- Timestamp:
- May 23, 2008, 6:56:41 AM (17 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
branches/samba-3.0/docs/htmldocs/Samba3-HOWTO/NetCommand.html
r44 r134 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 13. Remote and Local Management: The Net Command</title><link rel="stylesheet" href=" samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.71.0"><link rel="start" href="index.html" title="The Official Samba-3 HOWTO and Reference Guide"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="prev" href="groupmapping.html" title="Chapter 12. Group Mapping: MS Windows and UNIX"><link rel="next" href="idmapper.html" title="Chapter 14. Identity Mapping (IDMAP)"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 13. Remote and Local Management: The Net Command</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="groupmapping.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="idmapper.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="NetCommand"></a>Chapter 13. Remote and Local Management: The Net Command</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Volker</span> <span class="surname">Lendecke</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a href="mailto:Volker.Lendecke@SerNet.DE">Volker.Lendecke@SerNet.DE</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Guenther</span> <span class="surname">Deschner</span></h3><div class="affiliation"><span class="orgname">SuSE<br></span><div class="address"><p><code class="email"><<a href="mailto:gd@suse.de">gd@suse.de</a>></code></p></div></div></div></div><div><p class="pubdate">May 9, 2005</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="NetCommand.html#id362393">Overview</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id362669">Administrative Tasks and Methods</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id362743">UNIX and Windows Group Management</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetCommand.html#id362893">Adding, Renaming, or Deletion of Group Accounts</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#grpmemshipchg">Manipulating Group Memberships</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#nestedgrpmgmgt">Nested Group Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="NetCommand.html#id364122">UNIX and Windows User Management</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetCommand.html#sbeuseraddn">Adding User Accounts</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id364314">Deletion of User Accounts</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id364358">Managing User Accounts</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id364421">User Mapping</a></span></dt></dl></dd><dt><span class="sect1"><a href="NetCommand.html#id364498">Administering User Rights and Privileges</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id364808">Managing Trust Relationships</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetCommand.html#id364820">Machine Trust Accounts</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id365158">Interdomain Trusts</a></span></dt></dl></dd><dt><span class="sect1"><a href="NetCommand.html#id365367">Managing Security Identifiers (SIDS)</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id365569">Share Management</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetCommand.html#id365611">Creating, Editing, and Removing Shares</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id365767">Creating and Changing Share ACLs</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id365794">Share, Directory, and File Migration</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id366337">Printer Migration</a></span></dt></dl></dd><dt><span class="sect1"><a href="NetCommand.html#id366547">Controlling Open Files</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id366564">Session and Connection Management</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id366624">Printers and ADS</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id366727">Manipulating the Samba Cache</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id366744">Managing IDMAP UID/SID Mappings</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetCommand.html#id366782">Creating an IDMAP Database Dump File</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id366813">Restoring the IDMAP Database Dump File</a></span></dt></dl></dd><dt><span class="sect1"><a href="NetCommand.html#netmisc1">Other Miscellaneous Operations</a></span></dt></dl></div><p>2 <a class="indexterm" name="id3 62264"></a>3 <a class="indexterm" name="id3 62271"></a>4 <a class="indexterm" name="id3 62278"></a>5 <a class="indexterm" name="id3 62284"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 13. Remote and Local Management: The Net Command</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="The Official Samba 3.2.x HOWTO and Reference Guide"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="prev" href="groupmapping.html" title="Chapter 12. Group Mapping: MS Windows and UNIX"><link rel="next" href="idmapper.html" title="Chapter 14. Identity Mapping (IDMAP)"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 13. Remote and Local Management: The Net Command</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="groupmapping.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="idmapper.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="NetCommand"></a>Chapter 13. Remote and Local Management: The Net Command</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Volker</span> <span class="surname">Lendecke</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:Volker.Lendecke@SerNet.DE">Volker.Lendecke@SerNet.DE</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Guenther</span> <span class="surname">Deschner</span></h3><div class="affiliation"><span class="orgname">SuSE<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:gd@suse.de">gd@suse.de</a>></code></p></div></div></div></div><div><p class="pubdate">May 9, 2005</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="NetCommand.html#id385377">Overview</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id385653">Administrative Tasks and Methods</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id385728">UNIX and Windows Group Management</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetCommand.html#id385877">Adding, Renaming, or Deletion of Group Accounts</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#grpmemshipchg">Manipulating Group Memberships</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#nestedgrpmgmgt">Nested Group Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="NetCommand.html#id387104">UNIX and Windows User Management</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetCommand.html#sbeuseraddn">Adding User Accounts</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id387299">Deletion of User Accounts</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id387344">Managing User Accounts</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id387406">User Mapping</a></span></dt></dl></dd><dt><span class="sect1"><a href="NetCommand.html#id387484">Administering User Rights and Privileges</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id387799">Managing Trust Relationships</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetCommand.html#id387811">Machine Trust Accounts</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id388148">Interdomain Trusts</a></span></dt></dl></dd><dt><span class="sect1"><a href="NetCommand.html#id388358">Managing Security Identifiers (SIDS)</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id388559">Share Management</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetCommand.html#id388601">Creating, Editing, and Removing Shares</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id388770">Creating and Changing Share ACLs</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id388797">Share, Directory, and File Migration</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id389335">Printer Migration</a></span></dt></dl></dd><dt><span class="sect1"><a href="NetCommand.html#id389550">Controlling Open Files</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id389567">Session and Connection Management</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id389627">Printers and ADS</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id389730">Manipulating the Samba Cache</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id389747">Managing IDMAP UID/SID Mappings</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetCommand.html#id389785">Creating an IDMAP Database Dump File</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id389816">Restoring the IDMAP Database Dump File</a></span></dt></dl></dd><dt><span class="sect1"><a href="NetCommand.html#netmisc1">Other Miscellaneous Operations</a></span></dt></dl></div><p> 2 <a class="indexterm" name="id385248"></a> 3 <a class="indexterm" name="id385255"></a> 4 <a class="indexterm" name="id385262"></a> 5 <a class="indexterm" name="id385268"></a> 6 6 The <code class="literal">net</code> command is one of the new features of Samba-3 and is an attempt to provide a useful 7 7 tool for the majority of remote management operations necessary for common tasks. The <code class="literal">net</code> 8 8 tool is flexible by design and is intended for command-line use as well as for scripted control application. 