Changeset 226 for branches/samba-3.2.x/docs/htmldocs/Samba3-ByExample
- Timestamp:
- May 26, 2009, 9:43:19 AM (16 years ago)
- Location:
- branches/samba-3.2.x/docs/htmldocs/Samba3-ByExample
- Files:
-
- 27 edited
-
2000users.html (modified) (59 diffs)
-
Big500users.html (modified) (49 diffs)
-
DMSMig.html (modified) (2 diffs)
-
DomApps.html (modified) (37 diffs)
-
ExNetworks.html (modified) (2 diffs)
-
HA.html (modified) (27 diffs)
-
RefSection.html (modified) (1 diff)
-
apa.html (modified) (21 diffs)
-
appendix.html (modified) (31 diffs)
-
ch14.html (modified) (7 diffs)
-
go01.html (modified) (1 diff)
-
happy.html (modified) (144 diffs)
-
index.html (modified) (1 diff)
-
ix01.html (modified) (1 diff)
-
kerberos.html (modified) (72 diffs)
-
ntmigration.html (modified) (43 diffs)
-
nw4migration.html (modified) (26 diffs)
-
pr01.html (modified) (1 diff)
-
pr02.html (modified) (1 diff)
-
pr03.html (modified) (1 diff)
-
preface.html (modified) (7 diffs)
-
primer.html (modified) (35 diffs)
-
secure.html (modified) (85 diffs)
-
simple.html (modified) (61 diffs)
-
small.html (modified) (46 diffs)
-
unixclients.html (modified) (89 diffs)
-
upgrades.html (modified) (51 diffs)
Legend:
- Unmodified
- Added
- Removed
-
branches/samba-3.2.x/docs/htmldocs/Samba3-ByExample/2000users.html
r204 r226 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 6. A Distributed 2000-User Network</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="happy.html" title="Chapter 5. Making Happy Users"><link rel="next" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 6. A Distributed 2000-User Network</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="happy.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="DMSMig.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="2000users"></a>Chapter 6. A Distributed 2000-User Network</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="2000users.html#id25768 74">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id2576904">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id2576972">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id2577245">Technical Issues</a></span></dt><dt><span class="sect2"><a href="2000users.html#id2578189">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id2578207">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id2581365">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id2581512">Questions and Answers</a></span></dt></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 6. A Distributed 2000-User Network</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="happy.html" title="Chapter 5. Making Happy Users"><link rel="next" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 6. A Distributed 2000-User Network</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="happy.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="DMSMig.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="2000users"></a>Chapter 6. A Distributed 2000-User Network</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="2000users.html#id2576869">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id2576899">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id2576967">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id2577240">Technical Issues</a></span></dt><dt><span class="sect2"><a href="2000users.html#id2578184">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id2578202">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id2581360">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id2581507">Questions and Answers</a></span></dt></dl></div><p> 2 2 There is something indeed mystical about things that are 3 3 big. Large networks exhibit a certain magnetism and exude a sense of … … 31 31 specifics of implementing LDAP changes, Samba changes, and approach and 32 32 design of the solution and its deployment. 33 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id25768 74"></a>Introduction</h2></div></div></div><p>33 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2576869"></a>Introduction</h2></div></div></div><p> 34 34 Abmas is a miracle company. Most businesses would have collapsed under 35 35 the weight of rapid expansion that this company has experienced. Samba … … 40 40 Samba server just to change the way your network should function. 41 41 </p><p> 42 <a class="indexterm" name="id25768 92"></a>42 <a class="indexterm" name="id2576888"></a> 43 43 Network growth is common to all organizations. In this exercise, 44 44 your preoccupation is with the mechanics of implementing Samba and 45 45 LDAP so that network users on each network segment can work 46 46 without impediment. 47 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2576 904"></a>Assignment Tasks</h3></div></div></div><p>47 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2576899"></a>Assignment Tasks</h3></div></div></div><p> 48 48 Starting with the configuration files for the server called 49 49 <code class="constant">MASSIVE</code> in <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>, you now deal with the … … 52 52 alternatives, and then design and implement a solution. 53 53 </p><p> 54 <a class="indexterm" name="id25769 32"></a>54 <a class="indexterm" name="id2576927"></a> 55 55 Remember, you have users based in London (UK), Los Angeles, 56 56 Washington. DC, and, three buildings in New York. A significant portion … … 73 73 DirectPointe. Your concern is server maintenance and third-level 74 74 support. Build a plan and show what must be done. 75 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id25769 72"></a>Dissection and Discussion</h2></div></div></div><p>76 <a class="indexterm" name="id25769 80"></a>77 <a class="indexterm" name="id257698 7"></a>75 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2576967"></a>Dissection and Discussion</h2></div></div></div><p> 76 <a class="indexterm" name="id2576975"></a> 77 <a class="indexterm" name="id2576982"></a> 78 78 In <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>, you implemented an LDAP server that provided the 79 79 <em class="parameter"><code>passdb backend</code></em> for the Samba servers. You … … 81 81 took control of network performance. 82 82 </p><p> 83 <a class="indexterm" name="id25770 12"></a>84 <a class="indexterm" name="id257701 8"></a>85 <a class="indexterm" name="id257702 5"></a>86 <a class="indexterm" name="id25770 32"></a>83 <a class="indexterm" name="id2577007"></a> 84 <a class="indexterm" name="id2577014"></a> 85 <a class="indexterm" name="id2577021"></a> 86 <a class="indexterm" name="id2577027"></a> 87 87 The implementation of an LDAP-based passdb backend (known as 88 88 <span class="emphasis"><em>ldapsam</em></span> in Samba parlance), or some form of database … … 97 97 managers. 98 98 </p><p> 99 <a class="indexterm" name="id25770 72"></a>100 <a class="indexterm" name="id257707 8"></a>99 <a class="indexterm" name="id2577067"></a> 100 <a class="indexterm" name="id2577073"></a> 101 101 The new <span class="emphasis"><em>tdbsam</em></span> facility supports functionality 102 102 that is similar to an <span class="emphasis"><em>ldapsam</em></span>, but the lack of … … 106 106 backend? Is support for these tools broken? Answers to these 107 107 questions require a bit of background.</p><p> 108 <a class="indexterm" name="id2577 102"></a>109 <a class="indexterm" name="id257710 9"></a>110 <a class="indexterm" name="id257711 5"></a>111 <a class="indexterm" name="id25771 22"></a>108 <a class="indexterm" name="id2577097"></a> 109 <a class="indexterm" name="id2577104"></a> 110 <a class="indexterm" name="id2577111"></a> 111 <a class="indexterm" name="id2577118"></a> 112 112 <span class="emphasis"><em>What is a directory?</em></span> A directory is a 113 113 collection of information regarding objects that can be accessed to … … 117 117 information is organized to facilitate read access rather than to 118 118 support transaction processing.</p><p> 119 <a class="indexterm" name="id25771 43"></a>120 <a class="indexterm" name="id25771 52"></a>121 <a class="indexterm" name="id257715 9"></a>122 <a class="indexterm" name="id257716 6"></a>119 <a class="indexterm" name="id2577138"></a> 120 <a class="indexterm" name="id2577148"></a> 121 <a class="indexterm" name="id2577155"></a> 122 <a class="indexterm" name="id2577161"></a> 123 123 The Lightweight Directory Access Protocol (LDAP) differs 124 124 considerably from a traditional database. It has a simple search … … 127 127 the data repository and for keeping all copies (slaves) in sync with 128 128 the master repository.</p><p> 129 <a class="indexterm" name="id25771 82"></a>130 <a class="indexterm" name="id257718 9"></a>131 <a class="indexterm" name="id257719 6"></a>129 <a class="indexterm" name="id2577177"></a> 130 <a class="indexterm" name="id2577184"></a> 131 <a class="indexterm" name="id2577191"></a> 132 132 Samba is a flexible and powerful file and print sharing 133 133 technology. It can use many external authentication sources and can be … … 137 137 avoid the proprietary implications of Microsoft Active Directory 138 138 naturally gravitate toward OpenLDAP.</p><p> 139 <a class="indexterm" name="id25772 13"></a>139 <a class="indexterm" name="id2577209"></a> 140 140 In <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>, you had to deal with a locally routed 141 141 network. All deployment concerns focused around making users happy, … … 148 148 access information globally. And you must make the network robust 149 149 enough so that it can sustain partial breakdown without causing loss of 150 productivity.</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id257724 5"></a>Technical Issues</h3></div></div></div><p>150 productivity.</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2577240"></a>Technical Issues</h3></div></div></div><p> 151 151 There are at least three areas that need to be addressed as you 152 152 approach the challenge of designing a network solution for the newly 153 153 expanded business: 154 </p><div class="itemizedlist"><ul type="disc"><li><p><a class="indexterm" name="id25772 61"></a>155 User needs such as mobility and data access</p></li><li><p>The nature of Windows networking protocols</p></li><li><p>Identity management infrastructure needs</p></li></ul></div><p>Let's look at each in turn.</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id257728 4"></a>User Needs</h4></div></div></div><p>154 </p><div class="itemizedlist"><ul type="disc"><li><p><a class="indexterm" name="id2577256"></a> 155 User needs such as mobility and data access</p></li><li><p>The nature of Windows networking protocols</p></li><li><p>Identity management infrastructure needs</p></li></ul></div><p>Let's look at each in turn.</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2577280"></a>User Needs</h4></div></div></div><p> 156 156 The new company has three divisions. Staff for each division are spread across 157 157 the company. Some staff are office-bound and some are mobile users. Mobile … … 164 164 off for reasons outside the scope of this discussion. 165 165 </p><p> 166 <a class="indexterm" name="id257730 9"></a>166 <a class="indexterm" name="id2577304"></a> 167 167 Decisions must be made regarding where data is to be stored, how it will be 168 168 replicated (if at all), and what the network bandwidth implications are. For … … 175 175 to the network. 176 176 </p><p> 177 <a class="indexterm" name="id257733 5"></a>178 <a class="indexterm" name="id257734 4"></a>177 <a class="indexterm" name="id2577330"></a> 178 <a class="indexterm" name="id2577340"></a> 179 179 No matter which way you look at this, the bandwidth requirements 180 180 for acceptable performance are substantial even if only 10 percent of … … 189 189 server to and from the client. 190 190 </p><p> 191 <a class="indexterm" name="id257736 6"></a>191 <a class="indexterm" name="id2577361"></a> 192 192 Obviously then, user needs and wide-area practicalities dictate the economic and 193 193 technical aspects of your network design as well as for standard operating procedures. 194 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id257737 8"></a>The Nature of Windows Networking Protocols</h4></div></div></div><p>195 <a class="indexterm" name="id257738 6"></a>194 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2577373"></a>The Nature of Windows Networking Protocols</h4></div></div></div><p> 195 <a class="indexterm" name="id2577382"></a> 196 196 Network logons that include roaming profile handling requires from 140 KB to 2 MB. 197 197 The inclusion of support for a minimal set of common desktop applications can push … … 201 201 part of a total service-level assurance program that might be implemented. 202 202 </p><p> 203 <a class="indexterm" name="id257740 7"></a>204 <a class="indexterm" name="id25774 14"></a>203 <a class="indexterm" name="id2577402"></a> 204 <a class="indexterm" name="id2577409"></a> 205 205 One way to reduce the network bandwidth impact of user logon 206 206 traffic is through folder redirection. In <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>, you … … 211 211 logon or logout. Redirected folders are analogous to network drive 212 212 connections. 213 </p><p><a class="indexterm" name="id25774 41"></a>213 </p><p><a class="indexterm" name="id2577437"></a> 214 214 Of course, network applications should only be run off 215 215 local application servers. As a general rule, even with 2 Mb/sec … … 218 218 server that is located in New York. 219 219 </p><p> 220 <a class="indexterm" name="id257745 6"></a>220 <a class="indexterm" name="id2577452"></a> 221 221 When network bandwidth becomes a precious commodity (that is most 222 222 of the time), there is a significant demand to understand network … … 227 227 the network, several important things must happen. 228 228 </p><div class="itemizedlist"><ul type="disc"><li><p> 229 <a class="indexterm" name="id257747 9"></a>229 <a class="indexterm" name="id2577474"></a> 230 230 The client obtains an IP address via DHCP. (DHCP is 231 231 necessary so that users can roam between offices.) 232 232 </p></li><li><p> 233 <a class="indexterm" name="id25774 92"></a>234 <a class="indexterm" name="id257749 9"></a>233 <a class="indexterm" name="id2577488"></a> 234 <a class="indexterm" name="id2577494"></a> 235 235 The client must register itself with the WINS and/or DNS server. 236 236 </p></li><li><p> 237 <a class="indexterm" name="id25775 11"></a>237 <a class="indexterm" name="id2577506"></a> 238 238 The client must locate the closest domain controller. 239 239 </p></li><li><p> … … 257 257 at the WINS server. 258 258 </p><p> 259 <a class="indexterm" name="id257755 8"></a>260 <a class="indexterm" name="id257756 5"></a><a class="indexterm" name="id2577574"></a>259 <a class="indexterm" name="id2577554"></a> 260 <a class="indexterm" name="id2577560"></a><a class="indexterm" name="id2577570"></a> 261 261 Given that the client is already a domain member, it then sends 262 262 a directed (Unicast) request to the WINS server seeking the list of 263 263 IP addresses for domain controllers (NetBIOS name type 0x1C). The 264 264 WINS server replies with the information requested.</p><p> 265 <a class="indexterm" name="id257758 9"></a>266 <a class="indexterm" name="id257759 8"></a>267 <a class="indexterm" name="id257760 5"></a>265 <a class="indexterm" name="id2577584"></a> 266 <a class="indexterm" name="id2577593"></a> 267 <a class="indexterm" name="id2577600"></a> 268 268 The client sends two netlogon mailslot broadcast requests 269 269 to the local network and to each of the IP addresses returned by … … 275 275 domain controllers. 276 276 </p><p> 277 <a class="indexterm" name="id25776 31"></a>278 <a class="indexterm" name="id25776 40"></a>279 <a class="indexterm" name="id257764 7"></a>277 <a class="indexterm" name="id2577626"></a> 278 <a class="indexterm" name="id2577635"></a> 279 <a class="indexterm" name="id2577642"></a> 280 280 The logon process begins with negotiation of the SMB/CIFS 281 281 protocols that are to be used; this is followed by an exchange of … … 288 288 local domain controllers fail or break? 289 289 </p><p> 290 <a class="indexterm" name="id257766 6"></a>291 <a class="indexterm" name="id25776 73"></a>292 <a class="indexterm" name="id25776 80"></a>293 <a class="indexterm" name="id257768 6"></a>290 <a class="indexterm" name="id2577662"></a> 291 <a class="indexterm" name="id2577668"></a> 292 <a class="indexterm" name="id2577675"></a> 293 <a class="indexterm" name="id2577682"></a> 294 294 Under most circumstances, the nearest domain controller 295 295 responds to the netlogon mailslot broadcast. The exception to this … … 300 300 domain controllers are by definition BDCs. 301 301 </p><p> 302 <a class="indexterm" name="id2577 704"></a>303 <a class="indexterm" name="id25777 10"></a>302 <a class="indexterm" name="id2577699"></a> 303 <a class="indexterm" name="id2577706"></a> 304 304 The provision of sufficient servers that are BDCs is an 305 305 important design factor. The second important design factor … … 307 307 data. That is the subject of the next section, which involves key 308 308 decisions regarding Identity Management facilities. 309 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id257772 5"></a>Identity Management Needs</h4></div></div></div><p>310 <a class="indexterm" name="id25777 33"></a>311 <a class="indexterm" name="id257773 9"></a>312 <a class="indexterm" name="id257774 6"></a>313 <a class="indexterm" name="id25777 53"></a>309 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2577720"></a>Identity Management Needs</h4></div></div></div><p> 310 <a class="indexterm" name="id2577728"></a> 311 <a class="indexterm" name="id2577735"></a> 312 <a class="indexterm" name="id2577742"></a> 313 <a class="indexterm" name="id2577748"></a> 314 314 Network managers recognize that in large organizations users 315 315 generally need to be given resource access based on needs, while … … 320 320 rights and privileges are allocated. 321 321 </p><p> 322 <a class="indexterm" name="id25777 70"></a>323 <a class="indexterm" name="id257777 7"></a>324 <a class="indexterm" name="id257778 4"></a>322 <a class="indexterm" name="id2577766"></a> 323 <a class="indexterm" name="id2577773"></a> 324 <a class="indexterm" name="id2577780"></a> 325 325 Unfortunately, network resources tend to have their own Identity 326 326 Management facilities, the quality and manageability of which varies … … 334 334 as <code class="constant">Network Information System</code> (NIS). 335 335 </p><p> 336 <a class="indexterm" name="id257781 5"></a>336 <a class="indexterm" name="id2577810"></a> 337 337 NIS gained a strong following throughout the UNIX/VMS space in a short 338 338 period of time and retained that appeal and use for over a decade. … … 344 344 other information systems is catching on. 345 345 </p><p> 346 <a class="indexterm" name="id257783 4"></a>347 <a class="indexterm" name="id25778 41"></a>348 <a class="indexterm" name="id257784 8"></a>346 <a class="indexterm" name="id2577830"></a> 347 <a class="indexterm" name="id2577836"></a> 348 <a class="indexterm" name="id2577843"></a> 349 349 Nevertheless, both NIS and NIS+ continue to hold ground in 350 350 business areas where UNIX still has major sway. Examples of … … 354 354 focus. 355 355 </p><p> 356 <a class="indexterm" name="id25778 63"></a>357 <a class="indexterm" name="id25778 70"></a>356 <a class="indexterm" name="id2577858"></a> 357 <a class="indexterm" name="id2577865"></a> 358 358 Today's networking world needs a scalable, distributed Identity 359 359 Management infrastructure, commonly called a directory. The most … … 361 361 and a number of LDAP implementations. 362 362 </p><p> 363 <a class="indexterm" name="id25778 84"></a>363 <a class="indexterm" name="id2577879"></a> 364 364 The problem of managing multiple directories has become a focal 365 365 point over the past decade, creating a large market for … … 370 370 having to remember and deal with fewer login identities and 371 371 passwords.</p><p> 372 <a class="indexterm" name="id2577 902"></a>372 <a class="indexterm" name="id2577897"></a> 373 373 The challenge of every large network is to find the optimum 374 374 balance of internal systems and facilities for Identity … … 376 376 implemented has potentially significant impact on network bandwidth 377 377 and systems response needs.</p><p> 378 <a class="indexterm" name="id257791 9"></a>379 <a class="indexterm" name="id257792 6"></a>380 <a class="indexterm" name="id257793 5"></a>378 <a class="indexterm" name="id2577914"></a> 379 <a class="indexterm" name="id2577921"></a> 380 <a class="indexterm" name="id2577930"></a> 381 381 In <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>, you implemented a single LDAP server for the 382 382 entire network. This may work for smaller networks, but almost … … 387 387 servers within the context of a distributed 2,000-user network is a 388 388 question that remains to be answered.</p><p> 389 <a class="indexterm" name="id257796 4"></a>390 <a class="indexterm" name="id25779 71"></a>389 <a class="indexterm" name="id2577960"></a> 390 <a class="indexterm" name="id2577966"></a> 391 391 One possibility that has great appeal is to create a single, 392 392 large distributed domain. The practical implications of this … … 399 399 maintenance. 400 400 </p><p> 401 <a class="indexterm" name="id257799 6"></a>401 <a class="indexterm" name="id2577991"></a> 402 402 The network design in <a class="link" href="2000users.html#chap7net2" title="Figure 6.7. Network Topology 2000 User Complex Design B">“Network Topology 2000 User Complex Design B”</a> takes the approach 403 403 that management of networks that are too remote to be managed … … 410 410 in how they may access global resources. 411 411 </p><p> 412 <a class="indexterm" name="id25780 22"></a>412 <a class="indexterm" name="id2578017"></a> 413 413 Desk-bound users need not be negatively affected by this design, since 414 414 the use of interdomain trusts can be used to satisfy the need for global 415 415 data sharing. 416 416 </p><p> 417 <a class="indexterm" name="id257803 4"></a>418 <a class="indexterm" name="id25780 41"></a>419 <a class="indexterm" name="id25780 50"></a>417 <a class="indexterm" name="id2578030"></a> 418 <a class="indexterm" name="id2578036"></a> 419 <a class="indexterm" name="id2578046"></a> 420 420 When Samba-3 is configured to use an LDAP backend, it stores the domain 421 421 account information in a directory entry. This account entry contains the … … 423 423 possible to operate with more than one PDC on a distributed network. 424 424 </p><p> 425 <a class="indexterm" name="id257806 5"></a>426 <a class="indexterm" name="id25780 72"></a>427 <a class="indexterm" name="id257807 9"></a>425 <a class="indexterm" name="id2578060"></a> 426 <a class="indexterm" name="id2578067"></a> 427 <a class="indexterm" name="id2578074"></a> 428 428 How might this peculiar feature be exploited? The answer is simple. It is 429 429 imperative that each network segment have its own WINS server. Major … … 435 435 single LDAP backend, users have unfettered ability to roam. 436 436 </p><p> 437 <a class="indexterm" name="id2578 104"></a>438 <a class="indexterm" name="id25781 13"></a>437 <a class="indexterm" name="id2578099"></a> 438 <a class="indexterm" name="id2578108"></a> 439 439 This concept has not been exhaustively validated, though we can see no reason 440 440 why this should not work. The important facets are the following: The name of … … 447 447 that are in fact slave LDAP servers on the local segments. 448 448 </p><p> 449 <a class="indexterm" name="id257813 5"></a>450 <a class="indexterm" name="id25781 44"></a>451 <a class="indexterm" name="id25781 51"></a>452 <a class="indexterm" name="id25781 60"></a>449 <a class="indexterm" name="id2578130"></a> 450 <a class="indexterm" name="id2578139"></a> 451 <a class="indexterm" name="id2578146"></a> 452 <a class="indexterm" name="id2578155"></a> 453 453 With a single master LDAP server, all network updates are effected on a single 454 454 server. In the event that this should become excessively fragile or network … … 464 464 procedures for managing the directory, because retroactive correction of 465 465 inconsistent directory information can be exceedingly difficult. 466 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id257818 9"></a>Political Issues</h3></div></div></div><p>466 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2578184"></a>Political Issues</h3></div></div></div><p> 467 467 As organizations grow, the number of points of control increases 468 468 also. In a large distributed organization, it is important that the … … 472 472 minutes rather than days (the old limitation of highly manual 473 473 systems). 474 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id257820 7"></a>Implementation</h2></div></div></div><p>475 <a class="indexterm" name="id257821 4"></a>476 <a class="indexterm" name="id25782 21"></a>477 <a class="indexterm" name="id257822 8"></a>478 <a class="indexterm" name="id257823 5"></a>474 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2578202"></a>Implementation</h2></div></div></div><p> 475 <a class="indexterm" name="id2578210"></a> 476 <a class="indexterm" name="id2578217"></a> 477 <a class="indexterm" name="id2578223"></a> 478 <a class="indexterm" name="id2578230"></a> 479 479 Samba-3 has the ability to use multiple password (authentication and 480 480 identity resolution) backends. The diagram in <a class="link" href="2000users.html#chap7idres" title="Figure 6.1. Samba and Authentication Backend Search Pathways">“Samba and Authentication Backend Search Pathways”</a> … … 484 484 using the specific systems shown. 485 485 </p><div class="figure"><a name="chap7idres"></a><p class="title"><b>Figure 6.1. Samba and Authentication Backend Search Pathways</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap7-idresol.png" width="297" alt="Samba and Authentication Backend Search Pathways"></div></div></div><br class="figure-break"><p> 486 <a class="indexterm" name="id257829 8"></a>487 <a class="indexterm" name="id257830 5"></a>488 <a class="indexterm" name="id25783 12"></a>489 <a class="indexterm" name="id257831 9"></a>490 <a class="indexterm" name="id257832 6"></a>491 <a class="indexterm" name="id25783 32"></a>492 <a class="indexterm" name="id257833 9"></a>486 <a class="indexterm" name="id2578294"></a> 487 <a class="indexterm" name="id2578300"></a> 488 <a class="indexterm" name="id2578307"></a> 489 <a class="indexterm" name="id2578314"></a> 490 <a class="indexterm" name="id2578321"></a> 491 <a class="indexterm" name="id2578328"></a> 492 <a class="indexterm" name="id2578335"></a> 493 493 Samba is capable of using the <code class="constant">smbpasswd</code>, 494 494 <code class="constant">tdbsam</code>, <code class="constant">xmlsam</code>, … … 498 498 operations. 499 499 </p><p> 500 <a class="indexterm" name="id257836 7"></a>500 <a class="indexterm" name="id2578363"></a> 501 501 Additionally, it is possible to use multiple passdb backends 502 502 concurrently as well as have multiple LDAP backends. As a result, you … … 510 510 This configuration tells Samba to use a single LDAP server, as shown in <a class="link" href="2000users.html#ch7singleLDAP" title="Figure 6.2. Samba Configuration to Use a Single LDAP Server">“Samba Configuration to Use a Single LDAP Server”</a>. 511 511 </p><div class="figure"><a name="ch7singleLDAP"></a><p class="title"><b>Figure 6.2. Samba Configuration to Use a Single LDAP Server</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/ch7-singleLDAP.png" width="351" alt="Samba Configuration to Use a Single LDAP Server"></div></div></div><p><br class="figure-break"> 512 <a class="indexterm" name="id25784 40"></a>513 <a class="indexterm" name="id257844 9"></a>512 <a class="indexterm" name="id2578436"></a> 513 <a class="indexterm" name="id2578445"></a> 514 514 The addition of a failover LDAP server can simply be done by adding a 515 515 second entry for the failover server to the single <em class="parameter"><code>ldapsam</code></em> … … 533 533 ... 534 534 </pre><p> 535 <a class="indexterm" name="id257853 6"></a>535 <a class="indexterm" name="id2578532"></a> 536 536 The effect of this style of entry is that Samba lists the users 537 537 that are in both LDAP databases. If both contain the same information, … … 554 554 pattern similar to what was covered in <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>. The following steps 555 555 permit the operation of a master/slave OpenLDAP arrangement. 