- Timestamp:
- Sep 30, 2008, 7:14:08 AM (17 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
branches/samba-3.0/docs/htmldocs/Samba3-HOWTO/NetCommand.html
r134 r158 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 13. Remote and Local Management: The Net Command</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="The Official Samba 3.2.x HOWTO and Reference Guide"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="prev" href="groupmapping.html" title="Chapter 12. Group Mapping: MS Windows and UNIX"><link rel="next" href="idmapper.html" title="Chapter 14. Identity Mapping (IDMAP)"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 13. Remote and Local Management: The Net Command</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="groupmapping.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="idmapper.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="NetCommand"></a>Chapter 13. Remote and Local Management: The Net Command</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Volker</span> <span class="surname">Lendecke</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:Volker.Lendecke@SerNet.DE">Volker.Lendecke@SerNet.DE</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Guenther</span> <span class="surname">Deschner</span></h3><div class="affiliation"><span class="orgname">SuSE<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:gd@suse.de">gd@suse.de</a>></code></p></div></div></div></div><div><p class="pubdate">May 9, 2005</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="NetCommand.html#id3 85377">Overview</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id385653">Administrative Tasks and Methods</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id385728">UNIX and Windows Group Management</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetCommand.html#id385877">Adding, Renaming, or Deletion of Group Accounts</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#grpmemshipchg">Manipulating Group Memberships</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#nestedgrpmgmgt">Nested Group Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="NetCommand.html#id387104">UNIX and Windows User Management</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetCommand.html#sbeuseraddn">Adding User Accounts</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id387299">Deletion of User Accounts</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id387344">Managing User Accounts</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id387406">User Mapping</a></span></dt></dl></dd><dt><span class="sect1"><a href="NetCommand.html#id387484">Administering User Rights and Privileges</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id387799">Managing Trust Relationships</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetCommand.html#id387811">Machine Trust Accounts</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id388148">Interdomain Trusts</a></span></dt></dl></dd><dt><span class="sect1"><a href="NetCommand.html#id388358">Managing Security Identifiers (SIDS)</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id388559">Share Management</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetCommand.html#id388601">Creating, Editing, and Removing Shares</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id388770">Creating and Changing Share ACLs</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id388797">Share, Directory, and File Migration</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id389335">Printer Migration</a></span></dt></dl></dd><dt><span class="sect1"><a href="NetCommand.html#id389550">Controlling Open Files</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id389567">Session and Connection Management</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id389627">Printers and ADS</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id389730">Manipulating the Samba Cache</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id389747">Managing IDMAP UID/SID Mappings</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetCommand.html#id389785">Creating an IDMAP Database Dump File</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id389816">Restoring the IDMAP Database Dump File</a></span></dt></dl></dd><dt><span class="sect1"><a href="NetCommand.html#netmisc1">Other Miscellaneous Operations</a></span></dt></dl></div><p>2 <a class="indexterm" name="id3 85248"></a>3 <a class="indexterm" name="id3 85255"></a>4 <a class="indexterm" name="id3 85262"></a>5 <a class="indexterm" name="id3 85268"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 13. Remote and Local Management: The Net Command</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.2"><link rel="start" href="index.html" title="The Official Samba 3.2.x HOWTO and Reference Guide"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="prev" href="groupmapping.html" title="Chapter 12. Group Mapping: MS Windows and UNIX"><link rel="next" href="idmapper.html" title="Chapter 14. Identity Mapping (IDMAP)"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 13. Remote and Local Management: The Net Command</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="groupmapping.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="idmapper.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="NetCommand"></a>Chapter 13. Remote and Local Management: The Net Command</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Volker</span> <span class="surname">Lendecke</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:Volker.Lendecke@SerNet.DE">Volker.Lendecke@SerNet.DE</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Guenther</span> <span class="surname">Deschner</span></h3><div class="affiliation"><span class="orgname">SuSE<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:gd@suse.de">gd@suse.de</a>></code></p></div></div></div></div><div><p class="pubdate">May 9, 2005</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="NetCommand.html#id359824">Overview</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id360100">Administrative Tasks and Methods</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id360174">UNIX and Windows Group Management</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetCommand.html#id360324">Adding, Renaming, or Deletion of Group Accounts</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#grpmemshipchg">Manipulating Group Memberships</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#nestedgrpmgmgt">Nested Group Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="NetCommand.html#id361551">UNIX and Windows User Management</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetCommand.html#sbeuseraddn">Adding User Accounts</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id361746">Deletion of User Accounts</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id361791">Managing User Accounts</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id361853">User Mapping</a></span></dt></dl></dd><dt><span class="sect1"><a href="NetCommand.html#id361930">Administering User Rights and Privileges</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id362240">Managing Trust Relationships</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetCommand.html#id362252">Machine Trust Accounts</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id362590">Interdomain Trusts</a></span></dt></dl></dd><dt><span class="sect1"><a href="NetCommand.html#id362800">Managing Security Identifiers (SIDS)</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id363001">Share Management</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetCommand.html#id363043">Creating, Editing, and Removing Shares</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id363212">Creating and Changing Share ACLs</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id363239">Share, Directory, and File Migration</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id363774">Printer Migration</a></span></dt></dl></dd><dt><span class="sect1"><a href="NetCommand.html#id363992">Controlling Open Files</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id364009">Session and Connection Management</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id364068">Printers and ADS</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id364172">Manipulating the Samba Cache</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id364188">Managing IDMAP UID/SID Mappings</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetCommand.html#id364227">Creating an IDMAP Database Dump File</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id364258">Restoring the IDMAP Database Dump File</a></span></dt></dl></dd><dt><span class="sect1"><a href="NetCommand.html#netmisc1">Other Miscellaneous Operations</a></span></dt></dl></div><p> 2 <a class="indexterm" name="id359695"></a> 3 <a class="indexterm" name="id359702"></a> 4 <a class="indexterm" name="id359708"></a> 5 <a class="indexterm" name="id359715"></a> 6 6 The <code class="literal">net</code> command is one of the new features of Samba-3 and is an attempt to provide a useful 7 7 tool for the majority of remote management operations necessary for common tasks. The <code class="literal">net</code> 8 8 tool is flexible by design and is intended for command-line use as well as for scripted control application. 