div><div class="example"><a name="acctconf"></a><p class="title"><b>Example 1.5. Accounting Office Network <code class="filename">smb.conf</code> Old Style Configuration File</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id344279"></a><em class="parameter"><code>workgroup = BILLMORE</code></em></td></tr><tr><td><a class="indexterm" name="id344290"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id344300"></a><em class="parameter"><code>disable spoolss = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id344310"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id344321"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[files]</code></em></td></tr><tr><td><a class="indexterm" name="id344340"></a><em class="parameter"><code>comment = Work area files</code></em></td></tr><tr><td><a class="indexterm" name="id344350"></a><em class="parameter"><code>path = /data/%U</code></em></td></tr><tr><td><a class="indexterm" name="id344360"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[master]</code></em></td></tr><tr><td><a class="indexterm" name="id344379"></a><em class="parameter"><code>comment = Master work area files</code></em></td></tr><tr><td><a class="indexterm" name="id344390"></a><em class="parameter"><code>path = /data</code></em></td></tr><tr><td><a class="indexterm" name="id344400"></a><em class="parameter"><code>valid users = alan</code></em></td></tr><tr><td><a class="indexterm" name="id344410"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id344429"></a><em class="parameter"><code>comment = Print Temporary Spool Configuration</code></em></td></tr><tr><td><a class="indexterm" name="id344440"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id344450"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id344460"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id344471"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id344481"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id344496"></a>Questions and Answers</h2></div></div></div><p> 711 711 The following questions and answers draw from the examples in this chapter. 712 712 Many design decisions are impacted by the configurations chosen. The intent 713 713 is to expose some of the hidden implications. 714 </p><div class="qandaset"><dl><dt> <a href="simple.html#id3 20836">714 </p><div class="qandaset"><dl><dt> <a href="simple.html#id344512"> 715 715 What makes an anonymous Samba server more simple than a non-anonymous Samba server? 716 </a></dt><dt> <a href="simple.html#id3 20859">716 </a></dt><dt> <a href="simple.html#id344535"> 717 717 How is the operation of the parameter force user different from 718 718 setting the root directory of the share SUID? 719 </a></dt><dt> <a href="simple.html#id3 20906">719 </a></dt><dt> <a href="simple.html#id344580"> 720 720 When would you both use the per share parameter force user and set 721 721 the share root directory SUID? 722 </a></dt><dt> <a href="simple.html#id3 20931">722 </a></dt><dt> <a href="simple.html#id344603"> 723 723 What is better about CUPS printing than LPRng printing? 724 </a></dt><dt> <a href="simple.html#id3 20964">724 </a></dt><dt> <a href="simple.html#id344636"> 725 725 When should Windows client IP addresses be hard-coded? 726 </a></dt><dt> <a href="simple.html#id3 20985">726 </a></dt><dt> <a href="simple.html#id344658"> 727 727 Under what circumstances is it best to use a DHCP server? 728 </a></dt><dt> <a href="simple.html#id3 21016">728 </a></dt><dt> <a href="simple.html#id344688"> 729 729 What is the purpose of setting the parameter guest ok on a share? 730 </a></dt><dt> <a href="simple.html#id3 21040">730 </a></dt><dt> <a href="simple.html#id344711"> 731 731 When would you set the global parameter disable spoolss? 732 </a></dt><dt> <a href="simple.html#id3 21120">732 </a></dt><dt> <a href="simple.html#id344780"> 733 733 Why would you disable password caching on Windows 9x/Me clients? 734 </a></dt><dt> <a href="simple.html#id3 21140">734 </a></dt><dt> <a href="simple.html#id344801"> 735 735 The example of Abmas Accounting uses User Mode security. How does this provide anonymous access? 736 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id3 20836"></a><a name="id320838"></a></td><td align="left" valign="top"><p>736 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id344512"></a><a name="id344515"></a></td><td align="left" valign="top"><p> 737 737 What makes an anonymous Samba server more simple than a non-anonymous Samba server? 738 738 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 741 741 UNIX system and to the Samba configuration. Non-anonymous servers require additional 742 742 administration. 743 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 20859"></a><a name="id320861"></a></td><td align="left" valign="top"><p>743 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id344535"></a><a name="id344537"></a></td><td align="left" valign="top"><p> 744 744 How is the operation of the parameter <em class="parameter"><code>force user</code></em> different from 745 745 setting the root directory of the share SUID? … … 755 755 The parameter <em class="parameter"><code>force user</code></em> has potential security implications that go 756 756 beyond the actual share root directory. Be careful and wary of using this parameter. 757 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 20906"></a><a name="id320908"></a></td><td align="left" valign="top"><p>757 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id344580"></a><a name="id344582"></a></td><td align="left" valign="top"><p> 758 758 When would you both use the per share parameter <em class="parameter"><code>force user</code></em> and set 759 759 the share root directory SUID? … … 762 762 are conducted as the forced user, while all file and directory creation are done as the SUID 763 763 directory owner. 764 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 20931"></a><a name="id320933"></a></td><td align="left" valign="top"><p>764 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id344603"></a><a name="id344605"></a></td><td align="left" valign="top"><p> 765 765 What is better about CUPS printing than LPRng printing? 766 766 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 780 780 Which spooling system is better is a matter of personal taste. It depends on what you want to do and how you want to 781 781 do it and manage it. Most modern Linux systems ship with CUPS as the default print management system. 782 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 20964"></a><a name="id320966"></a></td><td align="left" valign="top"><p>782 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id344636"></a><a name="id344639"></a></td><td align="left" valign="top"><p> 783 783 When should Windows client IP addresses be hard-coded? 784 784 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 789 789 for a DHCP server. This reduces maintenance overheads and eliminates a possible point of network 790 790 failure. 791 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 20985"></a><a name="id320988"></a></td><td align="left" valign="top"><p>791 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id344658"></a><a name="id344660"></a></td><td align="left" valign="top"><p> 792 792 Under what circumstances is it best to use a DHCP server? 793 793 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 805 805 assigned IP addresses with the DNS server. The benefits of Dynamic DNS (DDNS) are considerable in 806 806 a large Windows network environment. 807 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 21016"></a><a name="id321018"></a></td><td align="left" valign="top"><p>807 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id344688"></a><a name="id344691"></a></td><td align="left" valign="top"><p> 808 808 What is the purpose of setting the parameter <em class="parameter"><code>guest ok</code></em> on a share? 809 809 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 810 810 If this parameter is set to yes for a service, then no password is required to connect to the service. 811 811 Privileges are those of the guest account. 812 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 21040"></a><a name="id321042"></a></td><td align="left" valign="top"><p>812 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id344711"></a><a name="id344713"></a></td><td align="left" valign="top"><p> 813 813 When would you set the global parameter <em class="parameter"><code>disable spoolss</code></em>? 814 814 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 834 834 (even though jobs may be printed successfully). This parameter MUST not be enabled on a print share that has a valid 835 835 print driver installed on the Samba server. 836 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 21120"></a><a name="id321122"></a></td><td align="left" valign="top"><p>836 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id344780"></a><a name="id344783"></a></td><td align="left" valign="top"><p> 837 837 Why would you disable password caching on Windows 9x/Me clients? 838 838 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 841 841 machine) and decrypted, thus revealing the user's access credentials for all systems the user may have accessed. 842 842 It is most insecure to allow any Windows 9x/Me client to operate with password caching enabled. 843 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 21140"></a><a name="id321142"></a></td><td align="left" valign="top"><p>843 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id344801"></a><a name="id344803"></a></td><td align="left" valign="top"><p> 844 844 The example of Abmas Accounting uses User Mode security. How does this provide anonymous access? 845 845 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 849 849 password are the same as those set on the Samba server, access is transparent and does not require 850 850 separate user authentication. 851 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id3 16538" href="#id316538">1</a>] </sup>The examples given mirror those documented851 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id340669" href="#id340669" class="para">1</a>] </sup>The examples given mirror those documented 852 852 in The Official Samba-3 HOWTO and Reference Guide, Second Edition (TOSHARG2) Chapter 2, Section 2.3.1. You may gain additional 853 853 insight from the standalone server configurations covered in TOSHARG2, sections 2.3.1.2 through 2.3.1.4. 854 </p></div><div class="footnote"><p><sup>[<a name="ftn.id3 16688" href="#id316688">2</a>] </sup>854 </p></div><div class="footnote"><p><sup>[<a name="ftn.id340813" href="#id340813" class="para">2</a>] </sup> 855 855 This information is given purely as an example of how data may be stored in such a way that it 856 856 will be easy to locate records at a later date. The example is not meant to imply any instructions 857 857 that may be construed as essential to the design of the solution; this is something you will almost 858 certainly want to determine for yourself.</p></div><div class="footnote"></div><div class="footnote"><p><sup>[<a name="ftn.id3 20060" href="#id320060">4</a>] </sup>This example uses the858 certainly want to determine for yourself.</p></div><div class="footnote"></div><div class="footnote"><p><sup>[<a name="ftn.id343830" href="#id343830" class="para">4</a>] </sup>This example uses the 859 859 <em class="parameter"><code>smbpasswd</code></em> file in an obtuse way, since the use of 860 860 the <em class="parameter"><code>passdb backend</code></em> has not been specified in the <code class="filename">smb.conf</code> -
branches/samba-3.0/docs/htmldocs/Samba3-ByExample/small.html
r44 r134 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 2. Small Office Networking</title><link rel="stylesheet" href=" samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="simple.html" title="Chapter 1. No-Frills Samba Servers"><link rel="next" href="secure.html" title="Chapter 3. Secure Office Networking"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 2. Small Office Networking</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="simple.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="secure.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="small"></a>Chapter 2. Small Office Networking</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="small.html#id321229">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id321247">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id321293">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id321342">Technical Issues</a></span></dt><dt><span class="sect2"><a href="small.html#id321528">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id321546">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id323199">Validation</a></span></dt><dt><span class="sect2"><a href="small.html#id323822">Notebook Computers: A Special Case</a></span></dt><dt><span class="sect2"><a href="small.html#id323841">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id323907">Questions and Answers</a></span></dt></dl></div><p>2 <a href="simple.html" title="Chapter 1. No-Frills Samba Servers">???</a> focused on the basics of simple yet effective3 network solutions. Network administrators who take pride in their work 4 (that's most of us, right?) take care to deliver what our users want, 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 2. Small Office Networking</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="simple.html" title="Chapter 1. No-Frills Samba Servers"><link rel="next" href="secure.html" title="Chapter 3. Secure Office Networking"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 2. Small Office Networking</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="simple.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="secure.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="small"></a>Chapter 2. Small Office Networking</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="small.html#id344880">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id344898">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id344943">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id344988">Technical Issues</a></span></dt><dt><span class="sect2"><a href="small.html#id345160">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id345178">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id346626">Validation</a></span></dt><dt><span class="sect2"><a href="small.html#id347201">Notebook Computers: A Special Case</a></span></dt><dt><span class="sect2"><a href="small.html#id347221">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id347285">Questions and Answers</a></span></dt></dl></div><p> 2 <a class="link" href="simple.html" title="Chapter 1. No-Frills Samba Servers">“No-Frills Samba Servers”</a> focused on the basics of simple yet effective 3 network solutions. Network administrators who take pride in their work 4 (that's most of us, right?) take care to deliver what our users want, 5 5 but not too much more. If we make things too complex, we confound our users 6 and increase costs of network ownership. A professional network manager 7 avoids the temptation to put too much pizazz into the way that the network 6 and increase costs of network ownership. A professional network manager 7 avoids the temptation to put too much pizazz into the way that the network 8 8 operates. Some creativity is helpful, but keep it under control 9 9 good advice that the following two scenarios illustrate. 10 10 </p><p> 11 <a class="indexterm" name="id3 21194"></a>11 <a class="indexterm" name="id344851"></a> 12 12 In one case the network administrator of a mid-sized company spent three 13 13 months building a new network to replace an old Netware server. What he … … 37 37 sleeves for when you need them.</span>” Was he smart? You decide. Let's 38 38 get on with our next exercise. 39 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 21229"></a>Introduction</h2></div></div></div><p>39 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id344880"></a>Introduction</h2></div></div></div><p> 40 40 Abmas Accounting has grown. Mr. Meany likes you and says he knew you 41 41 were the right person for the job. That's why he asked you to install the … … 45 45 network without any problems. 46 46 </p><p> 47 Some of the Windows clients are nearly past their use-by date. 48 You found damaged and unusable software on some of the workstations 49 that came with the acquired business and found some machines 50 in need of both hardware and software maintenance. 51 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id321247"></a>Assignment Tasks</h3></div></div></div><p> 52 <a class="indexterm" name="id321255"></a> 47 Some of the Windows clients are nearly past their use-by date. You found damaged and unusable software on 48 some of the workstations that came with the acquired business and found some machines in need of both 49 hardware and software maintenance. 50 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id344898"></a>Assignment Tasks</h3></div></div></div><p> 51 <a class="indexterm" name="id344905"></a> 53 52 Mr. Meany is retiring in 12 months. Before he goes, he wants you to help ensure 54 53 that the business is running efficiently. Many of the new staff want notebook … … 82 81 user accounts from the Windows desktop. That person will be responsible for 83 82 basic operations. 84 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 21293"></a>Dissection and Discussion</h2></div></div></div><p>83 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id344943"></a>Dissection and Discussion</h2></div></div></div><p> 85 84 What are the key requirements in this business example? A quick review indicates 86 85 a need for … … 89 88 </p></li><li><p> 90 89 Mobile computing capability 91 <a class="indexterm" name="id3 21314"></a>90 <a class="indexterm" name="id344963"></a> 92 91 </p></li><li><p> 93 92 Improved reliability and usability … … 95 94 Easier administration 96 95 </p></li></ul></div><p> 97 In this instance the installed Linux system is assumed to be a Red Hat Linux Fedora Core2 server 98 (as in <a href="simple.html#AccountingOffice" title="Accounting Office">???</a>).99 100 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 21342"></a>Technical Issues</h3></div></div></div><p>101 <a class="indexterm" name="id3 21350"></a>102 <a class="indexterm" name="id3 21357"></a>103 <a class="indexterm" name="id3 21364"></a>104 <a class="indexterm" name="id3 21370"></a>105 <a class="indexterm" name="id3 21377"></a>96 In this instance the installed Linux system is assumed to be a Red Hat Linux Fedora Core2 server 97 (as in <a class="link" href="simple.html#AccountingOffice" title="Accounting Office">“Accounting Office”</a>). 98 99 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id344988"></a>Technical Issues</h3></div></div></div><p> 100 <a class="indexterm" name="id344995"></a> 101 <a class="indexterm" name="id345002"></a> 102 <a class="indexterm" name="id345008"></a> 103 <a class="indexterm" name="id345014"></a> 104 <a class="indexterm" name="id345020"></a> 106 105 It is time to implement a domain security environment. You will use the <code class="constant"> 107 106 smbpasswd</code> (default) backend. You should implement a DHCP server. There is no need to … … 109 108 BILLMORE</code>. This time, the name of the server will be <code class="constant">SLEETH</code>. 110 109 </p><p> 111 All printers will be configured as DHCP clients. The DHCP server will assign 110 All printers will be configured as DHCP clients. The DHCP server will assign 112 111 the printer a fixed IP address by way of its Ethernet interface (MAC) address. 113 See <a href="small.html#dhcp01" title="Example 2.2. Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf">???</a>.112 See <a class="link" href="small.html#dhcp01" title="Example 2.2. Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf">“Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf”</a>. 114 113 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 115 114 The <code class="filename">smb.conf</code> file you are creating in this exercise can be used with equal effectiveness … … 124 123 other enhancements. It is important that you plan accordingly. 125 124 </p><p> 126 <a class="indexterm" name="id3 21431"></a>125 <a class="indexterm" name="id345070"></a> 127 126 You have split the network into two separate areas. Each has its own Ethernet switch. 128 127 There are 20 users on the accounting network and 32 users on the financial services 129 network. The server has two network interfaces, one serving each network. The 130 network printers will be located in a central area. You plan to install the new 128 network. The server has two network interfaces, one serving each network. The 129 network printers will be located in a central area. You plan to install the new 131 130 printers and keep the old printer in use also. 132 131 </p><p> … … 136 135 responsible for file location, so the old share point must be maintained. 137 136 </p><p> 138 Given that DNS will not be used, you will configure WINS name resolution for UNIX 137 Given that DNS will not be used, you will configure WINS name resolution for UNIX 139 138 hostname name resolution. 140 139 </p><p> 141 <a class="indexterm" name="id3 21455"></a>142 <a class="indexterm" name="id3 21464"></a>140 <a class="indexterm" name="id345093"></a> 141 <a class="indexterm" name="id345101"></a> 143 142 It is necessary to map Windows Domain Groups to UNIX groups. It is 144 143 advisable to also map Windows Local Groups to UNIX groups. Additionally, the two … … 157 156 more information. 158 157 </p><p> 159 <a class="indexterm" name="id3 21515"></a>158 <a class="indexterm" name="id345147"></a> 160 159 Vendor-supplied printer drivers will be installed on each client. The CUPS print 161 160 spooler on the UNIX host will be operated in <code class="constant">raw</code> mode. 162 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 21528"></a>Political Issues</h3></div></div></div><p>161 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id345160"></a>Political Issues</h3></div></div></div><p> 163 162 Mr. Meany is an old-school manager. He sets the rules and wants to see compliance. 164 163 He is willing to spend money on things he believes are of value. You need more … … 168 167 supplied with antivirus software? Above all, demonstrate good purchase value and remember 169 168 to make your users happy. 170 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 21546"></a>Implementation</h2></div></div></div><p>171 <a class="indexterm" name="id3 21554"></a>169 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id345178"></a>Implementation</h2></div></div></div><p> 170 <a class="indexterm" name="id345185"></a> 172 171 In this example, the assumption is made that this server is being configured from a clean start. 173 172 The alternate approach could be to demonstrate the migration of the system that is documented 174 in <a href="simple.html#AcctgNet" title="Implementation">???</a> to meet the new requirements. The decision to treat this case, as with173 in <a class="link" href="simple.html#AcctgNet" title="Implementation">“Implementation”</a> to meet the new requirements. The decision to treat this case, as with 175 174 future examples, as a new installation is based on the premise that you can determine 176 the migration steps from the information provided in <a href="ntmigration.html" title="Chapter 9. Migrating NT4 Domain to Samba-3">???</a>.175 the migration steps from the information provided in <a class="link" href="ntmigration.html" title="Chapter 9. Migrating NT4 Domain to Samba-3">“Migrating NT4 Domain to Samba-3”</a>. 177 176 Additionally, a fresh installation makes the example easier to follow. 178 177 </p><p> 179 <a class="indexterm" name="id3 21581"></a>178 <a class="indexterm" name="id345207"></a> 180 179 Each user will be given a home directory on the UNIX system, which will be available as a private 181 180 share. Two additional shares will be created, one for the accounting department and the other for … … 183 182 of group membership. 184 183 </p><p> 185 <a class="indexterm" name="id3 21593"></a>184 <a class="indexterm" name="id345220"></a> 186 185 UNIX group membership is the primary mechanism by which Windows Domain users will be granted 187 186 rights and privileges within the Windows environment. 188 187 </p><p> 189 <a class="indexterm" name="id3 21607"></a>188 <a class="indexterm" name="id345232"></a> 190 189 The user <code class="literal">alanm</code> will be made the owner of all files. This will be preserved 191 190 by setting the sticky bit (set UID/GID) on the top-level directories. 192 </p><div class="figure"><a name="acct2net"></a><p class="title"><b>Figure 2.1. Abmas Accounting 52-User Network Topology</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/acct2net.png" alt="Abmas Accounting 52-User Network Topology"></div></div></div><br class="figure-break"><div class="procedure"><a name="id3 21665"></a><p class="title"><b>Procedure 2.1. Server Installation Steps</b></p><ol type="1"><li><p>191 </p><div class="figure"><a name="acct2net"></a><p class="title"><b>Figure 2.1. Abmas Accounting 52-User Network Topology</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/acct2net.png" alt="Abmas Accounting 52-User Network Topology"></div></div></div><br class="figure-break"><div class="procedure"><a name="id345285"></a><p class="title"><b>Procedure 2.1. Server Installation Steps</b></p><ol type="1"><li><p> 193 192 Using UNIX/Linux system tools, name the server <code class="constant">sleeth</code>. 194 193 </p></li><li><p> 195 <a class="indexterm" name="id3 21687"></a>194 <a class="indexterm" name="id345305"></a> 196 195 Place an entry for the machine <code class="constant">sleeth</code> in the <code class="filename">/etc/hosts</code>. 197 196 The printers are network attached, so there should be entries for the … … 209 208 Install the ISC DHCP server using the UNIX/Linux system tools available to you. 210 209 </p></li><li><p> 211 <a class="indexterm" name="id3 21738"></a>212 <a class="indexterm" name="id3 21745"></a>213 <a class="indexterm" name="id3 21752"></a>214 <a class="indexterm" name="id3 21759"></a>210 <a class="indexterm" name="id345353"></a> 211 <a class="indexterm" name="id345359"></a> 212 <a class="indexterm" name="id345365"></a> 213 <a class="indexterm" name="id345372"></a> 215 214 Because Samba will be operating over two network interfaces and clients on each side 216 215 may want to be able to reach clients on the other side, it is imperative that IP forwarding … … 223 222 This causes the Linux kernel to forward IP packets so that it acts as a router. 224 223 </p></li><li><p> 225 Install the <code class="filename">smb.conf</code> file as shown in <a href="small.html#acct2conf" title="Example 2.3. Accounting Office Network smb.conf File [globals] Section">???</a> and226 <a href="small.html#acct3conf" title="Example 2.4. Accounting Office Network smb.conf File Services and Shares Section">???</a>. Combine these two examples to form a single224 Install the <code class="filename">smb.conf</code> file as shown in <a class="link" href="small.html#acct2conf" title="Example 2.3. Accounting Office Network smb.conf File [globals] Section">“Accounting Office Network smb.conf File [globals] Section”</a> and 225 <a class="link" href="small.html#acct3conf" title="Example 2.4. Accounting Office Network smb.conf File Services and Shares Section">“Accounting Office Network smb.conf File Services and Shares Section”</a>. Combine these two examples to form a single 227 226 <code class="filename">/etc/samba/smb.conf</code> file. 228 227 </p></li><li><p> 229 <a class="indexterm" name="id3 21820"></a>228 <a class="indexterm" name="id345424"></a> 230 229 Add the user <code class="literal">root</code> to the Samba password backend: 231 230 </p><pre class="screen"> … … 235 234 <code class="prompt">root# </code> 236 235 </pre><p> 237 <a class="indexterm" name="id3 21851"></a>236 <a class="indexterm" name="id345452"></a> 238 237 This is the Windows Domain Administrator password. Never delete this account from 239 238 the password backend after Windows Domain Groups have been initialized. If you delete … … 241 240 and your Samba server can no longer be administered. 