556 </p><div class="procedure"><a name="id257867 8"></a><p class="title"><b>Procedure 6.1. Implementation Steps for an LDAP Slave Server</b></p><ol type="1"><li><p>557 <a class="indexterm" name="id25786 90"></a>558 <a class="indexterm" name="id257869 6"></a>556 </p><div class="procedure"><a name="id2578674"></a><p class="title"><b>Procedure 6.1. Implementation Steps for an LDAP Slave Server</b></p><ol type="1"><li><p> 557 <a class="indexterm" name="id2578685"></a> 558 <a class="indexterm" name="id2578692"></a> 559 559 Log onto the master LDAP server as <code class="constant">root</code>. 560 560 You are about to change the configuration of the LDAP server, so it … … 569 569 </pre><p> 570 570 </p></li><li><p> 571 <a class="indexterm" name="id25787 42"></a>571 <a class="indexterm" name="id2578737"></a> 572 572 Edit the <code class="filename">/etc/openldap/slapd.conf</code> file so it 573 573 matches the content of <a class="link" href="2000users.html#ch7-LDAP-master" title="Example 6.1. LDAP Master Server Configuration File /etc/openldap/slapd.conf">“LDAP Master Server Configuration File /etc/openldap/slapd.conf”</a>. … … 593 593 </pre><p> 594 594 </p></li><li><p> 595 <a class="indexterm" name="id257881 5"></a>596 <a class="indexterm" name="id25788 22"></a>595 <a class="indexterm" name="id2578811"></a> 596 <a class="indexterm" name="id2578818"></a> 597 597 Change directory to a suitable place to dump the contents of the 598 598 LDAP server. The dump file (and LDIF file) is used to preload … … 603 603 Each record is written to the file. 604 604 </p></li><li><p> 605 <a class="indexterm" name="id257885 4"></a>605 <a class="indexterm" name="id2578850"></a> 606 606 Copy the file <code class="filename">LDAP-transfer-LDIF.txt</code> to the intended 607 607 slave LDAP server. A good location could be in the directory … … 653 653 </pre><p> 654 654 </p></li><li><p> 655 <a class="indexterm" name="id257902 8"></a>656 <a class="indexterm" name="id257903 4"></a>657 <a class="indexterm" name="id25790 41"></a>655 <a class="indexterm" name="id2579023"></a> 656 <a class="indexterm" name="id2579030"></a> 657 <a class="indexterm" name="id2579037"></a> 658 658 Go back to the master LDAP server. Execute the following to start LDAP as well 659 659 as <code class="literal">slurpd</code>, the synchronization daemon, as shown here: … … 664 664 <code class="prompt">root# </code> chkconfig slurpd on 665 665 </pre><p> 666 <a class="indexterm" name="id257908 7"></a>666 <a class="indexterm" name="id2579082"></a> 667 667 On Red Hat Linux, check the equivalent command to start <code class="literal">slurpd</code>. 668 668 </p></li><li><p> 669 <a class="indexterm" name="id257910 7"></a>669 <a class="indexterm" name="id2579102"></a> 670 670 On the master LDAP server you may now add an account to validate that replication 671 671 is working. Assuming the configuration shown in <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>, execute: … … 792 792 index sambaDomainName eq 793 793 index default sub 794 </pre></div></div><br class="example-break"><div class="example"><a name="ch7-massmbconfA"></a><p class="title"><b>Example 6.3. Primary Domain Controller <code class="filename">smb.conf</code> File Part A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id25793 71"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id2579383"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id2579395"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2579407"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2579419"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2579431"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2579442"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2579454"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2579466"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2579477"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2579489"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2579501"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2579513"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2579525"></a><em class="parameter"><code>delete user script = /opt/IDEALX/sbin/smbldap-userdel '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2579538"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd -p '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2579550"></a><em class="parameter"><code>delete group script = /opt/IDEALX/sbin/smbldap-groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2579563"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/smbldap-groupmod -m '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2579576"></a><em class="parameter"><code>delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2579589"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2579601"></a><em class="parameter"><code>add machine script = /opt/IDEALX/sbin/smbldap-useradd -w '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2579614"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id2579626"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id2579639"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2579651"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2579662"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2579674"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2579686"></a><em class="parameter"><code>domain master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2579698"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2579709"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2579721"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2579733"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2579745"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2579757"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2579769"></a><em class="parameter"><code>ldap admin dn = cn=sambaadmin,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2579781"></a><em class="parameter"><code>idmap backend = ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2579794"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2579805"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2579817"></a><em class="parameter"><code>printer admin = root</code></em></td></tr><tr><td><a class="indexterm" name="id2579829"></a><em class="parameter"><code>printing = cups</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-massmbconfB"></a><p class="title"><b>Example 6.4. Primary Domain Controller <code class="filename">smb.conf</code> File Part B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[IPC$]</code></em></td></tr><tr><td><a class="indexterm" name="id2579874"></a><em class="parameter"><code>path = /tmp</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id2579895"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id2579906"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id2579918"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id2579938"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id2579950"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id2579962"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id2579982"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id2579994"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id2580006"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2580026"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2580038"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2580050"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2580061"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2580082"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2580094"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2580105"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2580117"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2580129"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-massmbconfC"></a><p class="title"><b>Example 6.5. Primary Domain Controller <code class="filename">smb.conf</code> File Part C</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id2580174"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id2580186"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id2580197"></a><em class="parameter"><code>admin users = bjones</code></em></td></tr><tr><td><a class="indexterm" name="id2580209"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2580230"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2580242"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2580253"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id2580265"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2580277"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2580297"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2580309"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2580321"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2580333"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id2580353"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id2580365"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id2580377"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2580389"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id2580409"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2580421"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2580433"></a><em class="parameter"><code>write list = root</code></em></td></tr><tr><td><a class="indexterm" name="id2580444"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-slvsmbocnfA"></a><p class="title"><b>Example 6.6. Backup Domain Controller <code class="filename">smb.conf</code> File Part A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># # Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2580494"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id2580505"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id2580517"></a><em class="parameter"><code>netbios name = BLDG1</code></em></td></tr><tr><td><a class="indexterm" name="id2580529"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://lapdc.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2580541"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2580553"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2580565"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2580576"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2580588"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id2580600"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2580612"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2580624"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2580636"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2580648"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2580660"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2580672"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2580683"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2580695"></a><em class="parameter"><code>os level = 63</code></em></td></tr><tr><td><a class="indexterm" name="id2580706"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id2580718"></a><em class="parameter"><code>wins server = 192.168.2.1</code></em></td></tr><tr><td><a class="indexterm" name="id2580730"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2580742"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2580754"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2580766"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2580778"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2580790"></a><em class="parameter"><code>ldap admin dn = cn=sambaadmin,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2580802"></a><em class="parameter"><code>utmp = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2580814"></a><em class="parameter"><code>idmap backend = ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2580826"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2580837"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2580849"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id2580870"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id2580881"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id2580893"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id2580914"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id2580926"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id2580937"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-slvsmbocnfB"></a><p class="title"><b>Example 6.7. Backup Domain Controller <code class="filename">smb.conf</code> File Part B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id2580983"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id2580995"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id2581006"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2581027"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2581038"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2581050"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2581062"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2581082"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2581094"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2581106"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2581117"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2581129"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id2581149"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id2581161"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id2581173"></a><em class="parameter"><code>admin users = bjones</code></em></td></tr><tr><td><a class="indexterm" name="id2581184"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2581205"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2581217"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2581229"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2581240"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2581261"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2581273"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2581284"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2581296"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id2581317"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id2581329"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id2581340"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2581352"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2581365"></a>Key Points Learned</h3></div></div></div><div class="itemizedlist"><ul type="disc"><li><p>795 <a class="indexterm" name="id258137 6"></a><a class="indexterm" name="id2581382"></a>794 </pre></div></div><br class="example-break"><div class="example"><a name="ch7-massmbconfA"></a><p class="title"><b>Example 6.3. Primary Domain Controller <code class="filename">smb.conf</code> File Part A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2579366"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id2579378"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id2579390"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2579402"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2579414"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2579426"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2579437"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2579449"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2579461"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2579473"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2579485"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2579496"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2579508"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2579521"></a><em class="parameter"><code>delete user script = /opt/IDEALX/sbin/smbldap-userdel '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2579533"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd -p '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2579546"></a><em class="parameter"><code>delete group script = /opt/IDEALX/sbin/smbldap-groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2579558"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/smbldap-groupmod -m '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2579571"></a><em class="parameter"><code>delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2579584"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2579597"></a><em class="parameter"><code>add machine script = /opt/IDEALX/sbin/smbldap-useradd -w '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2579609"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id2579622"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id2579634"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2579646"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2579658"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2579669"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2579681"></a><em class="parameter"><code>domain master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2579693"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2579705"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2579716"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2579728"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2579740"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2579752"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2579764"></a><em class="parameter"><code>ldap admin dn = cn=sambaadmin,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2579777"></a><em class="parameter"><code>idmap backend = ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2579789"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2579801"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2579812"></a><em class="parameter"><code>printer admin = root</code></em></td></tr><tr><td><a class="indexterm" name="id2579824"></a><em class="parameter"><code>printing = cups</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-massmbconfB"></a><p class="title"><b>Example 6.4. Primary Domain Controller <code class="filename">smb.conf</code> File Part B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[IPC$]</code></em></td></tr><tr><td><a class="indexterm" name="id2579870"></a><em class="parameter"><code>path = /tmp</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id2579890"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id2579902"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id2579914"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id2579934"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id2579946"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id2579957"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id2579978"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id2579990"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id2580001"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2580022"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2580034"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2580045"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2580057"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2580077"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2580089"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2580101"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2580112"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2580124"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-massmbconfC"></a><p class="title"><b>Example 6.5. Primary Domain Controller <code class="filename">smb.conf</code> File Part C</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id2580170"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id2580182"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id2580193"></a><em class="parameter"><code>admin users = bjones</code></em></td></tr><tr><td><a class="indexterm" name="id2580204"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2580225"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2580237"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2580249"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id2580261"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2580272"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2580293"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2580304"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2580316"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2580328"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id2580349"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id2580360"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id2580372"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2580384"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id2580405"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2580416"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2580428"></a><em class="parameter"><code>write list = root</code></em></td></tr><tr><td><a class="indexterm" name="id2580440"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-slvsmbocnfA"></a><p class="title"><b>Example 6.6. Backup Domain Controller <code class="filename">smb.conf</code> File Part A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># # Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2580489"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id2580501"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id2580512"></a><em class="parameter"><code>netbios name = BLDG1</code></em></td></tr><tr><td><a class="indexterm" name="id2580524"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://lapdc.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2580537"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2580549"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2580560"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2580572"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2580584"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id2580595"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2580607"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2580619"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2580631"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2580643"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2580655"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2580667"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2580678"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2580690"></a><em class="parameter"><code>os level = 63</code></em></td></tr><tr><td><a class="indexterm" name="id2580702"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id2580714"></a><em class="parameter"><code>wins server = 192.168.2.1</code></em></td></tr><tr><td><a class="indexterm" name="id2580725"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2580737"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2580749"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2580761"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2580773"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2580785"></a><em class="parameter"><code>ldap admin dn = cn=sambaadmin,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2580797"></a><em class="parameter"><code>utmp = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2580809"></a><em class="parameter"><code>idmap backend = ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2580821"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2580833"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2580844"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id2580865"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id2580877"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id2580888"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id2580909"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id2580921"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id2580933"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-slvsmbocnfB"></a><p class="title"><b>Example 6.7. Backup Domain Controller <code class="filename">smb.conf</code> File Part B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id2580978"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id2580990"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id2581002"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2581022"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2581034"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2581045"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2581057"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2581078"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2581089"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2581101"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2581113"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2581124"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id2581145"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id2581156"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id2581168"></a><em class="parameter"><code>admin users = bjones</code></em></td></tr><tr><td><a class="indexterm" name="id2581180"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2581200"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2581212"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2581224"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2581236"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2581256"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2581268"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2581280"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2581291"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id2581312"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id2581324"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id2581336"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2581347"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2581360"></a>Key Points Learned</h3></div></div></div><div class="itemizedlist"><ul type="disc"><li><p> 795 <a class="indexterm" name="id2581371"></a><a class="indexterm" name="id2581377"></a> 796 796 Where Samba-3 is used as a domain controller, the use of LDAP is an 797 797 essential component to permit the use of BDCs. 798 798 </p></li><li><p> 799 <a class="indexterm" name="id258139 5"></a>799 <a class="indexterm" name="id2581390"></a> 800 800 Replication of the LDAP master server to create a network of BDCs 801 801 is an important mechanism for limiting WAN traffic. … … 809 809 departure from this may clog wide-area arteries and slow legitimate network 810 810 traffic to a crawl. 811 </p></li></ul></div></div><div class="figure"><a name="chap7net"></a><p class="title"><b>Figure 6.6. Network Topology 2000 User Complex Design A</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap7-net-Ar.png" width="432" alt="Network Topology 2000 User Complex Design A"></div></div></div><br class="figure-break"><div class="figure"><a name="chap7net2"></a><p class="title"><b>Figure 6.7. Network Topology 2000 User Complex Design B</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap7-net2-Br.png" width="432" alt="Network Topology 2000 User Complex Design B"></div></div></div><br class="figure-break"></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id25815 12"></a>Questions and Answers</h2></div></div></div><p>811 </p></li></ul></div></div><div class="figure"><a name="chap7net"></a><p class="title"><b>Figure 6.6. Network Topology 2000 User Complex Design A</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap7-net-Ar.png" width="432" alt="Network Topology 2000 User Complex Design A"></div></div></div><br class="figure-break"><div class="figure"><a name="chap7net2"></a><p class="title"><b>Figure 6.7. Network Topology 2000 User Complex Design B</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap7-net2-Br.png" width="432" alt="Network Topology 2000 User Complex Design B"></div></div></div><br class="figure-break"></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2581507"></a>Questions and Answers</h2></div></div></div><p> 812 812 There is much rumor and misinformation regarding the use of MS Windows networking protocols. 813 813 These questions are just a few of those frequently asked. 814 </p><div class="qandaset"><dl><dt> <a href="2000users.html#id25815 30">814 </p><div class="qandaset"><dl><dt> <a href="2000users.html#id2581526"> 815 815 816 816 817 817 Is it true that DHCP uses lots of WAN bandwidth? 818 </a></dt><dt> <a href="2000users.html#id258166 5">818 </a></dt><dt> <a href="2000users.html#id2581660"> 819 819 820 820 821 821 How much background communication takes place between a master LDAP server and its slave LDAP servers? 822 </a></dt><dt> <a href="2000users.html#id258172 6">822 </a></dt><dt> <a href="2000users.html#id2581721"> 823 823 LDAP has a database. Is LDAP not just a fancy database front end? 824 </a></dt><dt> <a href="2000users.html#id25817 90">824 </a></dt><dt> <a href="2000users.html#id2581785"> 825 825 826 826 Can Active Directory obtain account information from an OpenLDAP server? 