9 9 </p><p> 10 <a class="indexterm" name="id3 85292"></a>11 <a class="indexterm" name="id3 85299"></a>12 <a class="indexterm" name="id3 85306"></a>13 <a class="indexterm" name="id3 85313"></a>10 <a class="indexterm" name="id359739"></a> 11 <a class="indexterm" name="id359746"></a> 12 <a class="indexterm" name="id359752"></a> 13 <a class="indexterm" name="id359759"></a> 14 14 Originally introduced with the intent to mimic the Microsoft Windows command that has the same name, the 15 15 <code class="literal">net</code> command has morphed into a very powerful instrument that has become an essential part … … 23 23 A Samba-3 administrator cannot afford to gloss over this chapter because to do so will almost certainly cause 24 24 the infliction of self-induced pain, agony, and desperation. Be warned: this is an important chapter. 25 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 85377"></a>Overview</h2></div></div></div><p>26 <a class="indexterm" name="id3 85385"></a>27 <a class="indexterm" name="id3 85391"></a>28 <a class="indexterm" name="id3 85398"></a>29 <a class="indexterm" name="id3 85405"></a>30 <a class="indexterm" name="id3 85411"></a>31 <a class="indexterm" name="id3 85418"></a>25 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id359824"></a>Overview</h2></div></div></div><p> 26 <a class="indexterm" name="id359831"></a> 27 <a class="indexterm" name="id359838"></a> 28 <a class="indexterm" name="id359845"></a> 29 <a class="indexterm" name="id359851"></a> 30 <a class="indexterm" name="id359858"></a> 31 <a class="indexterm" name="id359864"></a> 32 32 The tasks that follow the installation of a Samba-3 server, whether standalone or domain member, of a 33 33 domain controller (PDC or BDC) begins with the need to create administrative rights. Of course, the … … 36 36 the central domain authentication backend. 37 37 </p><p> 38 <a class="indexterm" name="id3 85432"></a>39 <a class="indexterm" name="id3 85438"></a>40 <a class="indexterm" name="id3 85445"></a>41 <a class="indexterm" name="id3 85452"></a>42 <a class="indexterm" name="id3 85459"></a>43 <a class="indexterm" name="id3 85465"></a>44 <a class="indexterm" name="id3 85472"></a>45 <a class="indexterm" name="id3 85479"></a>38 <a class="indexterm" name="id359878"></a> 39 <a class="indexterm" name="id359885"></a> 40 <a class="indexterm" name="id359892"></a> 41 <a class="indexterm" name="id359899"></a> 42 <a class="indexterm" name="id359906"></a> 43 <a class="indexterm" name="id359912"></a> 44 <a class="indexterm" name="id359919"></a> 45 <a class="indexterm" name="id359925"></a> 46 46 Regardless of the type of server being installed, local UNIX groups must be mapped to the Windows 47 47 networking domain global group accounts. Do you ask why? Because Samba always limits its access to … … 51 51 Samba. Such mappings are implemented using the <code class="literal">net</code> command. 52 52 </p><p> 53 <a class="indexterm" name="id3 85499"></a>54 <a class="indexterm" name="id3 85506"></a>55 <a class="indexterm" name="id3 85512"></a>56 <a class="indexterm" name="id3 85519"></a>57 <a class="indexterm" name="id3 85525"></a>58 <a class="indexterm" name="id3 85532"></a>59 <a class="indexterm" name="id3 85539"></a>53 <a class="indexterm" name="id359946"></a> 54 <a class="indexterm" name="id359952"></a> 55 <a class="indexterm" name="id359959"></a> 56 <a class="indexterm" name="id359965"></a> 57 <a class="indexterm" name="id359972"></a> 58 <a class="indexterm" name="id359979"></a> 59 <a class="indexterm" name="id359986"></a> 60 60 UNIX systems that are hosting a Samba-3 server that is running as a member (PDC, BDC, or DMS) must have 61 61 a machine security account in the domain authentication database (or directory). The creation of such 62 62 security (or trust) accounts is also handled using the <code class="literal">net</code> command. 63 63 </p><p> 64 <a class="indexterm" name="id3 85557"></a>65 <a class="indexterm" name="id3 85564"></a>66 <a class="indexterm" name="id3 85570"></a>67 <a class="indexterm" name="id3 85577"></a>68 <a class="indexterm" name="id3 85584"></a>69 <a class="indexterm" name="id3 85591"></a>70 <a class="indexterm" name="id3 85597"></a>71 <a class="indexterm" name="id3 85604"></a>72 <a class="indexterm" name="id3 85611"></a>64 <a class="indexterm" name="id360004"></a> 65 <a class="indexterm" name="id360010"></a> 66 <a class="indexterm" name="id360017"></a> 67 <a class="indexterm" name="id360024"></a> 68 <a class="indexterm" name="id360030"></a> 69 <a class="indexterm" name="id360037"></a> 70 <a class="indexterm" name="id360044"></a> 71 <a class="indexterm" name="id360051"></a> 72 <a class="indexterm" name="id360058"></a> 73 73 The establishment of interdomain trusts is achieved using the <code class="literal">net</code> command also, as 74 74 may a plethora of typical administrative duties such as user management, group management, share and 75 75 printer management, file and printer migration, security identifier management, and so on. 76 76 </p><p> 77 <a class="indexterm" name="id3 85629"></a>78 <a class="indexterm" name="id3 85636"></a>77 <a class="indexterm" name="id360076"></a> 78 <a class="indexterm" name="id360082"></a> 79 79 The overall picture should be clear now: the <code class="literal">net</code> command plays a central role 80 80 on the Samba-3 stage. This role will continue to be developed. The inclusion of this chapter is 81 81 evidence of its importance, one that has grown in complexity to the point that it is no longer considered 82 82 prudent to cover its use fully in the online UNIX man pages. 83 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 85653"></a>Administrative Tasks and Methods</h2></div></div></div><p>84 <a class="indexterm" name="id3 85661"></a>85 <a class="indexterm" name="id3 85668"></a>86 <a class="indexterm" name="id3 85674"></a>87 <a class="indexterm" name="id3 85683"></a>83 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id360100"></a>Administrative Tasks and Methods</h2></div></div></div><p> 84 <a class="indexterm" name="id360108"></a> 85 <a class="indexterm" name="id360114"></a> 86 <a class="indexterm" name="id360121"></a> 87 <a class="indexterm" name="id360130"></a> 88 88 The basic operations of the <code class="literal">net</code> command are documented here. This documentation is not 89 89 exhaustive, and thus it is incomplete. Since the primary focus is on migration from Windows servers to a Samba … … 95 95 <code class="constant">rap</code> modes. Please refer to the man page for a more comprehensive overview of the 96 96 capabilities of this utility. 97 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 85728"></a>UNIX and Windows Group Management</h2></div></div></div><p>98 <a class="indexterm" name="id3 85735"></a>99 <a class="indexterm" name="id3 85742"></a>100 <a class="indexterm" name="id3 85751"></a>101 <a class="indexterm" name="id3 85760"></a>102 <a class="indexterm" name="id3 85768"></a>97 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id360174"></a>UNIX and Windows Group Management</h2></div></div></div><p> 98 <a class="indexterm" name="id360182"></a> 99 <a class="indexterm" name="id360189"></a> 100 <a class="indexterm" name="id360198"></a> 101 <a class="indexterm" name="id360206"></a> 102 <a class="indexterm" name="id360215"></a> 103 103 As stated, the focus in most of this chapter is on use of the <code class="literal">net rpc</code> family of 104 104 operations that are supported by Samba. Most of them are supported by the <code class="literal">net ads</code> … … 107 107 earlier SMB servers. 