242 241 </p></li><li><p> 243 <a class="indexterm" name="id3 21867"></a>244 Create the username map file to permit the <code class="constant">root</code> account to be called 242 <a class="indexterm" name="id345467"></a> 243 Create the username map file to permit the <code class="constant">root</code> account to be called 245 244 <code class="constant">Administrator</code> from the Windows network environment. To do this, create 246 245 the file <code class="filename">/etc/samba/smbusers</code> with the following contents: … … 268 267 </pre><p> 269 268 </p></li><li><p> 270 <a class="indexterm" name="id3 21909"></a>269 <a class="indexterm" name="id345501"></a> 271 270 Create and map Windows Domain Groups to UNIX groups. A sample script is provided in 272 <a href="small.html#initGrps" title="Example 2.1. Script to Map Windows NT Groups to UNIX Groups">???</a>. Create a file containing this script. We called ours271 <a class="link" href="small.html#initGrps" title="Example 2.1. Script to Map Windows NT Groups to UNIX Groups">“Script to Map Windows NT Groups to UNIX Groups”</a>. Create a file containing this script. We called ours 273 272 <code class="filename">/etc/samba/initGrps.sh</code>. Set this file so it can be executed, 274 273 and then execute the script. Sample output should be as follows: 275 274 276 </p><div class="example"><a name="initGrps"></a><p class="title"><b>Example 2.1. Script to Map Windows NT Groups to UNIX Groups</b></p><div class="example-contents"><a class="indexterm" name="id3 21939"></a><pre class="screen">275 </p><div class="example"><a name="initGrps"></a><p class="title"><b>Example 2.1. Script to Map Windows NT Groups to UNIX Groups</b></p><div class="example-contents"><a class="indexterm" name="id345527"></a><pre class="screen"> 277 276 #!/bin/bash 278 277 # … … 296 295 </p><pre class="screen"> 297 296 <code class="prompt">root# </code> chmod 755 initGrps.sh 298 <code class="prompt">root# </code> cd /etc/samba 297 <code class="prompt">root# </code> cd /etc/samba 299 298 <code class="prompt">root# </code> ./initGrps.sh 300 299 Updated mapping entry for Domain Admins … … 306 305 Successfully added group Domain Guests to the mapping db 307 306 308 <code class="prompt">root# </code> cd /etc/samba 307 <code class="prompt">root# </code> cd /etc/samba 309 308 <code class="prompt">root# </code> net groupmap list | sort 310 309 Account Operators (S-1-5-32-548) -> -1 … … 324 323 </pre><p> 325 324 </p></li><li><p> 326 <a class="indexterm" name="id3 22008"></a>327 <a class="indexterm" name="id3 22015"></a>328 <a class="indexterm" name="id3 22024"></a>325 <a class="indexterm" name="id345591"></a> 326 <a class="indexterm" name="id345597"></a> 327 <a class="indexterm" name="id345606"></a> 329 328 For each user who needs to be given a Windows Domain account, make an entry in the 330 329 <code class="filename">/etc/passwd</code> file as well as in the Samba password backend. … … 332 331 <code class="literal">smbpasswd</code> program to create the Domain user accounts. 333 332 </p><p> 334 <a class="indexterm" name="id3 22048"></a>335 <a class="indexterm" name="id3 22055"></a>336 <a class="indexterm" name="id3 22062"></a>333 <a class="indexterm" name="id345628"></a> 334 <a class="indexterm" name="id345634"></a> 335 <a class="indexterm" name="id345640"></a> 337 336 There are a number of tools for user management under UNIX, such as 338 337 <code class="literal">useradd</code> and <code class="literal">adduser</code>, as well as a plethora of custom … … 345 344 data storage for company files. In this case the mount point is indicated in the <code class="filename">smb.conf</code> 346 345 file is <code class="filename">/data</code>. Format the file system as required, mount the formatted 347 file system partition using <code class="literal">mount</code>, 346 file system partition using <code class="literal">mount</code>, 348 347 and make the appropriate changes in <code class="filename">/etc/fstab</code>. 349 348 </p></li><li><p> … … 360 359 The directory root of the <code class="literal">finsvcs</code> share is <code class="filename">/data/finsvcs</code>. 361 360 </p></li><li><p> 362 Configure the printers with the IP addresses as shown in <a href="small.html#acct2net" title="Figure 2.1. Abmas Accounting 52-User Network Topology">???</a>.361 Configure the printers with the IP addresses as shown in <a class="link" href="small.html#acct2net" title="Figure 2.1. Abmas Accounting 52-User Network Topology">“Abmas Accounting 52-User Network Topology”</a>. 363 362 Follow the instructions in the manufacturers' manuals to permit printing to port 9100. 364 363 This allows the CUPS spooler to print using raw mode protocols. 365 <a class="indexterm" name="id3 22209"></a>366 <a class="indexterm" name="id3 22216"></a>367 </p></li><li><p> 368 <a class="indexterm" name="id3 22229"></a>369 <a class="indexterm" name="id3 22238"></a>364 <a class="indexterm" name="id345771"></a> 365 <a class="indexterm" name="id345777"></a> 366 </p></li><li><p> 367 <a class="indexterm" name="id345790"></a> 368 <a class="indexterm" name="id345798"></a> 370 369 Configure the CUPS Print Queues as follows: 371 370 </p><pre class="screen"> … … 374 373 <code class="prompt">root# </code> lpadmin -p qms -v socket://192.168.2.10:9100 -E 375 374 </pre><p> 376 <a class="indexterm" name="id3 22270"></a>375 <a class="indexterm" name="id345825"></a> 377 376 This creates the necessary print queues with no assigned print filter. 378 377 </p></li><li><p> 379 <a class="indexterm" name="id3 22284"></a>380 <a class="indexterm" name="id3 22291"></a>381 <a class="indexterm" name="id3 22298"></a>378 <a class="indexterm" name="id345839"></a> 379 <a class="indexterm" name="id345845"></a> 380 <a class="indexterm" name="id345851"></a> 382 381 Edit the file <code class="filename">/etc/cups/mime.convs</code> to uncomment the line: 383 382 </p><pre class="screen"> … … 385 384 </pre><p> 386 385 </p></li><li><p> 387 <a class="indexterm" name="id3 22324"></a>386 <a class="indexterm" name="id345875"></a> 388 387 Edit the file <code class="filename">/etc/cups/mime.types</code> to uncomment the line: 389 388 </p><pre class="screen"> … … 391 390 </pre><p> 392 391 </p></li><li><p> 393 <a class="indexterm" name="id3 22349"></a>392 <a class="indexterm" name="id345898"></a> 394 393 Using your favorite system editor, create an <code class="filename">/etc/dhcpd.conf</code> with the 395 contents as shown in <a href="small.html#dhcp01" title="Example 2.2. Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf">???</a>.396 </p><div class="example"><a name="dhcp01"></a><p class="title"><b>Example 2.2. Abmas Accounting DHCP Server Configuration File <code class="filename">/etc/dhcpd.conf</code></b></p><div class="example-contents"><a class="indexterm" name="id3 22384"></a><pre class="screen">394 contents as shown in <a class="link" href="small.html#dhcp01" title="Example 2.2. Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf">“Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf”</a>. 395 </p><div class="example"><a name="dhcp01"></a><p class="title"><b>Example 2.2. Abmas Accounting DHCP Server Configuration File <code class="filename">/etc/dhcpd.conf</code></b></p><div class="example-contents"><a class="indexterm" name="id345927"></a><pre class="screen"> 397 396 default-lease-time 86400; 398 397 max-lease-time 172800; … … 442 441 automatically at every system reboot. For example, 443 442 </p><p> 444 <a class="indexterm" name="id3 22419"></a>445 <a class="indexterm" name="id3 22426"></a>446 <a class="indexterm" name="id3 22432"></a>447 <a class="indexterm" name="id3 22439"></a>448 <a class="indexterm" name="id3 22446"></a>443 <a class="indexterm" name="id345960"></a> 444 <a class="indexterm" name="id345966"></a> 445 <a class="indexterm" name="id345973"></a> 446 <a class="indexterm" name="id345979"></a> 447 <a class="indexterm" name="id345985"></a> 449 448 </p><pre class="screen"> 450 449 <code class="prompt">root# </code> chkconfig dhcp on … … 456 455 </pre><p> 457 456 </p></li><li><p> 458 <a class="indexterm" name="id3 22501"></a>459 <a class="indexterm" name="id3 22508"></a>460 <a class="indexterm" name="id3 22517"></a>461 <a class="indexterm" name="id3 22523"></a>462 <a class="indexterm" name="id3 22530"></a>463 <a class="indexterm" name="id3 22537"></a>457 <a class="indexterm" name="id346034"></a> 458 <a class="indexterm" name="id346040"></a> 459 <a class="indexterm" name="id346049"></a> 460 <a class="indexterm" name="id346055"></a> 461 <a class="indexterm" name="id346061"></a> 462 <a class="indexterm" name="id346068"></a> 464 463 Configure the name service switch (NSS) to handle WINS-based name resolution. 465 464 Since this system does not use a DNS server, it is safe to remove this option from … … 469 468 hosts: files wins 470 469 </pre><p> 471 </p></li></ol></div><div class="example"><a name="acct2conf"></a><p class="title"><b>Example 2.3. Accounting Office Network <code class="filename">smb.conf</code> File [globals] Section</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id3 22599"></a><em class="parameter"><code>workgroup = BILLMORE</code></em></td></tr><tr><td><a class="indexterm" name="id322611"></a><em class="parameter"><code>passwd chat = *New*Password* %n\n*Re-enter*new*password* %n\n *Password*changed*</code></em></td></tr><tr><td><a class="indexterm" name="id322624"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id322637"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id322650"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id322662"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id322675"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id322688"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id322700"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id322713"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id322726"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id322739"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -G '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id322752"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id322765"></a><em class="parameter"><code>logon script = scripts\login.bat</code></em></td></tr><tr><td><a class="indexterm" name="id322778"></a><em class="parameter"><code>logon path = </code></em></td></tr><tr><td><a class="indexterm" name="id322790"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id322803"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id322815"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id322828"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id322840"></a><em class="parameter"><code>printing = CUPS</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="acct3conf"></a><p class="title"><b>Example 2.4. Accounting Office Network <code class="filename">smb.conf</code> File Services and Shares Section</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id322886"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id322898"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id322911"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id322924"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id322945"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id322958"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id322970"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id322983"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id322995"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id323008"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id323029"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id323042"></a><em class="parameter"><code>path = /data/%U</code></em></td></tr><tr><td><a class="indexterm" name="id323054"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id323067"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id323088"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id323101"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id323114"></a><em class="parameter"><code>valid users = %G</code></em></td></tr><tr><td><a class="indexterm" name="id323126"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[finsvcs]</code></em></td></tr><tr><td><a class="indexterm" name="id323148"></a><em class="parameter"><code>comment = Financial Service Files</code></em></td></tr><tr><td><a class="indexterm" name="id323160"></a><em class="parameter"><code>path = /data/finsvcs</code></em></td></tr><tr><td><a class="indexterm" name="id323173"></a><em class="parameter"><code>valid users = %G</code></em></td></tr><tr><td><a class="indexterm" name="id323185"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id323199"></a>Validation</h3></div></div></div><p>470 </p></li></ol></div><div class="example"><a name="acct2conf"></a><p class="title"><b>Example 2.3. Accounting Office Network <code class="filename">smb.conf</code> File [globals] Section</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id346123"></a><em class="parameter"><code>workgroup = BILLMORE</code></em></td></tr><tr><td><a class="indexterm" name="id346133"></a><em class="parameter"><code>passwd chat = *New*Password* %n\n*Re-enter*new*password* %n\n *Password*changed*</code></em></td></tr><tr><td><a class="indexterm" name="id346145"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id346155"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id346165"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id346176"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id346186"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id346197"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m -G users '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id346207"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id346217"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id346228"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id346238"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -A '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id346249"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id346260"></a><em class="parameter"><code>logon script = scripts\login.bat</code></em></td></tr><tr><td><a class="indexterm" name="id346271"></a><em class="parameter"><code>logon path = </code></em></td></tr><tr><td><a class="indexterm" name="id346281"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id346292"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id346302"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id346312"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id346323"></a><em class="parameter"><code>printing = CUPS</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="acct3conf"></a><p class="title"><b>Example 2.4. Accounting Office Network <code class="filename">smb.conf</code> File Services and Shares Section</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id346363"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id346373"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id346383"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id346394"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id346413"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id346423"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id346433"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id346444"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id346454"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id346465"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id346483"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id346494"></a><em class="parameter"><code>path = /data/%U</code></em></td></tr><tr><td><a class="indexterm" name="id346504"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id346515"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id346533"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id346544"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id346554"></a><em class="parameter"><code>valid users = %G</code></em></td></tr><tr><td><a class="indexterm" name="id346565"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[finsvcs]</code></em></td></tr><tr><td><a class="indexterm" name="id346583"></a><em class="parameter"><code>comment = Financial Service Files</code></em></td></tr><tr><td><a class="indexterm" name="id346594"></a><em class="parameter"><code>path = /data/finsvcs</code></em></td></tr><tr><td><a class="indexterm" name="id346604"></a><em class="parameter"><code>valid users = %G</code></em></td></tr><tr><td><a class="indexterm" name="id346615"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id346626"></a>Validation</h3></div></div></div><p> 472 471 Does everything function as it ought? That is the key question at this point. 473 472 Here are some simple steps to validate your Samba server configuration. 474 </p><div class="procedure"><a name="id3 23209"></a><p class="title"><b>Procedure 2.2. Validation Steps</b></p><ol type="1"><li><p>475 <a class="indexterm" name="id3 23220"></a>473 </p><div class="procedure"><a name="id346636"></a><p class="title"><b>Procedure 2.2. Validation Steps</b></p><ol type="1"><li><p> 474 <a class="indexterm" name="id346647"></a> 476 475 If your <code class="filename">smb.conf</code> file has bogus options or parameters, this may cause Samba 477 476 to refuse to start. The first step should always be to validate the contents … … 496 495 printcap name = CUPS 497 496 show add printer wizard = No 498 add user script = /usr/sbin/useradd -m '%u'497 add user script = /usr/sbin/useradd -m -G users '%u' 499 498 delete user script = /usr/sbin/userdel -r '%u' 500 499 add group script = /usr/sbin/groupadd '%g' 501 500 delete group script = /usr/sbin/groupdel '%g' 502 add user to group script = /usr/sbin/usermod - G'%g' '%u'503 add machine script = /usr/sbin/useradd 501 add user to group script = /usr/sbin/usermod -A '%g' '%u' 502 add machine script = /usr/sbin/useradd 504 503 -s /bin/false -d /var/lib/nobody '%u' 505 504 logon script = scripts\logon.bat … … 520 519 Clear away all errors before proceeding, and start or restart samba as necessary. 521 520 </p></li><li><p> 522 <a class="indexterm" name="id3 23270"></a>523 <a class="indexterm" name="id3 23277"></a>524 <a class="indexterm" name="id3 23284"></a>525 <a class="indexterm" name="id3 23291"></a>521 <a class="indexterm" name="id346704"></a> 522 <a class="indexterm" name="id346710"></a> 523 <a class="indexterm" name="id346716"></a> 524 <a class="indexterm" name="id346722"></a> 526 525 Check that the Samba server is running: 527 526 </p><pre class="screen"> … … 540 539 <code class="literal">smbd</code> is normal. 541 540 </p></li><li><p> 542 <a class="indexterm" name="id3 23342"></a>541 <a class="indexterm" name="id346768"></a> 543 542 Check that an anonymous connection can be made to the Samba server: 544 543 </p><pre class="screen"> … … 569 568 a <code class="constant">NULL</code> password. 570 569 </p></li><li><p> 571 <a class="indexterm" name="id3 23387"></a>572 <a class="indexterm" name="id3 23393"></a>573 <a class="indexterm" name="id3 23400"></a>570 <a class="indexterm" name="id346810"></a> 571 <a class="indexterm" name="id346816"></a> 572 <a class="indexterm" name="id346822"></a> 574 573 Verify that the printers have the IP addresses assigned in the DHCP server configuration file. 575 574 The easiest way to do this is to ping the printer name. Immediately after the ping response … … 590 589 <code class="filename">/etc/dhcpd.conf</code> file. 591 590 </p></li><li><p> 592 <a class="indexterm" name="id3 23459"></a>591 <a class="indexterm" name="id346876"></a> 593 592 Make an authenticated connection to the server using the <code class="literal">smbclient</code> tool: 594 593 </p><pre class="screen"> … … 607 606 smb: \> q 608 607 </pre><p> 609 </p></li></ol></div></div><div class="procedure"><a name="id3 23498"></a><p class="title"><b>Procedure 2.3. Windows XP Professional Client Configuration</b></p><ol type="1"><li><p>610 Configure clients to the network settings shown in <a href="small.html#acct2net" title="Figure 2.1. Abmas Accounting 52-User Network Topology">???</a>.608 </p></li></ol></div></div><div class="procedure"><a name="id346912"></a><p class="title"><b>Procedure 2.3. Windows XP Professional Client Configuration</b></p><ol type="1"><li><p> 609 Configure clients to the network settings shown in <a class="link" href="small.html#acct2net" title="Figure 2.1. Abmas Accounting 52-User Network Topology">“Abmas Accounting 52-User Network Topology”</a>. 611 610 All clients use DHCP for TCP/IP protocol stack configuration. 612 <a class="indexterm" name="id3 23516"></a>613 <a class="indexterm" name="id3 23523"></a>611 <a class="indexterm" name="id346928"></a> 612 <a class="indexterm" name="id346934"></a> 614 613 DHCP configures all Windows clients to use the WINS Server address <code class="constant">192.168.1.1</code>. 615 614 </p></li><li><p> … … 617 616 username <code class="constant">root</code> and the SMB password you assigned to this account. 618 617 A detailed step-by-step procedure for joining a Windows 200x/XP Professional client to 619 a Windows Domain is given in <a href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">???</a>, <a href="appendix.html#domjoin" title="Joining a Domain: Windows 200x/XP Professional">???</a>.618 a Windows Domain is given in <a class="link" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">“A Collection of Useful Tidbits”</a>, <a class="link" href="appendix.html#domjoin" title="Joining a Domain: Windows 200x/XP Professional">“Joining a Domain: Windows 200x/XP Professional”</a>. 620 619 Reboot the machine as prompted and then log on using a Domain User account. 621 620 </p></li><li><p> … … 653 652 Repeat the printer installation steps above for the HP LaserJet 6 printer 654 653 as well as for the QMS Magicolor XXXX laser printer. 655 </p></li></ol></div></li></ol></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 23822"></a>Notebook Computers: A Special Case</h3></div></div></div><p>654 </p></li></ol></div></li></ol></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id347201"></a>Notebook Computers: A Special Case</h3></div></div></div><p> 656 655 As a network administrator, you already know how to create local machine accounts for Windows 200x/XP 657 656 Professional systems. This is the preferred solution to provide continuity of work for notebook users … … 663 662 that mean that as the network is more tightly secured, it becomes necessary to modify Windows client 664 663 configuration somewhat. 665 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 23841"></a>Key Points Learned</h3></div></div></div><p>664 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id347221"></a>Key Points Learned</h3></div></div></div><p> 666 665 In this network design and implementation exercise, you created a Windows NT4-style Domain 667 666 Controller using Samba-3.0.20. Following these guidelines, you experienced … … 669 668 you build on the experience. These are the highlights from this chapter: 670 669 </p><div class="itemizedlist"><ul type="disc"><li><p> 671 <a class="indexterm" name="id3 23858"></a>670 <a class="indexterm" name="id347237"></a> 672 671 You implemented a DHCP server, and Microsoft Windows clients were able to obtain all necessary 673 672 network configuration settings from this server. 674 673 </p></li><li><p> 675 <a class="indexterm" name="id3 23871"></a>674 <a class="indexterm" name="id347249"></a> 676 675 You created a Windows Domain Controller. You were able to use the network logon service 677 676 and successfully joined Windows 200x/XP Professional clients to the Domain. 678 677 </p></li><li><p> 679 <a class="indexterm" name="id3 23883"></a>678 <a class="indexterm" name="id347262"></a> 680 679 You created raw print queues in the CUPS printing system. You maintained a simple 681 680 printing system so that all users can share centrally managed printers. You installed … … 686 685 You offered Mobile notebook users a solution that allows them to continue to work 687 686 while away from the office and not connected to the corporate network. 688 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 23907"></a>Questions and Answers</h2></div></div></div><p>687 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id347285"></a>Questions and Answers</h2></div></div></div><p> 689 688 Your new Domain Controller is ready to serve you. What does it mean? Here are some questions and answers that 690 689 may help. 691 </p><div class="qandaset"><dl><dt>1. <a href="small.html#id3 23919">690 </p><div class="qandaset"><dl><dt>1. <a href="small.html#id347297"> 692 691 What is the key benefit of using DHCP to configure Windows client TCP/IP stacks? 693 </a></dt><dt>2. <a href="small.html#id3 23941">692 </a></dt><dt>2. <a href="small.html#id347318"> 694 693 Are there any DHCP server configuration parameters in the /etc/dhcpd.conf 695 694 that should be noted in particular? 696 </a></dt><dt>3. <a href="small.html#id3 23968">695 </a></dt><dt>3. <a href="small.html#id347344"> 697 696 Is it possible to create a Windows Domain account that is specifically called Administrator? 698 </a></dt><dt>4. <a href="small.html#id3 24004">697 </a></dt><dt>4. <a href="small.html#id347378"> 699 698 Why is it necessary to give the Windows Domain Administrator a UNIX UID of 0? 700 </a></dt><dt>5. <a href="small.html#id3 24039">699 </a></dt><dt>5. <a href="small.html#id347411"> 701 700 One of my junior staff needs the ability to add machines to the Domain, but I do not want to give him 702 701 root access. How can we do this? 703 </a></dt><dt>6. <a href="small.html#id3 24077">702 </a></dt><dt>6. <a href="small.html#id347447"> 704 703 Why must I map Windows Domain Groups to UNIX groups? 705 </a></dt><dt>7. <a href="small.html#id3 24114">704 </a></dt><dt>7. <a href="small.html#id347481"> 706 705 I deleted my root account and now I cannot add it back! What can I do? 707 </a></dt><dt>8. <a href="small.html#id3 24184">706 </a></dt><dt>8. <a href="small.html#id347546"> 708 707 When I run net groupmap list, it reports a group called Administrators 709 708 as well as Domain Admins. What is the difference between them? 710 </a></dt><dt>9. <a href="small.html#id3 24228">709 </a></dt><dt>9. <a href="small.html#id347586"> 711 710 What is the effect of changing the name of a Samba server or of changing the Domain name? 712 </a></dt><dt>10. <a href="small.html#id3 24272">711 </a></dt><dt>10. <a href="small.html#id347628"> 713 712 How can I manage user accounts from my Windows XP Professional workstation? 714 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id3 23919"></a><a name="id323922"></a><b>1.</b></td><td align="left" valign="top"><p>713 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id347297"></a><a name="id347299"></a><p><b>1.</b></p></td><td align="left" valign="top"><p> 715 714 What is the key benefit of using DHCP to configure Windows client TCP/IP stacks? 716 715 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 721 720 default routes and DNS server addresses that apply only to the Abmas office environment do 722 721 not interfere with remote operations. This is an extremely important feature of DHCP. 723 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 23941"></a><a name="id323943"></a><b>2.</b></td><td align="left" valign="top"><p>722 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id347318"></a><a name="id347320"></a><p><b>2.</b></p></td><td align="left" valign="top"><p> 724 723 Are there any DHCP server configuration parameters in the <code class="filename">/etc/dhcpd.conf</code> 725 724 that should be noted in particular? … … 730 729 NetBIOS machine name needs to be resolved to an IP Address. This configuration 731 730 results in far lower UDP broadcast traffic than would be the case if WINS was not used. 732 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 23968"></a><a name="id323970"></a><b>3.</b></td><td align="left" valign="top"><p>731 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id347344"></a><a name="id347346"></a><p><b>3.</b></p></td><td align="left" valign="top"><p> 733 732 Is it possible to create a Windows Domain account that is specifically called <code class="constant">Administrator</code>? 734 733 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 737 736 necessary to use the <em class="parameter"><code>username map</code></em> facility to map this account to the UNIX 738 737 account called <code class="constant">root</code>. 