827 </a></dt><dt> <a href="2000users.html#id258182 6">827 </a></dt><dt> <a href="2000users.html#id2581821"> 828 828 What are the parts of a roaming profile? How large is each part? 829 </a></dt><dt> <a href="2000users.html#id25819 74">829 </a></dt><dt> <a href="2000users.html#id2581969"> 830 830 Can the My Documents folder be stored on a network drive? 831 </a></dt><dt> <a href="2000users.html#id25820 22">831 </a></dt><dt> <a href="2000users.html#id2582017"> 832 832 833 833 834 834 835 835 How much WAN bandwidth does WINS consume? 836 </a></dt><dt> <a href="2000users.html#id258210 6">836 </a></dt><dt> <a href="2000users.html#id2582101"> 837 837 How many BDCs should I have? What is the right number of Windows clients per server? 838 </a></dt><dt> <a href="2000users.html#id25821 42">838 </a></dt><dt> <a href="2000users.html#id2582137"> 839 839 840 840 I've heard that you can store NIS accounts in LDAP. Is LDAP not just a smarter way to 841 841 run an NIS server? 842 </a></dt><dt> <a href="2000users.html#id258217 6">842 </a></dt><dt> <a href="2000users.html#id2582171"> 843 843 Can I use NIS in place of LDAP? 844 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id25815 30"></a><a name="id2581533"></a></td><td align="left" valign="top"><p>845 <a class="indexterm" name="id258153 7"></a>846 <a class="indexterm" name="id25815 44"></a>844 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2581526"></a><a name="id2581528"></a></td><td align="left" valign="top"><p> 845 <a class="indexterm" name="id2581532"></a> 846 <a class="indexterm" name="id2581539"></a> 847 847 Is it true that DHCP uses lots of WAN bandwidth? 848 848 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 849 <a class="indexterm" name="id25815 60"></a>850 <a class="indexterm" name="id25815 70"></a>851 <a class="indexterm" name="id258157 6"></a>849 <a class="indexterm" name="id2581556"></a> 850 <a class="indexterm" name="id2581565"></a> 851 <a class="indexterm" name="id2581572"></a> 852 852 It is a smart practice to localize DHCP servers on each network segment. As a 853 853 rule, there should be two DHCP servers per network segment. This means that if … … 856 856 routers. This makes it possible to run fewer DHCP servers. 857 857 </p><p> 858 <a class="indexterm" name="id258159 5"></a>859 <a class="indexterm" name="id258160 5"></a>858 <a class="indexterm" name="id2581591"></a> 859 <a class="indexterm" name="id2581600"></a> 860 860 A DHCP network address request and confirmation usually results in about six UDP packets. 861 861 The packets are from 60 to 568 bytes in length. Let us consider a site that has 300 DHCP … … 875 875 From this can be seen that the traffic impact would be minimal. 876 876 </p><p> 877 <a class="indexterm" name="id25816 42"></a>878 <a class="indexterm" name="id25816 51"></a>877 <a class="indexterm" name="id2581638"></a> 878 <a class="indexterm" name="id2581646"></a> 879 879 Even when DHCP is configured to do DNS update (dynamic DNS) over a wide-area link, 880 880 the impact of the update is no more than the DHCP IP address renewal traffic and thus 881 881 still insignificant for most practical purposes. 882 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id258166 5"></a><a name="id2581667"></a></td><td align="left" valign="top"><p>883 <a class="indexterm" name="id25816 71"></a>884 <a class="indexterm" name="id258167 8"></a>882 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2581660"></a><a name="id2581662"></a></td><td align="left" valign="top"><p> 883 <a class="indexterm" name="id2581667"></a> 884 <a class="indexterm" name="id2581674"></a> 885 885 How much background communication takes place between a master LDAP server and its slave LDAP servers? 886 886 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 887 <a class="indexterm" name="id258169 9"></a>887 <a class="indexterm" name="id2581694"></a> 888 888 The process that controls the replication of data from the master LDAP server to the slave LDAP 889 889 servers is called <code class="literal">slurpd</code>. The <code class="literal">slurpd</code> remains nascent (quiet) 890 890 until an update must be propagated. The propagation traffic per LDAP slave to update (add/modify/delete) 891 891 two user accounts requires less than 10KB traffic. 892 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id258172 6"></a><a name="id2581728"></a></td><td align="left" valign="top"><p>892 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2581721"></a><a name="id2581723"></a></td><td align="left" valign="top"><p> 893 893 LDAP has a database. Is LDAP not just a fancy database front end? 894 894 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 895 <a class="indexterm" name="id25817 40"></a>896 <a class="indexterm" name="id258174 7"></a>897 <a class="indexterm" name="id258175 6"></a>898 <a class="indexterm" name="id25817 63"></a>895 <a class="indexterm" name="id2581735"></a> 896 <a class="indexterm" name="id2581742"></a> 897 <a class="indexterm" name="id2581751"></a> 898 <a class="indexterm" name="id2581758"></a> 899 899 LDAP does store its data in a database of sorts. In fact, the LDAP backend is an application-specific 900 900 data storage system. This type of database is indexed so that records can be rapidly located, but the … … 905 905 An LDAP front end is a purpose-built tool that has a search orientation that is designed around specific 906 906 simple queries. The term <code class="constant">database</code> is heavily overloaded and thus much misunderstood. 907 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id25817 90"></a><a name="id2581792"></a></td><td align="left" valign="top"><p>908 <a class="indexterm" name="id258179 6"></a>907 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2581785"></a><a name="id2581787"></a></td><td align="left" valign="top"><p> 908 <a class="indexterm" name="id2581792"></a> 909 909 Can Active Directory obtain account information from an OpenLDAP server? 910 910 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 911 <a class="indexterm" name="id25818 11"></a>911 <a class="indexterm" name="id2581806"></a> 912 912 No, at least not directly. It is possible to provision Active Directory from and/or to an OpenLDAP 913 913 database through use of a metadirectory server. Microsoft MMS (now called MIIS) can interface 914 914 to OpenLDAP using standard LDAP queries and updates. 915 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id258182 6"></a><a name="id2581828"></a></td><td align="left" valign="top"><p>915 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2581821"></a><a name="id2581823"></a></td><td align="left" valign="top"><p> 916 916 What are the parts of a roaming profile? How large is each part? 917 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id258183 9"></a>917 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2581834"></a> 918 918 A roaming profile consists of 919 919 </p><div class="itemizedlist"><ul type="disc"><li><p> … … 923 923 <code class="constant">Local Settings,</code> and more. See <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>, <a class="link" href="happy.html#XP-screen001" title="Figure 5.3. Windows XP Professional User Shared Folders">“Windows XP Professional User Shared Folders”</a>. 924 924 </p><p> 925 <a class="indexterm" name="id2581 900"></a>925 <a class="indexterm" name="id2581895"></a> 926 926 Each of these can be anywhere from a few bytes to gigabytes in capacity. Fortunately, all 927 927 such folders can be redirected to network drive resources. See <a class="link" href="happy.html#redirfold" title="Configuration of Default Profile with Folder Redirection">“Configuration of Default Profile with Folder Redirection”</a> … … 930 930 A static or rewritable portion that is typically only a few files (2-5 KB of information). 931 931 </p></li><li><p> 932 <a class="indexterm" name="id258192 6"></a>933 <a class="indexterm" name="id25819 32"></a>932 <a class="indexterm" name="id2581921"></a> 933 <a class="indexterm" name="id2581928"></a> 934 934 The registry load file that modifies the <code class="constant">HKEY_LOCAL_USER</code> hive. This is 935 935 the <code class="filename">NTUSER.DAT</code> file. It can be from 0.4 to 1.5 MB. 936 936 </p></li></ul></div><p> 937 <a class="indexterm" name="id258195 5"></a>937 <a class="indexterm" name="id2581951"></a> 938 938 Microsoft Outlook PST files may be stored in the <code class="constant">Local Settings\Application Data</code> 939 939 folder. It can be up to 2 GB in size per PST file. 940 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id25819 74"></a><a name="id2581976"></a></td><td align="left" valign="top"><p>940 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2581969"></a><a name="id2581971"></a></td><td align="left" valign="top"><p> 941 941 Can the <code class="constant">My Documents</code> folder be stored on a network drive? 942 942 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 943 <a class="indexterm" name="id25819 91"></a>944 <a class="indexterm" name="id258199 8"></a>943 <a class="indexterm" name="id2581987"></a> 944 <a class="indexterm" name="id2581993"></a> 945 945 Yes. More correctly, such folders can be redirected to network shares. No specific network drive 946 946 connection is required. Registry settings permit this to be redirected directly to a UNC (Universal 947 947 Naming Convention) resource, though it is possible to specify a network drive letter instead of a 948 948 UNC name. See <a class="link" href="happy.html#redirfold" title="Configuration of Default Profile with Folder Redirection">“Configuration of Default Profile with Folder Redirection”</a>. 949 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id25820 22"></a><a name="id2582024"></a></td><td align="left" valign="top"><p>950 <a class="indexterm" name="id258202 8"></a>951 <a class="indexterm" name="id258203 5"></a>952 <a class="indexterm" name="id258204 4"></a>949 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2582017"></a><a name="id2582019"></a></td><td align="left" valign="top"><p> 950 <a class="indexterm" name="id2582024"></a> 951 <a class="indexterm" name="id2582030"></a> 952 <a class="indexterm" name="id2582040"></a> 953 953 How much WAN bandwidth does WINS consume? 954 954 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 955 <a class="indexterm" name="id258205 8"></a>956 <a class="indexterm" name="id258206 8"></a>957 <a class="indexterm" name="id258207 4"></a>955 <a class="indexterm" name="id2582054"></a> 956 <a class="indexterm" name="id2582063"></a> 957 <a class="indexterm" name="id2582070"></a> 958 958 MS Windows clients cache information obtained from WINS lookups in a local NetBIOS name cache. 959 959 This keeps WINS lookups to a minimum. On a network with 3500 MS Windows clients and a central WINS … … 967 967 In conclusion, the total load afforded through WINS traffic is again marginal to total operational 968 968 usage as it should be. 969 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id258210 6"></a><a name="id2582108"></a></td><td align="left" valign="top"><p>969 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2582101"></a><a name="id2582103"></a></td><td align="left" valign="top"><p> 970 970 How many BDCs should I have? What is the right number of Windows clients per server? 971 971 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 981 981 As unsatisfactory as the answer might sound, it all depends on network and server load 982 982 characteristics. 983 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id25821 42"></a><a name="id2582144"></a></td><td align="left" valign="top"><p>984 <a class="indexterm" name="id258214 8"></a><a class="indexterm" name="id2582154"></a>983 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2582137"></a><a name="id2582139"></a></td><td align="left" valign="top"><p> 984 <a class="indexterm" name="id2582144"></a><a class="indexterm" name="id2582149"></a> 985 985 I've heard that you can store NIS accounts in LDAP. Is LDAP not just a smarter way to 986 986 run an NIS server? … … 989 989 a configurable schema that can store far more information for many more purposes than 990 990 just NIS. 991 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id258217 6"></a><a name="id2582178"></a></td><td align="left" valign="top"><p>991 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2582171"></a><a name="id2582173"></a></td><td align="left" valign="top"><p> 992 992 Can I use NIS in place of LDAP? 993 993 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 994 <a class="indexterm" name="id258218 9"></a>995 <a class="indexterm" name="id258219 6"></a>994 <a class="indexterm" name="id2582185"></a> 995 <a class="indexterm" name="id2582191"></a> 996 996 No. The NIS database does not have provision to store Microsoft encrypted passwords and does not deal 997 997 with the types of data necessary for interoperability with Microsoft Windows networking. The use -
branches/samba-3.2.x/docs/htmldocs/Samba3-ByExample/Big500users.html
r204 r226 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 4. The 500-User Office</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="secure.html" title="Chapter 3. Secure Office Networking"><link rel="next" href="happy.html" title="Chapter 5. Making Happy Users"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 4. The 500-User Office</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="secure.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="happy.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="Big500users"></a>Chapter 4. The 500-User Office</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="Big500users.html#id25583 52">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id2558397">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id2558503">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id2558539">Technical Issues</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2558741">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id2558764">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#ch5-dnshcp-setup">Installation of DHCP, DNS, and Samba Control Files</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2559494">Server Preparation: All Servers</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2560058">Server-Specific Preparation</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5-procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2563258">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id2563317">Questions and Answers</a></span></dt></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 4. The 500-User Office</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="secure.html" title="Chapter 3. Secure Office Networking"><link rel="next" href="happy.html" title="Chapter 5. Making Happy Users"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 4. The 500-User Office</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="secure.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="happy.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="Big500users"></a>Chapter 4. The 500-User Office</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="Big500users.html#id2558348">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id2558393">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id2558499">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id2558534">Technical Issues</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2558737">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id2558760">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#ch5-dnshcp-setup">Installation of DHCP, DNS, and Samba Control Files</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2559489">Server Preparation: All Servers</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2560054">Server-Specific Preparation</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5-procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2563254">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id2563312">Questions and Answers</a></span></dt></dl></div><p> 2 2 The Samba-3 networking you explored in <a class="link" href="secure.html" title="Chapter 3. Secure Office Networking">“Secure Office Networking”</a> covers the finer points of 3 3 configuration of peripheral services such as DHCP and DNS, and WINS. You experienced … … 18 18 to make printing more complex for the administrator while making it easier for the user. 19 19 </p><p> 20 <a class="indexterm" name="id255828 8"></a>21 <a class="indexterm" name="id255829 5"></a>22 <a class="indexterm" name="id2558 302"></a>20 <a class="indexterm" name="id2558284"></a> 21 <a class="indexterm" name="id2558290"></a> 22 <a class="indexterm" name="id2558297"></a> 23 23 <a class="link" href="secure.html" title="Chapter 3. Secure Office Networking">“Secure Office Networking”</a> demonstrates operation of a DHCP server and a DNS server 24 24 as well as a central WINS server. You validated the operation of these services and … … 42 42 You should take the opportunity to innovate and expand on the methods presented 43 43 here and explore them to the fullest. 44 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id25583 52"></a>Introduction</h2></div></div></div><p>44 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2558348"></a>Introduction</h2></div></div></div><p> 45 45 Business continues to go well for Abmas. Mr. Meany is driving your success and the 46 46 network continues to grow thanks to the hard work Christine has done. You recently … … 67 67 it is rolled out. Your strategy is to complete the new network so that it 68 68 is ready for operation when the old office moves into the new premises. 69 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id255839 7"></a>Assignment Tasks</h3></div></div></div><p>69 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2558393"></a>Assignment Tasks</h3></div></div></div><p> 70 70 The acquired business had 280 network users. The old Abmas building housed 71 71 220 network users in unbelievably cramped conditions. The network that … … 108 108 every four months. They automatically roll that out to each desktop system. 109 109 You must keep DirectPointe informed of all changes. 110 </p><p><a class="indexterm" name="id255847 5"></a>110 </p><p><a class="indexterm" name="id2558470"></a> 111 111 The new network has a single Samba Primary Domain Controller (PDC) located in the 112 112 Network Operation Center (NOC). Buildings 1 and 2 each have a local server … … 116 116 Printing is based on raw pass-through facilities just as it has been used so far. 117 117 All printer drivers are installed on the desktop and notebook computers. 118 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2558 503"></a>Dissection and Discussion</h2></div></div></div><p>119 <a class="indexterm" name="id25585 11"></a>118 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2558499"></a>Dissection and Discussion</h2></div></div></div><p> 119 <a class="indexterm" name="id2558507"></a> 120 120 The example you are building in this chapter is of a network design that works, but this 121 121 does not make it a design that is recommended. As a general rule, there should be at least … … 128 128 controller. This is not a good omen for user satisfaction. You, of course, address this 129 129 very soon (see <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>). 130 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id255853 9"></a>Technical Issues</h3></div></div></div><p>130 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2558534"></a>Technical Issues</h3></div></div></div><p> 131 131 Stan has talked you into a horrible compromise, but it is addressed. Just make 132 132 certain that the performance of this network is well validated before going live. … … 134 134 Design decisions made in this design include the following: 135 135 </p><div class="itemizedlist"><ul type="disc"><li><p> 136 <a class="indexterm" name="id25585 60"></a>137 <a class="indexterm" name="id255856 7"></a>138 <a class="indexterm" name="id25585 74"></a>136 <a class="indexterm" name="id2558556"></a> 137 <a class="indexterm" name="id2558562"></a> 138 <a class="indexterm" name="id2558569"></a> 139 139 A single PDC is being implemented. This limitation is based on the choice not to 140 140 use LDAP. Many network administrators fear using LDAP because of the perceived … … 142 142 identity management as well as to store network access credentials. 143 143 </p></li><li><p> 144 <a class="indexterm" name="id25585 90"></a>145 <a class="indexterm" name="id255859 7"></a>144 <a class="indexterm" name="id2558586"></a> 145 <a class="indexterm" name="id2558592"></a> 146 146 Because of the refusal to use an LDAP (ldapsam) passdb backend at this time, the 147 147 only choice that makes sense with 500 users is to use the tdbsam passwd backend. … … 157 157 integrity of operations considerations. 158 158 </p></li><li><p> 159 <a class="indexterm" name="id255863 8"></a>159 <a class="indexterm" name="id2558633"></a> 160 160 A single central WINS server is being used. The PDC is also the WINS server. 161 161 Any attempt to operate a routed network without a WINS server while using NetBIOS … … 168 168 why a single WINS server is being implemented. This should work without a problem. 169 169 </p></li><li><p> 170 <a class="indexterm" name="id255867 5"></a>170 <a class="indexterm" name="id2558670"></a> 171 171 BDCs make use of <code class="literal">winbindd</code> to provide 172 172 access to domain security credentials for file system access and object storage. 173 173 </p></li><li><p> 174 <a class="indexterm" name="id25586 94"></a>175 <a class="indexterm" name="id2558 703"></a>174 <a class="indexterm" name="id2558689"></a> 175 <a class="indexterm" name="id2558698"></a> 176 176 Configuration of Windows XP Professional clients is achieved using DHCP. Each 177 177 subnet has its own DHCP server. Backup DHCP serving is provided by one … … 189 189 each subnet. If in the future more addresses are required, it would make sense 190 190 to add further subnets rather than change addressing. 191 </p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id25587 41"></a>Political Issues</h3></div></div></div><p>191 </p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2558737"></a>Political Issues</h3></div></div></div><p> 192 192 This case gets close to the real world. You and I know the right way to implement 193 193 domain control. Politically, we have to navigate a minefield. In this case, the need is to … … 195 195 by having the real solution ready before it is needed. That real solution is presented in 196 196 <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>. 197 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id255876 4"></a>Implementation</h2></div></div></div><p>197 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2558760"></a>Implementation</h2></div></div></div><p> 198 198 The following configuration process begins following installation of Red Hat Fedora Core2 on the 199 199 three servers shown in the network topology diagram in <a class="link" href="Big500users.html#chap05net" title="Figure 4.1. Network Topology 500 User Network Using tdbsam passdb backend.">“Network Topology 500 User Network Using tdbsam passdb backend.”</a>. You have … … 206 206 The abbreviation shown in this table as <code class="constant">{VLN}</code> refers to 207 207 the directory location beginning with <code class="filename">/var/lib/named</code>. 208 </p><div class="table"><a name="ch5-filelocations"></a><p class="title"><b>Table 4.1. Domain: <code class="constant">MEGANET</code>, File Locations for Servers</b></p><div class="table-contents"><table summary="Domain: MEGANET, File Locations for Servers" border="1"><colgroup><col align="left"><col align="left"><col align="center"><col align="center"><col align="center"></colgroup><thead><tr><th colspan="2" align="center">File Information</th><th colspan="3" align="center">Server Name</th></tr><tr><th align="center">Source</th><th align="center">Target Location</th><th align="center">MASSIVE</th><th align="center">BLDG1</th><th align="center">BLDG2</th></tr></thead><tbody><tr><td align="left"><a class="link" href="Big500users.html#ch5-massivesmb" title="Example 4.1. Server: MASSIVE (PDC), File: /etc/samba/smb.conf">“Server: MASSIVE (PDC), File: /etc/samba/smb.conf”</a></td><td align="left"><code class="filename">/etc/samba/smb.conf</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-dc-common" title="Example 4.2. Server: MASSIVE (PDC), File: /etc/samba/dc-common.conf">“Server: MASSIVE (PDC), File: /etc/samba/dc-common.conf”</a></td><td align="left"><code class="filename">/etc/samba/dc-common.conf</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-commonsmb" title="Example 4.3. Common Samba Configuration File: /etc/samba/common.conf">“Common Samba Configuration File: /etc/samba/common.conf”</a></td><td align="left"><code class="filename">/etc/samba/common.conf</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-bldg1-smb" title="Example 4.4. Server: BLDG1 (Member), File: smb.conf">“Server: BLDG1 (Member), File: smb.conf”</a></td><td align="left"><code class="filename">/etc/samba/smb.conf</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-bldg2-smb" title="Example 4.5. Server: BLDG2 (Member), File: smb.conf">“Server: BLDG2 (Member), File: smb.conf”</a></td><td align="left"><code class="filename">/etc/samba/smb.conf</code></td><td align="center">No</td><td align="center">No</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-dommem-smb" title="Example 4.6. Common Domain Member Include File: dom-mem.conf">“Common Domain Member Include File: dom-mem.conf”</a></td><td align="left"><code class="filename">/etc/samba/dommem.conf</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#massive-dhcp" title="Example 4.7. Server: MASSIVE, File: dhcpd.conf">“Server: MASSIVE, File: dhcpd.conf”</a></td><td align="left"><code class="filename">/etc/dhcpd.conf</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#bldg1dhcp" title="Example 4.8. Server: BLDG1, File: dhcpd.conf">“Server: BLDG1, File: dhcpd.conf”</a></td><td align="left"><code class="filename">/etc/dhcpd.conf</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#bldg2dhcp" title="Example 4.9. Server: BLDG2, File: dhcpd.conf">“Server: BLDG2, File: dhcpd.conf”</a></td><td align="left"><code class="filename">/etc/dhcpd.conf</code></td><td align="center">No</td><td align="center">No</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#massive-nameda" title="Example 4.10. Server: MASSIVE, File: named.conf, Part: A">“Server: MASSIVE, File: named.conf, Part: A”</a></td><td align="left"><code class="filename">/etc/named.conf (part A)</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#massive-namedb" title="Example 4.11. Server: MASSIVE, File: named.conf, Part: B">“Server: MASSIVE, File: named.conf, Part: B”</a></td><td align="left"><code class="filename">/etc/named.conf (part B)</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#massive-namedc" title="Example 4.12. Server: MASSIVE, File: named.conf, Part: C">“Server: MASSIVE, File: named.conf, Part: C”</a></td><td align="left"><code class="filename">/etc/named.conf (part C)</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#abmasbizdns" title="Example 4.13. Forward Zone File: abmas.biz.hosts">“Forward Zone File: abmas.biz.hosts”</a></td><td align="left"><code class="filename">{VLN}/master/abmas.biz.hosts</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#abmasusdns" title="Example 4.14. Forward Zone File: abmas.biz.hosts">“Forward Zone File: abmas.biz.hosts”</a></td><td align="left"><code class="filename">{VLN}/master/abmas.us.hosts</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#bldg12nameda" title="Example 4.15. Servers: BLDG1/BLDG2, File: named.conf, Part: A">“Servers: BLDG1/BLDG2, File: named.conf, Part: A”</a></td><td align="left"><code class="filename">/etc/named.conf (part A)</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#bldg12namedb" title="Example 4.16. Servers: BLDG1/BLDG2, File: named.conf, Part: B">“Servers: BLDG1/BLDG2, File: named.conf, Part: B”</a></td><td align="left"><code class="filename">/etc/named.conf (part B)</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="appendix.html#loopback" title="Example 15.3. DNS Localhost Forward Zone File: /var/lib/named/localhost.zone">“DNS Localhost Forward Zone File: /var/lib/named/localhost.zone”</a></td><td align="left"><code