108 108 </p><p> 109 <a class="indexterm" name="id3 85799"></a>110 <a class="indexterm" name="id3 85805"></a>111 <a class="indexterm" name="id3 85812"></a>109 <a class="indexterm" name="id360246"></a> 110 <a class="indexterm" name="id360252"></a> 111 <a class="indexterm" name="id360259"></a> 112 112 Samba's <code class="literal">net</code> tool implements sufficient capability to permit all common administrative 113 113 tasks to be completed from the command line. In this section each of the essential user and group management 114 114 facilities are explored. 115 115 </p><p> 116 <a class="indexterm" name="id3 85830"></a>117 <a class="indexterm" name="id3 85837"></a>118 <a class="indexterm" name="id3 85846"></a>119 <a class="indexterm" name="id3 85855"></a>116 <a class="indexterm" name="id360276"></a> 117 <a class="indexterm" name="id360283"></a> 118 <a class="indexterm" name="id360292"></a> 119 <a class="indexterm" name="id360302"></a> 120 120 Samba-3 recognizes two types of groups: <span class="emphasis"><em>domain groups</em></span> and <span class="emphasis"><em>local 121 121 groups</em></span>. Domain groups can contain (have as members) only domain user accounts. Local groups … … 124 124 The purpose of a local group is to permit file permission to be set for a group account that, like the 125 125 usual UNIX/Linux group, is persistent across redeployment of a Windows file server. 126 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 85877"></a>Adding, Renaming, or Deletion of Group Accounts</h3></div></div></div><p>126 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id360324"></a>Adding, Renaming, or Deletion of Group Accounts</h3></div></div></div><p> 127 127 Samba provides file and print services to Windows clients. The file system resources it makes available 128 128 to the Windows environment must, of necessity, be provided in a manner that is compatible with the … … 144 144 show how UNIX group members automatically pass-through to Windows group membership as soon as a logical 145 145 mapping has been created. 146 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 85906"></a>Adding or Creating a New Group</h4></div></div></div><p>146 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id360352"></a>Adding or Creating a New Group</h4></div></div></div><p> 147 147 Before attempting to add a Windows group account, the currently available groups can be listed as shown 148 148 here: 149 <a class="indexterm" name="id3 85915"></a>150 <a class="indexterm" name="id3 85926"></a>149 <a class="indexterm" name="id360361"></a> 150 <a class="indexterm" name="id360372"></a> 151 151 </p><pre class="screen"> 152 152 <code class="prompt">root# </code> net rpc group list -Uroot%not24get … … 164 164 A Windows group account called “<span class="quote">SupportEngrs</span>” can be added by executing the following 165 165 command: 166 <a class="indexterm" name="id3 85960"></a>166 <a class="indexterm" name="id360406"></a> 167 167 </p><pre class="screen"> 168 168 <code class="prompt">root# </code> net rpc group add "SupportEngrs" -Uroot%not24get … … 184 184 </pre><p> 185 185 </p><p> 186 <a class="indexterm" name="id3 85999"></a>187 <a class="indexterm" name="id3 86006"></a>188 <a class="indexterm" name="id3 86013"></a>186 <a class="indexterm" name="id360446"></a> 187 <a class="indexterm" name="id360453"></a> 188 <a class="indexterm" name="id360460"></a> 189 189 The following demonstrates that the POSIX (UNIX/Linux system account) group has been created by calling 190 190 the <a class="link" href="smb.conf.5.html#ADDGROUPSCRIPT">add group script = /opt/IDEALX/sbin/smbldap-groupadd -p "%g"</a> interface … … 206 206 results in immediate mapping of the POSIX group that has been created to the Windows group account as shown 207 207 here: 208 <a class="indexterm" name="id3 86052"></a>208 <a class="indexterm" name="id360499"></a> 209 209 </p><pre class="screen"> 210 210 <code class="prompt">root# </code> net groupmap list … … 219 219 SupportEngrs (S-1-5-21-72630-4128915-11681869-3007) -> SupportEngrs 220 220 </pre><p> 221 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 86085"></a>Mapping Windows Groups to UNIX Groups</h4></div></div></div><p>222 <a class="indexterm" name="id3 86093"></a>223 <a class="indexterm" name="id3 86100"></a>224 <a class="indexterm" name="id3 86107"></a>225 <a class="indexterm" name="id3 86114"></a>221 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id360532"></a>Mapping Windows Groups to UNIX Groups</h4></div></div></div><p> 222 <a class="indexterm" name="id360540"></a> 223 <a class="indexterm" name="id360547"></a> 224 <a class="indexterm" name="id360554"></a> 225 <a class="indexterm" name="id360560"></a> 226 226 Windows groups must be mapped to UNIX system (POSIX) groups so that file system access controls 227 227 can be asserted in a manner that is consistent with the methods appropriate to the operating 228 228 system that is hosting the Samba server. 229 229 </p><p> 230 <a class="indexterm" name="id3 86126"></a>231 <a class="indexterm" name="id3 86133"></a>232 <a class="indexterm" name="id3 86139"></a>233 <a class="indexterm" name="id3 86146"></a>230 <a class="indexterm" name="id360572"></a> 231 <a class="indexterm" name="id360579"></a> 232 <a class="indexterm" name="id360586"></a> 233 <a class="indexterm" name="id360592"></a> 234 234 All file system (file and directory) access controls, within the file system of a UNIX/Linux server that is 235 235 hosting a Samba server, are implemented using a UID/GID identity tuple. Samba does not in any way override … … 239 239 command does not call any RPC-functions here but directly accesses the passdb. 240 240 </p><p> 241 <a class="indexterm" name="id3 86166"></a>242 <a class="indexterm" name="id3 86173"></a>243 <a class="indexterm" name="id3 86180"></a>244 <a class="indexterm" name="id3 86187"></a>245 <a class="indexterm" name="id3 86194"></a>246 <a class="indexterm" name="id3 86200"></a>247 <a class="indexterm" name="id3 86207"></a>241 <a class="indexterm" name="id360613"></a> 242 <a class="indexterm" name="id360620"></a> 243 <a class="indexterm" name="id360627"></a> 244 <a class="indexterm" name="id360633"></a> 245 <a class="indexterm" name="id360640"></a> 246 <a class="indexterm" name="id360647"></a> 247 <a class="indexterm" name="id360654"></a> 248 248 Samba depends on default mappings for the <code class="constant">Domain Admins, Domain Users</code>, and 249 249 <code class="constant">Domain Guests</code> global groups. Additional groups may be added as shown in the … … 252 252 of creation of the mapping. 253 253 </p><p> 254 <a class="indexterm" name="id3 86228"></a>255 <a class="indexterm" name="id3 86239"></a>256 <a class="indexterm" name="id3 86250"></a>254 <a class="indexterm" name="id360674"></a> 255 <a class="indexterm" name="id360686"></a> 256 <a class="indexterm" name="id360697"></a> 257 257 The operations that are permitted include: <code class="constant">add</code>, <code class="constant">modify</code>, 258 258 and <code class="constant">delete</code>. An example of each operation is shown here. … … 291 291 treated as local to the individual Samba server. Local groups can be used with Samba to enable multiple 292 292 nested group support. 293 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 86366"></a>Deleting a Group Account</h4></div></div></div><p>294 <a class="indexterm" name="id3 86374"></a>293 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id360813"></a>Deleting a Group Account</h4></div></div></div><p> 294 <a class="indexterm" name="id360821"></a> 295 295 A group account may be deleted by executing the following command: 296 296 </p><pre class="screen"> … … 299 299 </p><p> 300 300 Validation of the deletion is advisable. The same commands may be executed as shown above. 