9 9 </p><p> 10 <a class="indexterm" name="id3 62308"></a>11 <a class="indexterm" name="id3 62315"></a>12 <a class="indexterm" name="id3 62322"></a>13 <a class="indexterm" name="id3 62328"></a>10 <a class="indexterm" name="id385292"></a> 11 <a class="indexterm" name="id385299"></a> 12 <a class="indexterm" name="id385306"></a> 13 <a class="indexterm" name="id385313"></a> 14 14 Originally introduced with the intent to mimic the Microsoft Windows command that has the same name, the 15 15 <code class="literal">net</code> command has morphed into a very powerful instrument that has become an essential part … … 23 23 A Samba-3 administrator cannot afford to gloss over this chapter because to do so will almost certainly cause 24 24 the infliction of self-induced pain, agony, and desperation. Be warned: this is an important chapter. 25 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 62393"></a>Overview</h2></div></div></div><p>26 <a class="indexterm" name="id3 62400"></a>27 <a class="indexterm" name="id3 62407"></a>28 <a class="indexterm" name="id3 62414"></a>29 <a class="indexterm" name="id3 62421"></a>30 <a class="indexterm" name="id3 62427"></a>31 <a class="indexterm" name="id3 62434"></a>25 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id385377"></a>Overview</h2></div></div></div><p> 26 <a class="indexterm" name="id385385"></a> 27 <a class="indexterm" name="id385391"></a> 28 <a class="indexterm" name="id385398"></a> 29 <a class="indexterm" name="id385405"></a> 30 <a class="indexterm" name="id385411"></a> 31 <a class="indexterm" name="id385418"></a> 32 32 The tasks that follow the installation of a Samba-3 server, whether standalone or domain member, of a 33 33 domain controller (PDC or BDC) begins with the need to create administrative rights. Of course, the … … 36 36 the central domain authentication backend. 37 37 </p><p> 38 <a class="indexterm" name="id3 62448"></a>39 <a class="indexterm" name="id3 62454"></a>40 <a class="indexterm" name="id3 62461"></a>41 <a class="indexterm" name="id3 62468"></a>42 <a class="indexterm" name="id3 62475"></a>43 <a class="indexterm" name="id3 62481"></a>44 <a class="indexterm" name="id3 62488"></a>45 <a class="indexterm" name="id3 62495"></a>38 <a class="indexterm" name="id385432"></a> 39 <a class="indexterm" name="id385438"></a> 40 <a class="indexterm" name="id385445"></a> 41 <a class="indexterm" name="id385452"></a> 42 <a class="indexterm" name="id385459"></a> 43 <a class="indexterm" name="id385465"></a> 44 <a class="indexterm" name="id385472"></a> 45 <a class="indexterm" name="id385479"></a> 46 46 Regardless of the type of server being installed, local UNIX groups must be mapped to the Windows 47 47 networking domain global group accounts. Do you ask why? Because Samba always limits its access to … … 51 51 Samba. Such mappings are implemented using the <code class="literal">net</code> command. 52 52 </p><p> 53 <a class="indexterm" name="id3 62515"></a>54 <a class="indexterm" name="id3 62521"></a>55 <a class="indexterm" name="id3 62528"></a>56 <a class="indexterm" name="id3 62534"></a>57 <a class="indexterm" name="id3 62541"></a>58 <a class="indexterm" name="id3 62548"></a>59 <a class="indexterm" name="id3 62555"></a>53 <a class="indexterm" name="id385499"></a> 54 <a class="indexterm" name="id385506"></a> 55 <a class="indexterm" name="id385512"></a> 56 <a class="indexterm" name="id385519"></a> 57 <a class="indexterm" name="id385525"></a> 58 <a class="indexterm" name="id385532"></a> 59 <a class="indexterm" name="id385539"></a> 60 60 UNIX systems that are hosting a Samba-3 server that is running as a member (PDC, BDC, or DMS) must have 61 61 a machine security account in the domain authentication database (or directory). The creation of such 62 62 security (or trust) accounts is also handled using the <code class="literal">net</code> command. 63 63 </p><p> 64 <a class="indexterm" name="id3 62573"></a>65 <a class="indexterm" name="id3 62580"></a>66 <a class="indexterm" name="id3 62586"></a>67 <a class="indexterm" name="id3 62593"></a>68 <a class="indexterm" name="id3 62600"></a>69 <a class="indexterm" name="id3 62606"></a>70 <a class="indexterm" name="id3 62613"></a>71 <a class="indexterm" name="id3 62620"></a>72 <a class="indexterm" name="id3 62627"></a>64 <a class="indexterm" name="id385557"></a> 65 <a class="indexterm" name="id385564"></a> 66 <a class="indexterm" name="id385570"></a> 67 <a class="indexterm" name="id385577"></a> 68 <a class="indexterm" name="id385584"></a> 69 <a class="indexterm" name="id385591"></a> 70 <a class="indexterm" name="id385597"></a> 71 <a class="indexterm" name="id385604"></a> 72 <a class="indexterm" name="id385611"></a> 73 73 The establishment of interdomain trusts is achieved using the <code class="literal">net</code> command also, as 74 74 may a plethora of typical administrative duties such as user management, group management, share and 75 75 printer management, file and printer migration, security identifier management, and so on. 76 76 </p><p> 77 <a class="indexterm" name="id3 62645"></a>78 <a class="indexterm" name="id3 62651"></a>77 <a class="indexterm" name="id385629"></a> 78 <a class="indexterm" name="id385636"></a> 79 79 The overall picture should be clear now: the <code class="literal">net</code> command plays a central role 80 80 on the Samba-3 stage. This role will continue to be developed. The inclusion of this chapter is 81 81 evidence of its importance, one that has grown in complexity to the point that it is no longer considered 82 82 prudent to cover its use fully in the online UNIX man pages. 83 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 62669"></a>Administrative Tasks and Methods</h2></div></div></div><p>84 <a class="indexterm" name="id3 62677"></a>85 <a class="indexterm" name="id3 62683"></a>86 <a class="indexterm" name="id3 62690"></a>87 <a class="indexterm" name="id3 62699"></a>83 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id385653"></a>Administrative Tasks and Methods</h2></div></div></div><p> 84 <a class="indexterm" name="id385661"></a> 85 <a class="indexterm" name="id385668"></a> 86 <a class="indexterm" name="id385674"></a> 87 <a class="indexterm" name="id385683"></a> 88 88 The basic operations of the <code class="literal">net</code> command are documented here. This documentation is not 89 89 exhaustive, and thus it is incomplete. Since the primary focus is on migration from Windows servers to a Samba … … 95 95 <code class="constant">rap</code> modes. Please refer to the man page for a more comprehensive overview of the 96 96 capabilities of this utility. 97 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 62743"></a>UNIX and Windows Group Management</h2></div></div></div><p>98 <a class="indexterm" name="id3 62751"></a>99 <a class="indexterm" name="id3 62758"></a>100 <a class="indexterm" name="id3 62767"></a>101 <a class="indexterm" name="id3 62775"></a>102 <a class="indexterm" name="id3 62784"></a>97 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id385728"></a>UNIX and Windows Group Management</h2></div></div></div><p> 98 <a class="indexterm" name="id385735"></a> 99 <a class="indexterm" name="id385742"></a> 100 <a class="indexterm" name="id385751"></a> 101 <a class="indexterm" name="id385760"></a> 102 <a class="indexterm" name="id385768"></a> 103 103 As stated, the focus in most of this chapter is on use of the <code class="literal">net rpc</code> family of 104 104 operations that are supported by Samba. Most of them are supported by the <code class="literal">net ads</code> … … 107 107 earlier SMB servers. 108 108 </p><p> 109 <a class="indexterm" name="id3 62815"></a>110 <a class="indexterm" name="id3 62821"></a>111 <a class="indexterm" name="id3 62828"></a>109 <a class="indexterm" name="id385799"></a> 110 <a class="indexterm" name="id385805"></a> 111 <a class="indexterm" name="id385812"></a> 112 112 Samba's <code class="literal">net</code> tool implements sufficient capability to permit all common administrative 113 113 tasks to be completed from the command line. In this section each of the essential user and group management 114 114 facilities are explored. 115 115 </p><p> 116 <a class="indexterm" name="id3 62846"></a>117 <a class="indexterm" name="id3 62852"></a>118 <a class="indexterm" name="id3 62862"></a>119 <a class="indexterm" name="id3 62871"></a>116 <a class="indexterm" name="id385830"></a> 117 <a class="indexterm" name="id385837"></a> 118 <a class="indexterm" name="id385846"></a> 119 <a class="indexterm" name="id385855"></a> 120 120 Samba-3 recognizes two types of groups: <span class="emphasis"><em>domain groups</em></span> and <span class="emphasis"><em>local 121 121 groups</em></span>. Domain groups can contain (have as members) only domain user accounts. Local groups … … 124 124 The purpose of a local group is to permit file permission to be set for a group account that, like the 125 125 usual UNIX/Linux group, is persistent across redeployment of a Windows file server. 