739 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 24004"></a><a name="id324006"></a><b>4.</b></td><td align="left" valign="top"><p>738 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id347378"></a><a name="id347380"></a><p><b>4.</b></p></td><td align="left" valign="top"><p> 740 739 Why is it necessary to give the Windows Domain <code class="constant">Administrator</code> a UNIX UID of 0? 741 740 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 747 746 settings within the Domain and on the Samba server, equivalent rights must be assigned. This is 748 747 achieved with the <code class="constant">root</code> UID equal to 0. 749 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 24039"></a><a name="id324042"></a><b>5.</b></td><td align="left" valign="top"><p>748 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id347411"></a><a name="id347414"></a><p><b>5.</b></p></td><td align="left" valign="top"><p> 750 749 One of my junior staff needs the ability to add machines to the Domain, but I do not want to give him 751 750 <code class="constant">root</code> access. How can we do this? … … 756 755 This must be the primary GID of the account of the user who is a member of the Windows <code class="constant"> 757 756 Domain Admins</code> account. 758 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 24077"></a><a name="id324079"></a><b>6.</b></td><td align="left" valign="top"><p>757 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id347447"></a><a name="id347449"></a><p><b>6.</b></p></td><td align="left" valign="top"><p> 759 758 Why must I map Windows Domain Groups to UNIX groups? 760 759 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 762 761 has a UNIX group account equivalent. The Domain groups that should be given UNIX equivalents are 763 762 <span class="guimenu">Domain Guests</span>, <span class="guimenu">Domain Users</span>, and <span class="guimenu">Domain Admins</span>. 764 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 24114"></a><a name="id324116"></a><b>7.</b></td><td align="left" valign="top"><p>763 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id347481"></a><a name="id347483"></a><p><b>7.</b></p></td><td align="left" valign="top"><p> 765 764 I deleted my <code class="constant">root</code> account and now I cannot add it back! What can I do? 766 765 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 767 This is a nasty problem. Fortunately, there is a solution. 766 This is a nasty problem. Fortunately, there is a solution. 768 767 </p><div class="procedure"><ol type="1"><li><p> 769 768 Back up your existing configuration files in case you need to restore them. 770 769 </p></li><li><p> 771 Rename the <code class="filename">group_mapping.tdb</code> file. 770 Rename the <code class="filename">group_mapping.tdb</code> file. 772 771 </p></li><li><p> 773 772 Use the <code class="literal">smbpasswd</code> to add the root account. 774 773 </p></li><li><p> 775 774 Restore the <code class="filename">group_mapping.tdb</code> file. 776 </p></li></ol></div></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 24184"></a><a name="id324186"></a><b>8.</b></td><td align="left" valign="top"><p>775 </p></li></ol></div></td></tr><tr class="question"><td align="left" valign="top"><a name="id347546"></a><a name="id347548"></a><p><b>8.</b></p></td><td align="left" valign="top"><p> 777 776 When I run <code class="literal">net groupmap list</code>, it reports a group called <span class="guimenu">Administrators</span> 778 777 as well as <span class="guimenu">Domain Admins</span>. What is the difference between them? 779 778 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 780 779 The group called <span class="guimenu">Administrators</span> is representative of the same account that would be 781 present as the Local Group account on a Domain Member server or workstation. Samba uses only Domain 780 present as the Local Group account on a Domain Member server or workstation. Samba uses only Domain 782 781 Groups at this time. A Workstation or Server Local Group has no meaning in a Samba context. This 783 782 may change at some later date. These accounts are provided only so that security objects are correctly shown. 784 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 24228"></a><a name="id324230"></a><b>9.</b></td><td align="left" valign="top"><p>783 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id347586"></a><a name="id347588"></a><p><b>9.</b></p></td><td align="left" valign="top"><p> 785 784 What is the effect of changing the name of a Samba server or of changing the Domain name? 786 785 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 794 793 or the <code class="literal">smbpasswd</code> (Samba-2.2.x). To change the SID, you use the same tool. Be sure 795 794 to check the man page for this command for detailed instructions regarding the steps involved. 796 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 24272"></a><a name="id324274"></a><b>10.</b></td><td align="left" valign="top"><p>795 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id347628"></a><a name="id347630"></a><p><b>10.</b></p></td><td align="left" valign="top"><p> 797 796 How can I manage user accounts from my Windows XP Professional workstation? 798 797 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> -
branches/samba-3.0/docs/htmldocs/Samba3-ByExample/unixclients.html
r44 r134 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 7. Adding Domain Member Servers and Clients</title><link rel="stylesheet" href=" samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="next" href="upgrades.html" title="Chapter 8. Updating Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 7. Adding Domain Member Servers and Clients</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="DMSMig.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="upgrades.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="unixclients"></a>Chapter 7. Adding Domain Member Servers and Clients</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="unixclients.html#id352990">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id353039">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id353067">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id353091">Technical Issues</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id353679">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id353760">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></span></dt><dt><span class="sect2"><a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></span></dt><dt><span class="sect2"><a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a></span></dt><dt><span class="sect2"><a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id359708">UNIX/Linux Client Domain Member</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id360196">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id360240">Questions and Answers</a></span></dt></dl></div><p><a class="indexterm" name="id352902"></a><a class="indexterm" name="id352910"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 7. Adding Domain Member Servers and Clients</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="next" href="upgrades.html" title="Chapter 8. Updating Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 7. Adding Domain Member Servers and Clients</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="DMSMig.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="upgrades.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="unixclients"></a>Chapter 7. Adding Domain Member Servers and Clients</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="unixclients.html#id375489">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id375537">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id375566">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id375589">Technical Issues</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id376189">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id376274">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></span></dt><dt><span class="sect2"><a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></span></dt><dt><span class="sect2"><a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a></span></dt><dt><span class="sect2"><a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id382025">UNIX/Linux Client Domain Member</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id382521">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id382565">Questions and Answers</a></span></dt></dl></div><p><a class="indexterm" name="id375400"></a><a class="indexterm" name="id375408"></a> 2 2 The most frequently discussed Samba subjects over the past 2 years have focused around domain control and printing. 3 3 It is well known that Samba is a file and print server. A recent survey conducted by <span class="emphasis"><em>Open Magazine</em></span> found 4 4 that of all respondents, 97 percent use Samba for file and print services, and 68 percent use Samba for Domain Control. See the 5 <a href="http://www.open-mag.com/cgi-bin/opencgi/surveys/survey.cgi?survey_name=samba" target="_top">Open-Mag</a>5 <a class="ulink" href="http://www.open-mag.com/cgi-bin/opencgi/surveys/survey.cgi?survey_name=samba" target="_top">Open-Mag</a> 6 6 Web site for current information. The survey results as found on January 14, 2004, are shown in 7 <a href="unixclients.html#ch09openmag" title="Figure 7.1. Open Magazine Samba Survey">???</a>.7 <a class="link" href="unixclients.html#ch09openmag" title="Figure 7.1. Open Magazine Samba Survey">“Open Magazine Samba Survey”</a>. 8 8 </p><div class="figure"><a name="ch09openmag"></a><p class="title"><b>Figure 7.1. Open Magazine Samba Survey</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/openmag.png" width="324" alt="Open Magazine Samba Survey"></div></div></div><br class="figure-break"><p> 9 9 While domain control is an exciting subject, basic file and print sharing remains the staple bread-and-butter … … 12 12 the addition of Samba servers into your present Windows network whatever the controlling technology 13 13 may be. So let's get back to our good friends at Abmas. 14 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 52990"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id352997"></a><a class="indexterm" name="id353005"></a>14 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id375489"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id375495"></a><a class="indexterm" name="id375503"></a> 15 15 Looking back over the achievements of the past year or two, daily events at Abmas are rather straightforward 16 16 with not too many distractions or problems. Your team is doing well, but a number of employees 17 17 are asking for Linux desktop systems. Your network has grown and demands additional domain member servers. Let's 18 18 get on with this; Christine and Stan are ready to go. 19 </p><p><a class="indexterm" name="id3 53023"></a>19 </p><p><a class="indexterm" name="id375521"></a> 20 20 Stan is firmly in control of the department of the future, while Christine is enjoying a stable and 21 21 predictable network environment. It is time to add more servers and to add Linux desktops. It is 22 22 time to meet the demands of future growth and endure trial by fire. 23 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 53039"></a>Assignment Tasks</h3></div></div></div><p><a class="indexterm" name="id353045"></a>23 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id375537"></a>Assignment Tasks</h3></div></div></div><p><a class="indexterm" name="id375544"></a> 24 24 You must now add UNIX/Linux domain member servers to your network. You have a friend who has a Windows 2003 25 25 Active Directory domain network who wants to add a Samba/Linux server and has asked Christine to help him … … 31 31 do likewise at Swodniw Biz NL (your friend's company) to help them to evaluate a Linux desktop. You want to make 32 32 the right decision, don't you? 33 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 53067"></a>Dissection and Discussion</h2></div></div></div><p>34 <a class="indexterm" name="id3 53075"></a>33 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id375566"></a>Dissection and Discussion</h2></div></div></div><p> 34 <a class="indexterm" name="id375573"></a> 35 35 Recent Samba mailing-list activity is witness to how many sites are using winbind. Some have no trouble 36 36 at all with it, yet to others the problems seem insurmountable. Periodically there are complaints concerning … … 40 40 resolution. You also provide working examples of solutions for integrated authentication for 41 41 both UNIX/Linux and Windows environments. 42 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 53091"></a>Technical Issues</h3></div></div></div><p>42 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id375589"></a>Technical Issues</h3></div></div></div><p> 43 43 One of the great challenges we face when people ask us, “<span class="quote">What is the best way to solve 44 44 this problem?</span>” is to get beyond the facts so we not only can clearly comprehend 45 45 the immediate technical problem, but also can understand how needs may change. 46 46 </p><p> 47 <a class="indexterm" name="id3 53108"></a>47 <a class="indexterm" name="id375606"></a> 48 48 There are a few facts we should note when dealing with the question of how best to 49 49 integrate UNIX/Linux clients and servers into a Windows networking environment: 50 50 </p><div class="itemizedlist"><ul type="disc"><li><p> 51 <a class="indexterm" name="id3 53122"></a>52 <a class="indexterm" name="id3 53129"></a>53 <a class="indexterm" name="id3 53136"></a>54 <a class="indexterm" name="id3 53145"></a>55 <a class="indexterm" name="id3 53152"></a>51 <a class="indexterm" name="id375621"></a> 52 <a class="indexterm" name="id375628"></a> 53 <a class="indexterm" name="id375634"></a> 54 <a class="indexterm" name="id375644"></a> 55 <a class="indexterm" name="id375650"></a> 56 56 A domain controller (PDC or BDC) is always authoritative for all accounts in its domain. 57 57 This means that a BDC must (of necessity) be able to resolve all account UIDs and GIDs 58 58 to the same values that the PDC resolved them to. 59 59 </p></li><li><p> 60 <a class="indexterm" name="id3 53165"></a>61 <a class="indexterm" name="id3 53172"></a>62 <a class="indexterm" name="id3 53183"></a>63 <a class="indexterm" name="id3 53190"></a>60 <a class="indexterm" name="id375663"></a> 61 <a class="indexterm" name="id375670"></a> 62 <a class="indexterm" name="id375681"></a> 63 <a class="indexterm" name="id375688"></a> 64 64 A domain member can be authoritative for local accounts, but is never authoritative for 65 65 domain accounts. If a user is accessing a domain member server and that user's account … … 71 71 number of sources: 72 72 </p><div class="itemizedlist"><ul type="circle"><li><p> 73 <a class="indexterm" name="id3 53218"></a>74 <a class="indexterm" name="id3 53225"></a>75 <a class="indexterm" name="id3 53232"></a>76 <a class="indexterm" name="id3 53238"></a>77 <a class="indexterm" name="id3 53245"></a>73 <a class="indexterm" name="id375716"></a> 74 <a class="indexterm" name="id375723"></a> 75 <a class="indexterm" name="id375730"></a> 76 <a class="indexterm" name="id375736"></a> 77 <a class="indexterm" name="id375743"></a> 78 78 By executing a system <code class="literal">getpwnam()</code> or <code class="literal">getgrnam()</code> call. 79 79 On systems that support it, this utilizes the name service switch (NSS) facility to … … 81 81 file. NSS can be configured to use LDAP, winbind, NIS, or local files. 82 82 </p></li><li><p> 83 <a class="indexterm" name="id3 53276"></a>84 <a class="indexterm" name="id3 53283"></a>85 <a class="indexterm" name="id3 53290"></a>83 <a class="indexterm" name="id375774"></a> 84 <a class="indexterm" name="id375781"></a> 85 <a class="indexterm" name="id375788"></a> 86 86 Performing, via NSS, a direct LDAP search (where an LDAP passdb backend has been configured). 87 87 This requires the use of the PADL nss_ldap tool (or equivalent). 88 88 </p></li><li><p> 89 <a class="indexterm" name="id3 53302"></a>90 <a class="indexterm" name="id3 53309"></a>91 <a class="indexterm" name="id3 53316"></a>92 <a class="indexterm" name="id3 53322"></a>89 <a class="indexterm" name="id375800"></a> 90 <a class="indexterm" name="id375807"></a> 91 <a class="indexterm" name="id375814"></a> 92 <a class="indexterm" name="id375821"></a> 93 93 Directly by querying <code class="literal">winbindd</code>. The <code class="literal">winbindd</code> 94 94 contacts a domain controller to attempt to resolve the identity of the user or group. It … … 98 98 <code class="filename">winbindd_cache.tdb</code> files. 99 99 </p><p> 100 <a class="indexterm" name="id3 53359"></a>101 <a class="indexterm" name="id3 53366"></a>102 If the parameter <a class=" indexterm" name="id353373"></a>idmap backend = ldap:ldap://myserver.domain100 <a class="indexterm" name="id375857"></a> 101 <a class="indexterm" name="id375864"></a> 102 If the parameter <a class="link" href="smb.conf.5.html#IDMAPBACKEND">idmap backend = ldap:ldap://myserver.domain</a> 103 103 was specified and the LDAP server has been configured with a container in which it may 104 104 store the IDMAP entries, all domain members may share a common mapping. … … 112 112 casual user. 113 113 </p></li><li><p> 114 <a class="indexterm" name="id3 53420"></a>115 <a class="indexterm" name="id3 53427"></a>116 <a class="indexterm" name="id3 53436"></a>114 <a class="indexterm" name="id375922"></a> 115 <a class="indexterm" name="id375929"></a> 116 <a class="indexterm" name="id375939"></a> 117 117 If you wish to make use of accounts (users and/or groups) that are local to (i.e., capable 118 118 of being resolved using) the NSS facility, it is possible to use the 119 <a class=" indexterm" name="id353445"></a>winbind trusted domains only = Yes119 <a class="link" href="smb.conf.5.html#WINBINDTRUSTEDDOMAINSONLY">winbind trusted domains only = Yes</a> 120 120 in the <code class="filename">smb.conf</code> file. This parameter specifically applies to domain controllers, 121 121 and to domain member servers. 122 122 </p></li></ul></div><p> 123 <a class="indexterm" name="id3 53463"></a>124 <a class="indexterm" name="id3 53470"></a>125 <a class="indexterm" name="id3 53477"></a>123 <a class="indexterm" name="id375970"></a> 124 <a class="indexterm" name="id375977"></a> 125 <a class="indexterm" name="id375983"></a> 126 126 For many administrators, it should be plain that the use of an LDAP-based repository for all network 127 127 accounts (both for POSIX accounts and for Samba accounts) provides the most elegant and 128 128 controllable facility. You eventually appreciate the decision to use LDAP. 129 129 </p><p> 130 <a class="indexterm" name="id3 53489"></a>131 <a class="indexterm" name="id3 53496"></a>132 <a class="indexterm" name="id3 53503"></a>130 <a class="indexterm" name="id375996"></a> 131 <a class="indexterm" name="id376003"></a> 132 <a class="indexterm" name="id376009"></a> 133 133 If your network account information resides in an LDAP repository, you should use it ahead of any 134 134 alternative method. This means that if it is humanly possible to use the <code class="literal">nss_ldap</code> … … 137 137 throughout the network. 138 138 </p><p> 139 <a class="indexterm" name="id3 53522"></a>140 <a class="indexterm" name="id3 53531"></a>141 <a class="indexterm" name="id3 53538"></a>142 <a class="indexterm" name="id3 53545"></a>143 <a class="indexterm" name="id3 53552"></a>144 <a class="indexterm" name="id3 53559"></a>139 <a class="indexterm" name="id376029"></a> 140 <a class="indexterm" name="id376038"></a> 141 <a class="indexterm" name="id376045"></a> 142 <a class="indexterm" name="id376052"></a> 143 <a class="indexterm" name="id376058"></a> 144 <a class="indexterm" name="id376065"></a> 145 145 In the situation where UNIX accounts are held on the domain member server itself, the only effective 146 146 way to use them involves the <code class="filename">smb.conf</code> entry 147 <a class=" indexterm" name="id353573"></a>winbind trusted domains only = Yes. This forces147 <a class="link" href="smb.conf.5.html#WINBINDTRUSTEDDOMAINSONLY">winbind trusted domains only = Yes</a>. This forces 148 148 Samba (<code class="literal">smbd</code>) to perform a <code class="literal">getpwnam()</code> system call that can 149 149 then be controlled via <code class="filename">/etc/nsswitch.conf</code> file settings. The use of this parameter 150 150 disables the use of Samba with trusted domains (i.e., external domains). 151 151 </p><p> 152 <a class="indexterm" name="id3 53602"></a>153 <a class="indexterm" name="id3 53609"></a>154 <a class="indexterm" name="id3 53618"></a>155 <a class="indexterm" name="id3 53625"></a>152 <a class="indexterm" name="id376113"></a> 153 <a class="indexterm" name="id376120"></a> 154 <a class="indexterm" name="id376129"></a> 155 <a class="indexterm" name="id376136"></a> 156 156 Winbind can be used to create an appliance mode domain member server. In this capacity, <code class="literal">winbindd</code> 157 157 is configured to automatically allocate UIDs/GIDs from numeric ranges set in the <code class="filename">smb.conf</code> file. The allocation … … 162 162 is stored in the <code class="filename">winbindd_idmap.tdb</code> and <code class="filename">winbindd_cache.tdb</code> files. 163 163 </p><p> 164 <a class="indexterm" name="id3 53667"></a>164 <a class="indexterm" name="id376177"></a> 165 165 The use of an LDAP backend for the Winbind IDMAP facility permits Windows domain SIDs 166 166 mappings to UIDs/GIDs to be stored centrally. The result is a consistent mapping across all domain member 167 167 servers so configured. This solves one of the major headaches for network administrators who need to copy 168 168 files between or across network file servers. 169 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 53679"></a>Political Issues</h3></div></div></div><p>170 <a class="indexterm" name="id3 53687"></a>171 <a class="indexterm" name="id3 53694"></a>172 <a class="indexterm" name="id3 53700"></a>173 <a class="indexterm" name="id3 53709"></a>169 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id376189"></a>Political Issues</h3></div></div></div><p> 170 <a class="indexterm" name="id376197"></a> 171 <a class="indexterm" name="id376204"></a> 172 <a class="indexterm" name="id376210"></a> 173 <a class="indexterm" name="id376219"></a> 174 174 One of the most fierce conflicts recently being waged is resistance to the adoption of LDAP, in 175 175 particular OpenLDAP, as a replacement for UNIX NIS (previously called Yellow Pages). Let's face it, LDAP … … 183 183 commercial integration products. But it's not what Active Directory was designed for. 184 184 </p><p> 185 <a class="indexterm" name="id3 53740"></a>186 <a class="indexterm" name="id3 53746"></a>185 <a class="indexterm" name="id376250"></a> 186 <a class="indexterm" name="id376256"></a> 187 187 A number of long-term UNIX devotees have recently commented in various communications that the Samba Team 188 188 is the first application group to almost force network administrators to use LDAP. It should be pointed … … 190 190 finally emerged as the preferred identity management backend for Samba. We recommend LDAP for your total 191 191 organizational directory needs. 192 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 53760"></a>Implementation</h2></div></div></div><p>193 <a class="indexterm" name="id3 53767"></a>194 <a class="indexterm" name="id3 53776"></a>195 <a class="indexterm" name="id3 53786"></a>192 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id376274"></a>Implementation</h2></div></div></div><p> 193 <a class="indexterm" name="id376281"></a> 194 <a class="indexterm" name="id376291"></a> 195 <a class="indexterm" name="id376300"></a> 196 196 The domain member server and the domain member client are at the center of focus in this chapter. 197 197 Configuration of Samba-3 domain controller is covered in earlier chapters, so if your … … 199 199 oil that helps you to add domain member servers and clients. 200 200 </p><p> 201 <a class="indexterm" name="id3 53799"></a>201 <a class="indexterm" name="id376313"></a> 202 202 In practice, domain member servers and domain member workstations are very different entities, but in 203 203 terms of technology they share similar core infrastructure. A technologist would argue that servers … … 207 207 but a server is viewed as a core component of the business. 208 208 </p><p> 209 <a class="indexterm" name="id3 53816"></a>209 <a class="indexterm" name="id376330"></a> 210 210 We can look at this another way. If a workstation breaks down, one user is affected, but if a 211 211 server breaks down, hundreds of users may not be able to work. The services that a workstation … … 213 213 and is distribution oriented. 214 214 </p><p> 215 <a class="indexterm" name="id3 53829"></a>216 <a class="indexterm" name="id3 53836"></a>217 <a class="indexterm" name="id3 53842"></a>215 <a class="indexterm" name="id376343"></a> 216 <a class="indexterm" name="id376350"></a> 217 <a class="indexterm" name="id376356"></a> 218 218 <span class="emphasis"><em>Why is this important?</em></span> For starters, we must identify what 219 219 components of the operating system and its environment must be configured. Also, it is necessary … … 227 227 what type of service need must be fulfilled. 228 228 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="sdcsdmldap"></a>Samba Domain with Samba Domain Member Server Using NSS LDAP</h3></div></div></div><p> 229 <a class="indexterm" name="id3 53877"></a>230 <a class="indexterm" name="id3 53884"></a>231 <a class="indexterm" name="id3 53890"></a>232 <a class="indexterm" name="id3 53897"></a>233 <a class="indexterm" name="id3 53906"></a>234 <a class="indexterm" name="id3 53913"></a>229 <a class="indexterm" name="id376392"></a> 230 <a class="indexterm" name="id376398"></a> 231 <a class="indexterm" name="id376405"></a> 232 <a class="indexterm" name="id376411"></a> 233 <a class="indexterm" name="id376421"></a> 234 <a class="indexterm" name="id376427"></a> 235 235 In this example, it is assumed that you have Samba PDC/BDC servers. This means you are using 236 236 an LDAP ldapsam backend. We are adding to the LDAP backend database (directory) … … 248 248 so that all domain member servers can use a consistent mapping. 249 249 </p><p> 250 <a class="indexterm" name="id3 53968"></a>251 <a class="indexterm" name="id3 53975"></a>252 <a class="indexterm" name="id3 53982"></a>250 <a class="indexterm" name="id376482"></a> 251 <a class="indexterm" name="id376489"></a> 252 <a class="indexterm" name="id376496"></a> 253 253 If your installation is accessed only from clients that are members of your own domain, and all 254 254 user accounts are present in a local passdb backend then it is not necessary to run … … 260 260 source can be provided from 261 261 </p><div class="itemizedlist"><ul type="disc"><li><p> 262 <a class="indexterm" name="id3 54014"></a>263 <a class="indexterm" name="id3 54021"></a>262 <a class="indexterm" name="id376528"></a> 263 <a class="indexterm" name="id376535"></a> 264 264 Accounts in <code class="filename">/etc/passwd</code> or in <code class="filename">/etc/group</code>. 265 265 </p></li><li><p> 266 <a class="indexterm" name="id3 54044"></a>267 <a class="indexterm" name="id3 54051"></a>268 <a class="indexterm" name="id3 54058"></a>269 <a class="indexterm" name="id3 54065"></a>270 <a class="indexterm" name="id3 54071"></a>271 <a class="indexterm" name="id3 54078"></a>272 <a class="indexterm" name="id3 54085"></a>273 <a class="indexterm" name="id3 54092"></a>274 <a class="indexterm" name="id3 54099"></a>266 <a class="indexterm" name="id376559"></a> 267 <a class="indexterm" name="id376565"></a> 268 <a class="indexterm" name="id376572"></a> 269 <a class="indexterm" name="id376579"></a> 270 <a class="indexterm" name="id376586"></a> 271 <a class="indexterm" name="id376592"></a> 272 <a class="indexterm" name="id376599"></a> 273 <a class="indexterm" name="id376606"></a> 274 <a class="indexterm" name="id376613"></a> 275 275 Resolution via NSS. On NSS-enabled systems, there is usually a facility to resolve IDs 276 276 via multiple methods. The methods typically include <code class="literal">files</code>, … … 284 284 used only locally on the Samba domain member server under discussion. 