301 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 86404"></a>Rename Group Accounts</h4></div></div></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>301 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id360851"></a>Rename Group Accounts</h4></div></div></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 302 302 This command is not documented in the man pages; it is implemented in the source code, but it does not 303 303 work at this time. The example given documents, from the source code, how it should work. Watch the … … 307 307 demands can be if this simple request is ignored. The following command demonstrates how the Windows group 308 308 “<span class="quote">SupportEngrs</span>” can be renamed to “<span class="quote">CustomerSupport</span>”: 309 <a class="indexterm" name="id3 86428"></a>309 <a class="indexterm" name="id360874"></a> 310 310 </p><pre class="screen"> 311 311 <code class="prompt">root# </code> net rpc group rename SupportEngrs \ … … 350 350 group mapping, a member of the Windows group, an attempt to add this account again should fail. This is 351 351 demonstrated here: 352 <a class="indexterm" name="id3 86539"></a>352 <a class="indexterm" name="id360986"></a> 353 353 </p><pre class="screen"> 354 354 <code class="prompt">root# </code> net rpc group addmem "MIDEARTH\Engineers" ajt -Uroot%not24get … … 360 360 To permit the user <code class="constant">ajt</code> to be added using the <code class="literal">net rpc group</code> utility, 361 361 this account must first be removed. The removal and confirmation of its effect is shown here: 362 <a class="indexterm" name="id3 86578"></a>362 <a class="indexterm" name="id361024"></a> 363 363 </p><pre class="screen"> 364 364 <code class="prompt">root# </code> net rpc group delmem "MIDEARTH\Engineers" ajt -Uroot%not24get … … 384 384 the <code class="literal">net rpc group</code> utility. Note the this contents of the UNIX/Linux group was shown 385 385 four paragraphs earlier. The Windows (domain) group membership is shown here: 386 <a class="indexterm" name="id3 86667"></a>386 <a class="indexterm" name="id361114"></a> 387 387 </p><pre class="screen"> 388 388 <code class="prompt">root# </code> net rpc group members "Domain Users" -Uroot%not24get … … 441 441 <code class="prompt">root# </code> net rpc group delmem demo "DOM\jht" -Uroot%not24get 442 442 </pre><p> 443 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 86831"></a>Managing Nest Groups on Workstations from the Samba Server</h4></div></div></div><p>443 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id361277"></a>Managing Nest Groups on Workstations from the Samba Server</h4></div></div></div><p> 444 444 Windows network administrators often ask on the Samba mailing list how it is possible to grant everyone 445 445 administrative rights on their own workstation. This is of course a very bad practice, but commonly done 446 446 to avoid user complaints. Here is how it can be done remotely from a Samba PDC or BDC: 447 <a class="indexterm" name="id3 86842"></a>447 <a class="indexterm" name="id361288"></a> 448 448 </p><pre class="screen"> 449 449 <code class="prompt">root# </code> net rpc group addmem "Administrators" "Domain Users" \ … … 453 453 This can be scripted, and can therefore be performed as a user logs onto the domain from a Windows 454 454 workstation. Here is a simple example that shows how this can be done. 455 </p><div class="procedure"><a name="id3 86871"></a><p class="title"><b>Procedure 13.1. Automating User Addition to the Workstation Power Users Group</b></p><div class="example"><a name="autopoweruserscript"></a><p class="title"><b>Example 13.1. Script to Auto-add Domain Users to Workstation Power Users Group</b></p><div class="example-contents"><pre class="screen">455 </p><div class="procedure"><a name="id361317"></a><p class="title"><b>Procedure 13.1. Automating User Addition to the Workstation Power Users Group</b></p><div class="example"><a name="autopoweruserscript"></a><p class="title"><b>Example 13.1. Script to Auto-add Domain Users to Workstation Power Users Group</b></p><div class="example-contents"><pre class="screen"> 456 456 #!/bin/bash 457 457 … … 460 460 461 461 exit 0 462 </pre></div></div><br class="example-break"><div class="example"><a name="magicnetlogon"></a><p class="title"><b>Example 13.2. A Magic Netlogon Share</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id3 87019"></a><em class="parameter"><code>comment = Netlogon Share</code></em></td></tr><tr><td><a class="indexterm" name="id387031"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id387042"></a><em class="parameter"><code>root preexec = /etc/samba/scripts/autopoweruser.sh %U %m</code></em></td></tr><tr><td><a class="indexterm" name="id387054"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id387066"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr></table></div></div><br class="example-break"><ol type="1"><li><p>462 </pre></div></div><br class="example-break"><div class="example"><a name="magicnetlogon"></a><p class="title"><b>Example 13.2. A Magic Netlogon Share</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id361466"></a><em class="parameter"><code>comment = Netlogon Share</code></em></td></tr><tr><td><a class="indexterm" name="id361477"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id361489"></a><em class="parameter"><code>root preexec = /etc/samba/scripts/autopoweruser.sh %U %m</code></em></td></tr><tr><td><a class="indexterm" name="id361501"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id361512"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr></table></div></div><br class="example-break"><ol type="1"><li><p> 463 463 Create the script shown in <a class="link" href="NetCommand.html#autopoweruserscript" title="Example 13.1. Script to Auto-add Domain Users to Workstation Power Users Group">“Script to Auto-add Domain Users to Workstation Power Users Group”</a> and locate it in 464 464 the directory <code class="filename">/etc/samba/scripts</code>, named as <code class="filename">autopoweruser.sh</code>. 465 <a class="indexterm" name="id3 86901"></a>466 <a class="indexterm" name="id3 86912"></a>467 <a class="indexterm" name="id3 86919"></a>465 <a class="indexterm" name="id361348"></a> 466 <a class="indexterm" name="id361359"></a> 467 <a class="indexterm" name="id361366"></a> 468 468 </p></li><li><p> 469 469 Set the permissions on this script to permit it to be executed as part of the logon process: … … 485 485 for the use of this method is that it will guarantee that all users have appropriate rights on 486 486 the workstation. 487 </p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 87104"></a>UNIX and Windows User Management</h2></div></div></div><p>488 <a class="indexterm" name="id3 87112"></a>489 <a class="indexterm" name="id3 87118"></a>490 <a class="indexterm" name="id3 87125"></a>491 <a class="indexterm" name="id3 87132"></a>492 <a class="indexterm" name="id3 87139"></a>493 <a class="indexterm" name="id3 87145"></a>494 <a class="indexterm" name="id3 87152"></a>495 <a class="indexterm" name="id3 87159"></a>487 </p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id361551"></a>UNIX and Windows User Management</h2></div></div></div><p> 488 <a class="indexterm" name="id361559"></a> 489 <a class="indexterm" name="id361565"></a> 490 <a class="indexterm" name="id361572"></a> 491 <a class="indexterm" name="id361578"></a> 492 <a class="indexterm" name="id361585"></a> 493 <a class="indexterm" name="id361592"></a> 494 <a class="indexterm" name="id361599"></a> 495 <a class="indexterm" name="id361606"></a> 496 496 Every Windows network user account must be translated to a UNIX/Linux user account. In actual fact, 497 497 the only account information the UNIX/Linux Samba server needs is a UID. The UID is available either … … 517 517 </p><p> 518 518 The following demonstrates the addition of an account to the server <code class="constant">FRODO</code>: 519 <a class="indexterm" name="id3 87244"></a>520 <a class="indexterm" name="id3 87255"></a>519 <a class="indexterm" name="id361691"></a> 520 <a class="indexterm" name="id361702"></a> 521 521 </p><pre class="screen"> 522 522 <code class="prompt">root# </code> net rpc user add jacko -S FRODO -Uroot%not24get … … 529 529 -S FRODO -Uroot%not24get 530 530 </pre><p> 531 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 87299"></a>Deletion of User Accounts</h3></div></div></div><p>531 