126 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 62893"></a>Adding, Renaming, or Deletion of Group Accounts</h3></div></div></div><p>126 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id385877"></a>Adding, Renaming, or Deletion of Group Accounts</h3></div></div></div><p> 127 127 Samba provides file and print services to Windows clients. The file system resources it makes available 128 128 to the Windows environment must, of necessity, be provided in a manner that is compatible with the … … 144 144 show how UNIX group members automatically pass-through to Windows group membership as soon as a logical 145 145 mapping has been created. 146 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 62922"></a>Adding or Creating a New Group</h4></div></div></div><p>146 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id385906"></a>Adding or Creating a New Group</h4></div></div></div><p> 147 147 Before attempting to add a Windows group account, the currently available groups can be listed as shown 148 148 here: 149 <a class="indexterm" name="id3 62931"></a>150 <a class="indexterm" name="id3 62942"></a>149 <a class="indexterm" name="id385915"></a> 150 <a class="indexterm" name="id385926"></a> 151 151 </p><pre class="screen"> 152 152 <code class="prompt">root# </code> net rpc group list -Uroot%not24get … … 164 164 A Windows group account called “<span class="quote">SupportEngrs</span>” can be added by executing the following 165 165 command: 166 <a class="indexterm" name="id3 62976"></a>166 <a class="indexterm" name="id385960"></a> 167 167 </p><pre class="screen"> 168 168 <code class="prompt">root# </code> net rpc group add "SupportEngrs" -Uroot%not24get … … 184 184 </pre><p> 185 185 </p><p> 186 <a class="indexterm" name="id3 63015"></a>187 <a class="indexterm" name="id3 63022"></a>188 <a class="indexterm" name="id3 63029"></a>186 <a class="indexterm" name="id385999"></a> 187 <a class="indexterm" name="id386006"></a> 188 <a class="indexterm" name="id386013"></a> 189 189 The following demonstrates that the POSIX (UNIX/Linux system account) group has been created by calling 190 the <a class=" indexterm" name="id363037"></a>add group script = /opt/IDEALX/sbin/smbldap-groupadd -p "%g"interface190 the <a class="link" href="smb.conf.5.html#ADDGROUPSCRIPT">add group script = /opt/IDEALX/sbin/smbldap-groupadd -p "%g"</a> interface 191 191 script: 192 192 </p><pre class="screen"> … … 206 206 results in immediate mapping of the POSIX group that has been created to the Windows group account as shown 207 207 here: 208 <a class="indexterm" name="id3 63065"></a>208 <a class="indexterm" name="id386052"></a> 209 209 </p><pre class="screen"> 210 210 <code class="prompt">root# </code> net groupmap list … … 219 219 SupportEngrs (S-1-5-21-72630-4128915-11681869-3007) -> SupportEngrs 220 220 </pre><p> 221 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 63098"></a>Mapping Windows Groups to UNIX Groups</h4></div></div></div><p>222 <a class="indexterm" name="id3 63106"></a>223 <a class="indexterm" name="id3 63113"></a>224 <a class="indexterm" name="id3 63119"></a>225 <a class="indexterm" name="id3 63126"></a>221 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id386085"></a>Mapping Windows Groups to UNIX Groups</h4></div></div></div><p> 222 <a class="indexterm" name="id386093"></a> 223 <a class="indexterm" name="id386100"></a> 224 <a class="indexterm" name="id386107"></a> 225 <a class="indexterm" name="id386114"></a> 226 226 Windows groups must be mapped to UNIX system (POSIX) groups so that file system access controls 227 227 can be asserted in a manner that is consistent with the methods appropriate to the operating 228 228 system that is hosting the Samba server. 229 229 </p><p> 230 <a class="indexterm" name="id3 63138"></a>231 <a class="indexterm" name="id3 63145"></a>232 <a class="indexterm" name="id3 63152"></a>233 <a class="indexterm" name="id3 63158"></a>230 <a class="indexterm" name="id386126"></a> 231 <a class="indexterm" name="id386133"></a> 232 <a class="indexterm" name="id386139"></a> 233 <a class="indexterm" name="id386146"></a> 234 234 All file system (file and directory) access controls, within the file system of a UNIX/Linux server that is 235 235 hosting a Samba server, are implemented using a UID/GID identity tuple. Samba does not in any way override … … 239 239 command does not call any RPC-functions here but directly accesses the passdb. 240 240 </p><p> 241 <a class="indexterm" name="id3 63179"></a>242 <a class="indexterm" name="id3 63186"></a>243 <a class="indexterm" name="id3 63192"></a>244 <a class="indexterm" name="id3 63199"></a>245 <a class="indexterm" name="id3 63206"></a>246 <a class="indexterm" name="id3 63213"></a>247 <a class="indexterm" name="id3 63220"></a>241 <a class="indexterm" name="id386166"></a> 242 <a class="indexterm" name="id386173"></a> 243 <a class="indexterm" name="id386180"></a> 244 <a class="indexterm" name="id386187"></a> 245 <a class="indexterm" name="id386194"></a> 246 <a class="indexterm" name="id386200"></a> 247 <a class="indexterm" name="id386207"></a> 248 248 Samba depends on default mappings for the <code class="constant">Domain Admins, Domain Users</code>, and 249 249 <code class="constant">Domain Guests</code> global groups. Additional groups may be added as shown in the … … 252 252 of creation of the mapping. 253 253 </p><p> 254 <a class="indexterm" name="id3 63240"></a>255 <a class="indexterm" name="id3 63251"></a>256 <a class="indexterm" name="id3 63262"></a>254 <a class="indexterm" name="id386228"></a> 255 <a class="indexterm" name="id386239"></a> 256 <a class="indexterm" name="id386250"></a> 257 257 The operations that are permitted include: <code class="constant">add</code>, <code class="constant">modify</code>, 258 258 and <code class="constant">delete</code>. An example of each operation is shown here. … … 291 291 treated as local to the individual Samba server. Local groups can be used with Samba to enable multiple 292 292 nested group support. 293 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 63379"></a>Deleting a Group Account</h4></div></div></div><p>294 <a class="indexterm" name="id3 63387"></a>293 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id386366"></a>Deleting a Group Account</h4></div></div></div><p> 294 <a class="indexterm" name="id386374"></a> 295 295 A group account may be deleted by executing the following command: 296 296 </p><pre class="screen"> … … 299 299 </p><p> 300 300 Validation of the deletion is advisable. The same commands may be executed as shown above. 301 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 63416"></a>Rename Group Accounts</h4></div></div></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>301 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id386404"></a>Rename Group Accounts</h4></div></div></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 302 302 This command is not documented in the man pages; it is implemented in the source code, but it does not 303 303 work at this time. The example given documents, from the source code, how it should work. Watch the … … 307 307 demands can be if this simple request is ignored. The following command demonstrates how the Windows group 308 308 “<span class="quote">SupportEngrs</span>” can be renamed to “<span class="quote">CustomerSupport</span>”: 309 <a class="indexterm" name="id3 63440"></a>309 <a class="indexterm" name="id386428"></a> 310 310 </p><pre class="screen"> 311 311 <code class="prompt">root# </code> net rpc group rename SupportEngrs \ … … 320 320 The <code class="literal">getent group</code> will list UNIX/Linux group membership. UNIX/Linux group members are 321 321 seen also as members of a Windows group that has been mapped using the <code class="literal">net groupmap</code> 322 command (see <a href="groupmapping.html" title="Chapter 12. Group Mapping: MS Windows and UNIX">???</a>). The following list of UNIX/Linux group membership shows322 command (see <a class="link" href="groupmapping.html" title="Chapter 12. Group Mapping: MS Windows and UNIX">“Group Mapping: MS Windows and UNIX”</a>). The following list of UNIX/Linux group membership shows 323 323 that the user <code class="constant">ajt</code> is a member of the UNIX/Linux group <code class="constant">Engineers</code>. 