class="filename">{VLN}/localhost.zone</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="appendix.html#dnsloopy" title="Example 15.4. DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone">“DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone”</a></td><td align="left"><code class="filename">{VLN}/127.0.0.zone</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="appendix.html#roothint" title="Example 15.5. DNS Root Name Server Hint File: /var/lib/named/root.hint">“DNS Root Name Server Hint File: /var/lib/named/root.hint”</a></td><td align="left"><code class="filename">{VLN}/root.hint</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr></tbody></table></div></div><br class="table-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id25594 94"></a>Server Preparation: All Servers</h3></div></div></div><p>208 </p><div class="table"><a name="ch5-filelocations"></a><p class="title"><b>Table 4.1. Domain: <code class="constant">MEGANET</code>, File Locations for Servers</b></p><div class="table-contents"><table summary="Domain: MEGANET, File Locations for Servers" border="1"><colgroup><col align="left"><col align="left"><col align="center"><col align="center"><col align="center"></colgroup><thead><tr><th colspan="2" align="center">File Information</th><th colspan="3" align="center">Server Name</th></tr><tr><th align="center">Source</th><th align="center">Target Location</th><th align="center">MASSIVE</th><th align="center">BLDG1</th><th align="center">BLDG2</th></tr></thead><tbody><tr><td align="left"><a class="link" href="Big500users.html#ch5-massivesmb" title="Example 4.1. Server: MASSIVE (PDC), File: /etc/samba/smb.conf">“Server: MASSIVE (PDC), File: /etc/samba/smb.conf”</a></td><td align="left"><code class="filename">/etc/samba/smb.conf</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-dc-common" title="Example 4.2. Server: MASSIVE (PDC), File: /etc/samba/dc-common.conf">“Server: MASSIVE (PDC), File: /etc/samba/dc-common.conf”</a></td><td align="left"><code class="filename">/etc/samba/dc-common.conf</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-commonsmb" title="Example 4.3. Common Samba Configuration File: /etc/samba/common.conf">“Common Samba Configuration File: /etc/samba/common.conf”</a></td><td align="left"><code class="filename">/etc/samba/common.conf</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-bldg1-smb" title="Example 4.4. Server: BLDG1 (Member), File: smb.conf">“Server: BLDG1 (Member), File: smb.conf”</a></td><td align="left"><code class="filename">/etc/samba/smb.conf</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-bldg2-smb" title="Example 4.5. Server: BLDG2 (Member), File: smb.conf">“Server: BLDG2 (Member), File: smb.conf”</a></td><td align="left"><code class="filename">/etc/samba/smb.conf</code></td><td align="center">No</td><td align="center">No</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-dommem-smb" title="Example 4.6. Common Domain Member Include File: dom-mem.conf">“Common Domain Member Include File: dom-mem.conf”</a></td><td align="left"><code class="filename">/etc/samba/dommem.conf</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#massive-dhcp" title="Example 4.7. Server: MASSIVE, File: dhcpd.conf">“Server: MASSIVE, File: dhcpd.conf”</a></td><td align="left"><code class="filename">/etc/dhcpd.conf</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#bldg1dhcp" title="Example 4.8. Server: BLDG1, File: dhcpd.conf">“Server: BLDG1, File: dhcpd.conf”</a></td><td align="left"><code class="filename">/etc/dhcpd.conf</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#bldg2dhcp" title="Example 4.9. Server: BLDG2, File: dhcpd.conf">“Server: BLDG2, File: dhcpd.conf”</a></td><td align="left"><code class="filename">/etc/dhcpd.conf</code></td><td align="center">No</td><td align="center">No</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#massive-nameda" title="Example 4.10. Server: MASSIVE, File: named.conf, Part: A">“Server: MASSIVE, File: named.conf, Part: A”</a></td><td align="left"><code class="filename">/etc/named.conf (part A)</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#massive-namedb" title="Example 4.11. Server: MASSIVE, File: named.conf, Part: B">“Server: MASSIVE, File: named.conf, Part: B”</a></td><td align="left"><code class="filename">/etc/named.conf (part B)</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#massive-namedc" title="Example 4.12. Server: MASSIVE, File: named.conf, Part: C">“Server: MASSIVE, File: named.conf, Part: C”</a></td><td align="left"><code class="filename">/etc/named.conf (part C)</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#abmasbizdns" title="Example 4.13. Forward Zone File: abmas.biz.hosts">“Forward Zone File: abmas.biz.hosts”</a></td><td align="left"><code class="filename">{VLN}/master/abmas.biz.hosts</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#abmasusdns" title="Example 4.14. Forward Zone File: abmas.biz.hosts">“Forward Zone File: abmas.biz.hosts”</a></td><td align="left"><code class="filename">{VLN}/master/abmas.us.hosts</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#bldg12nameda" title="Example 4.15. Servers: BLDG1/BLDG2, File: named.conf, Part: A">“Servers: BLDG1/BLDG2, File: named.conf, Part: A”</a></td><td align="left"><code class="filename">/etc/named.conf (part A)</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#bldg12namedb" title="Example 4.16. Servers: BLDG1/BLDG2, File: named.conf, Part: B">“Servers: BLDG1/BLDG2, File: named.conf, Part: B”</a></td><td align="left"><code class="filename">/etc/named.conf (part B)</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="appendix.html#loopback" title="Example 15.3. DNS Localhost Forward Zone File: /var/lib/named/localhost.zone">“DNS Localhost Forward Zone File: /var/lib/named/localhost.zone”</a></td><td align="left"><code class="filename">{VLN}/localhost.zone</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="appendix.html#dnsloopy" title="Example 15.4. DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone">“DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone”</a></td><td align="left"><code class="filename">{VLN}/127.0.0.zone</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="appendix.html#roothint" title="Example 15.5. DNS Root Name Server Hint File: /var/lib/named/root.hint">“DNS Root Name Server Hint File: /var/lib/named/root.hint”</a></td><td align="left"><code class="filename">{VLN}/root.hint</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr></tbody></table></div></div><br class="table-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2559489"></a>Server Preparation: All Servers</h3></div></div></div><p> 209 209 The following steps apply to all servers. Follow each step carefully. 210 </p><div class="procedure"><a name="id255950 4"></a><p class="title"><b>Procedure 4.1. Server Preparation Steps</b></p><ol type="1"><li><p>210 </p><div class="procedure"><a name="id2559500"></a><p class="title"><b>Procedure 4.1. Server Preparation Steps</b></p><ol type="1"><li><p> 211 211 Using the UNIX/Linux system tools, set the name of the server as shown in the network 212 212 topology diagram in <a class="link" href="Big500users.html#chap05net" title="Figure 4.1. Network Topology 500 User Network Using tdbsam passdb backend.">“Network Topology 500 User Network Using tdbsam passdb backend.”</a>. For SUSE Linux products, the tool … … 222 222 </pre><p> 223 223 </p></li><li><p> 224 <a class="indexterm" name="id255956 9"></a>225 <a class="indexterm" name="id255957 5"></a>224 <a class="indexterm" name="id2559564"></a> 225 <a class="indexterm" name="id2559571"></a> 226 226 Edit your <code class="filename">/etc/hosts</code> file to include the primary names and addresses 227 227 of all network interfaces that are on the host server. This is necessary so that during … … 231 231 should also include an entry for the printers in the <code class="filename">/etc/hosts</code> file. 232 232 </p></li><li><p> 233 <a class="indexterm" name="id255961 4"></a>233 <a class="indexterm" name="id2559610"></a> 234 234 All DNS name resolution should be handled locally. To ensure that the server is configured 235 235 correctly to handle this, edit <code class="filename">/etc/resolv.conf</code> so it has the following … … 242 242 that is running locally to resolve names to addresses. 243 243 </p></li><li><p> 244 <a class="indexterm" name="id255964 6"></a>245 <a class="indexterm" name="id25596 53"></a>244 <a class="indexterm" name="id2559641"></a> 245 <a class="indexterm" name="id2559648"></a> 246 246 Add the <code class="constant">root</code> user to the password backend: 247 247 </p><pre class="screen"> … … 256 256 without considerable trouble. 257 257 </p></li><li><p> 258 <a class="indexterm" name="id255969 8"></a>259 <a class="indexterm" name="id255970 5"></a>258 <a class="indexterm" name="id2559693"></a> 259 <a class="indexterm" name="id2559700"></a> 260 260 Create the username map file to permit the <code class="constant">root</code> account to be called 261 261 <code class="constant">Administrator</code> from the Windows network environment. To do this, create … … 295 295 to port 9100. Use any other port the manufacturer specifies for direct mode, 296 296 raw printing. This allows the CUPS spooler to print using raw mode protocols. 297 <a class="indexterm" name="id255979 6"></a>298 <a class="indexterm" name="id2559 803"></a>299 </p></li><li><p> 300 <a class="indexterm" name="id255981 6"></a>297 <a class="indexterm" name="id2559792"></a> 298 <a class="indexterm" name="id2559798"></a> 299 </p></li><li><p> 300 <a class="indexterm" name="id2559812"></a> 301 301 Only on the server to which the printer is attached configure the CUPS Print 302 302 Queues as follows: … … 304 304 <code class="prompt">root# </code> lpadmin -p <em class="parameter"><code>printque</code></em> -v socket://<em class="parameter"><code>printer-name</code></em>.abmas.biz:9100 -E 305 305 </pre><p> 306 <a class="indexterm" name="id25598 52"></a>306 <a class="indexterm" name="id2559847"></a> 307 307 This step creates the necessary print queue to use no assigned print filter. This 308 308 is ideal for raw printing, that is, printing without use of filters. … … 324 324 </pre><p> 325 325 </p></li><li><p> 326 <a class="indexterm" name="id25599 31"></a>327 <a class="indexterm" name="id255993 7"></a>328 <a class="indexterm" name="id255994 4"></a>326 <a class="indexterm" name="id2559926"></a> 327 <a class="indexterm" name="id2559933"></a> 328 <a class="indexterm" name="id2559940"></a> 329 329 This step, as well as the next one, may be omitted where CUPS version 1.1.18 330 330 or later is in use. Although it does no harm to follow it anyway, and may … … 337 337 </pre><p> 338 338 </p></li><li><p> 339 <a class="indexterm" name="id25599 81"></a>339 <a class="indexterm" name="id2559976"></a> 340 340 Edit the file <code class="filename">/etc/cups/mime.types</code> to uncomment the line: 341 341 </p><pre class="screen"> … … 360 360 is considerably more difficult when a single PDC is used on a routed network. It can be done, but not 361 361 as elegantly as you see in the next chapter. 362 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id256005 8"></a>Server-Specific Preparation</h3></div></div></div><p>362 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2560054"></a>Server-Specific Preparation</h3></div></div></div><p> 363 363 There are some steps that apply to particular server functionality only. Each step is critical 364 364 to correct server operation. The following step-by-step installation guidance will assist you 365 365 in working through the process of configuring the PDC and then both BDC's. 366 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id25600 72"></a>Configuration for Server: <code class="constant">MASSIVE</code></h4></div></div></div><p>366 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2560067"></a>Configuration for Server: <code class="constant">MASSIVE</code></h4></div></div></div><p> 367 367 The steps presented here attempt to implement Samba installation in a generic manner. While 368 368 some steps are clearly specific to Linux, it should not be too difficult to apply them to 369 369 your platform of choice. 370 </p><div class="procedure"><a name="id256008 7"></a><p class="title"><b>Procedure 4.2. Primary Domain Controller Preparation</b></p><ol type="1"><li><p>371 <a class="indexterm" name="id256009 8"></a>372 <a class="indexterm" name="id256010 5"></a>370 </p><div class="procedure"><a name="id2560082"></a><p class="title"><b>Procedure 4.2. Primary Domain Controller Preparation</b></p><ol type="1"><li><p> 371 <a class="indexterm" name="id2560094"></a> 372 <a class="indexterm" name="id2560101"></a> 373 373 The host server acts as a router between the two internal network segments as well 374 374 as for all Internet access. This necessitates that IP forwarding be enabled. This can be … … 398 398 <code class="filename">/etc/rc.d/init.d/rc.local</code>. 399 399 </p></li><li><p> 400 <a class="indexterm" name="id256019 9"></a>400 <a class="indexterm" name="id2560194"></a> 401 401 The final step that must be completed is to edit the <code class="filename">/etc/nsswitch.conf</code> file. 402 402 This file controls the operation of the various resolver libraries that are part of the Linux … … 406 406 </pre><p> 407 407 </p></li><li><p> 408 <a class="indexterm" name="id256022 9"></a>408 <a class="indexterm" name="id2560224"></a> 409 409 Create and map Windows domain groups to UNIX groups. A sample script is provided in 410 410 <a class="link" href="Big500users.html#ch5-initgrps" title="Example 4.17. Initialize Groups Script, File: /etc/samba/initGrps.sh">“Initialize Groups Script, File: /etc/samba/initGrps.sh”</a>. Create a file containing this script. You called yours … … 413 413 validation are shown in Section 4.3.2, Step 5. 414 414 </p></li><li><p> 415 <a class="indexterm" name="id25602 61"></a>416 <a class="indexterm" name="id256026 8"></a>417 <a class="indexterm" name="id256027 7"></a>415 <a class="indexterm" name="id2560257"></a> 416 <a class="indexterm" name="id2560263"></a> 417 <a class="indexterm" name="id2560273"></a> 418 418 For each user who needs to be given a Windows domain account, make an entry in the 419 419 <code class="filename">/etc/passwd</code> file as well as in the Samba password backend. … … 421 421 <code class="literal">smbpasswd</code> to create a domain user account. 422 422 </p><p> 423 <a class="indexterm" name="id2560 304"></a>424 <a class="indexterm" name="id25603 10"></a>425 <a class="indexterm" name="id256031 7"></a>423 <a class="indexterm" name="id2560299"></a> 424 <a class="indexterm" name="id2560306"></a> 425 <a class="indexterm" name="id2560313"></a> 426 426 There are a number of tools for user management under UNIX, such as 427 427 <code class="literal">useradd</code>, <code class="literal">adduser</code>, as well as a plethora of custom … … 436 436 file system partition using appropriate system tools. 437 437 </p></li><li><p> 438 <a class="indexterm" name="id25603 81"></a>438 <a class="indexterm" name="id2560376"></a> 439 439 Create the top-level file storage directories for data and applications as follows: 440 440 </p><pre class="screen"> … … 476 476 </pre><p> 477 477 </p></li><li><p> 478 <a class="indexterm" name="id256058 7"></a>479 <a class="indexterm" name="id25605 93"></a>478 <a class="indexterm" name="id2560582"></a> 479 <a class="indexterm" name="id2560589"></a> 480 480 Create a logon script. It is important that each line is correctly terminated with 481 481 a carriage return and line-feed combination (i.e., DOS encoding). The following procedure … … 519 519 isolated network segments. Remember that if the target installation platform is not Linux, it may 520 520 be necessary to adapt some commands to the equivalent on the target platform. 521 </p><div class="procedure"><a name="id25607 80"></a><p class="title"><b>Procedure 4.3. Backup Domain Controller Configuration Steps</b></p><ol type="1"><li><p>522 <a class="indexterm" name="id25607 92"></a>521 </p><div class="procedure"><a name="id2560776"></a><p class="title"><b>Procedure 4.3. Backup Domain Controller Configuration Steps</b></p><ol type="1"><li><p> 522 <a class="indexterm" name="id2560787"></a> 523 523 The final step that must be completed is to edit the <code class="filename">/etc/nsswitch.conf</code> file. 524 524 This file controls the operation of the various resolver libraries that are part of the Linux … … 533 533 start Samba at this time. Samba is controlled by the process called <code class="literal">smb</code>. 534 534 </p></li><li><p> 535 <a class="indexterm" name="id25608 44"></a>535 <a class="indexterm" name="id2560839"></a> 536 536 You must now attempt to join the domain member servers to the domain. The following 537 537 instructions should be executed to effect this: … … 540 540 </pre><p> 541 541 </p></li><li><p> 542 <a class="indexterm" name="id256087 6"></a>542 <a class="indexterm" name="id2560871"></a> 543 543 You now start the Samba services by executing: 544 544 </p><pre class="screen"> … … 549 549 <a class="link" href="Big500users.html#ch5-domsvrspec" title="Configuration Specific to Domain Member Servers: BLDG1, BLDG2">“Configuration Specific to Domain Member Servers: BLDG1, BLDG2”</a> until after the operation of the server has been 550 550 validated following the same methods as outlined in <a class="link" href="secure.html#ch4valid" title="Validation">“Validation”</a>. 551 </p></li></ol></div></div></div><div class="example"><a name="ch5-massivesmb"></a><p class="title"><b>Example 4.1. Server: MASSIVE (PDC), File: <code class="filename">/etc/samba/smb.conf</code></b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id25609 62"></a><em class="parameter"><code>workgroup = MEGANET</code></em></td></tr><tr><td><a class="indexterm" name="id2560973"></a><em class="parameter"><code>netbios name = MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id2560985"></a><em class="parameter"><code>interfaces = eth1, lo</code></em></td></tr><tr><td><a class="indexterm" name="id2560997"></a><em class="parameter"><code>bind interfaces only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561009"></a><em class="parameter"><code>passdb backend = tdbsam</code></em></td></tr><tr><td><a class="indexterm" name="id2561021"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2561032"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2561044"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2561057"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2561069"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2561081"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -G '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2561094"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2561106"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561118"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561130"></a><em class="parameter"><code>include = /etc/samba/dc-common.conf</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id2561151"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id2561162"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id2561174"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id2561195"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id2561207"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id2561218"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id2561239"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id2561251"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id2561262"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-dc-common"></a><p class="title"><b>Example 4.2. Server: MASSIVE (PDC), File: <code class="filename">/etc/samba/dc-common.conf</code></b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2561310"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id2561322"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id2561335"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2561347"></a><em class="parameter"><code>logon path = \%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2561358"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2561370"></a><em class="parameter"><code>logon home = \%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2561382"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561393"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561405"></a><em class="parameter"><code>include = /etc/samba/common.conf</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2561426"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2561438"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2561449"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2561461"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2561482"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2561493"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2561505"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561517"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2561537"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2561549"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2561561"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2561573"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-commonsmb"></a><p class="title"><b>Example 4.3. Common Samba Configuration File: <code class="filename">/etc/samba/common.conf</code></b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2561617"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2561629"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2561640"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2561652"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2561664"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id2561675"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2561687"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2561699"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561711"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2561723"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2561735"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id2561747"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id2561759"></a><em class="parameter"><code>utmp = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561771"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561783"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2561794"></a><em class="parameter"><code>veto files = /*.eml/*.nws/*.{*}/</code></em></td></tr><tr><td><a class="indexterm" name="id2561806"></a><em class="parameter"><code>veto oplock files = /*.doc/*.xls/*.mdb/</code></em></td></tr><tr><td><a class="indexterm" name="id2561818"></a><em class="parameter"><code>include = </code></em></td></tr><tr><td># Share and Service Definitions are common to all servers</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2561843"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2561855"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2561866"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561878"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561890"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561902"></a><em class="parameter"><code>default devmode = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561913"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id2561934"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id2561946"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id2561957"></a><em class="parameter"><code>admin users = bjordan</code></em></td></tr><tr><td><a class="indexterm" name="id2561969"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-bldg1-smb"></a><p class="title"><b>Example 4.4. Server: BLDG1 (Member), File: smb.conf</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2562012"></a><em class="parameter"><code>workgroup = MEGANET</code></em></td></tr><tr><td><a class="indexterm" name="id2562023"></a><em class="parameter"><code>netbios name = BLDG1</code></em></td></tr><tr><td><a class="indexterm" name="id2562035"></a><em class="parameter"><code>include = /etc/samba/dom-mem.conf</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-bldg2-smb"></a><p class="title"><b>Example 4.5. Server: BLDG2 (Member), File: smb.conf</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2562078"></a><em class="parameter"><code>workgroup = MEGANET</code></em></td></tr><tr><td><a class="indexterm" name="id2562090"></a><em class="parameter"><code>netbios name = BLDG2</code></em></td></tr><tr><td><a class="indexterm" name="id2562102"></a><em class="parameter"><code>include = /etc/samba/dom-mem.conf</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-dommem-smb"></a><p class="title"><b>Example 4.6. Common Domain Member Include File: dom-mem.conf</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2562145"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id2562157"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id2562170"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2562182"></a><em class="parameter"><code>wins server = 172.16.0.1</code></em></td></tr><tr><td><a class="indexterm" name="id2562193"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2562205"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2562217"></a><em class="parameter"><code>include = /etc/samba/common.conf</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="massive-dhcp"></a><p class="title"><b>Example 4.7. Server: MASSIVE, File: dhcpd.conf</b></p><div class="example-contents"><pre class="screen">551 </p></li></ol></div></div></div><div class="example"><a name="ch5-massivesmb"></a><p class="title"><b>Example 4.1. Server: MASSIVE (PDC), File: <code class="filename">/etc/samba/smb.conf</code></b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2560957"></a><em class="parameter"><code>workgroup = MEGANET</code></em></td></tr><tr><td><a class="indexterm" name="id2560969"></a><em class="parameter"><code>netbios name = MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id2560980"></a><em class="parameter"><code>interfaces = eth1, lo</code></em></td></tr><tr><td><a class="indexterm" name="id2560992"></a><em class="parameter"><code>bind interfaces only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561004"></a><em class="parameter"><code>passdb backend = tdbsam</code></em></td></tr><tr><td><a class="indexterm" name="id2561016"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2561028"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2561040"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2561052"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2561064"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2561076"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -G '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2561089"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2561102"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561114"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561125"></a><em class="parameter"><code>include = /etc/samba/dc-common.conf</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id2561146"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id2561158"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id2561170"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id2561190"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id2561202"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id2561214"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id2561234"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id2561246"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id2561258"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-dc-common"></a><p class="title"><b>Example 4.2. Server: MASSIVE (PDC), File: <code class="filename">/etc/samba/dc-common.conf</code></b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2561305"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id2561318"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id2561330"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2561342"></a><em class="parameter"><code>logon path = \%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2561354"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2561366"></a><em class="parameter"><code>logon home = \%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2561377"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561389"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561401"></a><em class="parameter"><code>include = /etc/samba/common.conf</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2561422"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2561433"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2561445"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2561456"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2561477"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2561489"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2561501"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561512"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2561533"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2561545"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2561556"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2561568"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-commonsmb"></a><p class="title"><b>Example 4.3. Common Samba Configuration File: <code class="filename">/etc/samba/common.conf</code></b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2561613"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2561624"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2561636"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2561647"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2561659"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id2561671"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2561682"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2561695"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561706"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2561718"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2561730"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id2561743"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id2561755"></a><em class="parameter"><code>utmp = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561766"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561778"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2561790"></a><em class="parameter"><code>veto files = /*.eml/*.nws/*.