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id361746"></a>Deletion of User Accounts</h3></div></div></div><p> 532 532 Deletion of a user account can be done using the following syntax: 533 533 </p><pre class="screen"> … … 535 535 </pre><p> 536 536 The following command will delete the user account <code class="constant">jacko</code>: 537 <a class="indexterm" name="id3 87319"></a>537 <a class="indexterm" name="id361766"></a> 538 538 </p><pre class="screen"> 539 539 <code class="prompt">root# </code> net rpc user delete jacko -Uroot%not24get 540 540 Deleted user account 541 541 </pre><p> 542 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 87344"></a>Managing User Accounts</h3></div></div></div><p>542 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id361791"></a>Managing User Accounts</h3></div></div></div><p> 543 543 Two basic user account operations are routinely used: change of password and querying which groups a user 544 544 is a member of. The change of password operation is shown in <a class="link" href="NetCommand.html#sbeuseraddn" title="Adding User Accounts">“Adding User Accounts”</a>. … … 546 546 The ability to query Windows group membership can be essential. Here is how a remote server may be 547 547 interrogated to find which groups a user is a member of: 548 <a class="indexterm" name="id3 87364"></a>548 <a class="indexterm" name="id361811"></a> 549 549 </p><pre class="screen"> 550 550 <code class="prompt">root# </code> net rpc user info jacko -S SAURON -Uroot%not24get … … 559 559 </p><p> 560 560 It is also possible to rename user accounts: 561 <a class="indexterm" name="id3 87391"></a>oldusername newusername561 <a class="indexterm" name="id361838"></a>oldusername newusername 562 562 Note that this operation does not yet work against Samba Servers. It is, however, possible to rename useraccounts on 563 563 Windows Servers. 564 564 565 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 87406"></a>User Mapping</h3></div></div></div><p>566 <a class="indexterm" name="id3 87414"></a>567 <a class="indexterm" name="id3 87421"></a>568 <a class="indexterm" name="id3 87427"></a>565 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id361853"></a>User Mapping</h3></div></div></div><p> 566 <a class="indexterm" name="id361860"></a> 567 <a class="indexterm" name="id361867"></a> 568 <a class="indexterm" name="id361874"></a> 569 569 In some situations it is unavoidable that a user's Windows logon name will differ from the login ID 570 570 that user has on the Samba server. It is possible to create a special file on the Samba server that … … 582 582 <code class="constant">parsonsw</code>, and the Windows user account “<span class="quote">geeringm</span>” will be mapped to the 583 583 UNIX user <code class="constant">marygee</code>. 584 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 87484"></a>Administering User Rights and Privileges</h2></div></div></div><p>585 <a class="indexterm" name="id3 87492"></a>586 <a class="indexterm" name="id3 87499"></a>587 <a class="indexterm" name="id3 87505"></a>588 <a class="indexterm" name="id3 87512"></a>589 <a class="indexterm" name="id3 87519"></a>584 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id361930"></a>Administering User Rights and Privileges</h2></div></div></div><p> 585 <a class="indexterm" name="id361938"></a> 586 <a class="indexterm" name="id361945"></a> 587 <a class="indexterm" name="id361952"></a> 588 <a class="indexterm" name="id361959"></a> 589 <a class="indexterm" name="id361966"></a> 590 590 With all versions of Samba earlier than 3.0.11 the only account on a Samba server that could 591 591 manage users, groups, shares, printers, and such was the <code class="constant">root</code> account. This caused … … 593 593 credentials for the most security-sensitive account on a UNIX/Linux system. 594 594 </p><p> 595 <a class="indexterm" name="id3 87536"></a>596 <a class="indexterm" name="id3 87543"></a>597 <a class="indexterm" name="id3 87549"></a>598 <a class="indexterm" name="id3 87556"></a>599 <a class="indexterm" name="id3 87563"></a>595 <a class="indexterm" name="id361982"></a> 596 <a class="indexterm" name="id361989"></a> 597 <a class="indexterm" name="id361996"></a> 598 <a class="indexterm" name="id362003"></a> 599 <a class="indexterm" name="id362010"></a> 600 600 New to Samba version 3.0.11 is the ability to delegate administrative privileges as necessary to either 601 601 a normal user or to groups of users. The significance of the administrative privileges is documented … … 633 633 The <code class="literal">net</code> command can be used to obtain the currently supported capabilities for rights 634 634 and privileges using this method: 635 <a class="indexterm" name="id3 87626"></a>636 <a class="indexterm" name="id3 87633"></a>637 <a class="indexterm" name="id3 87640"></a>638 <a class="indexterm" name="id3 87647"></a>639 <a class="indexterm" name="id3 87654"></a>640 <a class="indexterm" name="id3 87661"></a>641 <a class="indexterm" name="id3 87667"></a>642 <a class="indexterm" name="id3 87674"></a>643 <a class="indexterm" name="id3 87681"></a>635 <a class="indexterm" name="id362073"></a> 636 <a class="indexterm" name="id362080"></a> 637 <a class="indexterm" name="id362087"></a> 638 <a class="indexterm" name="id362094"></a> 639 <a class="indexterm" name="id362100"></a> 640 <a class="indexterm" name="id362107"></a> 641 <a class="indexterm" name="id362114"></a> 642 <a class="indexterm" name="id362121"></a> 643 <a class="indexterm" name="id362128"></a> 644 644 </p><pre class="screen"> 645 645 <code class="prompt">root# </code> net rpc rights list -U root%not24get … … 660 660 idea since members of this group are generally expected to be all-powerful. This assignment makes that 661 661 the reality: 662 <a class="indexterm" name="id3 87719"></a>662 <a class="indexterm" name="id362165"></a> 663 663 </p><pre class="screen"> 664 664 <code class="prompt">root# </code> net rpc rights grant "MIDEARTH\Domain Admins" \ … … 679 679 </p><p> 680 680 The following step permits validation of the changes just made: 681 <a class="indexterm" name="id3 87764"></a>681 <a class="indexterm" name="id362211"></a> 682 682 </p><pre class="screen"> 683 683 <code class="prompt">root# </code> net rpc rights list accounts -U root%not24get … … 713 713 SeDiskOperatorPrivilege 714 714 </pre><p> 715 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 87799"></a>Managing Trust Relationships</h2></div></div></div><p>715 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id362240"></a>Managing Trust Relationships</h2></div></div></div><p> 716 716 There are essentially two types of trust relationships: the first is between domain controllers and domain 717 717 member machines (network clients), the second is between domains (called interdomain trusts). All 718 718 Samba servers that participate in domain security require a domain membership trust account, as do like 719 719 Windows NT/200x/XP workstations. 720 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 87811"></a>Machine Trust Accounts</h3></div></div></div><p>720 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id362252"></a>Machine Trust Accounts</h3></div></div></div><p> 721 721 The net command looks in the <code class="filename">smb.conf</code> file to obtain its own configuration settings. Thus, the following 722 722 command 'knows' which domain to join from the <code class="filename">smb.conf</code> file. 723 723 </p><p> 724 724 A Samba server domain trust account can be validated as shown in this example: 725 <a class="indexterm" name="id3 87836"></a>725 <a class="indexterm" name="id362277"></a> 726 726 </p><pre class="screen"> 727 727 <code class="prompt">root# </code> net rpc testjoin … … 736 736 </p><p> 737 737 The equivalent command for joining a Samba server to a Windows ADS domain is shown here: 738 <a class="indexterm" name="id3 87870"></a>738 <a class="indexterm" name="id362312"></a> 739 739 </p><pre class="screen"> 740 740 <code class="prompt">root# </code> net ads testjoin … … 751 751 The following demonstrates the process of creating a machine trust account in the target domain for the 752 752 Samba server from which the command is executed: 753 <a class="indexterm" name="id3 87911"></a>753 <a class="indexterm" name="id362353"></a> 