324 324 </p><pre class="screen"> … … 350 350 group mapping, a member of the Windows group, an attempt to add this account again should fail. This is 351 351 demonstrated here: 352 <a class="indexterm" name="id3 63552"></a>352 <a class="indexterm" name="id386539"></a> 353 353 </p><pre class="screen"> 354 354 <code class="prompt">root# </code> net rpc group addmem "MIDEARTH\Engineers" ajt -Uroot%not24get … … 360 360 To permit the user <code class="constant">ajt</code> to be added using the <code class="literal">net rpc group</code> utility, 361 361 this account must first be removed. The removal and confirmation of its effect is shown here: 362 <a class="indexterm" name="id3 63590"></a>362 <a class="indexterm" name="id386578"></a> 363 363 </p><pre class="screen"> 364 364 <code class="prompt">root# </code> net rpc group delmem "MIDEARTH\Engineers" ajt -Uroot%not24get … … 384 384 the <code class="literal">net rpc group</code> utility. Note the this contents of the UNIX/Linux group was shown 385 385 four paragraphs earlier. The Windows (domain) group membership is shown here: 386 <a class="indexterm" name="id3 63680"></a>386 <a class="indexterm" name="id386667"></a> 387 387 </p><pre class="screen"> 388 388 <code class="prompt">root# </code> net rpc group members "Domain Users" -Uroot%not24get … … 441 441 <code class="prompt">root# </code> net rpc group delmem demo "DOM\jht" -Uroot%not24get 442 442 </pre><p> 443 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 63843"></a>Managing Nest Groups on Workstations from the Samba Server</h4></div></div></div><p>443 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id386831"></a>Managing Nest Groups on Workstations from the Samba Server</h4></div></div></div><p> 444 444 Windows network administrators often ask on the Samba mailing list how it is possible to grant everyone 445 445 administrative rights on their own workstation. This is of course a very bad practice, but commonly done 446 446 to avoid user complaints. Here is how it can be done remotely from a Samba PDC or BDC: 447 <a class="indexterm" name="id3 63854"></a>447 <a class="indexterm" name="id386842"></a> 448 448 </p><pre class="screen"> 449 449 <code class="prompt">root# </code> net rpc group addmem "Administrators" "Domain Users" \ … … 453 453 This can be scripted, and can therefore be performed as a user logs onto the domain from a Windows 454 454 workstation. Here is a simple example that shows how this can be done. 455 </p><div class="procedure"><a name="id3 63883"></a><p class="title"><b>Procedure 13.1. Automating User Addition to the Workstation Power Users Group</b></p><div class="example"><a name="autopoweruserscript"></a><p class="title"><b>Example 13.1. Script to Auto-add Domain Users to Workstation Power Users Group</b></p><div class="example-contents"><pre class="screen">455 </p><div class="procedure"><a name="id386871"></a><p class="title"><b>Procedure 13.1. Automating User Addition to the Workstation Power Users Group</b></p><div class="example"><a name="autopoweruserscript"></a><p class="title"><b>Example 13.1. Script to Auto-add Domain Users to Workstation Power Users Group</b></p><div class="example-contents"><pre class="screen"> 456 456 #!/bin/bash 457 457 … … 460 460 461 461 exit 0 462 </pre></div></div><br class="example-break"><div class="example"><a name="magicnetlogon"></a><p class="title"><b>Example 13.2. A Magic Netlogon Share</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id3 64032"></a><em class="parameter"><code>comment = Netlogon Share</code></em></td></tr><tr><td><a class="indexterm" name="id364044"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id364057"></a><em class="parameter"><code>root preexec = /etc/samba/scripts/autopoweruser.sh %U %m</code></em></td></tr><tr><td><a class="indexterm" name="id364070"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id364082"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr></table></div></div><br class="example-break"><ol type="1"><li><p>463 Create the script shown in <a href="NetCommand.html#autopoweruserscript" title="Example 13.1. Script to Auto-add Domain Users to Workstation Power Users Group">???</a> and locate it in462 </pre></div></div><br class="example-break"><div class="example"><a name="magicnetlogon"></a><p class="title"><b>Example 13.2. A Magic Netlogon Share</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id387019"></a><em class="parameter"><code>comment = Netlogon Share</code></em></td></tr><tr><td><a class="indexterm" name="id387031"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id387042"></a><em class="parameter"><code>root preexec = /etc/samba/scripts/autopoweruser.sh %U %m</code></em></td></tr><tr><td><a class="indexterm" name="id387054"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id387066"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr></table></div></div><br class="example-break"><ol type="1"><li><p> 463 Create the script shown in <a class="link" href="NetCommand.html#autopoweruserscript" title="Example 13.1. Script to Auto-add Domain Users to Workstation Power Users Group">“Script to Auto-add Domain Users to Workstation Power Users Group”</a> and locate it in 464 464 the directory <code class="filename">/etc/samba/scripts</code>, named as <code class="filename">autopoweruser.sh</code>. 465 <a class="indexterm" name="id3 63914"></a>466 <a class="indexterm" name="id3 63925"></a>467 <a class="indexterm" name="id3 63932"></a>465 <a class="indexterm" name="id386901"></a> 466 <a class="indexterm" name="id386912"></a> 467 <a class="indexterm" name="id386919"></a> 468 468 </p></li><li><p> 469 469 Set the permissions on this script to permit it to be executed as part of the logon process: … … 474 474 </p></li><li><p> 475 475 Modify the <code class="filename">smb.conf</code> file so the <code class="literal">NETLOGON</code> stanza contains the parameters 476 shown in <a href="NetCommand.html#magicnetlogon" title="Example 13.2. A Magic Netlogon Share">the Netlogon Example smb.conf file</a>.476 shown in <a class="link" href="NetCommand.html#magicnetlogon" title="Example 13.2. A Magic Netlogon Share">the Netlogon Example smb.conf file</a>. 477 477 </p></li><li><p> 478 478 Ensure that every Windows workstation Administrator account has the same password that you 479 have used in the script shown in <a href="NetCommand.html#magicnetlogon" title="Example 13.2. A Magic Netlogon Share">the Netlogon Example smb.conf479 have used in the script shown in <a class="link" href="NetCommand.html#magicnetlogon" title="Example 13.2. A Magic Netlogon Share">the Netlogon Example smb.conf 480 480 file</a> 481 481 </p></li></ol></div><p> … … 485 485 for the use of this method is that it will guarantee that all users have appropriate rights on 486 486 the workstation. 487 </p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 64122"></a>UNIX and Windows User Management</h2></div></div></div><p>488 <a class="indexterm" name="id3 64130"></a>489 <a class="indexterm" name="id3 64136"></a>490 <a class="indexterm" name="id3 64143"></a>491 <a class="indexterm" name="id3 64150"></a>492 <a class="indexterm" name="id3 64156"></a>493 <a class="indexterm" name="id3 64163"></a>494 <a class="indexterm" name="id3 64170"></a>495 <a class="indexterm" name="id3 64177"></a>487 </p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id387104"></a>UNIX and Windows User Management</h2></div></div></div><p> 488 <a class="indexterm" name="id387112"></a> 489 <a class="indexterm" name="id387118"></a> 490 <a class="indexterm" name="id387125"></a> 491 <a class="indexterm" name="id387132"></a> 492 <a class="indexterm" name="id387139"></a> 493 <a class="indexterm" name="id387145"></a> 494 <a class="indexterm" name="id387152"></a> 495 <a class="indexterm" name="id387159"></a> 496 496 Every Windows network user account must be translated to a UNIX/Linux user account. In actual fact, 497 497 the only account information the UNIX/Linux Samba server needs is a UID. The UID is available either … … 500 500 particular user will be allocated by <code class="literal">winbindd</code>. 501 501 </p><p> 502 Although this is not the appropriate place to discuss the <a class=" indexterm" name="id364197"></a>username mapfacility,502 Although this is not the appropriate place to discuss the <a class="link" href="smb.conf.5.html#USERNAMEMAP">username map</a> facility, 503 503 this interface is an important method of mapping a Windows user account to a UNIX account that has a 504 504 different name. Refer to the man page for the <code class="filename">smb.conf</code> file for more information regarding this … … 517 517 </p><p> 518 518 The following demonstrates the addition of an account to the server <code class="constant">FRODO</code>: 519 <a class="indexterm" name="id3 64258"></a>520 <a class="indexterm" name="id3 64270"></a>519 <a class="indexterm" name="id387244"></a> 520 <a class="indexterm" name="id387255"></a> 521 521 </p><pre class="screen"> 522 522 <code class="prompt">root# </code> net rpc user add jacko -S FRODO -Uroot%not24get … … 529 529 -S FRODO -Uroot%not24get 530 530 </pre><p> 531 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 64314"></a>Deletion of User Accounts</h3></div></div></div><p>531 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id387299"></a>Deletion of User Accounts</h3></div></div></div><p> 532 532 Deletion of a user account can be done using the following syntax: 533 533 </p><pre class="screen"> … … 535 535 </pre><p> 536 536 The following command will delete the user account <code class="constant">jacko</code>: 537 <a class="indexterm" name="id3 64333"></a>537 <a class="indexterm" name="id387319"></a> 538 538 </p><pre class="screen"> 539 539 <code class="prompt">root# </code> net rpc user delete jacko -Uroot%not24get 540 540 Deleted user account 541 541 </pre><p> 542 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 64358"></a>Managing User Accounts</h3></div></div></div><p>542 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id387344"></a>Managing User Accounts</h3></div></div></div><p> 543 543 Two basic user account operations are routinely used: change of password and querying which groups a user 544 is a member of. The change of password operation is shown in <a href="NetCommand.html#sbeuseraddn" title="Adding User Accounts">???