{*}/</code></em></td></tr><tr><td><a class="indexterm" name="id2561802"></a><em class="parameter"><code>veto oplock files = /*.doc/*.xls/*.mdb/</code></em></td></tr><tr><td><a class="indexterm" name="id2561814"></a><em class="parameter"><code>include = </code></em></td></tr><tr><td># Share and Service Definitions are common to all servers</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2561838"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2561850"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2561862"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561874"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561885"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561897"></a><em class="parameter"><code>default devmode = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561909"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id2561929"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id2561941"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id2561953"></a><em class="parameter"><code>admin users = bjordan</code></em></td></tr><tr><td><a class="indexterm" name="id2561964"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-bldg1-smb"></a><p class="title"><b>Example 4.4. Server: BLDG1 (Member), File: smb.conf</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2562007"></a><em class="parameter"><code>workgroup = MEGANET</code></em></td></tr><tr><td><a class="indexterm" name="id2562019"></a><em class="parameter"><code>netbios name = BLDG1</code></em></td></tr><tr><td><a class="indexterm" name="id2562031"></a><em class="parameter"><code>include = /etc/samba/dom-mem.conf</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-bldg2-smb"></a><p class="title"><b>Example 4.5. Server: BLDG2 (Member), File: smb.conf</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2562074"></a><em class="parameter"><code>workgroup = MEGANET</code></em></td></tr><tr><td><a class="indexterm" name="id2562085"></a><em class="parameter"><code>netbios name = BLDG2</code></em></td></tr><tr><td><a class="indexterm" name="id2562097"></a><em class="parameter"><code>include = /etc/samba/dom-mem.conf</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-dommem-smb"></a><p class="title"><b>Example 4.6. Common Domain Member Include File: dom-mem.conf</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2562140"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id2562153"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id2562165"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2562177"></a><em class="parameter"><code>wins server = 172.16.0.1</code></em></td></tr><tr><td><a class="indexterm" name="id2562189"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2562200"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2562212"></a><em class="parameter"><code>include = /etc/samba/common.conf</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="massive-dhcp"></a><p class="title"><b>Example 4.7. Server: MASSIVE, File: dhcpd.conf</b></p><div class="example-contents"><pre class="screen"> 552 552 # Abmas Accounting Inc. 553 553 … … 899 899 net groupmap add ntgroup="Insurance Group" unixgroup=piops type=d 900 900 </pre></div></div><br class="example-break"><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch5-procstart"></a>Process Startup Configuration</h3></div></div></div><p> 901 <a class="indexterm" name="id25625 72"></a>902 <a class="indexterm" name="id256257 9"></a>901 <a class="indexterm" name="id2562568"></a> 902 <a class="indexterm" name="id2562574"></a> 903 903 There are two essential steps to process startup configuration. A process 904 904 must be configured so that it is automatically restarted each time the server … … 909 909 necessary start or kill script is run. 910 910 </p><p> 911 <a class="indexterm" name="id256261 5"></a>911 <a class="indexterm" name="id2562610"></a> 912 912 In the event that a service is provided not as a daemon but via the internetworking 913 913 super daemon (<code class="literal">inetd</code> or <code class="literal">xinetd</code>), then the <code class="literal">chkconfig</code> … … 919 919 are for a Red Hat Linux system, please adapt them to suit the target OS platform on which you 920 920 are installing Samba. 921 </p><div class="procedure"><a name="id256265 9"></a><p class="title"><b>Procedure 4.4. Process Startup Configuration Steps</b></p><ol type="1"><li><p>921 </p><div class="procedure"><a name="id2562655"></a><p class="title"><b>Procedure 4.4. Process Startup Configuration Steps</b></p><ol type="1"><li><p> 922 922 Use the standard system tool to configure each service to restart 923 923 automatically at every system reboot. For example, 924 <a class="indexterm" name="id25626 74"></a>924 <a class="indexterm" name="id2562669"></a> 925 925 </p><pre class="screen"> 926 926 <code class="prompt">root# </code> chkconfig dhpc on … … 931 931 </pre><p> 932 932 </p></li><li><p> 933 <a class="indexterm" name="id25627 23"></a>934 <a class="indexterm" name="id25627 30"></a>935 <a class="indexterm" name="id256273 7"></a>933 <a class="indexterm" name="id2562719"></a> 934 <a class="indexterm" name="id2562726"></a> 935 <a class="indexterm" name="id2562733"></a> 936 936 Now start each service to permit the system to be validated. 937 937 Execute each of the following in the sequence shown: … … 947 947 The procedure for desktop client configuration for the network in this chapter is similar to 948 948 that used for the previous one. There are a few subtle changes that should be noted. 949 </p><div class="procedure"><a name="id2562 803"></a><p class="title"><b>Procedure 4.5. Windows Client Configuration Steps</b></p><ol type="1"><li><p>949 </p><div class="procedure"><a name="id2562798"></a><p class="title"><b>Procedure 4.5. Windows Client Configuration Steps</b></p><ol type="1"><li><p> 950 950 Install MS Windows XP Professional. During installation, configure the client to use DHCP for 951 951 TCP/IP protocol configuration. 952 <a class="indexterm" name="id256281 7"></a>953 <a class="indexterm" name="id25628 23"></a>952 <a class="indexterm" name="id2562812"></a> 953 <a class="indexterm" name="id2562819"></a> 954 954 DHCP configures all Windows clients to use the WINS Server address that has been defined 955 955 for the local subnet. … … 986 986 Install printers on each machine using the following steps: 987 987 988 </p><div class="procedure"><a name="id256295 4"></a><p class="title"><b>Procedure 4.6. Steps to Install Printer Drivers on Windows Clients</b></p><ol type="1"><li><p>988 </p><div class="procedure"><a name="id2562950"></a><p class="title"><b>Procedure 4.6. Steps to Install Printer Drivers on Windows Clients</b></p><ol type="1"><li><p> 989 989 Click <span class="guimenu">Start</span> → <span class="guimenuitem">Settings</span> → <span class="guimenuitem">Printers</span>+<span class="guiicon">Add Printer</span>+<span class="guibutton">Next</span>. Do not click <span class="guimenuitem">Network printer</span>. 990 990 Ensure that <span class="guimenuitem">Local printer</span> is selected. … … 1039 1039 </p></li><li><p> 1040 1040 Instruct all users to log onto the workstation using their assigned username and password. 1041 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id256325 8"></a>Key Points Learned</h3></div></div></div><p>1041 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2563254"></a>Key Points Learned</h3></div></div></div><p> 1042 1042 The network you have just deployed has been a valuable exercise in forced constraint. 1043 1043 You have deployed a network that works well, although you may soon start to see … … 1055 1055 </p></li><li><p> 1056 1056 The introduction of roaming profiles 1057 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id256331 7"></a>Questions and Answers</h2></div></div></div><p>1058 </p><div class="qandaset"><dl><dt> <a href="Big500users.html#id25633 32">1057 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2563312"></a>Questions and Answers</h2></div></div></div><p> 1058 </p><div class="qandaset"><dl><dt> <a href="Big500users.html#id2563328"> 1059 1059 The example smb.conf files in this chapter make use of the include facility. 1060 1060 How may I get to see what the actual working smb.conf settings are? 1061 </a></dt><dt> <a href="Big500users.html#id25633 82">1061 </a></dt><dt> <a href="Big500users.html#id2563377"> 1062 1062 Why does the include file common.conf have an empty include statement? 1063 </a></dt><dt> <a href="Big500users.html#id25634 44">1063 </a></dt><dt> <a href="Big500users.html#id2563439"> 1064 1064 I accept that the simplest configuration necessary to do the job is the best. The use of tdbsam 1065 1065 passdb backend is much simpler than having to manage an LDAP-based ldapsam passdb backend. 1066 1066 I tried using rsync to replicate the passdb.tdb, and it seems to work fine! 1067 1067 So what is the problem? 1068 </a></dt><dt> <a href="Big500users.html#id256349 9">1068 </a></dt><dt> <a href="Big500users.html#id2563494"> 1069 1069 You are using DHCP Relay enabled on the routers as well as a local DHCP server. Will this cause a clash? 1070 </a></dt><dt> <a href="Big500users.html#id256352 9">1070 </a></dt><dt> <a href="Big500users.html#id2563525"> 1071 1071 How does the Windows client find the PDC? 1072 </a></dt><dt> <a href="Big500users.html#id25635 52">1072 </a></dt><dt> <a href="Big500users.html#id2563547"> 1073 1073 Why did you enable IP forwarding (routing) only on the server called MASSIVE? 1074 </a></dt><dt> <a href="Big500users.html#id25635 82">1074 </a></dt><dt> <a href="Big500users.html#id2563578"> 1075 1075 You did nothing special to implement roaming profiles. Why? 1076 </a></dt><dt> <a href="Big500users.html#id2563 602">1076 </a></dt><dt> <a href="Big500users.html#id2563598"> 1077 1077 On the domain member computers, you configured winbind in the /etc/nsswitch.conf file. 1078 1078 You did not configure any PAM settings. Is this an omission? 1079 </a></dt><dt> <a href="Big500users.html#id256363 4">1079 </a></dt><dt> <a href="Big500users.html#id2563630"> 1080 1080 You are starting SWAT up on this example but have not discussed that anywhere. Why did you do this? 1081 </a></dt><dt> <a href="Big500users.html#id256367 6">1081 </a></dt><dt> <a href="Big500users.html#id2563671"> 1082 1082 The domain controller has an auto-shutdown script. Isn't that dangerous? 1083 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id25633 32"></a><a name="id2563335"></a></td><td align="left" valign="top"><p>1083 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2563328"></a><a name="id2563330"></a></td><td align="left" valign="top"><p> 1084 1084 The example <code class="filename">smb.conf</code> files in this chapter make use of the <em class="parameter"><code>include</code></em> facility. 1085 1085 How may I get to see what the actual working <code class="filename">smb.conf</code> settings are? … … 1089 1089 <code class="prompt">root# </code> testparm -s | less 1090 1090 </pre><p> 1091 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id25633 82"></a><a name="id2563384"></a></td><td align="left" valign="top"><p>1091 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2563377"></a><a name="id2563379"></a></td><td align="left" valign="top"><p> 1092 1092 Why does the include file <code class="filename">common.conf</code> have an empty include statement? 1093 1093 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1102 1102 the include in place, even though the file it points to has already been included. This is a bug 1103 1103 that will be fixed at a future date. 1104 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id25634 44"></a><a name="id2563446"></a></td><td align="left" valign="top"><p>1104 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2563439"></a><a name="id2563442"></a></td><td align="left" valign="top"><p> 1105 1105 I accept that the simplest configuration necessary to do the job is the best. The use of <em class="parameter"><code>tdbsam</code></em> 1106 1106 passdb backend is much simpler than having to manage an LDAP-based <em class="parameter"><code>ldapsam</code></em> passdb backend. … … 1112 1112 to log onto the network following a reboot and may have to rejoin the domain to recover network 1113 1113 access capability. 1114 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id256349 9"></a><a name="id2563501"></a></td><td align="left" valign="top"><p>1114 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2563494"></a><a name="id2563497"></a></td><td align="left" valign="top"><p> 1115 1115 You are using DHCP Relay enabled on the routers as well as a local DHCP server. Will this cause a clash? 1116 1116 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1121 1121 The only exception to this rule is when the client makes a directed request from a specific DHCP server 1122 1122 for renewal of the lease it has. This means that under normal circumstances there is no risk of a clash. 1123 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id256352 9"></a><a name="id2563531"></a></td><td align="left" valign="top"><p>1123 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2563525"></a><a name="id2563527"></a></td><td align="left" valign="top"><p> 1124 1124 How does the Windows client find the PDC? 1125 1125 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1128 1128 to register itself with the WINS server and to obtain enumeration of vital network information to 1129 1129 enable it to operate successfully. 1130 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id25635 52"></a><a name="id2563554"></a></td><td align="left" valign="top"><p>1130 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2563547"></a><a name="id2563550"></a></td><td align="left" valign="top"><p> 1131 1131 Why did you enable IP forwarding (routing) only on the server called <code class="constant">MASSIVE</code>? 1132 1132 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1135 1135 Route table entries are needed to direct MASSIVE to send all traffic intended for the remote network 1136 1136 segments to the router that is its gateway to them. 1137 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id25635 82"></a><a name="id2563585"></a></td><td align="left" valign="top"><p>1137 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2563578"></a><a name="id2563580"></a></td><td align="left" valign="top"><p> 1138 1138 You did nothing special to implement roaming profiles. Why? 1139 1139 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 1140 1140 Unless configured to do otherwise, the default behavior with Samba-3 and Windows XP Professional 1141 1141 clients is to use roaming profiles. 1142 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2563 602"></a><a name="id2563604"></a></td><td align="left" valign="top"><p>1142 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2563598"></a><a name="id2563600"></a></td><td align="left" valign="top"><p> 1143 1143 On the domain member computers, you configured winbind in the <code class="filename">/etc/nsswitch.conf</code> file. 1144 1144 You did not configure any PAM settings. Is this an omission? … … 1149 1149 to enable the use of winbind. Samba makes use only of the identity resolution facilities of the name 1150 1150 service switch (NSS). 1151 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id256363 4"></a><a name="id2563636"></a></td><td align="left" valign="top"><p>1151 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2563630"></a><a name="id2563632"></a></td><td align="left" valign="top"><p> 1152 1152 You are starting SWAT up on this example but have not discussed that anywhere. Why did you do this? 1153 1153 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1158 1158 file but leaves in place a broken reference to the top-layer include file. SWAT was not designed to 1159 1159 handle this functionality gracefully. 1160 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id256367 6"></a><a name="id2563678"></a></td><td align="left" valign="top"><p>1160 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2563671"></a><a name="id2563673"></a></td><td align="left" valign="top"><p> 1161 1161 The domain controller has an auto-shutdown script. Isn't that dangerous? 1162 1162 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> -
branches/samba-3.2.x/docs/htmldocs/Samba3-ByExample/DMSMig.html
r204 r226 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Part II. Domain Members, Updating Samba and Migration</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="2000users.html" title="Chapter 6. A Distributed 2000-User Network"><link rel="next" href="unixclients.html" title="Chapter 7. Adding Domain Member Servers and Clients"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Part II. Domain Members, Updating Samba and Migration</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="2000users.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="unixclients.html">Next</a></td></tr></table><hr></div><div class="part" lang="en"><div class="titlepage"><div><div><h1 class="title"><a name="DMSMig"></a>Part II. Domain Members, Updating Samba and Migration</h1></div></div></div><div class="partintro" lang="en"><div><div><div><h1 class="title"><a name="id258222 9"></a>Domain Members, Updating Samba and Migration</h1></div></div></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Part II. Domain Members, Updating Samba and Migration</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="2000users.html" title="Chapter 6. A Distributed 2000-User Network"><link rel="next" href="unixclients.html" title="Chapter 7. Adding Domain Member Servers and Clients"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Part II. Domain Members, Updating Samba and Migration</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="2000users.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="unixclients.html">Next</a></td></tr></table><hr></div><div class="part" lang="en"><div class="titlepage"><div><div><h1 class="title"><a name="DMSMig"></a>Part II. Domain Members, Updating Samba and Migration</h1></div></div></div><div class="partintro" lang="en"><div><div><div><h1 class="title"><a name="id2582225"></a>Domain Members, Updating Samba and Migration</h1></div></div></div><p> 2 2 This section <span class="emphasis"><em>Samba-3 by Example</em></span> covers two main topics: How to add 3 3 Samba Domain Member Servers and Samba Domain Member Clients to a Samba domain, the other … … 8 8 to a Samba or a Windows networking domain may also benefit by referring to the book 9 9 <span class="emphasis"><em>The Official Samba-3 HOWTO and Reference Guide.</em></span> 10 </p><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="chapter"><a href="unixclients.html">7. Adding Domain Member Servers and Clients</a></span></dt><dd><dl><dt><span class="sect1"><a href="unixclients.html#id25823 70">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id2582424">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id2582459">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id2582487">Technical Issues</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id2583136">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id2583237">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></span></dt><dt><span class="sect2"><a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></span></dt><dt><span class="sect2"><a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a></span></dt><dt><span class="sect2"><a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id2589442">UNIX/Linux Client Domain Member</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id2590017">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id2590071">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="upgrades.html">8. Updating Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="upgrades.html#id2591231">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id2591327">Cautions and Notes</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id2592656">Upgrading from Samba 1.x and 2.x to Samba-3</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2593024">Applicable to All Samba 2.x to Samba-3 Upgrades</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2593358">Samba-2.x with LDAP Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id2593539">Updating a Samba-3 Installation</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id2593650">Samba-3 to Samba-3 Updates on the Same Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2593853">Migrating Samba-3 to a New Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2594268">Migration of Samba Accounts to Active Directory</a></span></dt></dl></dd></dl></dd><dt><span class="chapter"><a href="ntmigration.html">9. Migrating NT4 Domain to Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="ntmigration.html#id2594439">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2594524">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2594579">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2594765">Technical Issues</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2595088">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2595114">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2595255">NT4 Migration Using LDAP Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2597714">NT4 Migration Using tdbsam Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2598120">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2598159">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="nw4migration.html">10. Migrating NetWare Server to Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="nw4migration.html#id2599134">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id2599251">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id2599364">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id2599440">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id2599631">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id2599640">NetWare Migration Using LDAP Backend</a></span></dt></dl></dd></dl></dd></dl></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="2000users.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="unixclients.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 6. A Distributed 2000-User Network </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 7. Adding Domain Member Servers and Clients</td></tr></table></div></body></html>10 </p><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="chapter"><a href="unixclients.html">7. Adding Domain Member Servers and Clients</a></span></dt><dd><dl><dt><span class="sect1"><a href="unixclients.html#id2582366">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id2582419">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id2582454">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id2582483">Technical Issues</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id2583132">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id2583232">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></span></dt><dt><span class="sect2"><a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></span></dt><dt><span class="sect2"><a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a></span></dt><dt><span class="sect2"><a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id2589438">UNIX/Linux Client Domain Member</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id2590012">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id2590066">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="upgrades.html">8. Updating Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="upgrades.html#id2591226">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id2591322">Cautions and Notes</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id2592651">Upgrading from Samba 1.x and 2.x to Samba-3</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2593019">Applicable to All Samba 2.x to Samba-3 Upgrades</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2593353">Samba-2.x with LDAP Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id2593535">Updating a Samba-3 Installation</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id2593645">Samba-3 to Samba-3 Updates on the Same Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2593848">Migrating Samba-3 to a New Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2594263">Migration of Samba Accounts to Active Directory</a></span></dt></dl></dd></dl></dd><dt><span class="chapter"><a href="ntmigration.html">9. Migrating NT4 Domain to Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="ntmigration.html#id2594435">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2594520">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2594574">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2594760">Technical Issues</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2595084">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2595109">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2595250">NT4 Migration Using LDAP Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2597709">NT4 Migration Using tdbsam Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2598116">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2598154">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="nw4migration.html">10. Migrating NetWare Server to Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="nw4migration.html#id2599130">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id2599246">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id2599359">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id2599436">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id2599626">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id2599635">NetWare Migration Using LDAP Backend</a></span></dt></dl></dd></dl></dd></dl></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="2000users.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="unixclients.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 6. A Distributed 2000-User Network </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 7. Adding Domain Member Servers and Clients</td></tr></table></div></body></html> -
branches/samba-3.2.x/docs/htmldocs/Samba3-ByExample/DomApps.html