754 754 </p><pre class="screen"> 755 755 <code class="prompt">root# </code> net rpc join -S FRODO -Uroot%not24get … … 766 766 purely as a workstation, in which case the S is replaced with a W (indicating a workstation account). The 767 767 following command can be used to affect this: 768 <a class="indexterm" name="id3 87950"></a>768 <a class="indexterm" name="id362392"></a> 769 769 </p><pre class="screen"> 770 770 <code class="prompt">root# </code> net rpc join member -S FRODO -Uroot%not24get … … 774 774 the type is deduced from the <code class="filename">smb.conf</code> file configuration. To specifically join as a PDC or BDC, the 775 775 command-line parameter will be <code class="constant">[PDC | BDC]</code>. For example: 776 <a class="indexterm" name="id3 87988"></a>776 <a class="indexterm" name="id362429"></a> 777 777 </p><pre class="screen"> 778 778 <code class="prompt">root# </code> net rpc join bdc -S FRODO -Uroot%not24get … … 782 782 </p><p> 783 783 The command to join a Samba server to a Windows ADS domain is shown here: 784 <a class="indexterm" name="id3 88021"></a>784 <a class="indexterm" name="id362463"></a> 785 785 </p><pre class="screen"> 786 786 <code class="prompt">root# </code> net ads join -UAdministrator%not24get … … 793 793 either. Inactive domain member accounts can be removed using any convenient tool. If necessary, the 794 794 machine account can be removed using the following <code class="literal">net</code> command: 795 <a class="indexterm" name="id3 88057"></a>795 <a class="indexterm" name="id362499"></a> 796 796 </p><pre class="screen"> 797 797 <code class="prompt">root# </code> net rpc user delete HERRING\$ -Uroot%not24get … … 803 803 A Samba-3 server that is a Windows ADS domain member can execute the following command to detach from the 804 804 domain: 805 <a class="indexterm" name="id3 88086"></a>805 <a class="indexterm" name="id362528"></a> 806 806 </p><pre class="screen"> 807 807 <code class="prompt">root# </code> net ads leave … … 810 810 Detailed information regarding an ADS domain can be obtained by a Samba DMS machine by executing the 811 811 following: 812 <a class="indexterm" name="id3 88113"></a>812 <a class="indexterm" name="id362554"></a> 813 813 </p><pre class="screen"> 814 814 <code class="prompt">root# </code> net ads status … … 817 817 Chapter 7 for more information regarding its use. This book may be obtained either in print or online from 818 818 the <a class="ulink" href="http://www.samba.org/samba/docs/Samba3-ByExample.pdf" target="_top">Samba-3 by Example</a>. 819 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 88148"></a>Interdomain Trusts</h3></div></div></div><p>819 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id362590"></a>Interdomain Trusts</h3></div></div></div><p> 820 820 Interdomain trust relationships form the primary mechanism by which users from one domain can be granted 821 821 access rights and privileges in another domain. 822 822 </p><p> 823 823 To discover what trust relationships are in effect, execute this command: 824 <a class="indexterm" name="id3 88162"></a>824 <a class="indexterm" name="id362604"></a> 825 825 </p><pre class="screen"> 826 826 <code class="prompt">root# </code> net rpc trustdom list -Uroot%not24get … … 838 838 create a trusted connection with this account. That means that the foreign domain is being trusted 839 839 to access resources in the local domain. This command creates the local trust account: 840 <a class="indexterm" name="id3 88192"></a>840 <a class="indexterm" name="id362633"></a> 841 841 </p><pre class="screen"> 842 842 <code class="prompt">root# </code> net rpc trustdom add DAMNATION f00db4r -Uroot%not24get … … 851 851 </p><p> 852 852 If the trusting domain is not capable of being reached, the following command will fail: 853 <a class="indexterm" name="id3 88238"></a>853 <a class="indexterm" name="id362680"></a> 854 854 </p><pre class="screen"> 855 855 <code class="prompt">root# </code> net rpc trustdom list -Uroot%not24get … … 877 877 the foreign account. In the process it creates a one-way trust to the resources on the remote domain. This 878 878 command achieves the objective of joining the trust relationship: 879 <a class="indexterm" name="id3 88276"></a>879 <a class="indexterm" name="id362718"></a> 880 880 </p><pre class="screen"> 881 881 <code class="prompt">root# </code> net rpc trustdom establish DAMNATION … … 898 898 Sometimes it is necessary to remove the ability for local users to access a foreign domain. The trusting 899 899 connection can be revoked as shown here: 900 <a class="indexterm" name="id3 88318"></a>900 <a class="indexterm" name="id362760"></a> 901 901 </p><pre class="screen"> 902 902 <code class="prompt">root# </code> net rpc trustdom revoke DAMNATION -Uroot%not24get … … 908 908 </pre><p> 909 909 910 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 88358"></a>Managing Security Identifiers (SIDS)</h2></div></div></div><p>911 <a class="indexterm" name="id3 88366"></a>912 <a class="indexterm" name="id3 88372"></a>913 <a class="indexterm" name="id3 88379"></a>914 <a class="indexterm" name="id3 88386"></a>915 <a class="indexterm" name="id3 88392"></a>910 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id362800"></a>Managing Security Identifiers (SIDS)</h2></div></div></div><p> 911 <a class="indexterm" name="id362807"></a> 912 <a class="indexterm" name="id362814"></a> 913 <a class="indexterm" name="id362821"></a> 914 <a class="indexterm" name="id362828"></a> 915 <a class="indexterm" name="id362834"></a> 916 916 The basic security identifier that is used by all Windows networking operations is the Windows security 917 917 identifier (SID). All Windows network machines (servers and workstations), users, and groups are … … 919 919 are specific to the SID of the domain to which the user belongs. 920 920 </p><p> 921 <a class="indexterm" name="id3 88406"></a>922 <a class="indexterm" name="id3 88413"></a>923 <a class="indexterm" name="id3 88419"></a>924 <a class="indexterm" name="id3 88426"></a>921 <a class="indexterm" name="id362848"></a> 922 <a class="indexterm" name="id362854"></a> 923 <a class="indexterm" name="id362861"></a> 924 <a class="indexterm" name="id362868"></a> 925 925 It is truly prudent to store the machine and/or domain SID in a file for safekeeping. Why? Because 926 926 a change in hostname or in the domain (workgroup) name may result in a change in the SID. When you … … 930 930 First, do not forget to store the local SID in a file. It is a good idea to put this in the directory 931 931 in which the <code class="filename">smb.conf</code> file is also stored. Here is a simple action to achieve this: 932 <a class="indexterm" name="id3 88447"></a>932 <a class="indexterm" name="id362889"></a> 933 933 </p><pre class="screen"> 934 934 <code class="prompt">root# </code> net getlocalsid > /etc/samba/my-sid … … 946 946 file, simply copy the SID (the string of characters that begins with <code class="constant">S-1-5-21</code>) to 947 947 the command line shown here: 948 <a class="indexterm" name="id3 88504"></a>948 <a class="indexterm" name="id362946"></a> 949 949 </p><pre class="screen"> 950 950 <code class="prompt">root# </code> net setlocalsid S-1-5-21-1385457007-882775198-1210191635 … … 957 957 any potential namespace collision. Here is the way that the BDC SID can be synchronized to that 958 958 of the PDC (this is the default NT4 domain practice also): 959 <a class="indexterm" name="id3 88532"></a>959 <a class="indexterm" name="id362974"></a> 960 960 </p><pre class="screen"> 961 961 <code class="prompt">root# </code> net rpc getsid -S FRODO -Uroot%not24get … … 965 965 Usually it is not necessary to specify the target server (-S FRODO) or the administrator account 966 966 credentials (-Uroot%not24get). 967 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 88559"></a>Share Management</h2></div></div></div><p>967 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id363001"></a>Share Management</h2></div></div></div><p> 968 968 Share management is central to all file serving operations. Typical share operations include: 969 969 </p><div class="itemizedlist"><ul type="disc"><li><p>Creation/change/deletion of shares</p></li><li><p>Setting/changing ACLs on shares</p></li><li><p>Moving shares from one server to another</p></li><li><p>Change of permissions of share contents</p></li></ul></div><p> 970 970 Each of these are dealt with here insofar as they involve the use of the <code class="literal">net</code> 971 971 command. Operations outside of this command are covered elsewhere in this document. 