285 285 </p></div><p> 286 <a class="indexterm" name="id3 54173"></a>287 The diagram in <a href="unixclients.html#ch9-sambadc" title="Figure 7.2. Samba Domain: Samba Member Server">???</a> demonstrates the relationship of Samba and system286 <a class="indexterm" name="id376687"></a> 287 The diagram in <a class="link" href="unixclients.html#ch9-sambadc" title="Figure 7.2. Samba Domain: Samba Member Server">“Samba Domain: Samba Member Server”</a> demonstrates the relationship of Samba and system 288 288 components that are involved in the identity resolution process where Samba is used as a domain 289 289 member server within a Samba domain control network. 290 290 </p><div class="figure"><a name="ch9-sambadc"></a><p class="title"><b>Figure 7.2. Samba Domain: Samba Member Server</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap9-SambaDC.png" width="324" alt="Samba Domain: Samba Member Server"></div></div></div><br class="figure-break"><p> 291 <a class="indexterm" name="id3 54233"></a>292 <a class="indexterm" name="id3 54239"></a>291 <a class="indexterm" name="id376747"></a> 292 <a class="indexterm" name="id376754"></a> 293 293 In this example configuration, Samba will directly search the LDAP-based passwd backend ldapsam 294 294 to obtain authentication and user identity information. The IDMAP information is stored in the LDAP … … 298 298 NSS will ensure that all UNIX processes will obtain a consistent UID/GID. 299 299 </p><p> 300 The instructions given here apply to the Samba environment shown in <a href="happy.html" title="Chapter 5. Making Happy Users">???</a> and <a href="2000users.html" title="Chapter 6. A Distributed 2000-User Network">???</a>.301 If the network does not have an LDAP slave server (i.e., <a href="happy.html" title="Chapter 5. Making Happy Users">???</a> configuration),300 The instructions given here apply to the Samba environment shown in <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a> and <a class="link" href="2000users.html" title="Chapter 6. A Distributed 2000-User Network">“A Distributed 2000-User Network”</a>. 301 If the network does not have an LDAP slave server (i.e., <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a> configuration), 302 302 change the target LDAP server from <code class="constant">lapdc</code> to <code class="constant">massive.</code> 303 </p><div class="procedure"><a name="id3 54281"></a><p class="title"><b>Procedure 7.1. Configuration of NSS_LDAP-Based Identity Resolution</b></p><ol type="1"><li><p>304 Create the <code class="filename">smb.conf</code> file as shown in <a href="unixclients.html#ch9-sdmsdc" title="Example 7.1. Samba Domain Member in Samba Domain Using LDAP smb.conf File">???</a>. Locate303 </p><div class="procedure"><a name="id376795"></a><p class="title"><b>Procedure 7.1. Configuration of NSS_LDAP-Based Identity Resolution</b></p><ol type="1"><li><p> 304 Create the <code class="filename">smb.conf</code> file as shown in <a class="link" href="unixclients.html#ch9-sdmsdc" title="Example 7.1. Samba Domain Member in Samba Domain Using LDAP smb.conf File">“Samba Domain Member in Samba Domain Using LDAP smb.conf File”</a>. Locate 305 305 this file in the directory <code class="filename">/etc/samba</code>. 306 306 </p></li><li><p> 307 <a class="indexterm" name="id3 54318"></a>307 <a class="indexterm" name="id376832"></a> 308 308 Configure the file that will be used by <code class="constant">nss_ldap</code> to 309 309 locate and communicate with the LDAP server. This file is called <code class="filename">ldap.conf</code>. … … 317 317 </p><p> 318 318 Change the parameters inside the file that is located on your OS so it matches 319 <a href="unixclients.html#ch9-sdmlcnf" title="Example 7.3. Configuration File for NSS LDAP Support /etc/ldap.conf">???</a>. To find the correct location of this file, you319 <a class="link" href="unixclients.html#ch9-sdmlcnf" title="Example 7.3. Configuration File for NSS LDAP Support /etc/ldap.conf">“Configuration File for NSS LDAP Support /etc/ldap.conf”</a>. To find the correct location of this file, you 320 320 can obtain this from the library that will be used by executing the following: 321 321 </p><pre class="screen"> … … 325 325 </p></li><li><p> 326 326 Configure the NSS control file so it matches the one shown in 327 <a href="unixclients.html#ch9-sdmnss" title="Example 7.4. NSS using LDAP for Identity Resolution File: /etc/nsswitch.conf">???</a>.328 </p></li><li><p> 329 <a class="indexterm" name="id3 54398"></a>330 <a class="indexterm" name="id3 54405"></a>327 <a class="link" href="unixclients.html#ch9-sdmnss" title="Example 7.4. NSS using LDAP for Identity Resolution File: /etc/nsswitch.conf">“NSS using LDAP for Identity Resolution File: /etc/nsswitch.conf”</a>. 328 </p></li><li><p> 329 <a class="indexterm" name="id376912"></a> 330 <a class="indexterm" name="id376919"></a> 331 331 Before proceeding to configure Samba, validate the operation of the NSS identity 332 332 resolution via LDAP by executing: … … 363 363 sammy:x:4321: 364 364 </pre><p> 365 <a class="indexterm" name="id3 54446"></a>366 <a class="indexterm" name="id3 54453"></a>367 <a class="indexterm" name="id3 54460"></a>365 <a class="indexterm" name="id376966"></a> 366 <a class="indexterm" name="id376973"></a> 367 <a class="indexterm" name="id376980"></a> 368 368 This shows that all is working as it should be. Notice that in the LDAP database 369 369 the users' primary and secondary group memberships are identical. It is not … … 375 375 after Samba-3.0.20 has been released. 376 376 </p></li><li><p> 377 <a class="indexterm" name="id3 54479"></a>377 <a class="indexterm" name="id376998"></a> 378 378 The LDAP directory must have a container object for IDMAP data. There are several ways you can 379 379 check that your LDAP database is able to receive IDMAP information. One of the simplest is to … … 384 384 ou: idmap 385 385 </pre><p> 386 <a class="indexterm" name="id3 54499"></a>386 <a class="indexterm" name="id377019"></a> 387 387 If the execution of this command does not return IDMAP entries, you need to create an LDIF 388 template file (see <a href="unixclients.html#ch9-ldifadd" title="Example 7.2. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF">???</a>). You can add the required entries using388 template file (see <a class="link" href="unixclients.html#ch9-ldifadd" title="Example 7.2. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF">“LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF”</a>). You can add the required entries using 389 389 the following command: 390 390 </p><pre class="screen"> … … 400 400 </pre><p> 401 401 </p></li><li><p> 402 <a class="indexterm" name="id3 54558"></a>403 <a class="indexterm" name="id3 54570"></a>402 <a class="indexterm" name="id377078"></a> 403 <a class="indexterm" name="id377089"></a> 404 404 The system is ready to join the domain. Execute the following: 405 405 </p><pre class="screen"> … … 419 419 <code class="prompt">root# </code> net rpc join -S 'pdc-name' -U administrator%password -d 5 420 420 </pre><p> 421 <a class="indexterm" name="id3 54636"></a>422 <a class="indexterm" name="id3 54643"></a>423 <a class="indexterm" name="id3 54650"></a>424 <a class="indexterm" name="id3 54657"></a>421 <a class="indexterm" name="id377156"></a> 422 <a class="indexterm" name="id377163"></a> 423 <a class="indexterm" name="id377169"></a> 424 <a class="indexterm" name="id377176"></a> 425 425 Note: Use "root" for UNIX/Linux and Samba, use "Administrator" for Windows NT4/200X. If the cause of 426 426 the failure appears to be related to a rejected or failed NT_SESSION_SETUP* or an error message that … … 450 450 </pre><p> 451 451 </p></li><li><p> 452 <a class="indexterm" name="id3 54709"></a>452 <a class="indexterm" name="id377228"></a> 453 453 Just joining the domain is not quite enough; you must now provide a privileged set 454 454 of credentials through which <code class="literal">winbindd</code> can interact with the … … 461 461 You may now start Samba in the usual manner, and your Samba domain member server 462 462 is ready for use. Just add shares as required. 463 </p></li></ol></div><div class="example"><a name="ch9-sdmsdc"></a><p class="title"><b>Example 7.1. Samba Domain Member in Samba Domain Using LDAP <code class="filename">smb.conf</code> File</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id3 54782"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id354794"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id354807"></a><em class="parameter"><code>security = DOMAIN</code></em></td></tr><tr><td><a class="indexterm" name="id354819"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id354832"></a><em class="parameter"><code>log level = 10</code></em></td></tr><tr><td><a class="indexterm" name="id354844"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id354857"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id354870"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id354882"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id354895"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id354907"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id354920"></a><em class="parameter"><code>wins server = 192.168.2.1</code></em></td></tr><tr><td><a class="indexterm" name="id354933"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id354945"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id354958"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id354971"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id354983"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id354996"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id355009"></a><em class="parameter"><code>idmap backend = ldap:ldap://lapdc.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id355022"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id355034"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id355047"></a><em class="parameter"><code>winbind trusted domains only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id355059"></a><em class="parameter"><code>printer admin = root</code></em></td></tr><tr><td><a class="indexterm" name="id355072"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id355093"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id355106"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id355119"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id355131"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id355153"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id355165"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id355178"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id355190"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id355203"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id355224"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id355237"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id355250"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id355262"></a><em class="parameter"><code>write list = root</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch9-ldifadd"></a><p class="title"><b>Example 7.2. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF</b></p><div class="example-contents"><pre class="screen">463 </p></li></ol></div><div class="example"><a name="ch9-sdmsdc"></a><p class="title"><b>Example 7.1. Samba Domain Member in Samba Domain Using LDAP <code class="filename">smb.conf</code> File</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id377301"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id377313"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id377324"></a><em class="parameter"><code>security = DOMAIN</code></em></td></tr><tr><td><a class="indexterm" name="id377336"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id377347"></a><em class="parameter"><code>log level = 10</code></em></td></tr><tr><td><a class="indexterm" name="id377359"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id377370"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id377382"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id377393"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id377405"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id377416"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id377428"></a><em class="parameter"><code>wins server = 192.168.2.1</code></em></td></tr><tr><td><a class="indexterm" name="id377439"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id377451"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id377463"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id377474"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id377486"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id377497"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id377509"></a><em class="parameter"><code>idmap backend = ldap:ldap://lapdc.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id377521"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id377532"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id377544"></a><em class="parameter"><code>winbind trusted domains only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id377556"></a><em class="parameter"><code>printer admin = root</code></em></td></tr><tr><td><a class="indexterm" name="id377567"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id377587"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id377599"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id377610"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id377622"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id377642"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id377654"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id377665"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id377677"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id377688"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id377709"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id377720"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id377732"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id377744"></a><em class="parameter"><code>write list = root</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch9-ldifadd"></a><p class="title"><b>Example 7.2. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF</b></p><div class="example-contents"><pre class="screen"> 464 464 dn: ou=Idmap,dc=abmas,dc=biz 465 465 objectClass: organizationalUnit … … 508 508 The Samba domain member server must be part of a Windows NT4 Domain, or a Samba Domain. 509 509 </p></li></ul></div><p> 510 <a class="indexterm" name="id3 55383"></a>511 <a class="indexterm" name="id3 55390"></a>512 <a class="indexterm" name="id3 55396"></a>510 <a class="indexterm" name="id377863"></a> 511 <a class="indexterm" name="id377870"></a> 512 <a class="indexterm" name="id377877"></a> 513 513 Later in the chapter, you can see how to configure a Samba domain member server for a Windows ADS domain. 514 514 Right now your objective is to configure a Samba server that can be a member of a Windows NT4-style 515 515 domain and/or does not use LDAP. 516 516 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 517 <a class="indexterm" name="id3 55410"></a>517 <a class="indexterm" name="id377890"></a> 518 518 If you use <code class="literal">winbind</code> for identity resolution, make sure that there are no 519 519 duplicate accounts. 520 520 </p><p> 521 <a class="indexterm" name="id3 55426"></a>521 <a class="indexterm" name="id377907"></a> 522 522 For example, do not have more than one account that has UID=0 in the password database. If there 523 523 is an account called <code class="constant">root</code> in the <code class="filename">/etc/passwd</code> database, … … 527 527 <code class="constant">root</code>. 528 528 </p><p> 529 <a class="indexterm" name="id3 55460"></a>530 <a class="indexterm" name="id3 55467"></a>531 <a class="indexterm" name="id3 55474"></a>529 <a class="indexterm" name="id377940"></a> 530 <a class="indexterm" name="id377947"></a> 531 <a class="indexterm" name="id377954"></a> 532 532 Winbind will break if there is an account in <code class="filename">/etc/passwd</code> that has 533 533 the same UID as an account that is in LDAP ldapsam (or in tdbsam) but that differs in name only. 534 534 </p></div><p> 535 <a class="indexterm" name="id3 55491"></a>536 <a class="indexterm" name="id3 55498"></a>537 <a class="indexterm" name="id3 55504"></a>538 <a class="indexterm" name="id3 55511"></a>539 <a class="indexterm" name="id3 55520"></a>535 <a class="indexterm" name="id377971"></a> 536 <a class="indexterm" name="id377978"></a> 537 <a class="indexterm" name="id377985"></a> 538 <a class="indexterm" name="id377991"></a> 539 <a class="indexterm" name="id378001"></a> 540 540 The following configuration uses CIFS/SMB protocols alone to obtain user and group credentials. 541 541 The winbind information is locally cached in the <code class="filename">winbindd_cache.tdb winbindd_idmap.tdb</code> … … 544 544 files using the tool <code class="literal">tdbdump</code>, though you may have to build this from the Samba 545 545 source code if it has not been supplied as part of a binary package distribution that you may be using. 546 </p><div class="procedure"><a name="id3 55545"></a><p class="title"><b>Procedure 7.2. Configuration of Winbind-Based Identity Resolution</b></p><ol type="1"><li><p>546 </p><div class="procedure"><a name="id378025"></a><p class="title"><b>Procedure 7.2. Configuration of Winbind-Based Identity Resolution</b></p><ol type="1"><li><p> 547 547 Using your favorite text editor, create the <code class="filename">smb.conf</code> file so it has the contents 548 shown in <a href="unixclients.html#ch0-NT4DSDM" title="Example 7.5. Samba Domain Member Server Using Winbind smb.conf File for NT4 Domain">???</a>.549 </p></li><li><p> 550 <a class="indexterm" name="id3 55576"></a>548 shown in <a class="link" href="unixclients.html#ch0-NT4DSDM" title="Example 7.5. Samba Domain Member Server Using Winbind smb.conf File for NT4 Domain">“Samba Domain Member Server Using Winbind smb.conf File for NT4 Domain”</a>. 549 </p></li><li><p> 550 <a class="indexterm" name="id378056"></a> 551 551 Edit the <code class="filename">/etc/nsswitch.conf</code> so it has the entries shown in 552 <a href="unixclients.html#ch9-sdmnss" title="Example 7.4. NSS using LDAP for Identity Resolution File: /etc/nsswitch.conf">???</a>.553 </p></li><li><p> 554 <a class="indexterm" name="id3 55601"></a>552 <a class="link" href="unixclients.html#ch9-sdmnss" title="Example 7.4. NSS using LDAP for Identity Resolution File: /etc/nsswitch.conf">“NSS using LDAP for Identity Resolution File: /etc/nsswitch.conf”</a>. 553 </p></li><li><p> 554 <a class="indexterm" name="id378081"></a> 555 555 The system is ready to join the domain. Execute the following: 556 556 </p><pre class="screen"> … … 561 561 562 562 </p></li><li><p> 563 <a class="indexterm" name="id3 55626"></a>564 <a class="indexterm" name="id3 55633"></a>563 <a class="indexterm" name="id378106"></a> 564 <a class="indexterm" name="id378113"></a> 565 565 Validate operation of <code class="literal">winbind</code> using the <code class="literal">wbinfo</code> 566 566 tool as follows: … … 589 589 This shows that domain groups have been correctly obtained also. 590 590 </p></li><li><p> 591 <a class="indexterm" name="id3 55685"></a>592 <a class="indexterm" name="id3 55691"></a>593 <a class="indexterm" name="id3 55698"></a>591 <a class="indexterm" name="id378165"></a> 592 <a class="indexterm" name="id378171"></a> 593 <a class="indexterm" name="id378178"></a> 594 594 The next step verifies that NSS is able to obtain this information 595 595 correctly from <code class="literal">winbind</code> also. … … 632 632 </p></li><li><p> 633 633 The Samba member server of a Windows NT4 domain is ready for use. 634 </p></li></ol></div><div class="example"><a name="ch0-NT4DSDM"></a><p class="title"><b>Example 7.5. Samba Domain Member Server Using Winbind <code class="filename">smb.conf</code> File for NT4 Domain</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id3 55794"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id355807"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id355819"></a><em class="parameter"><code>security = DOMAIN</code></em></td></tr><tr><td><a class="indexterm" name="id355832"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id355844"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id355857"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id355870"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id355882"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id355895"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id355907"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id355920"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id355932"></a><em class="parameter"><code>wins server = 192.168.2.1</code></em></td></tr><tr><td><a class="indexterm" name="id355945"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id355958"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id355970"></a><em class="parameter"><code>template primary group = "Domain Users"</code></em></td></tr><tr><td><a class="indexterm" name="id355983"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id355996"></a><em class="parameter"><code>winbind separator = +</code></em></td></tr><tr><td><a class="indexterm" name="id356008"></a><em class="parameter"><code>printer admin = root</code></em></td></tr><tr><td><a class="indexterm" name="id356021"></a><em class="parameter"><code>hosts allow = 192.168.2., 192.168.3., 127.</code></em></td></tr><tr><td><a class="indexterm" name="id356033"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id356055"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id356068"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id356080"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id356093"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id356114"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id356127"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id356139"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id356152"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id356164"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id356186"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id356198"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id356211"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id356224"></a><em class="parameter"><code>write list = root</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="dcwonss"></a>NT4/Samba Domain with Samba Domain Member Server without NSS Support</h3></div></div></div><p>634 </p></li></ol></div><div class="example"><a name="ch0-NT4DSDM"></a><p class="title"><b>Example 7.5. Samba Domain Member Server Using Winbind <code class="filename">smb.conf</code> File for NT4 Domain</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id378274"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id378286"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id378297"></a><em class="parameter"><code>security = DOMAIN</code></em></td></tr><tr><td><a class="indexterm" name="id378309"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id378320"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id378332"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id378343"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id378355"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id378366"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id378378"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id378389"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id378401"></a><em class="parameter"><code>wins server = 192.168.2.1</code></em></td></tr><tr><td><a class="indexterm" name="id378412"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id378424"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id378435"></a><em class="parameter"><code>template primary group = "Domain Users"</code></em></td></tr><tr><td><a class="indexterm" name="id378447"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id378459"></a><em class="parameter"><code>winbind separator = +</code></em></td></tr><tr><td><a class="indexterm" name="id378470"></a><em class="parameter"><code>printer admin = root</code></em></td></tr><tr><td><a class="indexterm" name="id378482"></a><em class="parameter"><code>hosts allow = 192.168.2., 192.168.3., 127.</code></em></td></tr><tr><td><a class="indexterm" name="id378493"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id378514"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id378525"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id378537"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id378548"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id378569"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id378580"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id378592"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id378603"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id378615"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id378635"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id378647"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id378658"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id378670"></a><em class="parameter"><code>write list = root</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="dcwonss"></a>NT4/Samba Domain with Samba Domain Member Server without NSS Support</h3></div></div></div><p> 635 635 No matter how many UNIX/Linux administrators there may be who believe that a UNIX operating 636 636 system that does not have NSS and PAM support to be outdated, the fact is there … … 643 643 is found, it is used. If the account is not found, one will be automatically created 644 644 on the local machine so that it can then be used for all access controls. 645 </p><div class="procedure"><a name="id3 56261"></a><p class="title"><b>Procedure 7.3. Configuration Using Local Accounts Only</b></p><ol type="1"><li><p>645 </p><div class="procedure"><a name="id378706"></a><p class="title"><b>Procedure 7.3. Configuration Using Local Accounts Only</b></p><ol type="1"><li><p> 646 646 Using your favorite text editor, create the <code class="filename">smb.conf</code> file so it has the contents 647 shown in <a href="unixclients.html#ch0-NT4DSCM" title="Example 7.6. Samba Domain Member Server Using Local Accounts smb.conf File for NT4 Domain">???</a>.648 </p></li><li><p><a class="indexterm" name="id3 56292"></a>647 shown in <a class="link" href="unixclients.html#ch0-NT4DSCM" title="Example 7.6. Samba Domain Member Server Using Local Accounts smb.conf File for NT4 Domain">“Samba Domain Member Server Using Local Accounts smb.conf File for NT4 Domain”</a>. 648 </p></li><li><p><a class="indexterm" name="id378737"></a> 649 649 The system is ready to join the domain. Execute the following: 650 650 </p><pre class="screen"> … … 657 657 </p></li><li><p> 658 658 The Samba member server of a Windows NT4 domain is ready for use. 659 </p></li></ol></div><div class="example"><a name="ch0-NT4DSCM"></a><p class="title"><b>Example 7.6. Samba Domain Member Server Using Local Accounts <code class="filename">smb.conf</code> File for NT4 Domain</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id3 56377"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id356390"></a><em class="parameter"><code>workgroup = MEGANET3</code></em></td></tr><tr><td><a class="indexterm" name="id356402"></a><em class="parameter"><code>netbios name = BSDBOX</code></em></td></tr><tr><td><a class="indexterm" name="id356415"></a><em class="parameter"><code>security = DOMAIN</code></em></td></tr><tr><td><a class="indexterm" name="id356428"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id356440"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id356453"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id356465"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id356478"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -M '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id356491"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id356504"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id356516"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id356529"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id356541"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id356554"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id356567"></a><em class="parameter"><code>wins server = 192.168.2.1</code></em></td></tr><tr><td><a class="indexterm" name="id356579"></a><em class="parameter"><code>printer admin = root</code></em></td></tr><tr><td><a class="indexterm" name="id356592"></a><em class="parameter"><code>hosts allow = 192.168.2., 192.168.3., 127.