</a>.544 is a member of. The change of password operation is shown in <a class="link" href="NetCommand.html#sbeuseraddn" title="Adding User Accounts">“Adding User Accounts”</a>. 545 545 </p><p> 546 546 The ability to query Windows group membership can be essential. Here is how a remote server may be 547 547 interrogated to find which groups a user is a member of: 548 <a class="indexterm" name="id3 64379"></a>548 <a class="indexterm" name="id387364"></a> 549 549 </p><pre class="screen"> 550 550 <code class="prompt">root# </code> net rpc user info jacko -S SAURON -Uroot%not24get … … 559 559 </p><p> 560 560 It is also possible to rename user accounts: 561 <a class="indexterm" name="id3 64406"></a>oldusername newusername561 <a class="indexterm" name="id387391"></a>oldusername newusername 562 562 Note that this operation does not yet work against Samba Servers. It is, however, possible to rename useraccounts on 563 563 Windows Servers. 564 564 565 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 64421"></a>User Mapping</h3></div></div></div><p>566 <a class="indexterm" name="id3 64428"></a>567 <a class="indexterm" name="id3 64435"></a>568 <a class="indexterm" name="id3 64442"></a>565 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id387406"></a>User Mapping</h3></div></div></div><p> 566 <a class="indexterm" name="id387414"></a> 567 <a class="indexterm" name="id387421"></a> 568 <a class="indexterm" name="id387427"></a> 569 569 In some situations it is unavoidable that a user's Windows logon name will differ from the login ID 570 570 that user has on the Samba server. It is possible to create a special file on the Samba server that … … 582 582 <code class="constant">parsonsw</code>, and the Windows user account “<span class="quote">geeringm</span>” will be mapped to the 583 583 UNIX user <code class="constant">marygee</code>. 584 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 64498"></a>Administering User Rights and Privileges</h2></div></div></div><p>585 <a class="indexterm" name="id3 64506"></a>586 <a class="indexterm" name="id3 64513"></a>587 <a class="indexterm" name="id3 64520"></a>588 <a class="indexterm" name="id3 64527"></a>589 <a class="indexterm" name="id3 64534"></a>584 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id387484"></a>Administering User Rights and Privileges</h2></div></div></div><p> 585 <a class="indexterm" name="id387492"></a> 586 <a class="indexterm" name="id387499"></a> 587 <a class="indexterm" name="id387505"></a> 588 <a class="indexterm" name="id387512"></a> 589 <a class="indexterm" name="id387519"></a> 590 590 With all versions of Samba earlier than 3.0.11 the only account on a Samba server that could 591 591 manage users, groups, shares, printers, and such was the <code class="constant">root</code> account. This caused … … 593 593 credentials for the most security-sensitive account on a UNIX/Linux system. 594 594 </p><p> 595 <a class="indexterm" name="id3 64550"></a>596 <a class="indexterm" name="id3 64557"></a>597 <a class="indexterm" name="id3 64564"></a>598 <a class="indexterm" name="id3 64571"></a>599 <a class="indexterm" name="id3 64578"></a>595 <a class="indexterm" name="id387536"></a> 596 <a class="indexterm" name="id387543"></a> 597 <a class="indexterm" name="id387549"></a> 598 <a class="indexterm" name="id387556"></a> 599 <a class="indexterm" name="id387563"></a> 600 600 New to Samba version 3.0.11 is the ability to delegate administrative privileges as necessary to either 601 601 a normal user or to groups of users. The significance of the administrative privileges is documented 602 in <a href="rights.html" title="Chapter 15. User Rights and Privileges">???</a>. Examples of use of the <code class="literal">net</code> for user rights and privilege602 in <a class="link" href="rights.html" title="Chapter 15. User Rights and Privileges">“User Rights and Privileges”</a>. Examples of use of the <code class="literal">net</code> for user rights and privilege 603 603 management is appropriate to this chapter. 604 604 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> … … 633 633 The <code class="literal">net</code> command can be used to obtain the currently supported capabilities for rights 634 634 and privileges using this method: 635 <a class="indexterm" name="id3 64641"></a>636 <a class="indexterm" name="id3 64648"></a>637 <a class="indexterm" name="id3 64655"></a>638 <a class="indexterm" name="id3 64661"></a>639 <a class="indexterm" name="id3 64668"></a>640 <a class="indexterm" name="id3 64675"></a>641 <a class="indexterm" name="id3 64682"></a>642 <a class="indexterm" name="id3 64689"></a>643 <a class="indexterm" name="id3 64696"></a>635 <a class="indexterm" name="id387626"></a> 636 <a class="indexterm" name="id387633"></a> 637 <a class="indexterm" name="id387640"></a> 638 <a class="indexterm" name="id387647"></a> 639 <a class="indexterm" name="id387654"></a> 640 <a class="indexterm" name="id387661"></a> 641 <a class="indexterm" name="id387667"></a> 642 <a class="indexterm" name="id387674"></a> 643 <a class="indexterm" name="id387681"></a> 644 644 </p><pre class="screen"> 645 645 <code class="prompt">root# </code> net rpc rights list -U root%not24get … … 660 660 idea since members of this group are generally expected to be all-powerful. This assignment makes that 661 661 the reality: 662 <a class="indexterm" name="id3 64733"></a>662 <a class="indexterm" name="id387719"></a> 663 663 </p><pre class="screen"> 664 664 <code class="prompt">root# </code> net rpc rights grant "MIDEARTH\Domain Admins" \ … … 679 679 </p><p> 680 680 The following step permits validation of the changes just made: 681 <a class="indexterm" name="id3 64779"></a>681 <a class="indexterm" name="id387764"></a> 682 682 </p><pre class="screen"> 683 683 <code class="prompt">root# </code> net rpc rights list accounts -U root%not24get … … 713 713 SeDiskOperatorPrivilege 714 714 </pre><p> 715 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 64808"></a>Managing Trust Relationships</h2></div></div></div><p>715 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id387799"></a>Managing Trust Relationships</h2></div></div></div><p> 716 716 There are essentially two types of trust relationships: the first is between domain controllers and domain 717 717 member machines (network clients), the second is between domains (called interdomain trusts). All 718 718 Samba servers that participate in domain security require a domain membership trust account, as do like 719 719 Windows NT/200x/XP workstations. 720 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 64820"></a>Machine Trust Accounts</h3></div></div></div><p>720 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id387811"></a>Machine Trust Accounts</h3></div></div></div><p> 721 721 The net command looks in the <code class="filename">smb.conf</code> file to obtain its own configuration settings. Thus, the following 722 722 command 'knows' which domain to join from the <code class="filename">smb.conf</code> file. 723 723 </p><p> 724 724 A Samba server domain trust account can be validated as shown in this example: 725 <a class="indexterm" name="id3 64845"></a>725 <a class="indexterm" name="id387836"></a> 726 726 </p><pre class="screen"> 727 727 <code class="prompt">root# </code> net rpc testjoin … … 736 736 </p><p> 737 737 The equivalent command for joining a Samba server to a Windows ADS domain is shown here: 738 <a class="indexterm" name="id3 64880"></a>738 <a class="indexterm" name="id387870"></a> 739 739 </p><pre class="screen"> 740 740 <code class="prompt">root# </code> net ads testjoin … … 751 751 The following demonstrates the process of creating a machine trust account in the target domain for the 752 752 Samba server from which the command is executed: 753 <a class="indexterm" name="id3 64921"></a>753 <a class="indexterm" name="id387911"></a> 754 754 </p><pre class="screen"> 755 755 <code class="prompt">root# </code> net rpc join -S FRODO -Uroot%not24get … … 766 766 purely as a workstation, in which case the S is replaced with a W (indicating a workstation account). The 767 767 following command can be used to affect this: 768 <a class="indexterm" name="id3 64959"></a>768 <a class="indexterm" name="id387950"></a> 769 769 </p><pre class="screen"> 770 770 <code class="prompt">root# </code> net rpc join member -S FRODO -Uroot%not24get … … 774 774 the type is deduced from the <code class="filename">smb.conf</code> file configuration. To specifically join as a PDC or BDC, the 775 775 command-line parameter will be <code class="constant">[PDC | BDC]</code>. For example: 776 <a class="indexterm" name="id3 