972 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 88601"></a>Creating, Editing, and Removing Shares</h3></div></div></div><p>972 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id363043"></a>Creating, Editing, and Removing Shares</h3></div></div></div><p> 973 973 A share can be added using the <code class="literal">net rpc share</code> command capabilities. 974 974 The target machine may be local or remote and is specified by the -S option. It must be noted … … 983 983 file system is the directory <code class="filename">/data</code>. The command that can be executed to perform the 984 984 addition of this share is shown here: 985 <a class="indexterm" name="id3 88685"></a>985 <a class="indexterm" name="id363126"></a> 986 986 </p><pre class="screen"> 987 987 <code class="prompt">root# </code> net rpc share add Bulge=/data -S MERLIN -Uroot%not24get … … 1004 1004 Often it is desirable also to permit a share to be removed using a command-line tool. 1005 1005 The following step permits the share that was previously added to be removed: 1006 <a class="indexterm" name="id3 88732"></a>1006 <a class="indexterm" name="id363174"></a> 1007 1007 </p><pre class="screen"> 1008 1008 <code class="prompt">root# </code> net rpc share delete Bulge -S MERLIN -Uroot%not24get … … 1020 1020 kyocera 1021 1021 </pre><p> 1022 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 88770"></a>Creating and Changing Share ACLs</h3></div></div></div><p>1022 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id363212"></a>Creating and Changing Share ACLs</h3></div></div></div><p> 1023 1023 At this time the <code class="literal">net</code> tool cannot be used to manage ACLs on Samba shares. In MS Windows 1024 1024 language this is called Share Permissions. … … 1027 1027 or using the Computer Management MMC snap-in. Neither is covered here, 1028 1028 but see <a class="link" href="AccessControls.html" title="Chapter 16. File, Directory, and Share Access Controls">“File, Directory, and Share Access Controls”</a>. 1029 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 88797"></a>Share, Directory, and File Migration</h3></div></div></div><p>1030 <a class="indexterm" name="id3 88805"></a>1029 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id363239"></a>Share, Directory, and File Migration</h3></div></div></div><p> 1030 <a class="indexterm" name="id363247"></a> 1031 1031 Shares and files can be migrated in the same manner as user, machine, and group accounts. 1032 1032 It is possible to preserve access control settings (ACLs) as well as security settings … … 1065 1065 Printer settings may not be fully or may be incorrectly migrated. This might in particular happen 1066 1066 when migrating a Windows 2003 print server to Samba. 1067 </p></li></ol></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 88890"></a>Share Migration</h4></div></div></div><p>1067 </p></li></ol></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id363329"></a>Share Migration</h4></div></div></div><p> 1068 1068 The <code class="literal">net rpc share migrate</code> command operation permits the migration of plain 1069 1069 share stanzas. A stanza contains the parameters within which a file or print share are defined. … … 1092 1092 large list of available shares on the system that is being migrated can be limited using the 1093 1093 <em class="parameter"><code>--exclude</code></em> switch. For example: 1094 <a class="indexterm" name="id3 88988"></a>1094 <a class="indexterm" name="id363427"></a> 1095 1095 </p><pre class="screen"> 1096 1096 <code class="prompt">root# </code> net rpc share migrate shares myshare\ … … 1105 1105 to validate that the migrated accounts (on the Samba server) have the needed rights and privileges. 1106 1106 This can be done as shown here: 1107 <a class="indexterm" name="id3 89036"></a>1107 <a class="indexterm" name="id363475"></a> 1108 1108 </p><pre class="screen"> 1109 1109 <code class="prompt">root# </code> net rpc right list accounts -Uroot%not24get … … 1111 1111 The steps taken so far perform only the migration of shares. Directories and directory contents 1112 1112 are not migrated by the steps covered up to this point. 1113 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 89062"></a>File and Directory Migration</h4></div></div></div><p>1113 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id363501"></a>File and Directory Migration</h4></div></div></div><p> 1114 1114 Everything covered to this point has been done in preparation for the migration of file and directory 1115 1115 data. For many people preparation is potentially boring and the real excitement only begins when file … … 1162 1162 An example for migration of files from a machine called <code class="constant">nt4box</code> to the Samba server 1163 1163 from which the process will be handled is shown here: 1164 <a class="indexterm" name="id3 89206"></a>1164 <a class="indexterm" name="id363645"></a> 1165 1165 </p><pre class="screen"> 1166 1166 <code class="prompt">root# </code> net rpc share migrate files -S nt4box --acls \ … … 1171 1171 <code class="constant">nt4box</code> to the Samba server from which migration is initiated. Files that are group-owned 1172 1172 will be owned by the user account <code class="constant">administrator</code>. 1173 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 89243"></a>Share-ACL Migration</h4></div></div></div><p>1173 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id363682"></a>Share-ACL Migration</h4></div></div></div><p> 1174 1174 It is possible to have share-ACLs (security descriptors) that won't allow you, even as Administrator, to 1175 1175 copy any files or directories into it. Therefor the migration of the share-ACLs has been put into a separate 1176 1176 function: 1177 <a class="indexterm" name="id3 89252"></a>1177 <a class="indexterm" name="id363692"></a> 1178 1178 </p><pre class="screen"> 1179 1179 <code class="prompt">root# </code> net rpc share migrate security -S nt4box -U administrator%secret … … 1181 1181 </p><p> 1182 1182 This command will only copy the share-ACL of each share on nt4box to your local samba-system. 1183 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id3 89282"></a>Simultaneous Share and File Migration</h4></div></div></div><p>1183 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id363721"></a>Simultaneous Share and File Migration</h4></div></div></div><p> 1184 1184 The operating mode shown here is just a combination of the previous three. It first migrates 1185 1185 share definitions and then all shared files and directories and finally migrates the share-ACLs: … … 1190 1190 </p><p> 1191 1191 An example of simultaneous migration is shown here: 1192 <a class="indexterm" name="id3 89303"></a>1192 <a class="indexterm" name="id363742"></a> 1193 1193 </p><pre class="screen"> 1194 1194 <code class="prompt">root# </code> net rpc share migrate all -S w2k3server -U administrator%secret 1195 1195 </pre><p> 1196 1196 This will generate a complete server clone of the <em class="parameter"><code>w2k3server</code></em> server. 