</code></em></td></tr><tr><td><a class="indexterm" name="id356605"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id356626"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id356639"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id356651"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id356664"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id356685"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id356698"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id356710"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id356723"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id356736"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id356757"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id356770"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id356782"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id356795"></a><em class="parameter"><code>write list = root</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="adssdm"></a>Active Directory Domain with Samba Domain Member Server</h3></div></div></div><p>660 <a class="indexterm" name="id3 56821"></a>661 <a class="indexterm" name="id3 56830"></a>662 <a class="indexterm" name="id3 56837"></a>659 </p></li></ol></div><div class="example"><a name="ch0-NT4DSCM"></a><p class="title"><b>Example 7.6. Samba Domain Member Server Using Local Accounts <code class="filename">smb.conf</code> File for NT4 Domain</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id378822"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id378834"></a><em class="parameter"><code>workgroup = MEGANET3</code></em></td></tr><tr><td><a class="indexterm" name="id378845"></a><em class="parameter"><code>netbios name = BSDBOX</code></em></td></tr><tr><td><a class="indexterm" name="id378857"></a><em class="parameter"><code>security = DOMAIN</code></em></td></tr><tr><td><a class="indexterm" name="id378868"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id378880"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id378891"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id378903"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id378914"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -M '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id378926"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id378938"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id378950"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id378961"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id378972"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id378984"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id378996"></a><em class="parameter"><code>wins server = 192.168.2.1</code></em></td></tr><tr><td><a class="indexterm" name="id379007"></a><em class="parameter"><code>printer admin = root</code></em></td></tr><tr><td><a class="indexterm" name="id379019"></a><em class="parameter"><code>hosts allow = 192.168.2., 192.168.3., 127.</code></em></td></tr><tr><td><a class="indexterm" name="id379030"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id379051"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id379062"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id379074"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id379085"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id379106"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id379117"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id379129"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id379140"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id379152"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id379172"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id379184"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id379195"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id379207"></a><em class="parameter"><code>write list = root</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="adssdm"></a>Active Directory Domain with Samba Domain Member Server</h3></div></div></div><p> 660 <a class="indexterm" name="id379232"></a> 661 <a class="indexterm" name="id379241"></a> 662 <a class="indexterm" name="id379248"></a> 663 663 One of the much-sought-after features new to Samba-3 is the ability to join an Active Directory 664 664 domain using Kerberos protocols. This makes it possible to operate an entire Windows network … … 668 668 in. For now, we simply focus on how a Samba-3 server can be made a domain member server. 669 669 </p><p> 670 <a class="indexterm" name="id3 56854"></a>671 <a class="indexterm" name="id3 56861"></a>672 <a class="indexterm" name="id3 56868"></a>673 <a class="indexterm" name="id3 56874"></a>674 The diagram in <a href="unixclients.html#ch9-adsdc" title="Figure 7.3. Active Directory Domain: Samba Member Server">???</a> demonstrates how Samba-3 interfaces with670 <a class="indexterm" name="id379265"></a> 671 <a class="indexterm" name="id379272"></a> 672 <a class="indexterm" name="id379278"></a> 673 <a class="indexterm" name="id379285"></a> 674 The diagram in <a class="link" href="unixclients.html#ch9-adsdc" title="Figure 7.3. Active Directory Domain: Samba Member Server">“Active Directory Domain: Samba Member Server”</a> demonstrates how Samba-3 interfaces with 675 675 Microsoft Active Directory components. It should be noted that if Microsoft Windows Services 676 676 for UNIX (SFU) has been installed and correctly configured, it is possible to use client LDAP … … 695 695 is known as <code class="constant">w2k3s.london.abmas.biz</code>. In NetBIOS nomenclature, the 696 696 domain name is <code class="constant">LONDON</code> and the server name is <code class="constant">W2K3S</code>. 697 </p><div class="figure"><a name="ch9-adsdc"></a><p class="title"><b>Figure 7.3. Active Directory Domain: Samba Member Server</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap9-ADSDC.png" width="324" alt="Active Directory Domain: Samba Member Server"></div></div></div><br class="figure-break"><div class="procedure"><a name="id3 56974"></a><p class="title"><b>Procedure 7.4. Joining a Samba Server as an ADS Domain Member</b></p><ol type="1"><li><p>698 <a class="indexterm" name="id3 56985"></a>697 </p><div class="figure"><a name="ch9-adsdc"></a><p class="title"><b>Figure 7.3. Active Directory Domain: Samba Member Server</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap9-ADSDC.png" width="324" alt="Active Directory Domain: Samba Member Server"></div></div></div><br class="figure-break"><div class="procedure"><a name="id379385"></a><p class="title"><b>Procedure 7.4. Joining a Samba Server as an ADS Domain Member</b></p><ol type="1"><li><p> 698 <a class="indexterm" name="id379396"></a> 699 699 Before you try to use Samba-3, you want to know for certain that your executables have 700 700 support for Kerberos and for LDAP. Execute the following to identify whether or … … 763 763 support. You are relieved to know that it is safe to progress. 764 764 </p></li><li><p> 765 <a class="indexterm" name="id3 57067"></a>766 <a class="indexterm" name="id3 57076"></a>767 <a class="indexterm" name="id3 57083"></a>768 <a class="indexterm" name="id3 57090"></a>769 <a class="indexterm" name="id3 57099"></a>770 <a class="indexterm" name="id3 57108"></a>771 <a class="indexterm" name="id3 57115"></a>772 <a class="indexterm" name="id3 57122"></a>773 <a class="indexterm" name="id3 57129"></a>765 <a class="indexterm" name="id379478"></a> 766 <a class="indexterm" name="id379487"></a> 767 <a class="indexterm" name="id379494"></a> 768 <a class="indexterm" name="id379501"></a> 769 <a class="indexterm" name="id379510"></a> 770 <a class="indexterm" name="id379519"></a> 771 <a class="indexterm" name="id379526"></a> 772 <a class="indexterm" name="id379533"></a> 773 <a class="indexterm" name="id379540"></a> 774 774 The next step is to identify which version of the Kerberos libraries have been used. 775 775 In order to permit Samba-3 to interoperate with Windows 2003 Active Directory, it is … … 787 787 Please note that the RPMs provided by the Samba-Team are known to be working and have 788 788 been validated. Red Hat Linux RPMs may be obtained from the Samba FTP sites. SUSE 789 Linux RPMs may be obtained from <a href="ftp://ftp.sernet.de" target="_top">Sernet</a> in789 Linux RPMs may be obtained from <a class="ulink" href="ftp://ftp.sernet.de" target="_top">Sernet</a> in 790 790 Germany. 791 791 </p><p> … … 795 795 Using you favorite editor, configure the <code class="filename">smb.conf</code> file that is located in the 796 796 <code class="filename">/etc/samba</code> directory so that it has the contents shown 797 in <a href="unixclients.html#ch9-adssdm" title="Example 7.7. Samba Domain Member smb.conf File for Active Directory Membership">???</a>.798 </p></li><li><p> 799 Edit or create the NSS control file so it has the contents shown in <a href="unixclients.html#ch9-sdmnss" title="Example 7.4. NSS using LDAP for Identity Resolution File: /etc/nsswitch.conf">???</a>.800 </p></li><li><p> 801 <a class="indexterm" name="id3 57221"></a>797 in <a class="link" href="unixclients.html#ch9-adssdm" title="Example 7.7. Samba Domain Member smb.conf File for Active Directory Membership">“Samba Domain Member smb.conf File for Active Directory Membership”</a>. 798 </p></li><li><p> 799 Edit or create the NSS control file so it has the contents shown in <a class="link" href="unixclients.html#ch9-sdmnss" title="Example 7.4. NSS using LDAP for Identity Resolution File: /etc/nsswitch.conf">“NSS using LDAP for Identity Resolution File: /etc/nsswitch.conf”</a>. 800 </p></li><li><p> 801 <a class="indexterm" name="id379632"></a> 802 802 Delete the file <code class="filename">/etc/samba/secrets.tdb</code> if it exists. Of course, you 803 803 do keep a backup, don't you? … … 810 810 </pre><p> 811 811 </p></li><li><p> 812 <a class="indexterm" name="id3 57261"></a>812 <a class="indexterm" name="id379672"></a> 813 813 Validate your <code class="filename">smb.conf</code> file using <code class="literal">testparm</code> (as you have 814 814 done previously). Correct all errors reported before proceeding. The command you … … 820 820 ADS domain, let's move on. 821 821 </p></li><li><p> 822 <a class="indexterm" name="id3 57300"></a>823 <a class="indexterm" name="id3 57311"></a>822 <a class="indexterm" name="id379711"></a> 823 <a class="indexterm" name="id379722"></a> 824 824 This is a good time to double-check everything and then execute the following 825 825 command when everything you have done has checked out okay: … … 832 832 using Kerberos protocols. 833 833 </p><p> 834 <a class="indexterm" name="id3 57336"></a>835 <a class="indexterm" name="id3 57342"></a>834 <a class="indexterm" name="id379746"></a> 835 <a class="indexterm" name="id379753"></a> 836 836 In the event that you receive no output messages, a silent return means that the 837 837 domain join failed. You should use <code class="literal">ethereal</code> to identify what … … 839 839 840 840 </p><div class="itemizedlist"><ul type="disc"><li><p> 841 <a class="indexterm" name="id3 57362"></a>841 <a class="indexterm" name="id379773"></a> 842 842 Defective or misconfigured DNS name resolution. 843 843 </p></li><li><p> 844 <a class="indexterm" name="id3 57376"></a>844 <a class="indexterm" name="id379787"></a> 845 845 Restrictive security settings on the Windows 200x ADS domain controller 846 846 preventing needed communications protocols. You can check this by searching … … 854 854 </p></li></ul></div><p> 855 855 856 <a class="indexterm" name="id3 57404"></a>857 <a class="indexterm" name="id3 57415"></a>858 <a class="indexterm" name="id3 57421"></a>856 <a class="indexterm" name="id379814"></a> 857 <a class="indexterm" name="id379825"></a> 858 <a class="indexterm" name="id379832"></a> 859 859 In any case, never execute the <code class="literal">net rpc join</code> command in an attempt 860 860 to join the Samba server to the domain, unless you wish not to use the Kerberos … … 862 862 Windows Server 200x ADS has been configured appropriately for mixed mode operation. 863 863 </p></li><li><p> 864 <a class="indexterm" name="id3 57443"></a>865 <a class="indexterm" name="id3 57450"></a>864 <a class="indexterm" name="id379854"></a> 865 <a class="indexterm" name="id379861"></a> 866 866 If the <code class="literal">tdbdump</code> is installed on your system (not essential), 867 867 you can look inside the <code class="filename">/etc/samba/secrets.tdb</code> file. If … … 894 894 in this book). 895 895 </p></li><li><p> 896 <a class="indexterm" name="id3 57500"></a>896 <a class="indexterm" name="id379911"></a> 897 897 This is a good time to verify that everything is working. First, check that 898 898 winbind is able to obtain the list of users and groups from the ADS domain controller. … … 920 920 </pre><p> 921 921 Excellent. That worked also, as expected. 922 </p></li><li><p><a class="indexterm" name="id3 57541"></a>922 </p></li><li><p><a class="indexterm" name="id379952"></a> 923 923 Now repeat this via NSS to validate that full identity resolution is 924 924 functional as required. Execute: … … 953 953 This is very pleasing. Everything works as expected. 954 954 </p></li><li><p> 955 <a class="indexterm" name="id3 57589"></a>956 <a class="indexterm" name="id3 57600"></a>957 <a class="indexterm" name="id3 57609"></a>955 <a class="indexterm" name="id380000"></a> 956 <a class="indexterm" name="id380011"></a> 957 <a class="indexterm" name="id380020"></a> 958 958 You may now perform final verification that communications between Samba-3 winbind and 959 959 the Active Directory server is using Kerberos protocols. Execute the following: … … 973 973 In any case, the output we obtained confirms that all systems are operational. 974 974 </p></li><li><p> 975 <a class="indexterm" name="id3 57639"></a>975 <a class="indexterm" name="id380050"></a> 976 976 There is one more action you elect to take, just because you are paranoid and disbelieving, 977 977 so you execute the following command: … … 1143 1143 Now all is revealed. Your curiosity, as well as that of your team, has been put at ease. 1144 1144 May this server serve well all who happen upon it. 1145 </p><div class="example"><a name="ch9-adssdm"></a><p class="title"><b>Example 7.7. Samba Domain Member <code class="filename">smb.conf</code> File for Active Directory Membership</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id3 57811"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id357824"></a><em class="parameter"><code>workgroup = LONDON</code></em></td></tr><tr><td><a class="indexterm" name="id357836"></a><em class="parameter"><code>realm = LONDON.ABMAS.BIZ</code></em></td></tr><tr><td><a class="indexterm" name="id357849"></a><em class="parameter"><code>server string = Samba 3.0.20</code></em></td></tr><tr><td><a class="indexterm" name="id357862"></a><em class="parameter"><code>security = ADS</code></em></td></tr><tr><td><a class="indexterm" name="id357874"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id357887"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id357899"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id357912"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id357925"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id357937"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id357950"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id357962"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id357975"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id357987"></a><em class="parameter"><code>template primary group = "Domain Users"</code></em></td></tr><tr><td><a class="indexterm" name="id358000"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id358013"></a><em class="parameter"><code>winbind separator = +</code></em></td></tr><tr><td><a class="indexterm" name="id358025"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id358047"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id358059"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id358072"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id358084"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id358106"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id358118"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id358131"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id358144"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id358156"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id358178"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id358190"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id358203"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id358216"></a><em class="parameter"><code>write list = root</code></em></td></tr></table></div></div><br class="example-break"><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id358229"></a>IDMAP_RID with Winbind</h4></div></div></div><p>1146 <a class="indexterm" name="id3 58237"></a>1147 <a class="indexterm" name="id3 58244"></a>1148 <a class="indexterm" name="id3 58250"></a>1149 <a class="indexterm" name="id3 58257"></a>1145 </p><div class="example"><a name="ch9-adssdm"></a><p class="title"><b>Example 7.7. Samba Domain Member <code class="filename">smb.conf</code> File for Active Directory Membership</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id380204"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id380215"></a><em class="parameter"><code>workgroup = LONDON</code></em></td></tr><tr><td><a class="indexterm" name="id380227"></a><em class="parameter"><code>realm = LONDON.ABMAS.BIZ</code></em></td></tr><tr><td><a class="indexterm" name="id380238"></a><em class="parameter"><code>server string = Samba 3.0.20</code></em></td></tr><tr><td><a class="indexterm" name="id380250"></a><em class="parameter"><code>security = ADS</code></em></td></tr><tr><td><a class="indexterm" name="id380262"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id380273"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id380285"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id380296"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id380308"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id380319"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id380331"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id380342"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id380354"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id380365"></a><em class="parameter"><code>template primary group = "Domain Users"</code></em></td></tr><tr><td><a class="indexterm" name="id380377"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id380388"></a><em class="parameter"><code>winbind separator = +</code></em></td></tr><tr><td><a class="indexterm" name="id380400"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id380420"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id380432"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id380443"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id380455"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id380475"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id380487"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id380498"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id380510"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id380521"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id380541"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id380553"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id380565"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id380576"></a><em class="parameter"><code>write list = root</code></em></td></tr></table></div></div><br class="example-break"><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id380589"></a>IDMAP_RID with Winbind</h4></div></div></div><p> 1146 <a class="indexterm" name="id380596"></a> 1147 <a class="indexterm" name="id380603"></a> 1148 <a class="indexterm" name="id380610"></a> 1149 <a class="indexterm" name="id380616"></a> 1150 1150 The <code class="literal">idmap_rid</code> facility is a new tool that, unlike native winbind, creates a 1151 1151 predictable mapping of MS Windows SIDs to UNIX UIDs and GIDs. The key benefit of this method … … 1154 1154 is not compatible with trusted domain implementations. 1155 1155 </p><p> 1156 <a class="indexterm" name="id3 58276"></a>1157 <a class="indexterm" name="id3 58283"></a>1158 <a class="indexterm" name="id3 58290"></a>1159 <a class="indexterm" name="id3 58297"></a>1156 <a class="indexterm" name="id380636"></a> 1157 <a class="indexterm" name="id380643"></a> 1158 <a class="indexterm" name="id380649"></a> 1159 <a class="indexterm" name="id380656"></a> 1160 1160 This alternate method of SID to UID/GID mapping can be achieved with the idmap_rid 1161 1161 plug-in. This plug-in uses the RID of the user SID to derive the UID and GID by adding the … … 1165 1165 <em class="parameter"><code>idmap gid</code></em> ranges must be specified. 1166 1166 </p><p> 1167 <a class="indexterm" name="id3 58326"></a>1168 <a class="indexterm" name="id3 58333"></a>1167 <a class="indexterm" name="id380685"></a> 1168 <a class="indexterm" name="id380692"></a> 1169 1169 The idmap_rid facility can be used both for NT4/Samba-style domains as well as with Active Directory. 1170 1170 To use this with an NT4 domain, the <em class="parameter"><code>realm</code></em> is not used. Additionally the 1171 1171 method used to join the domain uses the <code class="constant">net rpc join</code> process. 1172 1172 </p><p> 1173 An example <code class="filename">smb.conf</code> file for an ADS domain environment is shown in <a href="unixclients.html#sbe-idmapridex" title="Example 7.8. Example smb.conf File Using idmap_rid">???</a>.1174 </p><div class="example"><a name="sbe-idmapridex"></a><p class="title"><b>Example 7.8. Example <code class="filename">smb.conf</code> File Using <code class="constant">idmap_rid</code></b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id3 58404"></a><em class="parameter"><code>workgroup = KPAK</code></em></td></tr><tr><td><a class="indexterm" name="id358417"></a><em class="parameter"><code>netbios name = BIGJOE</code></em></td></tr><tr><td><a class="indexterm" name="id358429"></a><em class="parameter"><code>realm = CORP.KPAK.COM</code></em></td></tr><tr><td><a class="indexterm" name="id358442"></a><em class="parameter"><code>server string = Office Server</code></em></td></tr><tr><td><a class="indexterm" name="id358455"></a><em class="parameter"><code>security = ADS</code></em></td></tr><tr><td><a class="indexterm" name="id358467"></a><em class="parameter"><code>allow trusted domains = No</code></em></td></tr><tr><td><a class="indexterm" name="id358480"></a><em class="parameter"><code>idmap backend = idmap_rid:KPAK=500-100000000</code></em></td></tr><tr><td><a class="indexterm" name="id358493"></a><em class="parameter"><code>idmap uid = 500-100000000</code></em></td></tr><tr><td><a class="indexterm" name="id358505"></a><em class="parameter"><code>idmap gid = 500-100000000</code></em></td></tr><tr><td><a class="indexterm" name="id358518"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id358531"></a><em class="parameter"><code>winbind use default domain = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id358543"></a><em class="parameter"><code>winbind enum users = No</code></em></td></tr><tr><td><a class="indexterm" name="id358556"></a><em class="parameter"><code>winbind enum groups = No</code></em></td></tr><tr><td><a class="indexterm" name="id358569"></a><em class="parameter"><code>winbind nested groups = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id358581"></a><em class="parameter"><code>printer admin = "KPAK\Domain Admins"</code></em></td></tr></table></div></div><br class="example-break"><p>1175 <a class="indexterm" name="id3 58597"></a>1176 <a class="indexterm" name="id3 58604"></a>1177 <a class="indexterm" name="id3 58611"></a>1178 <a class="indexterm" name="id3 58618"></a>1173 An example <code class="filename">smb.conf</code> file for an ADS domain environment is shown in <a class="link" href="unixclients.html#sbe-idmapridex" title="Example 7.8. Example smb.conf File Using idmap_rid">“Example smb.conf File Using idmap_rid”</a>. 1174 </p><div class="example"><a name="sbe-idmapridex"></a><p class="title"><b>Example 7.8. Example <code class="filename">smb.conf</code> File Using <code class="constant">idmap_rid</code></b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id380764"></a><em class="parameter"><code>workgroup = KPAK</code></em></td></tr><tr><td><a class="indexterm" name="id380775"></a><em class="parameter"><code>netbios name = BIGJOE</code></em></td></tr><tr><td><a class="indexterm" name="id380787"></a><em class="parameter"><code>realm = CORP.KPAK.COM</code></em></td></tr><tr><td><a class="indexterm" name="id380798"></a><em class="parameter"><code>server string = Office Server</code></em></td></tr><tr><td><a class="indexterm" name="id380810"></a><em class="parameter"><code>security = ADS</code></em></td></tr><tr><td><a class="indexterm" name="id380821"></a><em class="parameter"><code>allow trusted domains = No</code></em></td></tr><tr><td><a class="indexterm" name="id380833"></a><em class="parameter"><code>idmap backend = idmap_rid:KPAK=500-100000000</code></em></td></tr><tr><td><a class="indexterm" name="id380845"></a><em class="parameter"><code>idmap uid = 500-100000000</code></em></td></tr><tr><td><a class="indexterm" name="id380856"></a><em class="parameter"><code>idmap gid = 500-100000000</code></em></td></tr><tr><td><a class="indexterm" name="id380868"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id380880"></a><em class="parameter"><code>winbind use default domain = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id380891"></a><em class="parameter"><code>winbind enum users = No</code></em></td></tr><tr><td><a class="indexterm" name="id380903"></a><em class="parameter"><code>winbind enum groups = No</code></em></td></tr><tr><td><a class="indexterm" name="id380914"></a><em class="parameter"><code>winbind nested groups = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id380926"></a><em class="parameter"><code>printer admin = "KPAK\Domain Admins"</code></em></td></tr></table></div></div><br class="example-break"><p> 1175 <a class="indexterm" name="id380941"></a> 1176 <a class="indexterm" name="id380948"></a> 1177 <a class="indexterm" name="id380954"></a> 1178 <a class="indexterm" name="id380961"></a> 1179 1179 In a large domain with many users, it is imperative to disable enumeration of users and groups. 1180 1180 For example, at a site that has 22,000 users in Active Directory the winbind-based user and … … 1186 1186 below. 1187 1187 </p><p> 1188 <a class="indexterm" name="id3 58651"></a>1189 <a class="indexterm" name="id3 58657"></a>1188 <a class="indexterm" name="id380994"></a> 1189 <a class="indexterm" name="id381001"></a> 1190 1190 The use of this tool requires configuration of NSS as per the native use of winbind. Edit the 1191 1191 <code class="filename">/etc/nsswitch.conf</code> so it has the following parameters: … … 1213 1213 </pre><p> 1214 1214 </p><p> 1215 <a class="indexterm" name="id3 58732"></a>1215 <a class="indexterm" name="id381076"></a> 1216 1216 An invalid or failed join can be detected by executing: 1217 1217 </p><pre class="screen"> … … 1229 1229 </p></li><li><p> 1230 1230 Validate the operation of this configuration by executing: 1231 <a class="indexterm" name="id3 58794"></a>1231 <a class="indexterm" name="id381137"></a> 1232 1232 </p><pre class="screen"> 1233 1233 <code class="prompt">root# </code> getent passwd administrator 1234 1234 administrator:x:1000:1013:Administrator:/home/BE/administrator:/bin/bash 1235 1235 </pre><p> 1236 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 58814"></a>IDMAP Storage in LDAP using Winbind</h4></div></div></div><p>1237 <a class="indexterm" name="id3 58822"></a>1238 <a class="indexterm" name="id3 58829"></a>1236 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id381158"></a>IDMAP Storage in LDAP using Winbind</h4></div></div></div><p> 1237 <a class="indexterm" name="id381166"></a> 1238 <a class="indexterm" name="id381173"></a> 1239 1239 The storage of IDMAP information in LDAP can be used with both NT4/Samba-3-style domains as well as 1240 1240 with ADS domains. OpenLDAP is a commonly used LDAP server for this purpose, although any standards-compliant … … 1242 1242 the Sun iPlanet LDAP server, Novell eDirectory, Microsoft ADS plus ADAM, and so on. 1243 1243 </p><p> 1244 The example in <a href="unixclients.html#sbeunxa" title="Example 7.9. Typical ADS Style Domain smb.conf File">???