r204 r226 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 12. Integrating Additional Services</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="kerberos.html" title="Chapter 11. Active Directory, Kerberos, and Security"><link rel="next" href="HA.html" title="Chapter 13. Performance, Reliability, and Availability"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 12. Integrating Additional Services</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="kerberos.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="HA.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="DomApps"></a>Chapter 12. Integrating Additional Services</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="DomApps.html#id260926 5">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id2609296">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2609396">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id2609429">Technical Issues</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id2609585">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2609603">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id2611455">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2611515">Questions and Answers</a></span></dt></dl></div><p>2 <a class="indexterm" name="id260921 6"></a>3 <a class="indexterm" name="id26092 22"></a>4 <a class="indexterm" name="id260922 9"></a>5 <a class="indexterm" name="id260923 6"></a>6 <a class="indexterm" name="id26092 42"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 12. Integrating Additional Services</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="kerberos.html" title="Chapter 11. Active Directory, Kerberos, and Security"><link rel="next" href="HA.html" title="Chapter 13. Performance, Reliability, and Availability"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 12. Integrating Additional Services</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="kerberos.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="HA.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="DomApps"></a>Chapter 12. Integrating Additional Services</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="DomApps.html#id2609260">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id2609291">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2609392">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id2609425">Technical Issues</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id2609581">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2609598">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id2611450">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2611510">Questions and Answers</a></span></dt></dl></div><p> 2 <a class="indexterm" name="id2609211"></a> 3 <a class="indexterm" name="id2609217"></a> 4 <a class="indexterm" name="id2609224"></a> 5 <a class="indexterm" name="id2609231"></a> 6 <a class="indexterm" name="id2609238"></a> 7 7 You've come a long way now. You have pretty much mastered Samba-3 for 8 8 most uses it can be put to. Up until now, you have cast Samba-3 in the leading … … 15 15 the latest Windows authentication technologies. Let's get started this is 16 16 leading edge. 17 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id260926 5"></a>Introduction</h2></div></div></div><p>17 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2609260"></a>Introduction</h2></div></div></div><p> 18 18 Abmas has continued its miraculous growth; indeed, nothing seems to be able 19 19 to stop its diversification into multiple (and seemingly unrelated) fields. … … 31 31 gradually, taking over key services and easing the way to a full migration and, 32 32 therefore, integration into Abmas's existing business later. 33 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id260929 6"></a>Assignment Tasks</h3></div></div></div><p>34 <a class="indexterm" name="id2609 304"></a>35 <a class="indexterm" name="id26093 12"></a>33 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2609291"></a>Assignment Tasks</h3></div></div></div><p> 34 <a class="indexterm" name="id2609299"></a> 35 <a class="indexterm" name="id2609308"></a> 36 36 You've promised the skeptical Abmas Snack Foods management team 37 37 that you can show them how Samba can ease itself and other Open Source … … 40 40 acquisition). You have chosen Web proxying and caching as your proving ground. 41 41 </p><p> 42 <a class="indexterm" name="id26093 31"></a>43 <a class="indexterm" name="id260933 8"></a>42 <a class="indexterm" name="id2609326"></a> 43 <a class="indexterm" name="id2609333"></a> 44 44 Abmas Snack Foods has several thousand users housed at its head office 45 45 and multiple regional offices, plants, and warehouses. A high proportion of … … 51 51 the earliest commercial users of Microsoft ISA. 52 52 </p><p> 53 <a class="indexterm" name="id260935 8"></a>54 <a class="indexterm" name="id260936 5"></a>55 <a class="indexterm" name="id26093 72"></a>53 <a class="indexterm" name="id2609354"></a> 54 <a class="indexterm" name="id2609361"></a> 55 <a class="indexterm" name="id2609368"></a> 56 56 The team is not happy with ISA. Because it never lived up to its marketing promises, 57 57 it underperformed and had reliability problems. You have pounced on the opportunity … … 64 64 This is a hands-on exercise. You build software applications so 65 65 that you obtain the functionality Abmas needs. 66 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id260939 6"></a>Dissection and Discussion</h2></div></div></div><p>66 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2609392"></a>Dissection and Discussion</h2></div></div></div><p> 67 67 The key requirements in this business example are straightforward. You are not required 68 68 to do anything new, just to replicate an existing system, not lose any existing features, … … 74 74 </p></li><li><p> 75 75 Seamless and transparent interoperability with the existing Active Directory domain 76 </p></li></ul></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id260942 9"></a>Technical Issues</h3></div></div></div><p>77 <a class="indexterm" name="id260943 7"></a>78 <a class="indexterm" name="id26094 44"></a>79 <a class="indexterm" name="id26094 51"></a>80 <a class="indexterm" name="id260945 8"></a>81 <a class="indexterm" name="id260946 4"></a>82 <a class="indexterm" name="id26094 71"></a>83 <a class="indexterm" name="id260947 8"></a>84 <a class="indexterm" name="id260948 5"></a>85 <a class="indexterm" name="id26094 92"></a>86 <a class="indexterm" name="id260949 9"></a>87 <a class="indexterm" name="id260950 6"></a>88 <a class="indexterm" name="id26095 13"></a>89 <a class="indexterm" name="id26095 22"></a><a class="indexterm" name="id2609528"></a>76 </p></li></ul></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2609425"></a>Technical Issues</h3></div></div></div><p> 77 <a class="indexterm" name="id2609432"></a> 78 <a class="indexterm" name="id2609439"></a> 79 <a class="indexterm" name="id2609446"></a> 80 <a class="indexterm" name="id2609453"></a> 81 <a class="indexterm" name="id2609460"></a> 82 <a class="indexterm" name="id2609467"></a> 83 <a class="indexterm" name="id2609474"></a> 84 <a class="indexterm" name="id2609480"></a> 85 <a class="indexterm" name="id2609487"></a> 86 <a class="indexterm" name="id2609494"></a> 87 <a class="indexterm" name="id2609501"></a> 88 <a class="indexterm" name="id2609508"></a> 89 <a class="indexterm" name="id2609517"></a><a class="indexterm" name="id2609523"></a> 90 90 Functionally, the user's Internet Explorer requests a browsing session with the 91 91 Squid proxy, for which it offers its AD authentication token. Squid hands off … … 108 108 </p></li><li><p> 109 109 Tying it all together 110 </p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id260958 5"></a>Political Issues</h3></div></div></div><p>110 </p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2609581"></a>Political Issues</h3></div></div></div><p> 111 111 You are a stranger in a strange land, and all eyes are upon you. Some would even like to see 112 112 you fail. For you to gain the trust of your newly acquired IT people, it is essential that your … … 114 114 will the entrenched positions consider taking up your new way of doing things on a 115 115 wider scale. 116 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2609 603"></a>Implementation</h2></div></div></div><p>117 <a class="indexterm" name="id26096 11"></a>116 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2609598"></a>Implementation</h2></div></div></div><p> 117 <a class="indexterm" name="id2609606"></a> 118 118 First, your system needs to be prepared and in a known good state to proceed. This consists 119 119 of making sure that everything the system depends on is present and that everything that could … … 122 122 they must be removed. 123 123 </p><p> 124 <a class="indexterm" name="id260962 8"></a>124 <a class="indexterm" name="id2609623"></a> 125 125 The following packages should be available on your Red Hat Linux system: 126 126 </p><div class="itemizedlist"><ul type="disc"><li><p> 127 <a class="indexterm" name="id26096 43"></a>128 <a class="indexterm" name="id260964 9"></a>127 <a class="indexterm" name="id2609638"></a> 128 <a class="indexterm" name="id2609645"></a> 129 129 krb5-libs 130 130 </p></li><li><p> … … 137 137 pam_krb5 138 138 </p></li></ul></div><p> 139 <a class="indexterm" name="id26096 80"></a>139 <a class="indexterm" name="id2609675"></a> 140 140 In the case of SUSE Linux, these packages are called: 141 141 </p><div class="itemizedlist"><ul type="disc"><li><p> … … 144 144 heimdal-devel 145 145 </p></li><li><p> 146 <a class="indexterm" name="id260970 4"></a>146 <a class="indexterm" name="id2609700"></a> 147 147 heimdal 148 148 </p></li><li><p> … … 153 153 for your Linux system to ensure that the packages are correctly updated. 154 154 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 155 <a class="indexterm" name="id260972 9"></a>156 <a class="indexterm" name="id260973 6"></a>157 <a class="indexterm" name="id26097 43"></a>155 <a class="indexterm" name="id2609725"></a> 156 <a class="indexterm" name="id2609732"></a> 157 <a class="indexterm" name="id2609739"></a> 158 158 If the requirement is for interoperation with MS Windows Server 2003, it 159 159 will be necessary to ensure that you are using MIT Kerberos version 1.3.1 … … 161 161 updating. 162 162 </p><p> 163 <a class="indexterm" name="id260975 7"></a>164 <a class="indexterm" name="id26097 64"></a>163 <a class="indexterm" name="id2609752"></a> 164 <a class="indexterm" name="id2609759"></a> 165 165 Heimdal 0.6 or later is required in the case of SUSE Linux. SUSE Enterprise 166 166 Linux Server 8 ships with Heimdal 0.4. SUSE 9 ships with the necessary version. 167 167 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch10-one"></a>Removal of Pre-Existing Conflicting RPMs</h3></div></div></div><p> 168 <a class="indexterm" name="id260978 7"></a>168 <a class="indexterm" name="id2609782"></a> 169 169 If Samba and/or Squid RPMs are installed, they should be updated. You can 170 170 build both from source. 171 171 </p><p> 172 <a class="indexterm" name="id260979 8"></a>173 <a class="indexterm" name="id260980 5"></a>174 <a class="indexterm" name="id26098 12"></a>172 <a class="indexterm" name="id2609794"></a> 173 <a class="indexterm" name="id2609800"></a> 174 <a class="indexterm" name="id2609807"></a> 175 175 Locating the packages to be un-installed can be achieved by running: 176 176 </p><pre class="screen"> … … 182 182 <code class="prompt">root# </code> rpm -e samba-common 183 183 </pre><p> 184 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id26098 52"></a>Kerberos Configuration</h3></div></div></div><p>185 <a class="indexterm" name="id26098 60"></a>186 <a class="indexterm" name="id260986 6"></a>187 <a class="indexterm" name="id260987 6"></a>188 <a class="indexterm" name="id26098 82"></a>184 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2609847"></a>Kerberos Configuration</h3></div></div></div><p> 185 <a class="indexterm" name="id2609855"></a> 186 <a class="indexterm" name="id2609862"></a> 187 <a class="indexterm" name="id2609871"></a> 188 <a class="indexterm" name="id2609878"></a> 189 189 The systems Kerberos installation must be configured to communicate with 190 190 your primary Active Directory server (ADS KDC). … … 194 194 unless you are using Windows 2003 servers. 195 195 </p><p> 196 <a class="indexterm" name="id2609 902"></a>197 <a class="indexterm" name="id260990 8"></a>198 <a class="indexterm" name="id260991 5"></a>199 <a class="indexterm" name="id26099 22"></a>200 <a class="indexterm" name="id260992 9"></a>201 <a class="indexterm" name="id260993 8"></a>202 <a class="indexterm" name="id26099 44"></a>196 <a class="indexterm" name="id2609897"></a> 197 <a class="indexterm" name="id2609903"></a> 198 <a class="indexterm" name="id2609910"></a> 199 <a class="indexterm" name="id2609917"></a> 200 <a class="indexterm" name="id2609924"></a> 201 <a class="indexterm" name="id2609933"></a> 202 <a class="indexterm" name="id2609939"></a> 203 203 Officially, neither MIT (1.3.4) nor Heimdal (0.63) Kerberos needs an <code class="filename">/etc/krb5.conf</code> 204 204 file in order to work correctly. All ADS domains automatically create SRV records in the … … 208 208 specifying only a single KDC, even if there is more than one. Using the DNS lookup 209 209 allows the KRB5 libraries to use whichever KDCs are available. 210 </p><div class="procedure"><a name="id260997 8"></a><p class="title"><b>Procedure 12.1. Kerberos Configuration Steps</b></p><ol type="1"><li><p>211 <a class="indexterm" name="id26099 90"></a>210 </p><div class="procedure"><a name="id2609974"></a><p class="title"><b>Procedure 12.1. Kerberos Configuration Steps</b></p><ol type="1"><li><p> 211 <a class="indexterm" name="id2609985"></a> 212 212 If you find the need to manually configure the <code class="filename">krb5.conf</code>, you should edit it 213 213 to have the contents shown in <a class="link" href="DomApps.html#ch10-krb5conf" title="Example 12.1. Kerberos Configuration File: /etc/krb5.conf">“Kerberos Configuration File: /etc/krb5.conf”</a>. The final fully qualified path for this file 214 214 should be <code class="filename">/etc/krb5.conf</code>. 215 215 </p></li><li><p> 216 <a class="indexterm" name="id261002 5"></a>217 <a class="indexterm" name="id26100 31"></a>218 <a class="indexterm" name="id261003 8"></a>219 <a class="indexterm" name="id261004 5"></a>220 <a class="indexterm" name="id26100 52"></a>221 <a class="indexterm" name="id261005 9"></a>222 <a class="indexterm" name="id261006 6"></a>223 <a class="indexterm" name="id26100 72"></a>224 <a class="indexterm" name="id261007 9"></a>225 <a class="indexterm" name="id261008 8"></a>226 <a class="indexterm" name="id261009 5"></a>227 <a class="indexterm" name="id2610 102"></a>228 <a class="indexterm" name="id261010 8"></a>216 <a class="indexterm" name="id2610020"></a> 217 <a class="indexterm" name="id2610027"></a> 218 <a class="indexterm" name="id2610034"></a> 219 <a class="indexterm" name="id2610040"></a> 220 <a class="indexterm" name="id2610047"></a> 221 <a class="indexterm" name="id2610054"></a> 222 <a class="indexterm" name="id2610061"></a> 223 <a class="indexterm" name="id2610068"></a> 224 <a class="indexterm" name="id2610074"></a> 225 <a class="indexterm" name="id2610083"></a> 226 <a class="indexterm" name="id2610090"></a> 227 <a class="indexterm" name="id2610097"></a> 228 <a class="indexterm" name="id2610104"></a> 229 229 The following gotchas often catch people out. Kerberos is case sensitive. Your realm must 230 230 be in UPPERCASE, or you will get an error: “<span class="quote">Cannot find KDC for requested realm while getting … … 242 242 when you try to join the realm. 243 243 </p></li><li><p> 244 <a class="indexterm" name="id26101 52"></a>244 <a class="indexterm" name="id2610148"></a> 245 245 You are now ready to test your installation by issuing the command: 246 246 </p><pre class="screen"> … … 262 262 kdc = w2k3s.london.abmas.biz 263 263 } 264 </pre></div></div><br class="example-break"><p><a class="indexterm" name="id261021 7"></a>264 </pre></div></div><br class="example-break"><p><a class="indexterm" name="id2610213"></a> 265 265 The command 266 266 </p><pre class="screen"> … … 268 268 </pre><p> 269 269 shows the Kerberos tickets cached by the system. 270 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id26102 40"></a>Samba Configuration</h4></div></div></div><p>271 <a class="indexterm" name="id261024 8"></a>270 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2610236"></a>Samba Configuration</h4></div></div></div><p> 271 <a class="indexterm" name="id2610244"></a> 272 272 Samba must be configured to correctly use Active Directory. Samba-3 must be used, since it 273 273 has the necessary components to interface with Active Directory. 274 </p><div class="procedure"><a name="id261025 9"></a><p class="title"><b>Procedure 12.2. Securing Samba-3 With ADS Support Steps</b></p><ol type="1"><li><p>275 <a class="indexterm" name="id26102 71"></a>276 <a class="indexterm" name="id261027 8"></a>277 <a class="indexterm" name="id261028 4"></a>278 <a class="indexterm" name="id26102 92"></a>279 <a class="indexterm" name="id261029 8"></a>274 </p><div class="procedure"><a name="id2610254"></a><p class="title"><b>Procedure 12.2. Securing Samba-3 With ADS Support Steps</b></p><ol type="1"><li><p> 275 <a class="indexterm" name="id2610266"></a> 276 <a class="indexterm" name="id2610273"></a> 277 <a class="indexterm" name="id2610280"></a> 278 <a class="indexterm" name="id2610287"></a> 279 <a class="indexterm" name="id2610294"></a> 280 280 Download the latest stable Samba-3 for Red Hat Linux from the official Samba Team 281 281 <a class="ulink" href="http://ftp.samba.org" target="_top">FTP site.</a> The official Samba Team … … 283 283 needed, and are linked against MIT KRB5 version 1.3.1 and therefore are ready for use. 284 284 </p><p> 285 <a class="indexterm" name="id261032 5"></a>286 <a class="indexterm" name="id26103 32"></a>285 <a class="indexterm" name="id2610320"></a> 286 <a class="indexterm" name="id2610327"></a> 287 287 The necessary, validated RPM packages for SUSE Linux may be obtained from 288 288 the <a class="ulink" href="ftp://ftp.sernet.de/pub/samba" target="_top">SerNet</a> FTP site that … … 294 294 file so it has contents similar to the example shown in <a class="link" href="DomApps.html#ch10-smbconf" title="Example 12.2. Samba Configuration File: /etc/samba/smb.conf">“Samba Configuration File: /etc/samba/smb.conf”</a>. 295 295 </p></li><li><p> 296 <a class="indexterm" name="id26103 83"></a>297 <a class="indexterm" name="id26103 90"></a>298 <a class="indexterm" name="id261039 6"></a>i299 <a class="indexterm" name="id261040 8"></a>300 <a class="indexterm" name="id261041 5"></a>296 <a class="indexterm" name="id2610378"></a> 297 <a class="indexterm" name="id2610385"></a> 298 <a class="indexterm" name="id2610392"></a>i 299 <a class="indexterm" name="id2610403"></a> 300 <a class="indexterm" name="id2610410"></a> 301 301 Next you need to create a computer account in the Active Directory. 302 302 This sets up the trust relationship needed for other clients to … … 308 308 </pre><p> 309 309 </p></li><li><p> 310 <a class="indexterm" name="id261044 9"></a>311 <a class="indexterm" name="id261045 6"></a>312 <a class="indexterm" name="id26104 62"></a>313 <a class="indexterm" name="id261046 9"></a>314 <a class="indexterm" name="id261047 6"></a>310 <a class="indexterm" name="id2610444"></a> 311 <a class="indexterm" name="id2610451"></a> 312 <a class="indexterm" name="id2610458"></a> 313 <a class="indexterm" name="id2610465"></a> 314 <a class="indexterm" name="id2610472"></a> 315 315 Your new Samba binaries must be started in the standard manner as is applicable 316 316 to the platform you are running on. Alternatively, start your Active Directory-enabled Samba with the following commands: … … 321 321 </pre><p> 322 322 </p></li><li><p> 323 <a class="indexterm" name="id261051 7"></a>324 <a class="indexterm" name="id26105 24"></a>325 <a class="indexterm" name="id26105 33"></a>326 <a class="indexterm" name="id26105 40"></a>327 <a class="indexterm" name="id261054 7"></a>323 <a class="indexterm" name="id2610512"></a> 324 <a class="indexterm" name="id2610519"></a> 325 <a class="indexterm" name="id2610528"></a> 326 <a class="indexterm" name="id2610535"></a> 327 <a class="indexterm" name="id2610542"></a> 328 328 We now need to test that Samba is communicating with the Active 329 329 Directory domain; most specifically, we want to see whether winbind … … 358 358 This enumerates all the groups in your Active Directory tree. 359 359 </p></li><li><p> 360 <a class="indexterm" name="id26106 11"></a>361 <a class="indexterm" name="id261061 8"></a>360 <a class="indexterm" name="id2610606"></a> 361 <a class="indexterm" name="id2610613"></a> 362 362 Squid uses the <code class="literal">ntlm_auth</code> helper build with Samba-3. 363 363 You may test <code class="literal">ntlm_auth</code> with the command: … … 371 371 </pre><p> 372 372 </p></li><li><p> 373 <a class="indexterm" name="id26106 70"></a>374 <a class="indexterm" name="id261067 7"></a>375 <a class="indexterm" name="id26106 84"></a>376 <a class="indexterm" name="id26106 90"></a>377 <a class="indexterm" name="id261069 7"></a>378 <a class="indexterm" name="id2610 704"></a>379 <a class="indexterm" name="id26107 11"></a>380 <a class="indexterm" name="id261071 8"></a>373 <a class="indexterm" name="id2610665"></a> 374 <a class="indexterm" name="id2610672"></a> 375 <a class="indexterm" name="id2610679"></a> 376 <a class="indexterm" name="id2610686"></a> 377 <a class="indexterm" name="id2610693"></a> 378 <a class="indexterm" name="id2610699"></a> 379 <a class="indexterm" name="id2610706"></a> 380 <a class="indexterm" name="id2610713"></a> 381 381 The <code class="literal">ntlm_auth</code> helper, when run from a command line as the user 382 382 “<span class="quote">root</span>”, authenticates against your Active Directory domain (with … … 396 396 <code class="prompt">root# </code> chmod 750 /var/lib/samba/winbindd_privileged 397 397 </pre><p> 398 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id26107 93"></a>NSS Configuration</h4></div></div></div><p>399 <a class="indexterm" name="id2610 801"></a>400 <a class="indexterm" name="id261080 7"></a>401 <a class="indexterm" name="id26108 14"></a>398 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2610788"></a>NSS Configuration</h4></div></div></div><p> 399 <a class="indexterm" name="id2610796"></a> 400 <a class="indexterm" name="id2610802"></a> 401 <a class="indexterm" name="id2610809"></a> 402 402 For Squid to benefit from Samba-3, NSS must be updated to allow winbind as a valid route to user authentication. 403 403 </p><p> 404 404 Edit your <code class="filename">/etc/nsswitch.conf</code> file so it has the parameters shown 405 405 in <a class="link" href="DomApps.html#ch10-etcnsscfg" title="Example 12.3. NSS Configuration File Extract File: /etc/nsswitch.conf">“NSS Configuration File Extract File: /etc/nsswitch.conf”</a>. 406 </p><div class="example"><a name="ch10-smbconf"></a><p class="title"><b>Example 12.2. Samba Configuration File: <code class="filename">/etc/samba/smb.conf</code></b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id26108 73"></a><em class="parameter"><code>workgroup = LONDON</code></em></td></tr><tr><td><a class="indexterm" name="id2610884"></a><em class="parameter"><code>netbios name = W2K3S</code></em></td></tr><tr><td><a class="indexterm" name="id2610896"></a><em class="parameter"><code>realm = LONDON.ABMAS.BIZ</code></em></td></tr><tr><td><a class="indexterm" name="id2610908"></a><em class="parameter"><code>security = ads</code></em></td></tr><tr><td><a class="indexterm" name="id2610919"></a><em class="parameter"><code>encrypt passwords = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2610931"></a><em class="parameter"><code>password server = w2k3s.london.abmas.biz</code></em></td></tr><tr><td># separate domain and username with '/', like DOMAIN/username</td></tr><tr><td><a class="indexterm" name="id2610948"></a><em class="parameter"><code>winbind separator = /</code></em></td></tr><tr><td># use UIDs from 10000 to 20000 for domain users</td></tr><tr><td><a class="indexterm" name="id2610964"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td># use GIDs from 10000 to 20000 for domain groups</td></tr><tr><td><a class="indexterm" name="id2610980"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td># allow enumeration of winbind users and groups</td></tr><tr><td><a class="indexterm" name="id2610996"></a><em class="parameter"><code>winbind enum users = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2611007"></a><em class="parameter"><code>winbind enum groups = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2611019"></a><em class="parameter"><code>winbind user default domain = yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch10-etcnsscfg"></a><p class="title"><b>Example 12.3. NSS Configuration File Extract File: <code class="filename">/etc/nsswitch.conf</code></b></p><div class="example-contents"><pre class="screen">406 </p><div class="example"><a name="ch10-smbconf"></a><p class="title"><b>Example 12.2. Samba Configuration File: <code class="filename">/etc/samba/smb.conf</code></b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2610868"></a><em class="parameter"><code>workgroup = LONDON</code></em></td></tr><tr><td><a class="indexterm" name="id2610880"></a><em class="parameter"><code>netbios name = W2K3S</code></em></td></tr><tr><td><a class="indexterm" name="id2610891"></a><em class="parameter"><code>realm = LONDON.ABMAS.BIZ</code></em></td></tr><tr><td><a class="indexterm" name="id2610903"></a><em class="parameter"><code>security = ads</code></em></td></tr><tr><td><a class="indexterm" name="id2610915"></a><em class="parameter"><code>encrypt passwords = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2610927"></a><em class="parameter"><code>password server = w2k3s.london.abmas.biz</code></em></td></tr><tr><td># separate domain and username with '/', like DOMAIN/username</td></tr><tr><td><a class="indexterm" name="id2610943"></a><em class="parameter"><code>winbind separator = /</code></em></td></tr><tr><td># use UIDs from 10000 to 20000 for domain users</td></tr><tr><td><a class="indexterm" name="id2610959"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td># use GIDs from 10000 to 20000 for domain groups</td></tr><tr><td><a class="indexterm" name="id2610975"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td># allow enumeration of winbind users and groups</td></tr><tr><td><a class="indexterm" name="id2610991"></a><em class="parameter"><code>winbind enum users = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2611003"></a><em class="parameter"><code>winbind enum groups = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2611015"></a><em class="parameter"><code>winbind user default domain = yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch10-etcnsscfg"></a><p class="title"><b>Example 12.3. NSS Configuration File Extract File: <code class="filename">/etc/nsswitch.conf</code></b></p><div class="example-contents"><pre class="screen"> 407 407 passwd: files winbind 408 408 shadow: files 409 409 group: files winbind 410 </pre></div></div><br class="example-break"></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id261105 8"></a>Squid Configuration</h4></div></div></div><p>411 <a class="indexterm" name="id261106 6"></a>412 <a class="indexterm" name="id26110 73"></a>410 </pre></div></div><br class="example-break"></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2611054"></a>Squid Configuration</h4></div></div></div><p> 411 <a class="indexterm" name="id2611061"></a> 412 <a class="indexterm" name="id2611068"></a> 413 413 Squid must be configured correctly to interact with the Samba-3 414 414 components that handle Active Directory authentication. 415 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id261108 8"></a>Configuration</h3></div></div></div></div><div class="procedure"><a name="id2611094"></a><p class="title"><b>Procedure 12.3. Squid Configuration Steps</b></p><ol type="1"><li><p>416 <a class="indexterm" name="id261110 5"></a>417 <a class="indexterm" name="id26111 12"></a>418 <a class="indexterm" name="id26111 20"></a>415 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2611083"></a>Configuration</h3></div></div></div></div><div class="procedure"><a name="id2611089"></a><p class="title"><b>Procedure 12.3. Squid Configuration Steps</b></p><ol type="1"><li><p> 416 <a class="indexterm" name="id2611100"></a> 417 <a class="indexterm" name="id2611107"></a> 418 <a class="indexterm" name="id2611115"></a> 419 419 If your Linux distribution is SUSE Linux 9, the version of Squid 420 420 supplied is already enabled to use the winbind helper agent. You … … 422 422 programs. 