1197 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 89335"></a>Printer Migration</h3></div></div></div><p>1197 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id363774"></a>Printer Migration</h3></div></div></div><p> 1198 1198 The installation of a new server, as with the migration to a new network environment, often is similar to 1199 1199 building a house; progress is very rapid from the laying of foundations up to the stage at which … … 1232 1232 Printer migration from a Windows print server (NT4 or 200x) is shown. This instruction causes the 1233 1233 printer share to be created together with the underlying print queue: 1234 <a class="indexterm" name="id3 89445"></a>1234 <a class="indexterm" name="id363887"></a> 1235 1235 </p><pre class="screen"> 1236 1236 net rpc printer MIGRATE PRINTERS [printer] [misc. options] [targets] … … 1238 1238 Printer drivers can be migrated from the Windows print server to the Samba server using this 1239 1239 command-line instruction: 1240 <a class="indexterm" name="id3 89464"></a>1240 <a class="indexterm" name="id363905"></a> 1241 1241 </p><pre class="screen"> 1242 1242 net rpc printer MIGRATE DRIVERS [printer] [misc. options] [targets] 1243 1243 </pre><p> 1244 1244 Printer forms can be migrated with the following operation: 1245 <a class="indexterm" name="id3 89481"></a>1245 <a class="indexterm" name="id363923"></a> 1246 1246 </p><pre class="screen"> 1247 1247 net rpc printer MIGRATE FORMS [printer] [misc. options] [targets] 1248 1248 </pre><p> 1249 1249 Printer security settings (ACLs) can be migrated from the Windows server to the Samba server using this command: 1250 <a class="indexterm" name="id3 89500"></a>1250 <a class="indexterm" name="id363941"></a> 1251 1251 </p><pre class="screen"> 1252 1252 net rpc printer MIGRATE SECURITY [printer] [misc. options] [targets] … … 1254 1254 Printer configuration settings include factors such as paper size and default paper orientation. 1255 1255 These can be migrated from the Windows print server to the Samba server with this command: 1256 <a class="indexterm" name="id3 89519"></a>1256 <a class="indexterm" name="id363960"></a> 1257 1257 </p><pre class="screen"> 1258 1258 net rpc printer MIGRATE SETTINGS [printer] [misc. options] [targets] … … 1264 1264 net rpc printer MIGRATE ALL [printer] [misc. options] [targets] 1265 1265 </pre><p> 1266 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 89550"></a>Controlling Open Files</h2></div></div></div><p>1266 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id363992"></a>Controlling Open Files</h2></div></div></div><p> 1267 1267 The man page documents the <code class="literal">net file</code> function suite, which provides the tools to 1268 1268 close open files using either RAP or RPC function calls. Please refer to the man page for specific 1269 1269 usage information. 1270 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 89567"></a>Session and Connection Management</h2></div></div></div><p>1270 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id364009"></a>Session and Connection Management</h2></div></div></div><p> 1271 1271 The session management interface of the <code class="literal">net session</code> command uses the old RAP 1272 1272 method to obtain the list of connections to the Samba server, as shown here: 1273 <a class="indexterm" name="id3 89582"></a>1273 <a class="indexterm" name="id364024"></a> 1274 1274 </p><pre class="screen"> 1275 1275 <code class="prompt">root# </code> net rap session -S MERLIN -Uroot%not24get … … 1286 1286 <code class="prompt">root# </code> net rap session close marvel -Uroot%not24get 1287 1287 </pre><p> 1288 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 89627"></a>Printers and ADS</h2></div></div></div><p>1288 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id364068"></a>Printers and ADS</h2></div></div></div><p> 1289 1289 When Samba-3 is used within an MS Windows ADS environment, printers shared via Samba will not be browseable 1290 1290 until they have been published to the ADS domain. Information regarding published printers may be obtained 1291 1291 from the ADS server by executing the <code class="literal">net ads print info</code> command following this syntax: 1292 <a class="indexterm" name="id3 89643"></a>1292 <a class="indexterm" name="id364085"></a> 1293 1293 </p><pre class="screen"> 1294 1294 net ads printer info <printer_name> <server_name> -Uadministrator%secret … … 1298 1298 </p><p> 1299 1299 To publish (make available) a printer to ADS, execute the following command: 1300 <a class="indexterm" name="id3 89666"></a>1300 <a class="indexterm" name="id364107"></a> 1301 1301 </p><pre class="screen"> 1302 1302 net ads printer publish <printer_name> -Uadministrator%secret … … 1305 1305 </p><p> 1306 1306 Removal of a Samba printer from ADS is achieved by executing this command: 1307 <a class="indexterm" name="id3 89688"></a>1307 <a class="indexterm" name="id364130"></a> 1308 1308 </p><pre class="screen"> 1309 1309 net ads printer remove <printer_name> -Uadministrator%secret … … 1311 1311 </p><p> 1312 1312 A generic search (query) can also be made to locate a printer across the entire ADS domain by executing: 1313 <a class="indexterm" name="id3 89710"></a>1313 <a class="indexterm" name="id364152"></a> 1314 1314 </p><pre class="screen"> 1315 1315 net ads printer search <printer_name> -Uadministrator%secret 1316 1316 </pre><p> 1317 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 89730"></a>Manipulating the Samba Cache</h2></div></div></div><p>1317 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id364172"></a>Manipulating the Samba Cache</h2></div></div></div><p> 1318 1318 Please refer to the <code class="literal">net</code> command man page for information regarding cache management. 1319 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id3 89747"></a>Managing IDMAP UID/SID Mappings</h2></div></div></div><p>1319 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id364188"></a>Managing IDMAP UID/SID Mappings</h2></div></div></div><p> 1320 1320 The IDMAP UID to SID, and SID to UID, mappings that are created by <code class="literal">winbindd</code> can be 1321 1321 backed up to a text file. The text file can be manually edited, although it is highly recommended that … … 1328 1328 Winbind must be shut down to dump the IDMAP file. Before restoring a dump file, shut down 1329 1329 <code class="literal">winbindd</code> and delete the old <code class="filename">winbindd_idmap.tdb</code> file. 1330 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 89785"></a>Creating an IDMAP Database Dump File</h3></div></div></div><p>1330 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id364227"></a>Creating an IDMAP Database Dump File</h3></div></div></div><p> 1331 1331 The IDMAP database can be dumped to a text file as shown here: 1332 1332 </p><pre class="screen"> … … 1338 1338 net idmap dump /var/lib/samba/winbindd_idmap.tdb > idmap_dump.txt 1339 1339 </pre><p> 1340 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id3 89816"></a>Restoring the IDMAP Database Dump File</h3></div></div></div><p>1340 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id364258"></a>Restoring the IDMAP Database Dump File</h3></div></div></div><p> 1341 1341 The IDMAP dump file can be restored using the following command: 1342 1342 </p><pre class="screen"> … … 1351 1351 The following command is useful for obtaining basic statistics regarding a Samba domain. This command does 1352 1352 not work with current Windows XP Professional clients. 1353 <a class="indexterm" name="id3 89862"></a>1353 <a class="indexterm" name="id364303"></a> 1354 1354 </p><pre class="screen"> 1355 1355 <code class="prompt">root# </code> net rpc info … … 1364 1364 Another useful tool is the <code class="literal">net time</code> tool set. This tool may be used to query the 1365 1365 current time on the target server as shown here: 1366 <a class="indexterm" name="id3 89896"></a>1366 <a class="indexterm" name="id364337"></a> 1367 1367 </p><pre class="screen"> 1368 1368 <code class="prompt">root# </code> net time -S SAURON … … 1372 1372 <code class="literal">/bin/time</code>, it is a good idea to obtain the time from the target server in a format 1373 1373 that is ready to be passed through. This may be done by executing: 1374 <a class="indexterm" name="id3 89924"></a>1374 <a class="indexterm" name="id364366"></a> 1375 1375 </p><pre class="screen"> 1376 1376 <code class="prompt">root# </code> net time system -S FRODO … … 1378 1378 </pre><p> 1379 1379 The time can be set on a target server by executing: 1380 <a class="indexterm" name="id3 89948"></a>1380 <a class="indexterm" name="id364390"></a> 1381 1381 </p><pre class="screen"> 1382 1382 <code class="prompt">root# </code> net time set -S MAGGOT -U Administrator%not24get … … 1384 1384 </pre><p> 1385 1385 It is possible to obtain the time zone of a server by executing the following command against it: 1386 <a class="indexterm" name="id3 89972"></a>1386 <a class="indexterm" name="id364414"></a> 1387 1387 </p><pre class="screen"> 1388 1388 <code class="prompt">root# </code> net time zone -S SAURON
Note:
See TracChangeset
for help on using the changeset viewer.