</a> is for an ADS-style domain.1245 </p><div class="example"><a name="sbeunxa"></a><p class="title"><b>Example 7.9. Typical ADS Style Domain <code class="filename">smb.conf</code> File</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id3 58883"></a><em class="parameter"><code>workgroup = SNOWSHOW</code></em></td></tr><tr><td><a class="indexterm" name="id358896"></a><em class="parameter"><code>netbios name = GOODELF</code></em></td></tr><tr><td><a class="indexterm" name="id358908"></a><em class="parameter"><code>realm = SNOWSHOW.COM</code></em></td></tr><tr><td><a class="indexterm" name="id358921"></a><em class="parameter"><code>server string = Samba Server</code></em></td></tr><tr><td><a class="indexterm" name="id358934"></a><em class="parameter"><code>security = ADS</code></em></td></tr><tr><td><a class="indexterm" name="id358946"></a><em class="parameter"><code>log level = 1 ads:10 auth:10 sam:10 rpc:10</code></em></td></tr><tr><td><a class="indexterm" name="id358959"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=SNOWSHOW,dc=COM</code></em></td></tr><tr><td><a class="indexterm" name="id358972"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id358984"></a><em class="parameter"><code>ldap suffix = dc=SNOWSHOW,dc=COM</code></em></td></tr><tr><td><a class="indexterm" name="id358997"></a><em class="parameter"><code>idmap backend = ldap:ldap://ldap.snowshow.com</code></em></td></tr><tr><td><a class="indexterm" name="id359010"></a><em class="parameter"><code>idmap uid = 150000-550000</code></em></td></tr><tr><td><a class="indexterm" name="id359022"></a><em class="parameter"><code>idmap gid = 150000-550000</code></em></td></tr><tr><td><a class="indexterm" name="id359035"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id359048"></a><em class="parameter"><code>winbind use default domain = Yes</code></em></td></tr></table></div></div><br class="example-break"><p>1246 <a class="indexterm" name="id3 59064"></a>1244 The example in <a class="link" href="unixclients.html#sbeunxa" title="Example 7.9. Typical ADS Style Domain smb.conf File">“Typical ADS Style Domain smb.conf File”</a> is for an ADS-style domain. 1245 </p><div class="example"><a name="sbeunxa"></a><p class="title"><b>Example 7.9. Typical ADS Style Domain <code class="filename">smb.conf</code> File</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id381227"></a><em class="parameter"><code>workgroup = SNOWSHOW</code></em></td></tr><tr><td><a class="indexterm" name="id381238"></a><em class="parameter"><code>netbios name = GOODELF</code></em></td></tr><tr><td><a class="indexterm" name="id381250"></a><em class="parameter"><code>realm = SNOWSHOW.COM</code></em></td></tr><tr><td><a class="indexterm" name="id381261"></a><em class="parameter"><code>server string = Samba Server</code></em></td></tr><tr><td><a class="indexterm" name="id381273"></a><em class="parameter"><code>security = ADS</code></em></td></tr><tr><td><a class="indexterm" name="id381284"></a><em class="parameter"><code>log level = 1 ads:10 auth:10 sam:10 rpc:10</code></em></td></tr><tr><td><a class="indexterm" name="id381296"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=SNOWSHOW,dc=COM</code></em></td></tr><tr><td><a class="indexterm" name="id381308"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id381319"></a><em class="parameter"><code>ldap suffix = dc=SNOWSHOW,dc=COM</code></em></td></tr><tr><td><a class="indexterm" name="id381331"></a><em class="parameter"><code>idmap backend = ldap:ldap://ldap.snowshow.com</code></em></td></tr><tr><td><a class="indexterm" name="id381343"></a><em class="parameter"><code>idmap uid = 150000-550000</code></em></td></tr><tr><td><a class="indexterm" name="id381354"></a><em class="parameter"><code>idmap gid = 150000-550000</code></em></td></tr><tr><td><a class="indexterm" name="id381366"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id381378"></a><em class="parameter"><code>winbind use default domain = Yes</code></em></td></tr></table></div></div><br class="example-break"><p> 1246 <a class="indexterm" name="id381392"></a> 1247 1247 In the case of an NT4 or Samba-3-style domain the <em class="parameter"><code>realm</code></em> is not used, and the 1248 1248 command used to join the domain is <code class="literal">net rpc join</code>. The above example also demonstrates … … 1250 1250 “<span class="quote">The Official Samba-3 HOWTO and Reference Guide, Second Edition</span>” (TOSHARG2). 1251 1251 </p><p> 1252 <a class="indexterm" name="id3 59092"></a>1253 <a class="indexterm" name="id3 59099"></a>1254 <a class="indexterm" name="id3 59106"></a>1252 <a class="indexterm" name="id381421"></a> 1253 <a class="indexterm" name="id381428"></a> 1254 <a class="indexterm" name="id381434"></a> 1255 1255 Where MIT kerberos is installed (version 1.3.4 or later), edit the <code class="filename">/etc/krb5.conf</code> 1256 1256 file so it has the following contents: … … 1307 1307 </pre><p> 1308 1308 </p><p> 1309 <a class="indexterm" name="id3 59178"></a>1310 <a class="indexterm" name="id3 59185"></a>1311 You will need the <a href="http://www.padl.com" target="_top">PADL</a> <code class="literal">nss_ldap</code>1309 <a class="indexterm" name="id381507"></a> 1310 <a class="indexterm" name="id381514"></a> 1311 You will need the <a class="ulink" href="http://www.padl.com" target="_top">PADL</a> <code class="literal">nss_ldap</code> 1312 1312 tool set for this solution. Configure the <code class="filename">/etc/ldap.conf</code> file so it has 1313 1313 the information needed. The following is an example of a working file: … … 1371 1371 Start the <code class="literal">nmbd</code>, <code class="literal">winbind</code>, and <code class="literal">smbd</code> daemons in the order shown. 1372 1372 </p></li></ol></div><p> 1373 <a class="indexterm" name="id3 59368"></a>1373 <a class="indexterm" name="id381697"></a> 1374 1374 Follow the diagnostic procedures shown earlier in this chapter to identify success or failure of the join. 1375 1375 In many cases a failure is indicated by a silent return to the command prompt with no indication of the 1376 1376 reason for failure. 1377 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 59380"></a>IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</h4></div></div></div><p>1378 <a class="indexterm" name="id3 59388"></a>1379 <a class="indexterm" name="id3 59395"></a>1377 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id381708"></a>IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</h4></div></div></div><p> 1378 <a class="indexterm" name="id381716"></a> 1379 <a class="indexterm" name="id381723"></a> 1380 1380 The use of this method is messy. The information provided in this section is for guidance only 1381 1381 and is very definitely not complete. This method does work; it is used in a number of large sites 1382 1382 and has an acceptable level of performance. 1383 1383 </p><p> 1384 An example <code class="filename">smb.conf</code> file is shown in <a href="unixclients.html#sbewinbindex" title="Example 7.10. ADS Membership Using RFC2307bis Identity Resolution smb.conf File">???</a>.1385 </p><div class="example"><a name="sbewinbindex"></a><p class="title"><b>Example 7.10. ADS Membership Using RFC2307bis Identity Resolution <code class="filename">smb.conf</code> File</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id3 59454"></a><em class="parameter"><code>workgroup = BUBBAH</code></em></td></tr><tr><td><a class="indexterm" name="id359466"></a><em class="parameter"><code>netbios name = MADMAX</code></em></td></tr><tr><td><a class="indexterm" name="id359479"></a><em class="parameter"><code>realm = BUBBAH.COM</code></em></td></tr><tr><td><a class="indexterm" name="id359491"></a><em class="parameter"><code>server string = Samba Server</code></em></td></tr><tr><td><a class="indexterm" name="id359504"></a><em class="parameter"><code>security = ADS</code></em></td></tr><tr><td><a class="indexterm" name="id359516"></a><em class="parameter"><code>idmap uid = 150000-550000</code></em></td></tr><tr><td><a class="indexterm" name="id359529"></a><em class="parameter"><code>idmap gid = 150000-550000</code></em></td></tr><tr><td><a class="indexterm" name="id359542"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id359554"></a><em class="parameter"><code>winbind use default domain = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id359567"></a><em class="parameter"><code>winbind trusted domains only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id359580"></a><em class="parameter"><code>winbind nested groups = Yes</code></em></td></tr></table></div></div><br class="example-break"><p>1386 <a class="indexterm" name="id3 59596"></a>1384 An example <code class="filename">smb.conf</code> file is shown in <a class="link" href="unixclients.html#sbewinbindex" title="Example 7.10. ADS Membership Using RFC2307bis Identity Resolution smb.conf File">“ADS Membership Using RFC2307bis Identity Resolution smb.conf File”</a>. 1385 </p><div class="example"><a name="sbewinbindex"></a><p class="title"><b>Example 7.10. ADS Membership Using RFC2307bis Identity Resolution <code class="filename">smb.conf</code> File</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id381782"></a><em class="parameter"><code>workgroup = BUBBAH</code></em></td></tr><tr><td><a class="indexterm" name="id381794"></a><em class="parameter"><code>netbios name = MADMAX</code></em></td></tr><tr><td><a class="indexterm" name="id381805"></a><em class="parameter"><code>realm = BUBBAH.COM</code></em></td></tr><tr><td><a class="indexterm" name="id381817"></a><em class="parameter"><code>server string = Samba Server</code></em></td></tr><tr><td><a class="indexterm" name="id381828"></a><em class="parameter"><code>security = ADS</code></em></td></tr><tr><td><a class="indexterm" name="id381840"></a><em class="parameter"><code>idmap uid = 150000-550000</code></em></td></tr><tr><td><a class="indexterm" name="id381851"></a><em class="parameter"><code>idmap gid = 150000-550000</code></em></td></tr><tr><td><a class="indexterm" name="id381863"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id381874"></a><em class="parameter"><code>winbind use default domain = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id381886"></a><em class="parameter"><code>winbind trusted domains only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id381898"></a><em class="parameter"><code>winbind nested groups = Yes</code></em></td></tr></table></div></div><br class="example-break"><p> 1386 <a class="indexterm" name="id381913"></a> 1387 1387 The DMS must be joined to the domain using the usual procedure. Additionally, it is necessary 1388 1388 to build and install the PADL nss_ldap tool set. Be sure to build this tool set with the … … 1393 1393 </pre><p> 1394 1394 </p><p> 1395 <a class="indexterm" name="id3 59614"></a>1395 <a class="indexterm" name="id381931"></a> 1396 1396 The following <code class="filename">/etc/nsswitch.conf</code> file contents are required: 1397 1397 </p><pre class="screen"> … … 1405 1405 </pre><p> 1406 1406 </p><p> 1407 <a class="indexterm" name="id3 59637"></a>1408 <a class="indexterm" name="id3 59644"></a>1407 <a class="indexterm" name="id381954"></a> 1408 <a class="indexterm" name="id381960"></a> 1409 1409 The <code class="filename">/etc/ldap.conf</code> file must be configured also. Refer to the PADL documentation 1410 1410 and source code for nss_ldap instructions. … … 1412 1412 The next step involves preparation on the ADS schema. This is briefly discussed in the remaining 1413 1413 part of this chapter. 1414 </p><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id3 59663"></a>IDMAP, Active Directory, and MS Services for UNIX 3.5</h5></div></div></div><p>1415 <a class="indexterm" name="id3 59671"></a>1414 </p><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id381980"></a>IDMAP, Active Directory, and MS Services for UNIX 3.5</h5></div></div></div><p> 1415 <a class="indexterm" name="id381988"></a> 1416 1416 The Microsoft Windows Service for UNIX version 3.5 is available for free 1417 <a href="http://www.microsoft.com/windows/sfu/" target="_top">download</a>1417 <a class="ulink" href="http://www.microsoft.com/windows/sfu/" target="_top">download</a> 1418 1418 from the Microsoft Web site. You will need to download this tool and install it following 1419 1419 Microsoft instructions. 1420 </p></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id3 59688"></a>IDMAP, Active Directory, and AD4UNIX</h5></div></div></div><p>1420 </p></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id382005"></a>IDMAP, Active Directory, and AD4UNIX</h5></div></div></div><p> 1421 1421 Instructions for obtaining and installing the AD4UNIX tool set can be found from the 1422 <a href="http://www.geekcomix.com/cgi-bin/classnotes/wiki.pl?LDAP01/An_Alternative_Approach" target="_top">1422 <a class="ulink" href="http://www.geekcomix.com/cgi-bin/classnotes/wiki.pl?LDAP01/An_Alternative_Approach" target="_top"> 1423 1423 Geekcomix</a> Web site. 1424 </p></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 59708"></a>UNIX/Linux Client Domain Member</h3></div></div></div><p><a class="indexterm" name="id359715"></a>1424 </p></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id382025"></a>UNIX/Linux Client Domain Member</h3></div></div></div><p><a class="indexterm" name="id382032"></a> 1425 1425 So far this chapter has been mainly concerned with the provision of file and print 1426 1426 services for domain member servers. However, an increasing number of UNIX/Linux … … 1428 1428 other than a single desktop user. The key demand for desktop systems is to be able 1429 1429 to log onto any UNIX/Linux or Windows desktop using the same network user credentials. 1430 </p><p><a class="indexterm" name="id3 59730"></a>1430 </p><p><a class="indexterm" name="id382047"></a> 1431 1431 The ability to use a common set of user credential across a variety of network systems 1432 1432 is generally regarded as a single sign-on (SSO) solution. SSO systems are sold by a … … 1440 1440 </p></li><li><p> 1441 1441 Replacement authentication systems 1442 </p></li></ul></div><p><a class="indexterm" name="id3 59768"></a>1442 </p></li></ul></div><p><a class="indexterm" name="id382085"></a> 1443 1443 There are really four solutions that provide integrated authentication and 1444 1444 user identity management facilities: … … 1447 1447 provides a greater level of scalability in large ADS environments. 1448 1448 </p></li><li><p> 1449 <a href="http://www.padl.com" target="_top">PADL</a> PAM and LDAP tools (free).1449 <a class="ulink" href="http://www.padl.com" target="_top">PADL</a> PAM and LDAP tools (free). 1450 1450 </p></li><li><p> 1451 <a href="http://www.vintela.com" target="_top">Vintela</a> Authentication Services (commercial).1451 <a class="ulink" href="http://www.vintela.com" target="_top">Vintela</a> Authentication Services (commercial). 1452 1452 </p></li><li><p> 1453 <a href="http://www.centrify.com" target="_top">Centrify</a> DirectControl (commercial).1453 <a class="ulink" href="http://www.centrify.com" target="_top">Centrify</a> DirectControl (commercial). 1454 1454 Centrify's commercial product allows UNIX and Linux systems to use Active Directory 1455 1455 security, directory and policy services. Enhancements include a centralized ID mapping that … … 1465 1465 support via Samba-3. 1466 1466 </p><p> 1467 <a class="indexterm" name="id3 59836"></a>1467 <a class="indexterm" name="id382152"></a> 1468 1468 On the other hand, if the authentication and identity resolution backend must be provided by 1469 1469 a Windows NT4-style domain or from an Active Directory Domain that does not have the Microsoft … … 1471 1471 situations now follows. 1472 1472 </p><p> 1473 <a class="indexterm" name="id3 59851"></a>1474 <a class="indexterm" name="id3 59857"></a>1475 <a class="indexterm" name="id3 59864"></a>1473 <a class="indexterm" name="id382168"></a> 1474 <a class="indexterm" name="id382174"></a> 1475 <a class="indexterm" name="id382181"></a> 1476 1476 To permit users to log on to a Linux system using Windows network credentials, you need to 1477 1477 configure identity resolution (NSS) and PAM. This means that the basic steps include those … … 1480 1480 of shares and printers is generally less important. Often this allows the share specifications 1481 1481 to be entirely removed from the <code class="filename">smb.conf</code> file. That is obviously an administrator decision. 1482 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 59882"></a>NT4 Domain Member</h4></div></div></div><p>1482 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id382199"></a>NT4 Domain Member</h4></div></div></div><p> 1483 1483 The following steps provide a Linux system that users can log onto using 1484 1484 Windows NT4 (or Samba-3) domain network credentials: 1485 1485 </p><div class="procedure"><ol type="1"><li><p> 1486 Follow the steps outlined in <a href="unixclients.html#wdcsdm" title="NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind">???</a> and ensure that1486 Follow the steps outlined in <a class="link" href="unixclients.html#wdcsdm" title="NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind">“NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind”</a> and ensure that 1487 1487 all validation tests function as shown. 1488 1488 </p></li><li><p> … … 1500 1500 </p></li><li><p> 1501 1501 If you require only console login support, edit the <code class="filename">/etc/pam.d/login</code> 1502 so it matches <a href="unixclients.html#ch9-pamwnbdlogin" title="Example 7.11. SUSE: PAM login Module Using Winbind">???</a>.1502 so it matches <a class="link" href="unixclients.html#ch9-pamwnbdlogin" title="Example 7.11. SUSE: PAM login Module Using Winbind">“SUSE: PAM login Module Using Winbind”</a>. 1503 1503 </p></li><li><p> 1504 1504 To provide the ability to log onto the graphical desktop interface, you must edit … … 1508 1508 Edit only one file at a time. Carefully validate its operation before attempting 1509 1509 to reboot the machine. 1510 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 59994"></a>ADS Domain Member</h4></div></div></div><p>1510 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id382311"></a>ADS Domain Member</h4></div></div></div><p> 1511 1511 This procedure should be followed to permit a Linux network client (workstation/desktop) 1512 1512 to permit users to log on using Microsoft Active Directory-based user credentials. 1513 1513 </p><div class="procedure"><ol type="1"><li><p> 1514 Follow the steps outlined in <a href="unixclients.html#adssdm" title="Active Directory Domain with Samba Domain Member Server">???</a> and ensure that1514 Follow the steps outlined in <a class="link" href="unixclients.html#adssdm" title="Active Directory Domain with Samba Domain Member Server">“Active Directory Domain with Samba Domain Member Server”</a> and ensure that 1515 1515 all validation tests function as shown. 1516 1516 </p></li><li><p> … … 1518 1518 intended that the user shall be given access to all services, it may be 1519 1519 most expeditious to simply configure the file 1520 <code class="filename">/etc/pam.d/system-auth</code> as shown in <a href="unixclients.html#ch9-rhsysauth" title="Example 7.13. Red Hat 9: PAM System Authentication File: /etc/pam.d/system-auth Module Using Winbind">???</a>.1520 <code class="filename">/etc/pam.d/system-auth</code> as shown in <a class="link" href="unixclients.html#ch9-rhsysauth" title="Example 7.13. Red Hat 9: PAM System Authentication File: /etc/pam.d/system-auth Module Using Winbind">“Red Hat 9: PAM System Authentication File: /etc/pam.d/system-auth Module Using Winbind”</a>. 1521 1521 </p></li><li><p> 1522 1522 Carefully make a backup copy of all PAM configuration files before you … … 1528 1528 </p></li><li><p> 1529 1529 If you require only console login support, edit the <code class="filename">/etc/pam.d/login</code> 1530 so it matches <a href="unixclients.html#ch9-pamwnbdlogin" title="Example 7.11. SUSE: PAM login Module Using Winbind">???</a>.1530 so it matches <a class="link" href="unixclients.html#ch9-pamwnbdlogin" title="Example 7.11. SUSE: PAM login Module Using Winbind">“SUSE: PAM login Module Using Winbind”</a>. 1531 1531 </p></li><li><p> 1532 1532 To provide the ability to log onto the graphical desktop interface, you must edit … … 1588 1588 session sufficient /lib/security/$ISA/pam_unix.so 1589 1589 session sufficient /lib/security/$ISA/pam_winbind.so use_first_pass 1590 </pre></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 60196"></a>Key Points Learned</h3></div></div></div><p>1590 </pre></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id382521"></a>Key Points Learned</h3></div></div></div><p> 1591 1591 The addition of UNIX/Linux Samba servers and clients is a common requirement. In this chapter, you 1592 1592 learned how to integrate such servers so that the UID/GID mappings they use can be consistent … … 1608 1608 On NSS/PAM enabled UNIX/Linux systems, NSS is responsible for identity management 1609 1609 and PAM is responsible for authentication of logon credentials (username and password). 1610 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 60240"></a>Questions and Answers</h2></div></div></div><p>1610 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id382565"></a>Questions and Answers</h2></div></div></div><p> 1611 1611 The following questions were obtained from the mailing list and also from private discussions 1612 1612 with Windows network administrators. 1613 </p><div class="qandaset"><dl><dt> <a href="unixclients.html#id3 60257">1613 </p><div class="qandaset"><dl><dt> <a href="unixclients.html#id382582"> 1614 1614 We use NIS for all UNIX accounts. Why do we need winbind? 1615 </a></dt><dt> <a href="unixclients.html#id3 60364">1615 </a></dt><dt> <a href="unixclients.html#id382690"> 1616 1616 Our IT management people do not like LDAP but are looking at Microsoft Active Directory. 1617 1617 Which is better? 1618 </a></dt><dt> <a href="unixclients.html#id3 60438">1618 </a></dt><dt> <a href="unixclients.html#id382763"> 1619 1619 We want to implement a Samba PDC, four Samba BDCs, and 10 Samba servers. Is it possible 1620 1620 to use NIS in place of LDAP? 1621 </a></dt><dt> <a href="unixclients.html#id3 60545">1621 </a></dt><dt> <a href="unixclients.html#id382867"> 1622 1622 Are you suggesting that users should not log on to a domain member server? If so, why? 1623 </a></dt><dt> <a href="unixclients.html#id3 60654">1623 </a></dt><dt> <a href="unixclients.html#id382979"> 1624 1624 We want to ensure that only users from our own domain plus from trusted domains can use our 1625 1625 Samba servers. In the smb.conf file on all servers, we have enabled the winbind … … 1627 1627 cannot access our servers, and users from Windows clients that are not domain members 1628 1628 can also access our servers. Is this a Samba bug? 1629 </a></dt><dt> <a href="unixclients.html#id3 60818">1629 </a></dt><dt> <a href="unixclients.html#id383144"> 1630 1630 What are the benefits of using LDAP for my domain member servers? 1631 </a></dt><dt> <a href="unixclients.html#id3 60993">1631 </a></dt><dt> <a href="unixclients.html#id383319"> 1632 1632 Is proper DNS operation necessary for Samba-3 plus LDAP? If so, what must I put into 1633 1633 my DNS configuration? 1634 </a></dt><dt> <a href="unixclients.html#id3 61141">1634 </a></dt><dt> <a href="unixclients.html#id383466"> 1635 1635 Our Windows 2003 Server Active Directory domain runs with NetBIOS disabled. Can we 1636 1636 use Samba-3 with that configuration? 1637 </a></dt><dt> <a href="unixclients.html#id3 61158">1637 </a></dt><dt> <a href="unixclients.html#id383484"> 1638 1638 When I tried to execute net ads join, I got no output. It did not work, so 1639 1639 I think that it failed. I then executed net rpc join and that worked fine. 1640 1640 That is okay, isn't it? 1641 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id3 60257"></a><a name="id360259"></a></td><td align="left" valign="top"><p>1641 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id382582"></a><a name="id382584"></a></td><td align="left" valign="top"><p> 1642 1642 We use NIS for all UNIX accounts. Why do we need winbind? 1643 1643 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 1644 <a class="indexterm" name="id3 60270"></a>1645 <a class="indexterm" name="id3 60277"></a>1646 <a class="indexterm" name="id3 60284"></a>1647 <a class="indexterm" name="id3 60290"></a>1648 <a class="indexterm" name="id3 60297"></a>1649 <a class="indexterm" name="id3 60304"></a>1644 <a class="indexterm" name="id382596"></a> 1645 <a class="indexterm" name="id382602"></a> 1646 <a class="indexterm" name="id382609"></a> 1647 <a class="indexterm" name="id382616"></a> 1648 <a class="indexterm" name="id382622"></a> 1649 <a class="indexterm" name="id382629"></a> 1650 1650 You can use NIS for your UNIX accounts. NIS does not store the Windows encrypted 1651 1651 passwords that need to be stored in one of the acceptable passdb backends. … … 1654 1654 SIDs from trusted domains to local UID/GID values. 1655 1655 </p><p> 1656 <a class="indexterm" name="id3 60328"></a>1657 <a class="indexterm" name="id3 60335"></a>1656 <a class="indexterm" name="id382654"></a> 1657 <a class="indexterm" name="id382661"></a> 1658 1658 On a domain member server, you effectively map Windows domain users to local users 1659 1659 that are in your NIS database by specifying the <em class="parameter"><code>winbind trusted domains … … 1663 1663 </p><p> 1664 1664 As a general rule, it is always a good idea to run winbind on all Samba servers. 1665 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 60364"></a><a name="id360366"></a></td><td align="left" valign="top"><p>1665 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id382690"></a><a name="id382692"></a></td><td align="left" valign="top"><p> 1666 1666 Our IT management people do not like LDAP but are looking at Microsoft Active Directory. 1667 Which is better?<a class="indexterm" name="id3 60372"></a>1668 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id3 60386"></a><a class="indexterm" name="id360397"></a><a class="indexterm" name="id360405"></a>1667 Which is better?<a class="indexterm" name="id382697"></a> 1668 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id382711"></a><a class="indexterm" name="id382723"></a><a class="indexterm" name="id382730"></a> 1669 1669 Microsoft Active Directory is an LDAP server that is intricately tied to a Kerberos 1670 1670 infrastructure. Most IT managers who object to LDAP do so because … … 1673 1673 devise the backup and recovery facilities in a site-dependent manner. LDAP servers 1674 1674 in general are seen as a high-energy, high-risk facility. 1675 </p><p><a class="indexterm" name="id3 60420"></a>1675 </p><p><a class="indexterm" name="id382746"></a> 1676 1676 Microsoft Active Directory by comparison is easy to install and configure and 1677 1677 is supplied with all tools necessary to implement and manage the directory. For sites … … 1682 1682 consider the options. On the other hand, if management just wants a solution that works, 1683 1683 Microsoft Active Directory is a good solution. 