64997"></a>776 <a class="indexterm" name="id387988"></a> 777 777 </p><pre class="screen"> 778 778 <code class="prompt">root# </code> net rpc join bdc -S FRODO -Uroot%not24get … … 782 782 </p><p> 783 783 The command to join a Samba server to a Windows ADS domain is shown here: 784 <a class="indexterm" name="id3 65031"></a>784 <a class="indexterm" name="id388021"></a> 785 785 </p><pre class="screen"> 786 786 <code class="prompt">root# </code> net ads join -UAdministrator%not24get … … 793 793 either. Inactive domain member accounts can be removed using any convenient tool. If necessary, the 794 794 machine account can be removed using the following <code class="literal">net</code> command: 795 <a class="indexterm" name="id3 65067"></a>795 <a class="indexterm" name="id388057"></a> 796 796 </p><pre class="screen"> 797 797 <code class="prompt">root# </code> net rpc user delete HERRING\$ -Uroot%not24get … … 803 803 A Samba-3 server that is a Windows ADS domain member can execute the following command to detach from the 804 804 domain: 805 <a class="indexterm" name="id3 65096"></a>805 <a class="indexterm" name="id388086"></a> 806 806 </p><pre class="screen"> 807 807 <code class="prompt">root# </code> net ads leave … … 810 810 Detailed information regarding an ADS domain can be obtained by a Samba DMS machine by executing the 811 811 following: 812 <a class="indexterm" name="id3 65122"></a>812 <a class="indexterm" name="id388113"></a> 813 813 </p><pre class="screen"> 814 814 <code class="prompt">root# </code> net ads status … … 816 816 The volume of information is extensive. Please refer to the book “<span class="quote">Samba-3 by Example</span>”, 817 817 Chapter 7 for more information regarding its use. This book may be obtained either in print or online from 818 the <a href="http://www.samba.org/samba/docs/Samba3-ByExample.pdf" target="_top">Samba-3 by Example</a>.819 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 65158"></a>Interdomain Trusts</h3></div></div></div><p>818 the <a class="ulink" href="http://www.samba.org/samba/docs/Samba3-ByExample.pdf" target="_top">Samba-3 by Example</a>. 819 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id388148"></a>Interdomain Trusts</h3></div></div></div><p> 820 820 Interdomain trust relationships form the primary mechanism by which users from one domain can be granted 821 821 access rights and privileges in another domain. 822 822 </p><p> 823 823 To discover what trust relationships are in effect, execute this command: 824 <a class="indexterm" name="id3 65171"></a>824 <a class="indexterm" name="id388162"></a> 825 825 </p><pre class="screen"> 826 826 <code class="prompt">root# </code> net rpc trustdom list -Uroot%not24get … … 838 838 create a trusted connection with this account. That means that the foreign domain is being trusted 839 839 to access resources in the local domain. This command creates the local trust account: 840 <a class="indexterm" name="id3 65201"></a>840 <a class="indexterm" name="id388192"></a> 841 841 </p><pre class="screen"> 842 842 <code class="prompt">root# </code> net rpc trustdom add DAMNATION f00db4r -Uroot%not24get … … 851 851 </p><p> 852 852 If the trusting domain is not capable of being reached, the following command will fail: 853 <a class="indexterm" name="id3 65248"></a>853 <a class="indexterm" name="id388238"></a> 854 854 </p><pre class="screen"> 855 855 <code class="prompt">root# </code> net rpc trustdom list -Uroot%not24get … … 877 877 the foreign account. In the process it creates a one-way trust to the resources on the remote domain. This 878 878 command achieves the objective of joining the trust relationship: 879 <a class="indexterm" name="id3 65286"></a>879 <a class="indexterm" name="id388276"></a> 880 880 </p><pre class="screen"> 881 881 <code class="prompt">root# </code> net rpc trustdom establish DAMNATION … … 898 898 Sometimes it is necessary to remove the ability for local users to access a foreign domain. The trusting 899 899 connection can be revoked as shown here: 900 <a class="indexterm" name="id3 65328"></a>900 <a class="indexterm" name="id388318"></a> 901 901 </p><pre class="screen"> 902 902 <code class="prompt">root# </code> net rpc trustdom revoke DAMNATION -Uroot%not24get … … 908 908 </pre><p> 909 909 910 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 65367"></a>Managing Security Identifiers (SIDS)</h2></div></div></div><p>911 <a class="indexterm" name="id3 65375"></a>912 <a class="indexterm" name="id3 65382"></a>913 <a class="indexterm" name="id3 65389"></a>914 <a class="indexterm" name="id3 65395"></a>915 <a class="indexterm" name="id3 65402"></a>910 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id388358"></a>Managing Security Identifiers (SIDS)</h2></div></div></div><p> 911 <a class="indexterm" name="id388366"></a> 912 <a class="indexterm" name="id388372"></a> 913 <a class="indexterm" name="id388379"></a> 914 <a class="indexterm" name="id388386"></a> 915 <a class="indexterm" name="id388392"></a> 916 916 The basic security identifier that is used by all Windows networking operations is the Windows security 917 917 identifier (SID). All Windows network machines (servers and workstations), users, and groups are … … 919 919 are specific to the SID of the domain to which the user belongs. 920 920 </p><p> 921 <a class="indexterm" name="id3 65416"></a>922 <a class="indexterm" name="id3 65422"></a>923 <a class="indexterm" name="id3 65429"></a>924 <a class="indexterm" name="id3 65436"></a>921 <a class="indexterm" name="id388406"></a> 922 <a class="indexterm" name="id388413"></a> 923 <a class="indexterm" name="id388419"></a> 924 <a class="indexterm" name="id388426"></a> 925 925 It is truly prudent to store the machine and/or domain SID in a file for safekeeping. Why? Because 926 926 a change in hostname or in the domain (workgroup) name may result in a change in the SID. When you … … 930 930 First, do not forget to store the local SID in a file. It is a good idea to put this in the directory 931 931 in which the <code class="filename">smb.conf</code> file is also stored. Here is a simple action to achieve this: 932 <a class="indexterm" name="id3 65457"></a>932 <a class="indexterm" name="id388447"></a> 933 933 </p><pre class="screen"> 934 934 <code class="prompt">root# </code> net getlocalsid > /etc/samba/my-sid … … 946 946 file, simply copy the SID (the string of characters that begins with <code class="constant">S-1-5-21</code>) to 947 947 the command line shown here: 948 <a class="indexterm" name="id3 65514"></a>948 <a class="indexterm" name="id388504"></a> 949 949 </p><pre class="screen"> 950 950 <code class="prompt">root# </code> net setlocalsid S-1-5-21-1385457007-882775198-1210191635 … … 957 957 any potential namespace collision. Here is the way that the BDC SID can be synchronized to that 958 958 of the PDC (this is the default NT4 domain practice also): 959 <a class="indexterm" name="id3 65542"></a>959 <a class="indexterm" name="id388532"></a> 960 960 </p><pre class="screen"> 961 961 <code class="prompt">root# </code> net rpc getsid -S FRODO -Uroot%not24get … … 965 965 Usually it is not necessary to specify the target server (-S FRODO) or the administrator account 966 966 credentials (-Uroot%not24get). 967 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 65569"></a>Share Management</h2></div></div></div><p>967 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id388559"></a>Share Management</h2></div></div></div><p> 968 968 Share management is central to all file serving operations. Typical share operations include: 969 969 </p><div class="itemizedlist"><ul type="disc"><li><p>Creation/change/deletion of shares</p></li><li><p>Setting/changing ACLs on shares</p></li><li><p>Moving shares from one server to another</p></li><li><p>Change of permissions of share contents</p></li></ul></div><p> 970 970 Each of these are dealt with here insofar as they involve the use of the <code class="literal">net</code> 971 971 command. Operations outside of this command are covered elsewhere in this document. 972 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 65611"></a>Creating, Editing, and Removing Shares</h3></div></div></div><p>972 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id388601"></a>Creating, Editing, and Removing Shares</h3></div></div></div><p> 973 973 A share can be added using the <code class="literal">net rpc share</code> command capabilities. 974 974 The target machine may be local or remote and is specified by the -S option. It must be noted 975 975 that the addition and deletion of shares using this tool depends on the availability of a suitable 976 976 interface script. The interface scripts Sambas <code class="literal">smbd</code> uses are called 977 <a class=" indexterm" name="id365633"></a>add share command, <a class="indexterm" name="id365640"></a>delete share commandand978 <a class=" indexterm" name="id365648"></a>change share commandA set of example scripts are provided in the Samba source977 <a class="link" href="smb.conf.5.html#ADDSHARECOMMAND">add share command</a>, <a class="link" href="smb.conf.5.html#DELETESHARECOMMAND">delete share command</a> and 978 <a class="link" href="smb.conf.5.html#CHANGESHARECOMMAND">change share command</a> A set of example scripts are provided in the Samba source 979 979 code tarball in the directory <code class="filename">~samba/examples/scripts</code>. 