423 423 </p></li><li><p> 424 <a class="indexterm" name="id261113 7"></a>425 <a class="indexterm" name="id26111 44"></a>426 <a class="indexterm" name="id26111 50"></a>427 <a class="indexterm" name="id261115 7"></a>428 <a class="indexterm" name="id26111 64"></a>424 <a class="indexterm" name="id2611132"></a> 425 <a class="indexterm" name="id2611139"></a> 426 <a class="indexterm" name="id2611146"></a> 427 <a class="indexterm" name="id2611152"></a> 428 <a class="indexterm" name="id2611159"></a> 429 429 Squid, by default, runs as the user <code class="constant">nobody</code>. You need to 430 430 add a system user <code class="constant">squid</code> and a system group … … 434 434 and a <code class="constant">squid</code> group in <code class="filename">/etc/group</code> if these aren't there already. 435 435 </p></li><li><p> 436 <a class="indexterm" name="id26112 12"></a>437 <a class="indexterm" name="id261121 8"></a>436 <a class="indexterm" name="id2611207"></a> 437 <a class="indexterm" name="id2611214"></a> 438 438 You now need to change the permissions on Squid's <code class="constant">var</code> 439 439 directory. Enter the following command: … … 442 442 </pre><p> 443 443 </p></li><li><p> 444 <a class="indexterm" name="id261124 9"></a>445 <a class="indexterm" name="id261125 6"></a>444 <a class="indexterm" name="id2611245"></a> 445 <a class="indexterm" name="id2611251"></a> 446 446 Squid must also have control over its logging. Enter the following commands: 447 447 </p><pre class="screen"> … … 457 457 </pre><p> 458 458 </p></li><li><p> 459 <a class="indexterm" name="id261131 6"></a>459 <a class="indexterm" name="id2611311"></a> 460 460 The <code class="filename">/etc/squid/squid.conf</code> file must be edited to include the lines from 461 461 <a class="link" href="DomApps.html#etcsquidcfg" title="Example 12.4. Squid Configuration File Extract /etc/squid.conf [ADMINISTRATIVE PARAMETERS Section]">“Squid Configuration File Extract /etc/squid.conf [ADMINISTRATIVE PARAMETERS Section]”</a> and <a class="link" href="DomApps.html#etcsquid2" title="Example 12.5. Squid Configuration File extract File: /etc/squid.conf [AUTHENTICATION PARAMETERS Section]">“Squid Configuration File extract File: /etc/squid.conf [AUTHENTICATION PARAMETERS Section]”</a>. 462 462 </p></li><li><p> 463 <a class="indexterm" name="id26113 50"></a>463 <a class="indexterm" name="id2611346"></a> 464 464 You must create Squid's cache directories before it may be run. Enter the following command: 465 465 </p><pre class="screen"> … … 488 488 acl AuthorizedUsers proxy_auth REQUIRED 489 489 http_access allow all AuthorizedUsers 490 </pre></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id261145 5"></a>Key Points Learned</h3></div></div></div><p>491 <a class="indexterm" name="id26114 63"></a>492 <a class="indexterm" name="id26114 70"></a>493 <a class="indexterm" name="id261147 7"></a>494 <a class="indexterm" name="id26114 84"></a>495 <a class="indexterm" name="id261149 5"></a>490 </pre></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2611450"></a>Key Points Learned</h3></div></div></div><p> 491 <a class="indexterm" name="id2611458"></a> 492 <a class="indexterm" name="id2611465"></a> 493 <a class="indexterm" name="id2611472"></a> 494 <a class="indexterm" name="id2611479"></a> 495 <a class="indexterm" name="id2611490"></a> 496 496 Microsoft Windows networking protocols permeate the spectrum of technologies that Microsoft 497 497 Windows clients use, even when accessing traditional services such as Web browsers. Depending … … 500 500 the cookie-based authentication regime used by all competing browsers. It is Samba's implementation 501 501 of NTLMSSP that makes it attractive to implement the solution that has been demonstrated in this chapter. 502 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id261151 5"></a>Questions and Answers</h2></div></div></div><p>503 <a class="indexterm" name="id26115 23"></a>504 <a class="indexterm" name="id26115 30"></a>505 <a class="indexterm" name="id261153 7"></a>506 <a class="indexterm" name="id26115 44"></a>502 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2611510"></a>Questions and Answers</h2></div></div></div><p> 503 <a class="indexterm" name="id2611518"></a> 504 <a class="indexterm" name="id2611525"></a> 505 <a class="indexterm" name="id2611532"></a> 506 <a class="indexterm" name="id2611539"></a> 507 507 The development of the <code class="literal">ntlm_auth</code> module was first discussed in many Open Source circles 508 508 in 2002. At the SambaXP conference in Goettingen, Germany, Mr. Francesco Chemolli demonstrated the use of … … 523 523 Make certain that your Squid proxy server is equipped with sufficient memory to permit all proxy operations to run 524 524 out of memory without invoking the overheads involved in the use of memory that has to be swapped to disk. 525 </p><div class="qandaset"><dl><dt> <a href="DomApps.html#id26116 21">525 </p><div class="qandaset"><dl><dt> <a href="DomApps.html#id2611617"> 526 526 What does Samba have to do with Web proxy serving? 527 </a></dt><dt> <a href="DomApps.html#id261178 7">527 </a></dt><dt> <a href="DomApps.html#id2611783"> 528 528 What other services does Samba provide? 529 </a></dt><dt> <a href="DomApps.html#id26119 30">529 </a></dt><dt> <a href="DomApps.html#id2611926"> 530 530 Does use of Samba (ntlm_auth) improve the performance of Squid? 531 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id26116 21"></a><a name="id2611623"></a></td><td align="left" valign="top"><p>531 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2611617"></a><a name="id2611619"></a></td><td align="left" valign="top"><p> 532 532 What does Samba have to do with Web proxy serving? 533 533 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 534 <a class="indexterm" name="id261163 5"></a>535 <a class="indexterm" name="id26116 42"></a>536 <a class="indexterm" name="id261164 9"></a>537 <a class="indexterm" name="id261165 8"></a>538 <a class="indexterm" name="id261166 5"></a>534 <a class="indexterm" name="id2611630"></a> 535 <a class="indexterm" name="id2611638"></a> 536 <a class="indexterm" name="id2611645"></a> 537 <a class="indexterm" name="id2611654"></a> 538 <a class="indexterm" name="id2611661"></a> 539 539 To provide transparent interoperability between Windows clients and the network services 540 540 that are used from them, Samba had to develop tools and facilities that deliver that feature. The benefit … … 542 542 module is basically a wrapper around authentication code from the core of the Samba project. 543 543 </p><p> 544 <a class="indexterm" name="id261168 8"></a>545 <a class="indexterm" name="id261169 4"></a>546 <a class="indexterm" name="id2611 704"></a>547 <a class="indexterm" name="id26117 13"></a>548 <a class="indexterm" name="id26117 22"></a>549 <a class="indexterm" name="id261172 8"></a>550 <a class="indexterm" name="id261173 5"></a>551 <a class="indexterm" name="id26117 42"></a>552 <a class="indexterm" name="id261174 9"></a>544 <a class="indexterm" name="id2611683"></a> 545 <a class="indexterm" name="id2611690"></a> 546 <a class="indexterm" name="id2611699"></a> 547 <a class="indexterm" name="id2611708"></a> 548 <a class="indexterm" name="id2611717"></a> 549 <a class="indexterm" name="id2611724"></a> 550 <a class="indexterm" name="id2611731"></a> 551 <a class="indexterm" name="id2611738"></a> 552 <a class="indexterm" name="id2611745"></a> 553 553 The <code class="literal">ntlm_auth</code> module supports basic plain-text authentication and NTLMSSP 554 554 protocols. This module makes it possible for Web and FTP proxy requests to be authenticated without … … 558 558 also. 559 559 </p><p> 560 <a class="indexterm" name="id26117 74"></a>560 <a class="indexterm" name="id2611769"></a> 561 561 The short answer is that by adding a wrapper around key authentication components of Samba, other 562 562 projects (like Squid) can benefit from the labors expended in meeting user interoperability needs. 563 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id261178 7"></a><a name="id2611789"></a></td><td align="left" valign="top"><p>563 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2611783"></a><a name="id2611785"></a></td><td align="left" valign="top"><p> 564 564 What other services does Samba provide? 565 565 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 566 <a class="indexterm" name="id2611 801"></a>567 <a class="indexterm" name="id261180 8"></a>568 <a class="indexterm" name="id261181 5"></a>569 <a class="indexterm" name="id26118 22"></a>570 <a class="indexterm" name="id261182 8"></a>566 <a class="indexterm" name="id2611796"></a> 567 <a class="indexterm" name="id2611803"></a> 568 <a class="indexterm" name="id2611810"></a> 569 <a class="indexterm" name="id2611817"></a> 570 <a class="indexterm" name="id2611824"></a> 571 571 Samba-3 is a file and print server. The core components that provide this functionality are <code class="literal">smbd</code>, 572 572 <code class="literal">nmbd</code>, and the identity resolver daemon, <code class="literal">winbindd</code>. 573 573 </p><p> 574 <a class="indexterm" name="id261185 9"></a>575 <a class="indexterm" name="id261186 6"></a>574 <a class="indexterm" name="id2611854"></a> 575 <a class="indexterm" name="id2611861"></a> 576 576 Samba-3 is an SMB/CIFS client. The core component that provides this is called <code class="literal">smbclient</code>. 577 577 </p><p> 578 <a class="indexterm" name="id26118 83"></a>579 <a class="indexterm" name="id26118 90"></a>580 <a class="indexterm" name="id261189 7"></a>581 <a class="indexterm" name="id2611 904"></a>582 <a class="indexterm" name="id26119 10"></a>578 <a class="indexterm" name="id2611878"></a> 579 <a class="indexterm" name="id2611885"></a> 580 <a class="indexterm" name="id2611892"></a> 581 <a class="indexterm" name="id2611899"></a> 582 <a class="indexterm" name="id2611906"></a> 583 583 Samba-3 includes a number of helper tools, plug-in modules, utilities, and test and validation facilities. 584 584 Samba-3 includes glue modules that help provide interoperability between MS Windows clients and UNIX/Linux … … 587 587 to permit identity resolution via SMB/CIFS servers (Windows NT4/200x, Samba, and a host of other commercial 588 588 server products). 589 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id26119 30"></a><a name="id2611933"></a></td><td align="left" valign="top"><p>589 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2611926"></a><a name="id2611928"></a></td><td align="left" valign="top"><p> 590 590 Does use of Samba (<code class="literal">ntlm_auth</code>) improve the performance of Squid? 591 591 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> -
branches/samba-3.2.x/docs/htmldocs/Samba3-ByExample/ExNetworks.html
r204 r226 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Part I. Example Network Configurations</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="preface.html" title="Preface"><link rel="next" href="simple.html" title="Chapter 1. No-Frills Samba Servers"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Part I. Example Network Configurations</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="preface.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="simple.html">Next</a></td></tr></table><hr></div><div class="part" lang="en"><div class="titlepage"><div><div><h1 class="title"><a name="ExNetworks"></a>Part I. Example Network Configurations</h1></div></div></div><div class="partintro" lang="en"><div><div><div><h1 class="title"><a name="id254291 5"></a>Example Network Configurations</h1></div></div></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Part I. Example Network Configurations</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="preface.html" title="Preface"><link rel="next" href="simple.html" title="Chapter 1. No-Frills Samba Servers"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Part I. Example Network Configurations</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="preface.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="simple.html">Next</a></td></tr></table><hr></div><div class="part" lang="en"><div class="titlepage"><div><div><h1 class="title"><a name="ExNetworks"></a>Part I. Example Network Configurations</h1></div></div></div><div class="partintro" lang="en"><div><div><div><h1 class="title"><a name="id2542910"></a>Example Network Configurations</h1></div></div></div><p> 2 2 This section of <span class="emphasis"><em>Samba-3 by Example</em></span> provides example network 3 3 configurations that can be copied, or modified as needed, and deployed as-is. … … 21 21 <a class="ulink" href="http://www.samba.org/samba/support/" target="_top">support</a> pages from 22 22 the Samba web site. 23 </p><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="chapter"><a href="simple.html">1. No-Frills Samba Servers</a></span></dt><dd><dl><dt><span class="sect1"><a href="simple.html#id25429 93">Introduction</a></span></dt><dt><span class="sect1"><a href="simple.html#id2543034">Assignment Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="simple.html#id2543078">Drafting Office</a></span></dt><dt><span class="sect2"><a href="simple.html#id2543849">Charity Administration Office</a></span></dt><dt><span class="sect2"><a href="simple.html#AccountingOffice">Accounting Office</a></span></dt></dl></dd><dt><span class="sect1"><a href="simple.html#id2547514">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="small.html">2. Small Office Networking</a></span></dt><dd><dl><dt><span class="sect1"><a href="small.html#id2547998">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2548021">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2548082">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2548136">Technical Issues</a></span></dt><dt><span class="sect2"><a href="small.html#id2548347">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2548369">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2550069">Validation</a></span></dt><dt><span class="sect2"><a href="small.html#id2550774">Notebook Computers: A Special Case</a></span></dt><dt><span class="sect2"><a href="small.html#id2550800">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2550876">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="secure.html">3. Secure Office Networking</a></span></dt><dd><dl><dt><span class="sect1"><a href="secure.html#id2551387">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id2551439">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2551688">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id2551704">Technical Issues</a></span></dt><dt><span class="sect2"><a href="secure.html#id2552156">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2552197">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#ch4bsc">Basic System Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id2553134">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4ptrcfg">Printer Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4valid">Validation</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4appscfg">Application Share Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id2557769">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2557831">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="Big500users.html">4. The 500-User Office</a></span></dt><dd><dl><dt><span class="sect1"><a href="Big500users.html#id2558352">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id2558397">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id2558503">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id2558539">Technical Issues</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2558741">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id2558764">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#ch5-dnshcp-setup">Installation of DHCP, DNS, and Samba Control Files</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2559494">Server Preparation: All Servers</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2560058">Server-Specific Preparation</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5-procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2563258">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id2563317">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="happy.html">5. Making Happy Users</a></span></dt><dd><dl><dt><span class="sect1"><a href="happy.html#id2564154">Regarding LDAP Directories and Windows Computer Accounts</a></span></dt><dt><span class="sect1"><a href="happy.html#id2564296">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id2564394">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2564531">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id2564988">Technical Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id2566867">Political Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id2566882">Installation Checklist</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2567062">Samba Server Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbeidealx">Install and Configure Idealx smbldap-tools Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id2569962">LDAP Initialization and Creation of User and Group Accounts</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-ptrcfg">Printer Configuration</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a></span></dt><dt><span class="sect1"><a href="happy.html#id2573911">Miscellaneous Server Preparation Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id2573932">Configuring Directory Share Point Roots</a></span></dt><dt><span class="sect2"><a href="happy.html#id2574027">Configuring Profile Directories</a></span></dt><dt><span class="sect2"><a href="happy.html#id2574271">Preparation of Logon Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id2574382">Assigning User Rights and Privileges</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2574516">Windows Client Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></span></dt><dt><span class="sect2"><a href="happy.html#id2575269">Configuration of MS Outlook to Relocate PST File</a></span></dt><dt><span class="sect2"><a href="happy.html#id2575585">Configure Delete Cached Profiles on Logout</a></span></dt><dt><span class="sect2"><a href="happy.html#id2575764">Uploading Printer Drivers to Samba Servers</a></span></dt><dt><span class="sect2"><a href="happy.html#id2576267">Software Installation</a></span></dt><dt><span class="sect2"><a href="happy.html#id2576303">Roll-out Image Creation</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2576337">Key Points Learned</a></span></dt><dt><span class="sect1"><a href="happy.html#id2576452">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="2000users.html">6. A Distributed 2000-User Network</a></span></dt><dd><dl><dt><span class="sect1"><a href="2000users.html#id2576874">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id2576904">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id2576972">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id2577245">Technical Issues</a></span></dt><dt><span class="sect2"><a href="2000users.html#id2578189">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id2578207">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id2581365">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id2581512">Questions and Answers</a></span></dt></dl></dd></dl></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="preface.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="simple.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Preface </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 1. No-Frills Samba Servers</td></tr></table></div></body></html>23 </p><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="chapter"><a href="simple.html">1. No-Frills Samba Servers</a></span></dt><dd><dl><dt><span class="sect1"><a href="simple.html#id2542989">Introduction</a></span></dt><dt><span class="sect1"><a href="simple.html#id2543030">Assignment Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="simple.html#id2543074">Drafting Office</a></span></dt><dt><span class="sect2"><a href="simple.html#id2543845">Charity Administration Office</a></span></dt><dt><span class="sect2"><a href="simple.html#AccountingOffice">Accounting Office</a></span></dt></dl></dd><dt><span class="sect1"><a href="simple.html#id2547510">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="small.html">2. Small Office Networking</a></span></dt><dd><dl><dt><span class="sect1"><a href="small.html#id2547993">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2548016">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2548078">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2548131">Technical Issues</a></span></dt><dt><span class="sect2"><a href="small.html#id2548343">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2548364">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2550065">Validation</a></span></dt><dt><span class="sect2"><a href="small.html#id2550769">Notebook Computers: A Special Case</a></span></dt><dt><span class="sect2"><a href="small.html#id2550795">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2550871">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="secure.html">3. Secure Office Networking</a></span></dt><dd><dl><dt><span class="sect1"><a href="secure.html#id2551382">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id2551434">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2551684">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id2551699">Technical Issues</a></span></dt><dt><span class="sect2"><a href="secure.html#id2552152">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2552192">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#ch4bsc">Basic System Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id2553129">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4ptrcfg">Printer Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4valid">Validation</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4appscfg">Application Share Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id2557764">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2557826">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="Big500users.html">4. The 500-User Office</a></span></dt><dd><dl><dt><span class="sect1"><a href="Big500users.html#id2558348">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id2558393">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id2558499">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id2558534">Technical Issues</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2558737">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id2558760">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#ch5-dnshcp-setup">Installation of DHCP, DNS, and Samba Control Files</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2559489">Server Preparation: All Servers</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2560054">Server-Specific Preparation</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5-procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2563254">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id2563312">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="happy.html">5. Making Happy Users</a></span></dt><dd><dl><dt><span class="sect1"><a href="happy.html#id2564150">Regarding LDAP Directories and Windows Computer Accounts</a></span></dt><dt><span class="sect1"><a href="happy.html#id2564292">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id2564389">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2564526">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id2564983">Technical Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id2566862">Political Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id2566878">Installation Checklist</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2567058">Samba Server Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbeidealx">Install and Configure Idealx smbldap-tools Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id2569957">LDAP Initialization and Creation of User and Group Accounts</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-ptrcfg">Printer Configuration</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a></span></dt><dt><span class="sect1"><a href="happy.html#id2573907">Miscellaneous Server Preparation Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id2573927">Configuring Directory Share Point Roots</a></span></dt><dt><span class="sect2"><a href="happy.html#id2574022">Configuring Profile Directories</a></span></dt><dt><span class="sect2"><a href="happy.html#id2574266">Preparation of Logon Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id2574377">Assigning User Rights and Privileges</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2574511">Windows Client Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></span></dt><dt><span class="sect2"><a href="happy.html#id2575264">Configuration of MS Outlook to Relocate PST File</a></span></dt><dt><span class="sect2"><a href="happy.html#id2575580">Configure Delete Cached Profiles on Logout</a></span></dt><dt><span class="sect2"><a href="happy.html#id2575759">Uploading Printer Drivers to Samba Servers</a></span></dt><dt><span class="sect2"><a href="happy.html#id2576262">Software Installation</a></span></dt><dt><span class="sect2"><a href="happy.html#id2576298">Roll-out Image Creation</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2576332">Key Points Learned</a></span></dt><dt><span class="sect1"><a href="happy.html#id2576448">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="2000users.html">6. A Distributed 2000-User Network</a></span></dt><dd><dl><dt><span class="sect1"><a href="2000users.html#id2576869">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id2576899">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id2576967">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id2577240">Technical Issues</a></span></dt><dt><span class="sect2"><a href="2000users.html#id2578184">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id2578202">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id2581360">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id2581507">Questions and Answers</a></span></dt></dl></dd></dl></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="preface.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="simple.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Preface </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 1. No-Frills Samba Servers</td></tr></table></div></body></html> -
branches/samba-3.2.x/docs/htmldocs/Samba3-ByExample/HA.html