1684 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 60438"></a><a name="id360440"></a></td><td align="left" valign="top"><p>1684 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id382763"></a><a name="id382765"></a></td><td align="left" valign="top"><p> 1685 1685 We want to implement a Samba PDC, four Samba BDCs, and 10 Samba servers. Is it possible 1686 1686 to use NIS in place of LDAP? 1687 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id3 60451"></a><a class="indexterm" name="id360458"></a><a class="indexterm" name="id360466"></a><a class="indexterm" name="id360474"></a><a class="indexterm" name="id360482"></a><a class="indexterm" name="id360490"></a><a class="indexterm" name="id360497"></a>1687 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id382776"></a><a class="indexterm" name="id382784"></a><a class="indexterm" name="id382792"></a><a class="indexterm" name="id382799"></a><a class="indexterm" name="id382807"></a><a class="indexterm" name="id382815"></a><a class="indexterm" name="id382823"></a> 1688 1688 Yes, it is possible to use NIS in place of LDAP, but there may be problems with keeping 1689 1689 the Windows (SMB) encrypted passwords database correctly synchronized across the entire … … 1691 1691 membership secure account password. How can you keep changes that are on remote BDCs 1692 1692 synchronized on the PDC? 1693 </p><p><a class="indexterm" name="id3 60515"></a><a class="indexterm" name="id360523"></a><a class="indexterm" name="id360530"></a>1693 </p><p><a class="indexterm" name="id382837"></a><a class="indexterm" name="id382845"></a><a class="indexterm" name="id382853"></a> 1694 1694 LDAP is a more elegant solution because it permits centralized storage and management 1695 1695 of all network identities (user, group, and machine accounts) together with all information 1696 1696 Samba needs to provide to network clients and their users. 1697 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 60545"></a><a name="id360547"></a></td><td align="left" valign="top"><p>1697 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id382867"></a><a name="id382869"></a></td><td align="left" valign="top"><p> 1698 1698 Are you suggesting that users should not log on to a domain member server? If so, why? 1699 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id3 60557"></a><a class="indexterm" name="id360565"></a><a class="indexterm" name="id360577"></a>1699 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id382880"></a><a class="indexterm" name="id382887"></a><a class="indexterm" name="id382899"></a> 1700 1700 Many UNIX administrators mock the model that the personal computer industry has adopted 1701 1701 as normative since the early days of Novell NetWare. The old … … 1703 1703 fears concerning the security and integrity of data. It was a simple and generally 1704 1704 effective measure to keep users away from servers, except through mapped drives. 1705 </p><p><a class="indexterm" name="id3 60591"></a><a class="indexterm" name="id360599"></a><a class="indexterm" name="id360607"></a><a class="indexterm" name="id360615"></a><a class="indexterm" name="id360623"></a>1705 </p><p><a class="indexterm" name="id382917"></a><a class="indexterm" name="id382925"></a><a class="indexterm" name="id382932"></a><a class="indexterm" name="id382940"></a><a class="indexterm" name="id382948"></a> 1706 1706 UNIX administrators are fully correct in asserting that UNIX servers and workstations 1707 1707 are identical in terms of the software that is installed. They correctly assert that … … 1712 1712 Only then can one begin to appraise the best strategy and adopt a site-specific 1713 1713 policy that best protects the needs of users and of the organization alike. 1714 </p><p><a class="indexterm" name="id3 60639"></a>1714 </p><p><a class="indexterm" name="id382965"></a> 1715 1715 From experience, it is my recommendation to keep general system-level logins to a 1716 1716 practical minimum and to eliminate them if possible. This should not be taken as a 1717 1717 hard rule, though. The better question is, what works best for the site? 1718 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 60654"></a><a name="id360656"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id360659"></a><a class="indexterm" name="id360667"></a><a class="indexterm" name="id360678"></a><a class="indexterm" name="id360686"></a>1718 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id382979"></a><a name="id382981"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id382984"></a><a class="indexterm" name="id382992"></a><a class="indexterm" name="id383004"></a><a class="indexterm" name="id383012"></a> 1719 1719 We want to ensure that only users from our own domain plus from trusted domains can use our 1720 1720 Samba servers. In the <code class="filename">smb.conf</code> file on all servers, we have enabled the <em class="parameter"><code>winbind … … 1722 1722 cannot access our servers, and users from Windows clients that are not domain members 1723 1723 can also access our servers. Is this a Samba bug? 1724 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id3 60715"></a><a class="indexterm" name="id360723"></a><a class="indexterm" name="id360731"></a><a class="indexterm" name="id360739"></a><a class="indexterm" name="id360747"></a><a class="indexterm" name="id360754"></a>1724 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id383041"></a><a class="indexterm" name="id383049"></a><a class="indexterm" name="id383056"></a><a class="indexterm" name="id383064"></a><a class="indexterm" name="id383072"></a><a class="indexterm" name="id383080"></a> 1725 1725 The manual page for this <em class="parameter"><code>winbind trusted domains only</code></em> parameter says, 1726 1726 “<span class="quote">This parameter is designed to allow Samba servers that are members of a Samba-controlled … … 1730 1730 of allocating a new UID for him or her.</span>” This clearly suggests that you are trying 1731 1731 to use this parameter inappropriately. 1732 </p><p><a class="indexterm" name="id3 60792"></a>1732 </p><p><a class="indexterm" name="id383118"></a> 1733 1733 A far better solution is to use the <em class="parameter"><code>valid users</code></em> by specifying 1734 1734 precisely the domain users and groups that should be permitted access to the shares. You could, … … 1739 1739 valid users = @"Domain Users", @"OTHERDOMAIN\Domain Users" 1740 1740 </pre><p> 1741 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 60818"></a><a name="id360820"></a></td><td align="left" valign="top"><p>1741 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id383144"></a><a name="id383146"></a></td><td align="left" valign="top"><p> 1742 1742 What are the benefits of using LDAP for my domain member servers? 1743 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id3 60831"></a><a class="indexterm" name="id360838"></a><a class="indexterm" name="id360846"></a><a class="indexterm" name="id360854"></a><a class="indexterm" name="id360862"></a><a class="indexterm" name="id360869"></a><a class="indexterm" name="id360877"></a><a class="indexterm" name="id360885"></a><a class="indexterm" name="id360893"></a>1743 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id383156"></a><a class="indexterm" name="id383164"></a><a class="indexterm" name="id383172"></a><a class="indexterm" name="id383179"></a><a class="indexterm" name="id383187"></a><a class="indexterm" name="id383195"></a><a class="indexterm" name="id383203"></a><a class="indexterm" name="id383211"></a><a class="indexterm" name="id383218"></a> 1744 1744 The key benefit of using LDAP is that the UID of all users and the GID of all groups 1745 1745 are globally consistent on domain controllers as well as on domain member servers. 1746 1746 This means that it is possible to copy/replicate files across servers without 1747 1747 loss of identity. 1748 </p><p><a class="indexterm" name="id3 60906"></a><a class="indexterm" name="id360914"></a><a class="indexterm" name="id360922"></a><a class="indexterm" name="id360930"></a><a class="indexterm" name="id360938"></a><a class="indexterm" name="id360946"></a><a class="indexterm" name="id360957"></a><a class="indexterm" name="id360965"></a>1748 </p><p><a class="indexterm" name="id383232"></a><a class="indexterm" name="id383240"></a><a class="indexterm" name="id383248"></a><a class="indexterm" name="id383256"></a><a class="indexterm" name="id383263"></a><a class="indexterm" name="id383271"></a><a class="indexterm" name="id383283"></a><a class="indexterm" name="id383290"></a> 1749 1749 When use is made of account identity resolution via winbind, even when an IDMAP backend 1750 1750 is stored in LDAP, the UID/GID on domain member servers is consistent, but differs … … 1753 1753 idmap uid/gid</code></em> in the <code class="filename">smb.conf</code> file. On domain controllers, the UID/GID is 1754 1754 that of the POSIX value assigned in the LDAP directory as part of the POSIX account information. 1755 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 60993"></a><a name="id360995"></a></td><td align="left" valign="top"><p>1755 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id383319"></a><a name="id383321"></a></td><td align="left" valign="top"><p> 1756 1756 Is proper DNS operation necessary for Samba-3 plus LDAP? If so, what must I put into 1757 1757 my DNS configuration? 1758 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id3 61006"></a><a class="indexterm" name="id361017"></a><a class="indexterm" name="id361028"></a><a class="indexterm" name="id361036"></a><a class="indexterm" name="id361044"></a><a class="indexterm" name="id361052"></a><a class="indexterm" name="id361059"></a>1758 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id383332"></a><a class="indexterm" name="id383343"></a><a class="indexterm" name="id383354"></a><a class="indexterm" name="id383362"></a><a class="indexterm" name="id383369"></a><a class="indexterm" name="id383377"></a><a class="indexterm" name="id383385"></a> 1759 1759 Samba depends on correctly functioning resolution of hostnames to their IP address. Samba 1760 1760 makes no direct DNS lookup calls, but rather redirects all name-to-address calls via the … … 1769 1769 If this fails to resolve, it attempts a DNS lookup, and if that fails, it tries a 1770 1770 WINS lookup. 1771 </p><p><a class="indexterm" name="id3 61109"></a><a class="indexterm" name="id361117"></a><a class="indexterm" name="id361125"></a>1771 </p><p><a class="indexterm" name="id383435"></a><a class="indexterm" name="id383442"></a><a class="indexterm" name="id383450"></a> 1772 1772 The addition of the WINS-based name lookup makes sense only if NetBIOS over TCP/IP has 1773 1773 been enabled on all Windows clients. Where NetBIOS over TCP/IP has been disabled, DNS … … 1776 1776 case, the Windows 200x autoregisters all locator records it needs with its own DNS 1777 1777 server or servers. 1778 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 61141"></a><a name="id361143"></a></td><td align="left" valign="top"><p>1778 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id383466"></a><a name="id383469"></a></td><td align="left" valign="top"><p> 1779 1779 Our Windows 2003 Server Active Directory domain runs with NetBIOS disabled. Can we 1780 1780 use Samba-3 with that configuration? 1781 1781 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 1782 1782 Yes. 1783 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id3 61158"></a><a name="id361161"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id361164"></a><a class="indexterm" name="id361178"></a>1783 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id383484"></a><a name="id383486"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id383489"></a><a class="indexterm" name="id383504"></a> 1784 1784 When I tried to execute net ads join, I got no output. It did not work, so 1785 1785 I think that it failed. I then executed net rpc join and that worked fine. 1786 1786 That is okay, isn't it? 1787 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id3 61200"></a><a class="indexterm" name="id361208"></a>1787 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id383526"></a><a class="indexterm" name="id383534"></a> 1788 1788 No. This is not okay. It means that your Samba-3 client has joined the ADS domain as 1789 1789 a Windows NT4 client, and Samba-3 will not be using Kerberos-based authentication. -
branches/samba-3.0/docs/htmldocs/Samba3-ByExample/upgrades.html
r44 r134 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 8. Updating Samba-3</title><link rel="stylesheet" href=" samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="unixclients.html" title="Chapter 7. Adding Domain Member Servers and Clients"><link rel="next" href="ntmigration.html" title="Chapter 9. Migrating NT4 Domain to Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 8. Updating Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="unixclients.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="ntmigration.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="upgrades"></a>Chapter 8. Updating Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="upgrades.html#id361313">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id361397">Cautions and Notes</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id362605">Upgrading from Samba 1.x and 2.x to Samba-3</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id362947">Applicable to All Samba 2.x to Samba-3 Upgrades</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id363269">Samba-2.x with LDAP Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id363384">Updating a Samba-3 Installation</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id363478">Samba-3 to Samba-3 Updates on the Same Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id363662">Migrating Samba-3 to a New Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id364040">Migration of Samba Accounts to Active Directory</a></span></dt></dl></dd></dl></div><p>2 <a class="indexterm" name="id3 61239"></a>3 <a class="indexterm" name="id3 61246"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 8. Updating Samba-3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="unixclients.html" title="Chapter 7. Adding Domain Member Servers and Clients"><link rel="next" href="ntmigration.html" title="Chapter 9. Migrating NT4 Domain to Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 8. Updating Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="unixclients.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="ntmigration.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="upgrades"></a>Chapter 8. Updating Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="upgrades.html#id383639">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id383722">Cautions and Notes</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id384934">Upgrading from Samba 1.x and 2.x to Samba-3</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id385275">Applicable to All Samba 2.x to Samba-3 Upgrades</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id385597">Samba-2.x with LDAP Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id385712">Updating a Samba-3 Installation</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id385807">Samba-3 to Samba-3 Updates on the Same Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id385991">Migrating Samba-3 to a New Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id386368">Migration of Samba Accounts to Active Directory</a></span></dt></dl></dd></dl></div><p> 2 <a class="indexterm" name="id383565"></a> 3 <a class="indexterm" name="id383571"></a> 4 4 It was a little difficult to select an appropriate title for this chapter. 5 5 From email messages on the Samba mailing lists it is clear that many people … … 8 8 installing a new Samba server to replace an older existing Samba server. 9 9 </p><p> 10 <a class="indexterm" name="id3 61259"></a>11 <a class="indexterm" name="id3 61266"></a>10 <a class="indexterm" name="id383585"></a> 11 <a class="indexterm" name="id383592"></a> 12 12 There has also been much talk about migration of Samba-3 from an smbpasswd 13 13 passdb backend to the use of the tdbsam or ldapsam facilities that are new … … 18 18 highlighted by an email posting that included the following neat remark: 19 19 </p><div class="blockquote"><blockquote class="blockquote"><p> 20 <a class="indexterm" name="id3 61284"></a>20 <a class="indexterm" name="id383609"></a> 21 21 I like the “<span class="quote">net rpc vampire</span>” on NT4, but that to my surprise does 22 22 not seem to work against a Samba PDC and, if addressed in the Samba to Samba 23 23 context in either book, I could not find it. 24 24 </p></blockquote></div><p> 25 <a class="indexterm" name="id3 61303"></a>25 <a class="indexterm" name="id383629"></a> 26 26 So in response to the significant request for these situations to be better 27 27 documented, this chapter has now been added. User contributions and documentation 28 28 of real-world experiences are a most welcome addition to this chapter. 29 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 61313"></a>Introduction</h2></div></div></div><p>30 <a class="indexterm" name="id3 61321"></a>31 <a class="indexterm" name="id3 61328"></a>32 <a class="indexterm" name="id3 61335"></a>29 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id383639"></a>Introduction</h2></div></div></div><p> 30 <a class="indexterm" name="id383646"></a> 31 <a class="indexterm" name="id383653"></a> 32 <a class="indexterm" name="id383660"></a> 33 33 A Windows network administrator explained in an email what changes he was 34 34 planning to make and followed with the question: “<span class="quote">Anyone done this … … 45 45 productivity on them. 46 46 </p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p> 47 <a class="indexterm" name="id3 61359"></a>48 <a class="indexterm" name="id3 61366"></a>47 <a class="indexterm" name="id383685"></a> 48 <a class="indexterm" name="id383692"></a> 49 49 Samba makes it possible to upgrade and update configuration files, but it 50 50 is not possible to downgrade the configuration files. Please ensure that … … 52 52 in the rare event that this may be necessary. 53 53 </p></div><p> 54 <a class="indexterm" name="id3 61378"></a>55 <a class="indexterm" name="id3 61385"></a>54 <a class="indexterm" name="id383704"></a> 55 <a class="indexterm" name="id383711"></a> 56 56 It is prudent also to backup all data files on the server before attempting 57 57 to perform a major upgrade. Many administrators have experienced the consequences … … 60 60 the precautions taken were inadequate. If a backup was not needed, but was available, 61 61 caution was on the side of the victor. 62 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 61397"></a>Cautions and Notes</h3></div></div></div><p>62 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id383722"></a>Cautions and Notes</h3></div></div></div><p> 63 63 Someone once said, “<span class="quote">It is good to be sorry, but better never to need to be!</span>” 64 64 These are wise words of advice to those contemplating a Samba upgrade or update. 65 65 </p><p> 66 <a class="indexterm" name="id3 61413"></a>67 <a class="indexterm" name="id3 61419"></a>68 <a class="indexterm" name="id3 61426"></a>66 <a class="indexterm" name="id383738"></a> 67 <a class="indexterm" name="id383745"></a> 68 <a class="indexterm" name="id383752"></a> 69 69 This is as good a time as any to define the terms <code class="constant">upgrade</code> and 70 70 <code class="constant">update</code>. The term <code class="constant">upgrade</code> refers to … … 74 74 is in development. 75 75 </p><p> 76 <a class="indexterm" name="id3 61450"></a>76 <a class="indexterm" name="id383776"></a> 77 77 The term <code class="constant">update</code> refers to a minor version number installation 78 78 in place of one of the same generation. For example, updating from Samba 3.0.10 to 3.0.14 79 79 is an update. The move from Samba 2.0.7 to 3.0.14 is an upgrade. 80 80 </p><p> 81 <a class="indexterm" name="id3 61466"></a>81 <a class="indexterm" name="id383791"></a> 82 82 While the use of these terms is an exercise in semantics, what needs to be realized 83 83 is that there are major functional differences between a Samba 2.x release and a Samba … … 91 91 noone can read it!</span>” While true, some documentation is an evil necessity. 92 92 It is hoped that this update to the documentation will avoid both extremes. 93 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 61487"></a>Security Identifiers (SIDs)</h4></div></div></div><p>94 <a class="indexterm" name="id3 61495"></a>95 <a class="indexterm" name="id3 61504"></a>96 <a class="indexterm" name="id3 61511"></a>97 <a class="indexterm" name="id3 61517"></a>98 <a class="indexterm" name="id3 61524"></a>99 <a class="indexterm" name="id3 61533"></a>93 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id383812"></a>Security Identifiers (SIDs)</h4></div></div></div><p> 94 <a class="indexterm" name="id383820"></a> 95 <a class="indexterm" name="id383829"></a> 96 <a class="indexterm" name="id383836"></a> 97 <a class="indexterm" name="id383843"></a> 98 <a class="indexterm" name="id383849"></a> 99 <a class="indexterm" name="id383858"></a> 100 100 Before the days of Windows NT and OS/2, every Windows and DOS networking client 101 101 that used the SMB protocols was an entirely autonomous entity. There was no concept … … 105 105 Windows NT 3.10. 106 106 </p><p> 107 <a class="indexterm" name="id3 61549"></a>108 <a class="indexterm" name="id3 61556"></a>109 <a class="indexterm" name="id3 61562"></a>110 <a class="indexterm" name="id3 61569"></a>111 <a class="indexterm" name="id3 61576"></a>112 <a class="indexterm" name="id3 61582"></a>107 <a class="indexterm" name="id383874"></a> 108 <a class="indexterm" name="id383881"></a> 109 <a class="indexterm" name="id383888"></a> 110 <a class="indexterm" name="id383895"></a> 111 <a class="indexterm" name="id383901"></a> 112 <a class="indexterm" name="id383908"></a> 113 113 Versions of Samba prior to 1.9 did not make use of a SID. Instead they make exclusive use 114 114 of the username that is embedded in the SessionSetUpAndX component of the connection 115 115 setup process between a Windows client and an SMB/CIFS server. 116 116 </p><p> 117 <a class="indexterm" name="id3 61597"></a>118 <a class="indexterm" name="id3 61604"></a>119 <a class="indexterm" name="id3 61610"></a>117 <a class="indexterm" name="id383922"></a> 118 <a class="indexterm" name="id383929"></a> 119 <a class="indexterm" name="id383936"></a> 120 120 Around November 1997 support was added to Samba-1.9 to handle the Windows security 121 121 RPC-based protocols that implemented support for Samba to store a machine SID. This 122 122 information was stored in a file called <code class="filename">MACHINE.SID.</code> 123 123 </p><p> 124 <a class="indexterm" name="id3 61628"></a>125 <a class="indexterm" name="id3 61635"></a>126 <a class="indexterm" name="id3 61641"></a>124 <a class="indexterm" name="id383953"></a> 125 <a class="indexterm" name="id383960"></a> 126 <a class="indexterm" name="id383967"></a> 127 127 Within the lifetime of the early Samba 2.x series, the machine SID information was 128 128 relocated into a tdb file called <code class="filename">secrets.tdb</code>, which is where … … 130 130 local machine and its role within a domain security context. 131 131 </p><p> 132 <a class="indexterm" name="id3 61660"></a>133 <a class="indexterm" name="id3 61669"></a>134 <a class="indexterm" name="id3 61678"></a>135 <a class="indexterm" name="id3 61684"></a>132 <a class="indexterm" name="id383985"></a> 133 <a class="indexterm" name="id383994"></a> 134 <a class="indexterm" name="id384003"></a> 135 <a class="indexterm" name="id384010"></a> 136 136 There are two types of SID, those pertaining to the machine itself and the domain to 137 137 which it may belong, and those pertaining to users and groups within the security … … 139 139 servers (DMS). 140 140 </p><p> 141 <a class="indexterm" name="id3 61697"></a>142 <a class="indexterm" name="id3 61704"></a>143 <a class="indexterm" name="id3 61710"></a>144 <a class="indexterm" name="id3 61717"></a>145 <a class="indexterm" name="id3 61724"></a>146 <a class="indexterm" name="id3 61731"></a>141 <a class="indexterm" name="id384022"></a> 142 <a class="indexterm" name="id384029"></a> 143 <a class="indexterm" name="id384036"></a> 144 <a class="indexterm" name="id384043"></a> 145 <a class="indexterm" name="id384050"></a> 146 <a class="indexterm" name="id384056"></a> 147 147 When the Samba <code class="literal">smbd</code> daemon is first started, if the <code class="filename">secrets.tdb</code> 148 148 file does not exist, it is created at the first client connection attempt. If this file does … … 154 154 (hostname) and domain name (workgroup), it will be different. 155 155 </p><p> 156 <a class="indexterm" name="id3 61775"></a>156 <a class="indexterm" name="id384101"></a> 157 157 The SID is the key used by MS Windows networking for all networking operations. This means 158 158 that when the machine or domain SID changes, all security-encoded objects such as profiles … … 163 163 be restored to its previous value. 164 164 </p></div><p> 165 <a class="indexterm" name="id3 61793"></a>166 <a class="indexterm" name="id3 61800"></a>167 <a class="indexterm" name="id3 61806"></a>168 <a class="indexterm" name="id3 61813"></a>169 <a class="indexterm" name="id3 61820"></a>170 <a class="indexterm" name="id3 61826"></a>171 <a class="indexterm" name="id3 61833"></a>172 <a class="indexterm" name="id3 61840"></a>173 <a class="indexterm" name="id3 61847"></a>174 <a class="indexterm" name="id3 61853"></a>165 <a class="indexterm" name="id384118"></a> 166 <a class="indexterm" name="id384125"></a> 167 <a class="indexterm" name="id384132"></a> 168 <a class="indexterm" name="id384138"></a> 169 <a class="indexterm" name="id384145"></a> 170 <a class="indexterm" name="id384152"></a> 171 <a class="indexterm" name="id384159"></a> 172 <a class="indexterm" name="id384166"></a> 173 <a class="indexterm" name="id384172"></a> 174 <a class="indexterm" name="id384179"></a> 175 175 In Samba-3 on a domain controller (PDC or BDC), the domain name controls the domain 176 176 SID. On all prior versions the hostname (computer name, or NetBIOS name) controlled 177 177 the SID. On a standalone server the hostname still controls the SID. 178 178 </p><p> 179 <a class="indexterm" name="id3 61865"></a>180 <a class="indexterm" name="id3 61874"></a>179 <a class="indexterm" name="id384191"></a> 180 <a class="indexterm" name="id384200"></a> 181 181 The local machine SID can be backed up using this procedure (Samba-3): 182 182 </p><pre class="screen"> … … 201 201 This is not a reversible process it is a one-way upgrade. 202 202 </p><p> 203 <a class="indexterm" name="id3 61956"></a>203 <a class="indexterm" name="id384281"></a> 204 204 In the course of the Samba 2.0.x series the <code class="literal">smbpasswd</code> was modified to 205 205 permit the domain SID to be captured to the <code class="filename">secrets.tdb</code> file by executing: … … 218 218 </pre><p> 219 219 </p><p> 220 <a class="indexterm" name="id3 62024"></a>221 <a class="indexterm" name="id3 62031"></a>220 <a class="indexterm" name="id384350"></a> 221 <a class="indexterm" name="id384356"></a> 222 222 Domain security information, which includes the domain SID, can be obtained from Samba-2.2.x 223 223 systems by executing: … … 238 238 case it is ever needed at a later date. 239 239 </p><p> 240 <a class="indexterm" name="id3 62073"></a>241 <a class="indexterm" name="id3 62079"></a>242 <a class="indexterm" name="id3 62086"></a>240 <a class="indexterm" name="id384398"></a> 241 <a class="indexterm" name="id384405"></a> 242 <a class="indexterm" name="id384412"></a> 243 243 Take note that the domain SID is used extensively in Samba. Where LDAP is used for the 244 244 <em class="parameter"><code>passdb backend</code></em>, all user, group, and trust accounts are encoded … … 251 251 </pre><p> 252 252 </p><p> 253 <a class="indexterm" name="id3 62118"></a>254 <a class="indexterm" name="id3 62124"></a>255 <a class="indexterm" name="id3 62131"></a>253 <a class="indexterm" name="id384443"></a> 254 <a class="indexterm" name="id384450"></a> 255 <a class="indexterm" name="id384456"></a> 256 256 When the domain SID has changed, roaming profiles cease to be functional. The recovery 257 257 of roaming profiles necessitates resetting of the domain portion of the user SID … … 262 262 addressed to the creator of the RPM package. The Samba Team do their best to make 263 263 available all the tools needed to manage a Samba-based Windows networking environment. 