980 980 </p><p> … … 983 983 file system is the directory <code class="filename">/data</code>. The command that can be executed to perform the 984 984 addition of this share is shown here: 985 <a class="indexterm" name="id3 65682"></a>985 <a class="indexterm" name="id388685"></a> 986 986 </p><pre class="screen"> 987 987 <code class="prompt">root# </code> net rpc share add Bulge=/data -S MERLIN -Uroot%not24get … … 1004 1004 Often it is desirable also to permit a share to be removed using a command-line tool. 1005 1005 The following step permits the share that was previously added to be removed: 1006 <a class="indexterm" name="id3 65729"></a>1006 <a class="indexterm" name="id388732"></a> 1007 1007 </p><pre class="screen"> 1008 1008 <code class="prompt">root# </code> net rpc share delete Bulge -S MERLIN -Uroot%not24get … … 1020 1020 kyocera 1021 1021 </pre><p> 1022 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 65767"></a>Creating and Changing Share ACLs</h3></div></div></div><p>1022 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id388770"></a>Creating and Changing Share ACLs</h3></div></div></div><p> 1023 1023 At this time the <code class="literal">net</code> tool cannot be used to manage ACLs on Samba shares. In MS Windows 1024 1024 language this is called Share Permissions. … … 1026 1026 It is possible to set ACLs on Samba shares using either the SRVTOOLS NT4 Domain Server Manager 1027 1027 or using the Computer Management MMC snap-in. Neither is covered here, 1028 but see <a href="AccessControls.html" title="Chapter 16. File, Directory, and Share Access Controls">???</a>.1029 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 65794"></a>Share, Directory, and File Migration</h3></div></div></div><p>1030 <a class="indexterm" name="id3 65802"></a>1028 but see <a class="link" href="AccessControls.html" title="Chapter 16. File, Directory, and Share Access Controls">“File, Directory, and Share Access Controls”</a>. 1029 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id388797"></a>Share, Directory, and File Migration</h3></div></div></div><p> 1030 <a class="indexterm" name="id388805"></a> 1031 1031 Shares and files can be migrated in the same manner as user, machine, and group accounts. 1032 1032 It is possible to preserve access control settings (ACLs) as well as security settings … … 1065 1065 Printer settings may not be fully or may be incorrectly migrated. This might in particular happen 1066 1066 when migrating a Windows 2003 print server to Samba. 1067 </p></li></ol></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 65893"></a>Share Migration</h4></div></div></div><p>1067 </p></li></ol></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id388890"></a>Share Migration</h4></div></div></div><p> 1068 1068 The <code class="literal">net rpc share migrate</code> command operation permits the migration of plain 1069 1069 share stanzas. A stanza contains the parameters within which a file or print share are defined. … … 1082 1082 access privileges and have the right to create shares and to set ACLs on them. Such rights are 1083 1083 conferred by these rights: <em class="parameter"><code>SeAddUsersPrivilege</code></em> and <em class="parameter"><code>SeDiskOperatorPrivilege</code></em>. 1084 For more information regarding rights and privileges please refer to <a href="rights.html" title="Chapter 15. User Rights and Privileges">???</a>.1084 For more information regarding rights and privileges please refer to <a class="link" href="rights.html" title="Chapter 15. User Rights and Privileges">“User Rights and Privileges”</a>. 1085 1085 </p><p> 1086 1086 The syntax of the share migration command is shown here: … … 1092 1092 large list of available shares on the system that is being migrated can be limited using the 1093 1093 <em class="parameter"><code>--exclude</code></em> switch. For example: 1094 <a class="indexterm" name="id3 65990"></a>1094 <a class="indexterm" name="id388988"></a> 1095 1095 </p><pre class="screen"> 1096 1096 <code class="prompt">root# </code> net rpc share migrate shares myshare\ … … 1105 1105 to validate that the migrated accounts (on the Samba server) have the needed rights and privileges. 1106 1106 This can be done as shown here: 1107 <a class="indexterm" name="id3 66041"></a>1107 <a class="indexterm" name="id389036"></a> 1108 1108 </p><pre class="screen"> 1109 1109 <code class="prompt">root# </code> net rpc right list accounts -Uroot%not24get … … 1111 1111 The steps taken so far perform only the migration of shares. Directories and directory contents 1112 1112 are not migrated by the steps covered up to this point. 1113 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 66067"></a>File and Directory Migration</h4></div></div></div><p>1113 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id389062"></a>File and Directory Migration</h4></div></div></div><p> 1114 1114 Everything covered to this point has been done in preparation for the migration of file and directory 1115 1115 data. For many people preparation is potentially boring and the real excitement only begins when file … … 1157 1157 the possibility of files that are owned only by a group. Group-alone file ownership is not possible under 1158 1158 UNIX/Linux. Errors in migrating group-owned files can be avoided by using the <code class="filename">smb.conf</code> file 1159 <a class=" indexterm" name="id366190"></a>force unknown acl user = yesparameter. This facility will1159 <a class="link" href="smb.conf.5.html#FORCEUNKNOWNACLUSER">force unknown acl user = yes</a> parameter. This facility will 1160 1160 automatically convert group-owned files into correctly user-owned files on the Samba server. 1161 1161 </p><p> 1162 1162 An example for migration of files from a machine called <code class="constant">nt4box</code> to the Samba server 1163 1163 from which the process will be handled is shown here: 1164 <a class="indexterm" name="id3 66206"></a>1164 <a class="indexterm" name="id389206"></a> 1165 1165 </p><pre class="screen"> 1166 1166 <code class="prompt">root# </code> net rpc share migrate files -S nt4box --acls \ … … 1171 1171 <code class="constant">nt4box</code> to the Samba server from which migration is initiated. Files that are group-owned 1172 1172 will be owned by the user account <code class="constant">administrator</code>. 1173 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 66244"></a>Share-ACL Migration</h4></div></div></div><p>1173 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id389243"></a>Share-ACL Migration</h4></div></div></div><p> 1174 1174 It is possible to have share-ACLs (security descriptors) that won't allow you, even as Administrator, to 1175 1175 copy any files or directories into it. Therefor the migration of the share-ACLs has been put into a separate 1176 1176 function: 1177 <a class="indexterm" name="id3 66254"></a>1177 <a class="indexterm" name="id389252"></a> 1178 1178 </p><pre class="screen"> 1179 1179 <code class="prompt">root# </code> net rpc share migrate security -S nt4box -U administrator%secret … … 1181 1181 </p><p> 1182 1182 This command will only copy the share-ACL of each share on nt4box to your local samba-system. 1183 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 66283"></a>Simultaneous Share and File Migration</h4></div></div></div><p>1183 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id389282"></a>Simultaneous Share and File Migration</h4></div></div></div><p> 1184 1184 The operating mode shown here is just a combination of the previous three. It first migrates 1185 1185 share definitions and then all shared files and directories and finally migrates the share-ACLs: … … 1190 1190 </p><p> 1191 1191 An example of simultaneous migration is shown here: 1192 <a class="indexterm" name="id3 66304"></a>1192 <a class="indexterm" name="id389303"></a> 1193 1193 </p><pre class="screen"> 1194 1194 <code class="prompt">root# </code> net rpc share migrate all -S w2k3server -U administrator%secret 1195 1195 </pre><p> 1196 1196 This will generate a complete server clone of the <em class="parameter"><code>w2k3server</code></em> server. 1197 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 66337"></a>Printer Migration</h3></div></div></div><p>1197 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id389335"></a>Printer Migration</h3></div></div></div><p> 1198 1198 The installation of a new server, as with the migration to a new network environment, often is similar to 1199 1199 building a house; progress is very rapid from the laying of foundations up to the stage at which … … 1220 1220 to the operating system in order to create the underlying printers. The call-out is implemented 1221 1221 by way of an interface script that can be specified by the <code class="filename">smb.conf</code> file parameter 1222 <a class=" indexterm" name="id366417"></a>. This script is essential to the migration process.1222 <a class="link" href="smb.conf.5.html#"></a>. This script is essential to the migration process. 1223 1223 A suitable example script may be obtained from the <code class="filename">$SAMBA_SOURCES/examples/scripts</code> 1224 1224 directory. Take note that this script must be customized to suit the operating system environment … … 1232 1232 Printer migration from a Windows print server (NT4 or 200x) is shown. This instruction causes the 1233 1233 printer share to be created together with the underlying print queue: 1234 <a class="indexterm" name="id3 66442"></a>1234 <a class="indexterm" name="id389445"></a> 1235 1235 </p><pre class="screen"> 1236 1236 net rpc printer MIGRATE PRINTERS [printer] [misc. options] [targets] … … 1238 1238 Printer drivers can be migrated from the Windows print server to the Samba server using this 1239 1239 command-line instruction: 1240 <a class="indexterm" name="id3 66460"></a>1240 <a class="indexterm" name="id389464"></a> 1241 1241 </p><pre class="screen"> 1242 1242 net rpc printer MIGRATE DRIVERS [printer] [misc. options] [targets] 1243 1243 </pre><p> 1244 1244 Printer forms can be migrated with the following operation: 1245 <a class="indexterm" name="id3 66478"></a>1245 <a class="indexterm" name="id389481"></a> 1246 1246 </p><pre class="screen"> 1247 1247 net rpc printer MIGRATE FORMS [printer] [misc. options] [targets] 1248 1248 </pre><p> 1249 1249 Printer security settings (ACLs) can be migrated from the Windows server to the Samba server using this command: 1250 <a class="indexterm" name="id3 66496"></a>1250 <a class="indexterm" name="id389500"></a> 1251 1251 </p><pre class="screen"> 1252 1252 net rpc printer MIGRATE SECURITY [printer] [misc. options] [targets] … … 1254 1254 Printer configuration settings include factors such as paper size and default paper orientation. 1255 1255 These can be migrated from the Windows print server to the Samba server with this command: 1256 <a class="indexterm" name="id3 66516"></a>1256 <a class="indexterm" name="id389519"></a> 1257 1257 </p><pre class="screen"> 1258 1258 net rpc printer MIGRATE SETTINGS [printer] [misc. options] [targets] … … 1264 1264 net rpc printer MIGRATE ALL [printer] [misc. options] [targets] 1265 1265 </pre><p> 1266 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 66547"></a>Controlling Open Files</h2></div></div></div><p>1266 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id389550"></a>Controlling Open Files</h2></div></div></div><p> 1267 1267 The man page documents the <code class="literal">net file</code> function suite, which provides the tools to 1268 1268 close open files using either RAP or RPC function calls. Please refer to the man page for specific 1269 1269 usage information. 1270 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 66564"></a>Session and Connection Management</h2></div></div></div><p>1270 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id389567"></a>Session and Connection Management</h2></div></div></div><p> 1271 1271 The session management interface of the <code class="literal">net session</code> command uses the old RAP 1272 1272 method to obtain the list of connections to the Samba server, as shown here: 1273 <a class="indexterm" name="id3 66579"></a>1273 <a class="indexterm" name="id389582"></a> 1274 1274 </p><pre class="screen"> 1275 1275 <code class="prompt">root# </code> net rap session -S MERLIN -Uroot%not24get … … 1286 1286 <code class="prompt">root# </code> net rap session close marvel -Uroot%not24get 1287 1287 </pre><p> 1288 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 66624"></a>Printers and ADS</h2></div></div></div><p>1288 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id389627"></a>Printers and ADS</h2></div></div></div><p> 1289 1289 When Samba-3 is used within an MS Windows ADS environment, printers shared via Samba will not be browseable 1290 1290 until they have been published to the ADS domain. Information regarding published printers may be obtained 1291 1291 from the ADS server by executing the <code class="literal">net ads print info</code> command following this syntax: 1292 <a class="indexterm" name="id3 66640"></a>1292 <a class="indexterm" name="id389643"></a> 1293 1293 </p><pre class="screen"> 1294 1294 net ads printer info <printer_name> <server_name> -Uadministrator%secret … … 1298 1298 </p><p> 1299 1299 To publish (make available) a printer to ADS, execute the following command: 1300 <a class="indexterm" name="id3 66662"></a>1300 <a class="indexterm" name="id389666"></a> 1301 1301 </p><pre class="screen"> 1302 1302 net ads printer publish <printer_name> -Uadministrator%secret … … 1305 1305 </p><p> 1306 1306 Removal of a Samba printer from ADS is achieved by executing this command: 1307 <a class="indexterm" name="id3 66685"></a>1307 <a class="indexterm" name="id389688"></a> 1308 1308 </p><pre class="screen"> 1309 1309 net ads printer remove <printer_name> -Uadministrator%secret … … 1311 1311 </p><p> 1312 1312 A generic search (query) can also be made to locate a printer across the entire ADS domain by executing: 1313 <a class="indexterm" name="id3 66707"></a>1313 <a class="indexterm" name="id389710"></a> 1314 1314 </p><pre class="screen"> 1315 1315 net ads printer search <printer_name> -Uadministrator%secret 1316 1316 </pre><p> 1317 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 66727"></a>Manipulating the Samba Cache</h2></div></div></div><p>1317 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id389730"></a>Manipulating the Samba Cache</h2></div></div></div><p> 1318 1318 Please refer to the <code class="literal">net</code> command man page for information regarding cache management. 1319 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 66744"></a>Managing IDMAP UID/SID Mappings</h2></div></div></div><p>1319 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id389747"></a>Managing IDMAP UID/SID Mappings</h2></div></div></div><p> 1320 1320 The IDMAP UID to SID, and SID to UID, mappings that are created by <code class="literal">winbindd</code> can be 1321 1321 backed up to a text file. The text file can be manually edited, although it is highly recommended that … … 1328 1328 Winbind must be shut down to dump the IDMAP file. Before restoring a dump file, shut down 1329 1329 <code class="literal">winbindd</code> and delete the old <code class="filename">winbindd_idmap.tdb</code> file. 1330 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 66782"></a>Creating an IDMAP Database Dump File</h3></div></div></div><p>1330 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id389785"></a>Creating an IDMAP Database Dump File</h3></div></div></div><p> 1331 1331 The IDMAP database can be dumped to a text file as shown here: 1332 1332 </p><pre class="screen"> … … 1338 1338 net idmap dump /var/lib/samba/winbindd_idmap.tdb > idmap_dump.txt 1339 1339 </pre><p> 1340 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 66813"></a>Restoring the IDMAP Database Dump File</h3></div></div></div><p>1340 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id389816"></a>Restoring the IDMAP Database Dump File</h3></div></div></div><p> 1341 1341 The IDMAP dump file can be restored using the following command: 1342 1342 </p><pre class="screen"> … … 1351 1351 The following command is useful for obtaining basic statistics regarding a Samba domain. This command does 1352 1352 not work with current Windows XP Professional clients. 1353 <a class="indexterm" name="id3 66858"></a>1353 <a class="indexterm" name="id389862"></a> 1354 1354 </p><pre class="screen"> 1355 1355 <code class="prompt">root# </code> net rpc info … … 1364 1364 Another useful tool is the <code class="literal">net time</code> tool set. This tool may be used to query the 1365 1365 current time on the target server as shown here: 1366 <a class="indexterm" name="id3 66892"></a>1366 <a class="indexterm" name="id389896"></a> 1367 1367 </p><pre class="screen"> 1368 1368 <code class="prompt">root# </code> net time -S SAURON … … 1372 1372 <code class="literal">/bin/time</code>, it is a good idea to obtain the time from the target server in a format 1373 1373 that is ready to be passed through. This may be done by executing: 1374 <a class="indexterm" name="id3 66921"></a>1374 <a class="indexterm" name="id389924"></a> 1375 1375 </p><pre class="screen"> 1376 1376 <code class="prompt">root# </code> net time system -S FRODO … … 1378 1378 </pre><p> 1379 1379 The time can be set on a target server by executing: 1380 <a class="indexterm" name="id3 66945"></a>1380 <a class="indexterm" name="id389948"></a> 1381 1381 </p><pre class="screen"> 1382 1382 <code class="prompt">root# </code> net time set -S MAGGOT -U Administrator%not24get … … 1384 1384 </pre><p> 1385 1385 It is possible to obtain the time zone of a server by executing the following command against it: 1386 <a class="indexterm" name="id3 66969"></a>1386 <a class="indexterm" name="id389972"></a> 1387 1387 </p><pre class="screen"> 1388 1388 <code class="prompt">root# </code> net time zone -S SAURON
Note:
See TracChangeset
for help on using the changeset viewer.