264 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 62157"></a>Change of hostname</h4></div></div></div><p>265 <a class="indexterm" name="id3 62165"></a>266 <a class="indexterm" name="id3 62174"></a>264 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id384485"></a>Change of hostname</h4></div></div></div><p> 265 <a class="indexterm" name="id384493"></a> 266 <a class="indexterm" name="id384502"></a> 267 267 Samba uses two methods by which the primary NetBIOS machine name (also known as a computer 268 268 name or the hostname) may be determined: If the <code class="filename">smb.conf</code> file contains a … … 278 278 is changed, be sure to reset the machine SID to the original setting. Otherwise 279 279 there may be serious interoperability and/or operational problems. 280 </p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 62215"></a>Change of Workgroup (Domain) Name</h4></div></div></div><p>281 <a class="indexterm" name="id3 62223"></a>280 </p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id384544"></a>Change of Workgroup (Domain) Name</h4></div></div></div><p> 281 <a class="indexterm" name="id384551"></a> 282 282 The domain name of a Samba server is identical to the workgroup name and is 283 283 set in the <code class="filename">smb.conf</code> file using the <em class="parameter"><code>workgroup</code></em> parameter. 284 284 This has been consistent throughout the history of Samba and across all versions. 285 285 </p><p> 286 <a class="indexterm" name="id3 62246"></a>286 <a class="indexterm" name="id384575"></a> 287 287 Be aware that when the workgroup name is changed, a new SID will be generated. 288 288 The old domain SID can be reset using the procedure outlined earlier in this chapter. … … 293 293 for network administrators. 294 294 </p><p> 295 <a class="indexterm" name="id3 62274"></a>295 <a class="indexterm" name="id384602"></a> 296 296 The Samba 1.9.x <code class="filename">smb.conf</code> file may be found either in the <code class="filename">/etc</code> 297 297 directory or in <code class="filename">/usr/local/samba/lib</code>. … … 301 301 remains located also for Samba 3.0.x installations. 302 302 </p><p> 303 <a class="indexterm" name="id3 62318"></a>303 <a class="indexterm" name="id384647"></a> 304 304 Samba 2.x introduced the <code class="filename">secrets.tdb</code> file that is also stored in the 305 305 <code class="filename">/etc/samba</code> directory, or in the <code class="filename">/usr/local/samba/lib</code> 306 306 directory subsystem. 307 307 </p><p> 308 <a class="indexterm" name="id3 62347"></a>308 <a class="indexterm" name="id384676"></a> 309 309 The location at which <code class="literal">smbd</code> expects to find all configuration and control 310 310 files is determined at the time of compilation of Samba. For versions of Samba prior to … … 318 318 <code class="filename">/usr/local/samba/sbin</code>. 319 319 </p><p> 320 <a class="indexterm" name="id3 62401"></a>320 <a class="indexterm" name="id384730"></a> 321 321 Samba-3 provides a neat new way to track the location of all control files as well as to 322 322 find the compile-time options used as the Samba package was built. Here is how the dark … … 349 349 </pre><p> 350 350 </p><p> 351 <a class="indexterm" name="id3 62430"></a>351 <a class="indexterm" name="id384759"></a> 352 352 It is important that both the <code class="filename">smb.conf</code> file and the <code class="filename">secrets.tdb</code> 353 353 be backed up before attempting any upgrade. The <code class="filename">secrets.tdb</code> file … … 355 355 of Samba. A backup means that it is always possible to revert a failed or problematic 356 356 upgrade. 357 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 62458"></a>International Language Support</h4></div></div></div><p>358 <a class="indexterm" name="id3 62466"></a>359 <a class="indexterm" name="id3 62473"></a>360 <a class="indexterm" name="id3 62480"></a>361 <a class="indexterm" name="id3 62486"></a>357 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id384787"></a>International Language Support</h4></div></div></div><p> 358 <a class="indexterm" name="id384795"></a> 359 <a class="indexterm" name="id384801"></a> 360 <a class="indexterm" name="id384808"></a> 361 <a class="indexterm" name="id384815"></a> 362 362 Samba-2.x had no support for Unicode; instead, all national language character-set support in file names 363 363 was done using particular locale codepage mapping techniques. Samba-3 supports Unicode in file names, thus 364 364 providing true internationalization support. 365 365 </p><p> 366 <a class="indexterm" name="id3 62499"></a>366 <a class="indexterm" name="id384827"></a> 367 367 Non-English users whose national language character set has special characters and who upgrade naively will 368 368 find that many files that have the special characters in the file name will see them garbled and jumbled up. … … 370 370 that was in use with Samba-2.x using an 8-bit encoding scheme. 371 371 </p><p> 372 <a class="indexterm" name="id3 62512"></a>372 <a class="indexterm" name="id384841"></a> 373 373 Files that are created with Samba-3 will use UTF-8 encoding. Should the file system ever end up with a 374 374 mix of codepage (unix charset)-encoded file names and UTF-8-encoded file names, the mess will take some 375 375 effort to set straight. 376 376 </p><p> 377 <a class="indexterm" name="id3 62524"></a>378 A very helpful tool is available from Bjorn Jacke's <a href="http://j3e.de/linux/convmv/" target="_top">convmv</a>377 <a class="indexterm" name="id384853"></a> 378 A very helpful tool is available from Bjorn Jacke's <a class="ulink" href="http://j3e.de/linux/convmv/" target="_top">convmv</a> 379 379 work. Convmv is a tool that can be used to convert file and directory names from one encoding method to 380 380 another. The most common use for this tool is to convert locale-encoded files to UTF-8 Unicode encoding. 381 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 62542"></a>Updates and Changes in Idealx smbldap-tools</h4></div></div></div><p>381 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id384870"></a>Updates and Changes in Idealx smbldap-tools</h4></div></div></div><p> 382 382 The smbldap-tools have been maturing rapidly over the past year. With maturation comes change. 383 383 The location of the <code class="filename">smbldap.conf</code> and the <code class="filename">smbldap_bind.conf</code> … … 393 393 current release should note that the information stored under <code class="constant">NextFreeUnixId</code> 394 394 must now be relocated to the DIT object <code class="constant">sambaDomainName</code>. 395 </p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 62605"></a>Upgrading from Samba 1.x and 2.x to Samba-3</h2></div></div></div><p>395 </p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id384934"></a>Upgrading from Samba 1.x and 2.x to Samba-3</h2></div></div></div><p> 396 396 Sites that are being upgraded from Samba-2 (or earlier versions) to Samba-3 397 397 may experience little difficulty or may require a lot of effort, depending … … 406 406 Where it is necessary to upgrade an old Samba installation to Samba-3, 407 407 the following procedure can be followed: 408 </p><div class="procedure"><a name="id3 62636"></a><p class="title"><b>Procedure 8.1. Upgrading from a Pre-Samba-3 Version</b></p><ol type="1"><li><p>409 <a class="indexterm" name="id3 62647"></a>410 <a class="indexterm" name="id3 62654"></a>411 <a class="indexterm" name="id3 62661"></a>408 </p><div class="procedure"><a name="id384965"></a><p class="title"><b>Procedure 8.1. Upgrading from a Pre-Samba-3 Version</b></p><ol type="1"><li><p> 409 <a class="indexterm" name="id384976"></a> 410 <a class="indexterm" name="id384983"></a> 411 <a class="indexterm" name="id384989"></a> 412 412 Stop Samba. This can be done using the appropriate system tool 413 413 that is particular for each operating system or by executing the … … 424 424 back it up to a safe location. 425 425 </p></li><li><p> 426 <a class="indexterm" name="id3 62739"></a>427 <a class="indexterm" name="id3 62746"></a>428 <a class="indexterm" name="id3 62753"></a>429 <a class="indexterm" name="id3 62760"></a>426 <a class="indexterm" name="id385068"></a> 427 <a class="indexterm" name="id385074"></a> 428 <a class="indexterm" name="id385081"></a> 429 <a class="indexterm" name="id385088"></a> 430 430 Find the location of the lock directory. This is the directory 431 431 in which Samba stores all its tdb control files. The default … … 438 438 tdb files to a safe location. 439 439 </p></li><li><p> 440 <a class="indexterm" name="id3 62794"></a>440 <a class="indexterm" name="id385122"></a> 441 441 It is now safe to upgrade the Samba installation. On Linux systems 442 442 it is not necessary to remove the Samba RPMs because a simple … … 450 450 When the Samba upgrade has been installed, the first step that should 451 451 be completed is to identify the new target locations for the control 452 files. Follow the steps shown in <a href="upgrades.html#sbeug1" title="Location of config files">???</a> to locate452 files. Follow the steps shown in <a class="link" href="upgrades.html#sbeug1" title="Location of config files">“Location of config files”</a> to locate 453 453 the correct directories to which each control file must be moved. 454 454 </p></li><li><p> … … 457 457 Do not change the workgroup name. 458 458 </p></li><li><p> 459 <a class="indexterm" name="id3 62843"></a>459 <a class="indexterm" name="id385171"></a> 460 460 Execute the <code class="literal">testparm</code> to validate the <code class="filename">smb.conf</code> file. 461 461 This process will flag any parameters that are no longer supported. … … 469 469 <code class="prompt">root# </code> testparm -s smb.conf.master > smb.conf 470 470 </pre><p> 471 <a class="indexterm" name="id3 62897"></a>471 <a class="indexterm" name="id385226"></a> 472 472 The resulting <code class="filename">smb.conf</code> file will be stripped of all comments 473 473 and of all nonconforming configuration settings. 474 474 </p></li><li><p> 475 <a class="indexterm" name="id3 62917"></a>475 <a class="indexterm" name="id385246"></a> 476 476 It is now safe to start Samba using the appropriate system tool. 477 477 Alternately, it is possible to just execute <code class="literal">nmbd</code>, 478 478 <code class="literal">smbd</code>, and <code class="literal">winbindd</code> for the command 479 479 line while logged in as the root user. 480 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 62947"></a>Applicable to All Samba 2.x to Samba-3 Upgrades</h3></div></div></div><p>481 <a class="indexterm" name="id3 62955"></a>482 <a class="indexterm" name="id3 62961"></a>483 <a class="indexterm" name="id3 62968"></a>480 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id385275"></a>Applicable to All Samba 2.x to Samba-3 Upgrades</h3></div></div></div><p> 481 <a class="indexterm" name="id385283"></a> 482 <a class="indexterm" name="id385290"></a> 483 <a class="indexterm" name="id385297"></a> 484 484 Samba 2.x servers that were running as a domain controller (PDC) 485 485 require changes to the configuration of the scripting interface … … 487 487 users, groups, and trust accounts (machines and interdomain). 488 488 </p><p> 489 <a class="indexterm" name="id3 62980"></a>489 <a class="indexterm" name="id385309"></a> 490 490 The following parameters are new to Samba-3 and should be correctly configured. 491 Please refer to <a href="secure.html" title="Chapter 3. Secure Office Networking">???</a> through <a href="2000users.html" title="Chapter 6. A Distributed 2000-User Network">???</a>491 Please refer to <a class="link" href="secure.html" title="Chapter 3. Secure Office Networking">“Secure Office Networking”</a> through <a class="link" href="2000users.html" title="Chapter 6. A Distributed 2000-User Network">“A Distributed 2000-User Network”</a> 492 492 in this book for examples of use of the new parameters shown here: 493 <a class="indexterm" name="id3 63000"></a>494 <a class="indexterm" name="id3 63006"></a>495 <a class="indexterm" name="id3 63013"></a>496 <a class="indexterm" name="id3 63020"></a>497 <a class="indexterm" name="id3 63027"></a>498 <a class="indexterm" name="id3 63034"></a>499 <a class="indexterm" name="id3 63041"></a>493 <a class="indexterm" name="id385328"></a> 494 <a class="indexterm" name="id385335"></a> 495 <a class="indexterm" name="id385342"></a> 496 <a class="indexterm" name="id385349"></a> 497 <a class="indexterm" name="id385355"></a> 498 <a class="indexterm" name="id385362"></a> 499 <a class="indexterm" name="id385369"></a> 500 500 </p><p> 501 501 </p><table class="simplelist" border="0" summary="Simple list"><tr><td><p>add group script</p></td></tr><tr><td><p>add machine script</p></td></tr><tr><td><p>add user to group script</p></td></tr><tr><td><p>delete group script</p></td></tr><tr><td><p>delete user from group script</p></td></tr><tr><td><p>passdb backend</p></td></tr><tr><td><p>set primary group script</p></td></tr></table><p> 502 502 </p><p> 503 <a class="indexterm" name="id3 63092"></a>504 <a class="indexterm" name="id3 63098"></a>503 <a class="indexterm" name="id385420"></a> 504 <a class="indexterm" name="id385427"></a> 505 505 The <em class="parameter"><code>add machine script</code></em> functionality was previously 506 506 handled by the <em class="parameter"><code>add user script</code></em>, which in Samba-3 is 507 507 used exclusively to add user accounts. 508 508 </p><p> 509 <a class="indexterm" name="id3 63121"></a>510 <a class="indexterm" name="id3 63128"></a>511 <a class="indexterm" name="id3 63135"></a>512 <a class="indexterm" name="id3 63142"></a>513 <a class="indexterm" name="id3 63148"></a>514 <a class="indexterm" name="id3 63155"></a>515 <a class="indexterm" name="id3 63162"></a>516 <a class="indexterm" name="id3 63169"></a>517 <a class="indexterm" name="id3 63176"></a>509 <a class="indexterm" name="id385450"></a> 510 <a class="indexterm" name="id385457"></a> 511 <a class="indexterm" name="id385463"></a> 512 <a class="indexterm" name="id385470"></a> 513 <a class="indexterm" name="id385477"></a> 514 <a class="indexterm" name="id385484"></a> 515 <a class="indexterm" name="id385491"></a> 516 <a class="indexterm" name="id385497"></a> 517 <a class="indexterm" name="id385504"></a> 518 518 Where the <em class="parameter"><code>passdb backend</code></em> used is either <code class="constant">smbpasswd</code> 519 519 (the default) or the new <code class="constant">tdbsam</code>, the system interface scripts … … 522 522 <code class="literal">groupmod</code>, <code class="literal">groupdel</code>, and so on. 523 523 </p><p> 524 <a class="indexterm" name="id3 63235"></a>525 <a class="indexterm" name="id3 63242"></a>526 <a class="indexterm" name="id3 63248"></a>524 <a class="indexterm" name="id385563"></a> 525 <a class="indexterm" name="id385570"></a> 526 <a class="indexterm" name="id385577"></a> 527 527 Where the <em class="parameter"><code>passdb backend</code></em> makes use of an LDAP directory, 528 528 it is necessary either to use the <code class="constant">smbldap-tools</code> provided 529 529 by Idealx or to use an alternate toolset provided by a third 530 530 party or else home-crafted to manage the LDAP directory accounts. 531 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 63269"></a>Samba-2.x with LDAP Support</h3></div></div></div><p>531 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id385597"></a>Samba-2.x with LDAP Support</h3></div></div></div><p> 532 532 Samba version 2.x could be compiled for use either with or without LDAP. 533 533 The LDAP control settings in the <code class="filename">smb.conf</code> file in this old version are … … 536 536 the LDAP settings entirely. 537 537 </p><p> 538 Follow the procedure outlined in <a href="upgrades.html#sbeug2" title="Samba 1.9.x and 2.x Versions Without LDAP">???</a> to affect a migration538 Follow the procedure outlined in <a class="link" href="upgrades.html#sbeug2" title="Samba 1.9.x and 2.x Versions Without LDAP">“Samba 1.9.x and 2.x Versions Without LDAP”</a> to affect a migration 539 539 of all files to the correct locations. 540 540 </p><p> 541 <a class="indexterm" name="id3 63299"></a>542 <a class="indexterm" name="id3 63306"></a>541 <a class="indexterm" name="id385628"></a> 542 <a class="indexterm" name="id385634"></a> 543 543 The Samba SAM schema required for Samba-3 is significantly different from that 544 544 used with Samba 2.x. This means that the LDAP directory must be updated … … 695 695 the DN's with quotation marks. 696 696 </pre><p> 697 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 63384"></a>Updating a Samba-3 Installation</h2></div></div></div><p>697 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id385712"></a>Updating a Samba-3 Installation</h2></div></div></div><p> 698 698 The key concern in this section is to deal with the changes that have been 699 699 affected in Samba-3 between the Samba-3.0.0 release and the current update. … … 701 701 taken to update Samba-3 versions. 702 702 </p><p> 703 <a class="indexterm" name="id3 63397"></a>704 The information in <a href="upgrades.html#sbeug1" title="Location of config files">???</a> would not be necessary if every703 <a class="indexterm" name="id385725"></a> 704 The information in <a class="link" href="upgrades.html#sbeug1" title="Location of config files">“Location of config files”</a> would not be necessary if every 705 705 person who has ever produced Samba executable (binary) files could agree on 706 706 the preferred location of the <code class="filename">smb.conf</code> file and other Samba control files. 707 707 Clearly, such agreement is further away than a pipedream. 708 708 </p><p> 709 <a class="indexterm" name="id3 63420"></a>709 <a class="indexterm" name="id385749"></a> 710 710 Vendors and packagers who produce Samba binary installable packages do not, 711 711 as a rule, use the default paths used by the Samba-Team for the location of … … 720 720 effect. 721 721 </p><p> 722 <a class="indexterm" name="id3 63448"></a>722 <a class="indexterm" name="id385777"></a> 723 723 The best advice for those lacking in code compilation experience is to use 724 724 only vendor (or Samba-Team) provided binary packages. The Samba packages … … 726 726 that are compatible with the original OS vendor's practices. 727 727 </p><p> 728 <a class="indexterm" name="id3 63461"></a>729 <a class="indexterm" name="id3 63468"></a>728 <a class="indexterm" name="id385789"></a> 729 <a class="indexterm" name="id385796"></a> 730 730 If you are not sure whether a binary package complies with the OS 731 731 vendor's practices, it is better to ask the package maintainer via … … 733 733 Alternately, just diagnose the paths specified by the binary files following 734 734 the procedure outlined above. 735 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 63478"></a>Samba-3 to Samba-3 Updates on the Same Server</h3></div></div></div><p>735 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id385807"></a>Samba-3 to Samba-3 Updates on the Same Server</h3></div></div></div><p> 736 736 The guidance in this section deals with updates to an existing 737 737 Samba-3 server installation. 738 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 63488"></a>Updating from Samba Versions Earlier than 3.0.5</h4></div></div></div><p>738 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id385817"></a>Updating from Samba Versions Earlier than 3.0.5</h4></div></div></div><p> 739 739 With the provision that the binary Samba-3 package has been built 740 740 with the same path and feature settings as the existing Samba-3 … … 743 743 and without need to change either the <code class="filename">smb.conf</code> file or, where 744 744 used, the LDAP schema. 745 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 63507"></a>Updating from Samba Versions between 3.0.6 and 3.0.10</h4></div></div></div><p>746 <a class="indexterm" name="id3 63515"></a>747 <a class="indexterm" name="id3 63522"></a>745 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id385836"></a>Updating from Samba Versions between 3.0.6 and 3.0.10</h4></div></div></div><p> 746 <a class="indexterm" name="id385844"></a> 747 <a class="indexterm" name="id385851"></a> 748 748 When updating versions of Samba-3 prior to 3.0.6 to 3.0.6 through 3.0.10, 749 749 it is necessary only to update the LDAP schema (where LDAP is used). … … 751 751 update. 752 752 </p><p> 753 <a class="indexterm" name="id3 63536"></a>754 <a class="indexterm" name="id3 63543"></a>755 <a class="indexterm" name="id3 63550"></a>753 <a class="indexterm" name="id385865"></a> 754 <a class="indexterm" name="id385872"></a> 755 <a class="indexterm" name="id385879"></a> 756 756 Samba-3.0.6 introduced the ability to remember the last <span class="emphasis"><em>n</em></span> number 757 757 of passwords a user has used. This information will work only with … … 760 760 </p><p> 761 761 After updating the LDAP schema, do not forget to re-index the LDAP database. 762 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 63581"></a>Updating from Samba Versions after 3.0.6 to a Current Release</h4></div></div></div><p>763 <a class="indexterm" name="id3 63589"></a>762 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id385909"></a>Updating from Samba Versions after 3.0.6 to a Current Release</h4></div></div></div><p> 763 <a class="indexterm" name="id385918"></a> 764 764 Samba-3.0.8 introduced changes in how the <em class="parameter"><code>username map</code></em> 765 765 behaves. It also included a change in behavior of <code class="literal">winbindd</code>. … … 767 767 from versions prior to 3.0.8 to a current version. 768 768 </p><p> 769 <a class="indexterm" name="id3 63618"></a>769 <a class="indexterm" name="id385947"></a> 770 770 In Samba-3.0.11 a new privileges interface was implemented. Please 771 refer to <a href="happy.html#sbehap-ppc" title="Addition of Machines to the Domain">???</a> for information regarding this new771 refer to <a class="link" href="happy.html#sbehap-ppc" title="Addition of Machines to the Domain">“Addition of Machines to the Domain”</a> for information regarding this new 772 772 feature. It is not necessary to implement the privileges interface, but it 773 773 is one that has been requested for several years and thus may be of interest … … 789 789 back to searching the 'ldap suffix' in some cases. 790 790 </pre><p> 791 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 63662"></a>Migrating Samba-3 to a New Server</h3></div></div></div><p>791 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id385991"></a>Migrating Samba-3 to a New Server</h3></div></div></div><p> 792 792 The two most likely candidates for replacement of a server are 793 793 domain member servers and domain controllers. Each needs to be 794 794 handled slightly differently. 795 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 63672"></a>Replacing a Domain Member Server</h4></div></div></div><p>796 <a class="indexterm" name="id3 63680"></a>795 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id386001"></a>Replacing a Domain Member Server</h4></div></div></div><p> 796 <a class="indexterm" name="id386009"></a> 797 797 Replacement of a domain member server should be done 798 using the same procedure as outlined in <a href="unixclients.html" title="Chapter 7. Adding Domain Member Servers and Clients">???</a>.798 using the same procedure as outlined in <a class="link" href="unixclients.html" title="Chapter 7. Adding Domain Member Servers and Clients">“Adding Domain Member Servers and Clients”</a>. 799 799 </p><p> 800 800 Usually the new server will be introduced with a temporary name. After … … 803 803 change its SID and will necessitate rejoining to the domain. 804 804 </p><p> 805 <a class="indexterm" name="id3 63703"></a>806 <a class="indexterm" name="id3 63709"></a>807 <a class="indexterm" name="id3 63716"></a>808 <a class="indexterm" name="id3 63723"></a>809 <a class="indexterm" name="id3 63730"></a>810 <a class="indexterm" name="id3 63736"></a>805 <a class="indexterm" name="id386031"></a> 806 <a class="indexterm" name="id386038"></a> 807 <a class="indexterm" name="id386045"></a> 808 <a class="indexterm" name="id386051"></a> 809 <a class="indexterm" name="id386058"></a> 810 <a class="indexterm" name="id386065"></a> 811 811 Following a change of hostname (NetBIOS name) it is a good idea on all servers 812 812 to shut down the Samba <code class="literal">smbd</code>, <code class="literal">nmbd</code>, and … … 818 818 change, but can persist for a longer period of time. 819 819 </p><p> 820 <a class="indexterm" name="id3 63780"></a>821 <a class="indexterm" name="id3 63786"></a>822 <a class="indexterm" name="id3 63793"></a>823 <a class="indexterm" name="id3 63800"></a>820 <a class="indexterm" name="id386108"></a> 821 <a class="indexterm" name="id386115"></a> 822 <a class="indexterm" name="id386122"></a> 823 <a class="indexterm" name="id386129"></a> 824 824 If the old domain member server had local accounts, it is necessary to create 825 825 on the new domain member server the same accounts with the same UID and GID … … 832 832 account entries to the new target server. 833 833 </p><p> 834 <a class="indexterm" name="id3 63845"></a>834 <a class="indexterm" name="id386173"></a> 835 835 Where the user accounts for both UNIX and Samba are stored in LDAP, the new 836 836 target server must be configured to use the <code class="literal">nss_ldap</code> tool set. 837 837 This will automatically ensure that the appropriate user entities are 838 838 available on the new server. 839 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 63862"></a>Replacing a Domain Controller</h4></div></div></div><p>840 <a class="indexterm" name="id3 63870"></a>839 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id386190"></a>Replacing a Domain Controller</h4></div></div></div><p> 840 <a class="indexterm" name="id386198"></a> 841 841 In the past, people who replaced a Windows NT4 domain controller typically 842 842 installed a new server, created printers and file shares on it, then migrate across … … 862 862 <code class="literal">slapadd</code> command. Do not forget to install and configure 863 863 the <code class="literal">nss_ldap</code> tool and the <code class="filename">/etc/nsswitch.conf</code> 864 (as shown in <a href="happy.html" title="Chapter 5. Making Happy Users">???</a>).864 (as shown in <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>). 865 865 </p></li><li><p> 866 866 Copy the <code class="filename">smb.conf</code> file from the old server to the new server into the correct … … 891 891 should correctly pick up the original SID and preserve all other settings. It is 892 892 sound advice to validate this before turning the system over to users. 893 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 64040"></a>Migration of Samba Accounts to Active Directory</h3></div></div></div><p>893 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id386368"></a>Migration of Samba Accounts to Active Directory</h3></div></div></div><p> 894 894 Yes, it works. The Windows ADMT tool can be used to migrate Samba accounts 895 895 to MS Active Directory. There are a few pitfalls to be aware of: 896 </p><div class="procedure"><a name="id3 64050"></a><p class="title"><b>Procedure 8.2. Migration to Active Directory</b></p><ol type="1"><li><p>896 </p><div class="procedure"><a name="id386378"></a><p class="title"><b>Procedure 8.2. Migration to Active Directory</b></p><ol type="1"><li><p> 897 897 Administrator password must be THE SAME on the Samba server, 898 898 the 2003 ADS, and the local Administrator account on the workstations. … … 915 915 workstations won't be migrated to the new domain. 916 916 </p></li><li><p> 917 <a class="indexterm" name="id3 64108"></a>917 <a class="indexterm" name="id386436"></a> 918 918 When migrating machines, always test first (using ADMT's test mode) 919 919 and satisfy all errors before committing the migration. Note that the … … 923 923 a test. 924 924 </p></li></ol></div><p> 925 <a class="indexterm" name="id3 64122"></a>925 <a class="indexterm" name="id386451"></a> 926 926 There are some significant benefits of using the ADMT, besides just 927 927 migrating user accounts. ADMT can be found on the Windows 2003 CD.
Note:
See TracChangeset
for help on using the changeset viewer.