r204 r226 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 13. Performance, Reliability, and Availability</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="DomApps.html" title="Chapter 12. Integrating Additional Services"><link rel="next" href="ch14.html" title="Chapter 14. Samba Support"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 13. Performance, Reliability, and Availability</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="DomApps.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="ch14.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="HA"></a>Chapter 13. Performance, Reliability, and Availability</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="HA.html#id261203 4">Introduction</a></span></dt><dt><span class="sect1"><a href="HA.html#id2612122">Dissection and Discussion</a></span></dt><dt><span class="sect1"><a href="HA.html#id2612593">Guidelines for Reliable Samba Operation</a></span></dt><dd><dl><dt><span class="sect2"><a href="HA.html#id2612620">Name Resolution</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613096">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613424">Use and Location of BDCs</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613499">Use One Consistent Version of MS Windows Client</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613521">For Scalability, Use SAN-Based Storage on Samba Servers</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613570">Distribute Network Load with MSDFS</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613625">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613671">Hardware Problems</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613829">Large Directories</a></span></dt></dl></dd><dt><span class="sect1"><a href="HA.html#id2613932">Key Points Learned</a></span></dt></dl></div><p>2 <a class="indexterm" name="id261199 6"></a>3 <a class="indexterm" name="id261 2003"></a>4 <a class="indexterm" name="id26120 10"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 13. Performance, Reliability, and Availability</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="DomApps.html" title="Chapter 12. Integrating Additional Services"><link rel="next" href="ch14.html" title="Chapter 14. Samba Support"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 13. Performance, Reliability, and Availability</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="DomApps.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="ch14.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="HA"></a>Chapter 13. Performance, Reliability, and Availability</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="HA.html#id2612030">Introduction</a></span></dt><dt><span class="sect1"><a href="HA.html#id2612117">Dissection and Discussion</a></span></dt><dt><span class="sect1"><a href="HA.html#id2612588">Guidelines for Reliable Samba Operation</a></span></dt><dd><dl><dt><span class="sect2"><a href="HA.html#id2612616">Name Resolution</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613092">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613419">Use and Location of BDCs</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613494">Use One Consistent Version of MS Windows Client</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613516">For Scalability, Use SAN-Based Storage on Samba Servers</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613566">Distribute Network Load with MSDFS</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613620">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613666">Hardware Problems</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613824">Large Directories</a></span></dt></dl></dd><dt><span class="sect1"><a href="HA.html#id2613927">Key Points Learned</a></span></dt></dl></div><p> 2 <a class="indexterm" name="id2611992"></a> 3 <a class="indexterm" name="id2611998"></a> 4 <a class="indexterm" name="id2612005"></a> 5 5 Well, you have reached one of the last chapters of this book. It is customary to attempt 6 6 to wrap up the theme and contents of a book in what is generally regarded as the … … 11 11 </p><div class="blockquote"><table border="0" width="100%" cellspacing="0" cellpadding="0" class="blockquote" summary="Block quote"><tr><td width="10%" valign="top"> </td><td width="80%" valign="top"><p> 12 12 In a world so full of noise, how can the sparrow be heard? 13 </p></td><td width="10%" valign="top"> </td></tr><tr><td width="10%" valign="top"> </td><td colspan="2" align="right" valign="top">--<span class="attribution">Anonymous</span></td></tr></table></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id261203 4"></a>Introduction</h2></div></div></div><p>14 <a class="indexterm" name="id26120 42"></a>13 </p></td><td width="10%" valign="top"> </td></tr><tr><td width="10%" valign="top"> </td><td colspan="2" align="right" valign="top">--<span class="attribution">Anonymous</span></td></tr></table></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2612030"></a>Introduction</h2></div></div></div><p> 14 <a class="indexterm" name="id2612037"></a> 15 15 The sparrow is a small bird whose sounds are drowned out by the noise of the busy 16 16 world it lives in. Likewise, the simple steps that can be taken to improve the … … 21 21 custom tools and methods. Only passing comments are offered concerning these methods. 22 22 </p><p> 23 <a class="indexterm" name="id26120 62"></a>24 <a class="indexterm" name="id261206 9"></a>25 <a class="indexterm" name="id261207 6"></a>23 <a class="indexterm" name="id2612058"></a> 24 <a class="indexterm" name="id2612064"></a> 25 <a class="indexterm" name="id2612071"></a> 26 26 <a class="ulink" href="http://www.google.com/search?hl=en&lr=&ie=ISO-8859-1&q=samba+cluster&btnG=Google+Search" target="_top">A search</a> 27 27 for “<span class="quote">samba cluster</span>” produced 71,600 hits. And a search for “<span class="quote">highly available samba</span>” … … 30 30 availability, reliability, and scalability are of vital interest to corporate network users. 31 31 </p><p> 32 <a class="indexterm" name="id261210 9"></a>32 <a class="indexterm" name="id2612105"></a> 33 33 So without further background, you can review a checklist of simple steps that 34 34 can be taken to ensure acceptable network performance while keeping costs of ownership 35 35 well under control. 36 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id26121 22"></a>Dissection and Discussion</h2></div></div></div><p>37 <a class="indexterm" name="id26121 30"></a>38 <a class="indexterm" name="id261213 6"></a>36 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2612117"></a>Dissection and Discussion</h2></div></div></div><p> 37 <a class="indexterm" name="id2612125"></a> 38 <a class="indexterm" name="id2612132"></a> 39 39 If it is your purpose to get the best mileage out of your Samba servers, there is one rule that 40 40 must be obeyed. If you want the best, keep your implementation as simple as possible. You may … … 45 45 complex ones. 46 46 </p><p> 47 <a class="indexterm" name="id261215 8"></a>48 <a class="indexterm" name="id261216 5"></a>47 <a class="indexterm" name="id2612154"></a> 48 <a class="indexterm" name="id2612161"></a> 49 49 Problems reported by users fall into three categories: configurations that do not work, those 50 50 that have broken behavior, and poor performance. The term <span class="emphasis"><em>broken behavior</em></span> … … 55 55 and at other times not listing them even though the machines are in use on the network. 56 56 </p><p> 57 <a class="indexterm" name="id26121 93"></a>58 <a class="indexterm" name="id2612 200"></a>59 <a class="indexterm" name="id261220 6"></a>60 <a class="indexterm" name="id26122 13"></a>61 <a class="indexterm" name="id26122 20"></a>62 <a class="indexterm" name="id261222 7"></a>57 <a class="indexterm" name="id2612188"></a> 58 <a class="indexterm" name="id2612195"></a> 59 <a class="indexterm" name="id2612202"></a> 60 <a class="indexterm" name="id2612208"></a> 61 <a class="indexterm" name="id2612215"></a> 62 <a class="indexterm" name="id2612222"></a> 63 63 A significant number of reports concern problems with the <code class="literal">smbfs</code> file system 64 64 driver that is part of the Linux kernel, not part of Samba. Users continue to interpret that … … 71 71 Samba and are really foreign to it. 72 72 </p><p> 73 <a class="indexterm" name="id261228 8"></a>73 <a class="indexterm" name="id2612283"></a> 74 74 The new project, <code class="literal">cifsfs</code>, is destined to replace <code class="literal">smbfs</code>. 75 75 It, too, is not part of Samba, even though one of the Samba Team members is a prime mover in … … 78 78 Table 13.1 lists typical causes of: 79 79 </p><div class="itemizedlist"><ul type="disc"><li><p>Not Working (NW)</p></li><li><p>Broken Behavior (BB)</p></li><li><p>Poor Performance (PP)</p></li></ul></div><div class="table"><a name="ProbList"></a><p class="title"><b>Table 13.1. Effect of Common Problems</b></p><div class="table-contents"><table summary="Effect of Common Problems" border="1"><colgroup><col align="left"><col align="center"><col align="center"><col align="center"></colgroup><thead><tr><th align="left"><p>Problem</p></th><th align="center"><p>NW</p></th><th align="center"><p>BB</p></th><th align="center"><p>PP</p></th></tr></thead><tbody><tr><td align="left"><p>File locking</p></td><td align="center"><p>-</p></td><td align="center"><p>X</p></td><td align="center"><p>-</p></td></tr><tr><td align="left"><p>Hardware problems</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td></tr><tr><td align="left"><p>Incorrect authentication</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td><td align="center"><p>-</p></td></tr><tr><td align="left"><p>Incorrect configuration</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td></tr><tr><td align="left"><p>LDAP problems</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td><td align="center"><p>-</p></td></tr><tr><td align="left"><p>Name resolution</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td></tr><tr><td align="left"><p>Printing problems</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td><td align="center"><p>-</p></td></tr><tr><td align="left"><p>Slow file transfer</p></td><td align="center"><p>-</p></td><td align="center"><p>-</p></td><td align="center"><p>X</p></td></tr><tr><td align="left"><p>Winbind problems</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td><td align="center"><p>-</p></td></tr></tbody></table></div></div><br class="table-break"><p> 80 <a class="indexterm" name="id26125 80"></a>80 <a class="indexterm" name="id2612575"></a> 81 81 It is obvious to all that the first requirement (as a matter of network hygiene) is to eliminate 82 82 problems that affect basic network operation. This book has provided sufficient working examples 83 83 to help you to avoid all these problems. 84 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id26125 93"></a>Guidelines for Reliable Samba Operation</h2></div></div></div><p>85 <a class="indexterm" name="id2612 601"></a>86 <a class="indexterm" name="id261260 8"></a>84 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2612588"></a>Guidelines for Reliable Samba Operation</h2></div></div></div><p> 85 <a class="indexterm" name="id2612597"></a> 86 <a class="indexterm" name="id2612604"></a> 87 87 Your objective is to provide a network that works correctly, can grow at all times, is resilient 88 88 at times of extreme demand, and can scale to meet future needs. The following subject areas provide 89 89 pointers that can help you today. 90 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id26126 20"></a>Name Resolution</h3></div></div></div><p>90 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2612616"></a>Name Resolution</h3></div></div></div><p> 91 91 There are three basic current problem areas: bad hostnames, routed networks, and network collisions. 92 92 These are covered in the following discussion. 93 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id26126 32"></a>Bad Hostnames</h4></div></div></div><p>94 <a class="indexterm" name="id26126 40"></a>95 <a class="indexterm" name="id261264 9"></a>96 <a class="indexterm" name="id261265 6"></a>97 <a class="indexterm" name="id26126 63"></a>98 <a class="indexterm" name="id26126 70"></a>93 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2612627"></a>Bad Hostnames</h4></div></div></div><p> 94 <a class="indexterm" name="id2612635"></a> 95 <a class="indexterm" name="id2612644"></a> 96 <a class="indexterm" name="id2612651"></a> 97 <a class="indexterm" name="id2612658"></a> 98 <a class="indexterm" name="id2612665"></a> 99 99 When configured as a DHCP client, a number of Linux distributions set the system hostname 100 100 to <code class="constant">localhost</code>. If the parameter <em class="parameter"><code>netbios name</code></em> is not … … 108 108 correctly. 109 109 </p><p> 110 <a class="indexterm" name="id261272 4"></a>110 <a class="indexterm" name="id2612720"></a> 111 111 A few sites have tried to name Windows clients and Samba servers with a name that begins 112 112 with the digits 1-9. This does not work either because it may result in the client or 113 113 server attempting to use that name as an IP address. 114 114 </p><p> 115 <a class="indexterm" name="id261273 8"></a>116 <a class="indexterm" name="id261274 7"></a>115 <a class="indexterm" name="id2612734"></a> 116 <a class="indexterm" name="id2612743"></a> 117 117 A Samba server called <code class="constant">FRED</code> in a NetBIOS domain called <code class="constant">COLLISION</code> 118 118 in a network environment that is part of the fully-qualified Internet domain namespace known … … 123 123 fails given that you probably do not have this in your DNS namespace. 124 124 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 125 <a class="indexterm" name="id26127 92"></a>126 <a class="indexterm" name="id2612 801"></a>127 <a class="indexterm" name="id261280 8"></a>125 <a class="indexterm" name="id2612787"></a> 126 <a class="indexterm" name="id2612796"></a> 127 <a class="indexterm" name="id2612803"></a> 128 128 An Active Directory realm called <code class="constant">collision.parrots.com</code> is perfectly okay, 129 129 although it too must be capable of being resolved via DNS, something that functions correctly 130 130 if Windows 200x ADS has been properly installed and configured. 131 </p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id26128 24"></a>Routed Networks</h4></div></div></div><p>132 <a class="indexterm" name="id26128 32"></a>133 <a class="indexterm" name="id261283 9"></a>134 <a class="indexterm" name="id261284 8"></a>131 </p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2612819"></a>Routed Networks</h4></div></div></div><p> 132 <a class="indexterm" name="id2612827"></a> 133 <a class="indexterm" name="id2612834"></a> 134 <a class="indexterm" name="id2612843"></a> 135 135 NetBIOS networks (Windows networking with NetBIOS over TCP/IP enabled) makes extensive use 136 136 of UDP-based broadcast traffic, as you saw during the exercises in <a class="link" href="primer.html" title="Chapter 16. Networking Primer">“Networking Primer”</a>. 137 137 </p><p> 138 <a class="indexterm" name="id261286 8"></a>139 <a class="indexterm" name="id261287 5"></a>140 <a class="indexterm" name="id26128 81"></a>138 <a class="indexterm" name="id2612863"></a> 139 <a class="indexterm" name="id2612870"></a> 140 <a class="indexterm" name="id2612877"></a> 141 141 UDP broadcast traffic is not forwarded by routers. This means that NetBIOS broadcast-based 142 142 networking cannot function across routed networks (i.e., multi-subnet networks) unless 143 143 special provisions are made: 144 144 </p><div class="itemizedlist"><ul type="disc"><li><p> 145 <a class="indexterm" name="id261289 8"></a>146 <a class="indexterm" name="id261290 5"></a>147 <a class="indexterm" name="id26129 12"></a>145 <a class="indexterm" name="id2612894"></a> 146 <a class="indexterm" name="id2612901"></a> 147 <a class="indexterm" name="id2612908"></a> 148 148 Either install on every Windows client an LMHOSTS file (located in the directory 149 149 <code class="filename">C:\windows\system32\drivers\etc</code>). It is also necessary to … … 152 152 manual page for the <code class="filename">smb.conf</code> file. 153 153 </p></li><li><p> 154 <a class="indexterm" name="id261295 8"></a>154 <a class="indexterm" name="id2612953"></a> 155 155 Or configure Samba as a WINS server, and configure all network clients to use that 156 156 WINS server in their TCP/IP configuration. 157 157 </p></li></ul></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 158 <a class="indexterm" name="id261297 5"></a>159 <a class="indexterm" name="id26129 84"></a>158 <a class="indexterm" name="id2612970"></a> 159 <a class="indexterm" name="id2612979"></a> 160 160 The use of DNS is not an acceptable substitute for WINS. DNS does not store specific 161 161 information regarding NetBIOS networking particulars that get stored in the WINS 162 162 name resolution database and that Windows clients require and depend on. 163 </p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id261299 7"></a>Network Collisions</h4></div></div></div><p>164 <a class="indexterm" name="id261300 5"></a>165 <a class="indexterm" name="id26130 14"></a>166 <a class="indexterm" name="id26130 23"></a>167 <a class="indexterm" name="id26130 30"></a>163 </p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2612992"></a>Network Collisions</h4></div></div></div><p> 164 <a class="indexterm" name="id2613000"></a> 165 <a class="indexterm" name="id2613009"></a> 166 <a class="indexterm" name="id2613018"></a> 167 <a class="indexterm" name="id2613025"></a> 168 168 Excessive network activity causes NetBIOS network timeouts. Timeouts may result in 169 169 blue screen of death (BSOD) experiences. High collision rates may be caused by excessive … … 174 174 in <a class="link" href="primer.html" title="Chapter 16. Networking Primer">“Networking Primer”</a>. 175 175 </p><p> 176 <a class="indexterm" name="id261305 9"></a>177 <a class="indexterm" name="id261306 6"></a>178 <a class="indexterm" name="id26130 73"></a>176 <a class="indexterm" name="id2613054"></a> 177 <a class="indexterm" name="id2613061"></a> 178 <a class="indexterm" name="id2613068"></a> 179 179 Under no circumstances should the facility be supported by many routers, known as <code class="constant">NetBIOS 180 180 forwarding</code>, unless you know exactly what you are doing. Inappropriate use of this … … 184 184 less than 15 KB/sec. After the NetBIOS forwarding was turned off, file transfer performance 185 185 immediately returned to 11 MB/sec. 186 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id261309 6"></a>Samba Configuration</h3></div></div></div><p>186 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2613092"></a>Samba Configuration</h3></div></div></div><p> 187 187 As a general rule, the contents of the <code class="filename">smb.conf</code> file should be kept as simple as possible. 188 188 No parameter should be specified unless you know it is essential to operation. 189 189 </p><p> 190 <a class="indexterm" name="id261311 6"></a>191 <a class="indexterm" name="id26131 23"></a>192 <a class="indexterm" name="id26131 30"></a>190 <a class="indexterm" name="id2613112"></a> 191 <a class="indexterm" name="id2613119"></a> 192 <a class="indexterm" name="id2613126"></a> 193 193 Many UNIX administrators like to fully document the settings in the <code class="filename">smb.conf</code> file. This is a 194 194 bad idea because it adds content to the file. The <code class="filename">smb.conf</code> file is re-read by every <code class="literal">smbd</code> … … 198 198 It is recommended to keep a fully documented <code class="filename">smb.conf</code> file on hand, and then to operate Samba only 199 199 with an optimized file. 200 </p><p><a class="indexterm" name="id26131 80"></a>200 </p><p><a class="indexterm" name="id2613176"></a> 201 201 The preferred way to maintain a documented file is to call it something like <code class="filename">smb.conf.master</code>. 202 202 You can generate the optimized file by executing: … … 224 224 Press enter to see a dump of your service definitions 225 225 </pre><p> 226 <a class="indexterm" name="id261323 9"></a>226 <a class="indexterm" name="id2613235"></a> 227 227 You now, of course, press the enter key to complete the command, or else abort it by pressing Ctrl-C. 228 228 The important thing to note is the noted Server role, as well as warning messages. Noted configuration … … 234 234 </pre><p> 235 235 </p><p> 236 <a class="indexterm" name="id261326 7"></a>237 <a class="indexterm" name="id261327 4"></a>238 <a class="indexterm" name="id26132 81"></a>236 <a class="indexterm" name="id2613262"></a> 237 <a class="indexterm" name="id2613270"></a> 238 <a class="indexterm" name="id2613276"></a> 239 239 There are two parameters that can cause severe network performance degradation: <em class="parameter"><code>socket options</code></em> 240 240 and <em class="parameter"><code>socket address</code></em>. The <em class="parameter"><code>socket options</code></em> parameter was often necessary … … 242 242 this parameter being set. Do not use either parameter unless it has been proven necessary to use them. 243 243 </p><p> 244 <a class="indexterm" name="id261331 5"></a>245 <a class="indexterm" name="id26133 22"></a>246 <a class="indexterm" name="id261332 9"></a>247 <a class="indexterm" name="id261333 6"></a>244 <a class="indexterm" name="id2613310"></a> 245 <a class="indexterm" name="id2613317"></a> 246 <a class="indexterm" name="id2613324"></a> 247 <a class="indexterm" name="id2613331"></a> 248 248 Another <code class="filename">smb.conf</code> parameter that may cause severe network performance degradation is the 249 249 <em class="parameter"><code>strict sync</code></em> parameter. Do not use this at all. There is no good reason … … 252 252 degrade network performance, so do not set it; if you must, do so with caution. 253 253 </p><p> 254 <a class="indexterm" name="id261337 7"></a>255 <a class="indexterm" name="id261338 4"></a>256 <a class="indexterm" name="id26133 91"></a>257 <a class="indexterm" name="id261339 8"></a>254 <a class="indexterm" name="id2613373"></a> 255 <a class="indexterm" name="id2613380"></a> 256 <a class="indexterm" name="id2613387"></a> 257 <a class="indexterm" name="id2613393"></a> 258 258 Finally, many network administrators deliberately disable opportunistic locking support. While this 259 259 does not degrade Samba performance, it significantly degrades Windows client performance because … … 263 263 oplock support for operations that are tolerant of it. See <a class="link" href="appendix.html#ch12dblck" title="Shared Data Integrity">“Shared Data Integrity”</a> for more 264 264 information. 265 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id26134 24"></a>Use and Location of BDCs</h3></div></div></div><p>266 <a class="indexterm" name="id26134 32"></a>267 <a class="indexterm" name="id261343 8"></a>268 <a class="indexterm" name="id261344 4"></a>269 <a class="indexterm" name="id26134 51"></a>270 <a class="indexterm" name="id261345 8"></a>265 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2613419"></a>Use and Location of BDCs</h3></div></div></div><p> 266 <a class="indexterm" name="id2613427"></a> 267 <a class="indexterm" name="id2613433"></a> 268 <a class="indexterm" name="id2613440"></a> 269 <a class="indexterm" name="id2613447"></a> 270 <a class="indexterm" name="id2613454"></a> 271 271 On a network segment where there is a PDC and a BDC, the BDC carries the bulk of the network logon 272 272 processing. If the BDC is a heavily loaded server, the PDC carries a greater proportion of … … 276 276 and is undesirable. 277 277 </p><p> 278 <a class="indexterm" name="id261347 7"></a>279 <a class="indexterm" name="id26134 84"></a>278 <a class="indexterm" name="id2613472"></a> 279 <a class="indexterm" name="id2613479"></a> 280 280 As a general guide, instead of adding domain member servers to a network, you would be better advised 281 281 to add BDCs until there are fewer than 30 Windows clients per BDC. Beyond that ratio, you should add 282 282 domain member servers. This practice ensures that there are always sufficient domain controllers 283 283 to handle logon requests and authentication traffic. 284 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id261349 9"></a>Use One Consistent Version of MS Windows Client</h3></div></div></div><p>284 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2613494"></a>Use One Consistent Version of MS Windows Client</h3></div></div></div><p> 285 285 Every network client has its own peculiarities. From a management perspective, it is easier to deal 286 286 with one version of MS Windows that is maintained to a consistent update level than it is to deal … … 290 290 have necessitated special handling from the Samba server end. If you want to remain sane, keep you 291 291 client workstation configurations consistent. 292 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id26135 21"></a>For Scalability, Use SAN-Based Storage on Samba Servers</h3></div></div></div><p>293 <a class="indexterm" name="id261352 9"></a>294 <a class="indexterm" name="id261353 6"></a>292 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2613516"></a>For Scalability, Use SAN-Based Storage on Samba Servers</h3></div></div></div><p> 293 <a class="indexterm" name="id2613525"></a> 294 <a class="indexterm" name="id2613532"></a> 295 295 Many SAN-based storage systems permit more than one server to share a common data store. 296 296 Use of a shared SAN data store means that you do not need to use time- and resource-hungry data 297 297 synchronization techniques. 298 298 </p><p> 299 <a class="indexterm" name="id26135 50"></a>300 <a class="indexterm" name="id261355 7"></a>299 <a class="indexterm" name="id2613546"></a> 300 <a class="indexterm" name="id2613552"></a> 301 301 The use of a collection of relatively low-cost front-end Samba servers that are coupled to 302 302 a shared backend SAN data store permits load distribution while containing costs below that 303 303 of installing and managing a complex clustering facility. 304 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id26135 70"></a>Distribute Network Load with MSDFS</h3></div></div></div><p>305 <a class="indexterm" name="id261357 8"></a>306 <a class="indexterm" name="id261358 5"></a>304 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2613566"></a>Distribute Network Load with MSDFS</h3></div></div></div><p> 305 <a class="indexterm" name="id2613574"></a> 306 <a class="indexterm" name="id2613581"></a> 307 307 Microsoft DFS (distributed file system) technology has been implemented in Samba. MSDFS permits 308 308 data to be accessed from a single share and yet to actually be distributed across multiple actual … … 310 310 implementation of an MSDFS installation. 311 311 </p><p> 312 <a class="indexterm" name="id2613 604"></a>313 <a class="indexterm" name="id26136 13"></a>312 <a class="indexterm" name="id2613599"></a> 313 <a class="indexterm" name="id2613608"></a> 314 314 The combination of multiple backend servers together with a front-end server and use of MSDFS 315 315 can achieve almost the same as you would obtain with a clustered Samba server. 316 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id261362 5"></a>Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</h3></div></div></div><p>317 <a class="indexterm" name="id26136 34"></a>318 <a class="indexterm" name="id26136 40"></a>319 <a class="indexterm" name="id261364 7"></a>316 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2613620"></a>Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</h3></div></div></div><p> 317 <a class="indexterm" name="id2613629"></a> 318 <a class="indexterm" name="id2613636"></a> 319 <a class="indexterm" name="id2613643"></a> 320 320 Consider using <code class="literal">rsync</code> to replicate data across the WAN during times 321 321 of low utilization. Users can then access the replicated data store rather than needing to do so … … 324 324 implementation if you choose to permit modification and return replication of the modified file; 325 325 otherwise, you may inadvertently overwrite important data. 326 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id26136 71"></a>Hardware Problems</h3></div></div></div><p>327 <a class="indexterm" name="id261367 9"></a>328 <a class="indexterm" name="id261368 6"></a>329 <a class="indexterm" name="id26136 92"></a>330 <a class="indexterm" name="id261369 9"></a>331 <a class="indexterm" name="id261370 8"></a>332 <a class="indexterm" name="id261371 8"></a>326 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2613666"></a>Hardware Problems</h3></div></div></div><p> 327 <a class="indexterm" name="id2613674"></a> 328 <a class="indexterm" name="id2613681"></a> 329 <a class="indexterm" name="id2613688"></a> 330 <a class="indexterm" name="id2613695"></a> 331 <a class="indexterm" name="id2613704"></a> 332 <a class="indexterm" name="id2613713"></a> 333 333 Networking hardware prices have fallen sharply over the past 5 years. A surprising number 334 334 of Samba networking problems over this time have been traced to defective network interface 335 335 cards (NICs) or defective HUBs, switches, and cables. 336 336 </p><p> 337 <a class="indexterm" name="id261373 4"></a>337 <a class="indexterm" name="id2613730"></a> 338 338 Not surprising is the fact that network administrators do not like to be shown to have made 339 339 a bad decision. Money saved in buying low-cost hardware may result in high costs incurred 340 340 in corrective action. 341 341 </p><p> 342 <a class="indexterm" name="id261374 8"></a>343 <a class="indexterm" name="id261375 5"></a>344 <a class="indexterm" name="id26137 62"></a>345 <a class="indexterm" name="id261376 9"></a>346 <a class="indexterm" name="id261377 6"></a>342 <a class="indexterm" name="id2613743"></a> 343 <a class="indexterm" name="id2613750"></a> 344 <a class="indexterm" name="id2613757"></a> 345 <a class="indexterm" name="id2613764"></a> 346 <a class="indexterm" name="id2613771"></a> 347 347 Defective NICs, HUBs, and switches may appear as intermittent network access problems, intermittent 348 348 or persistent data corruption, slow network throughput, low performance, or even as BSOD … … 353 353 Defective hardware problems may take patience and persistence before the real cause can be discovered. 354 354 </p><p> 355 <a class="indexterm" name="id261379 9"></a>355 <a class="indexterm" name="id2613794"></a> 356 356 Networking hardware defects can significantly impact perceived Samba performance, but defective 357 357 RAID controllers as well as SCSI and IDE hard disk controllers have also been known to impair Samba server … … 360 360 administrator until the entire server was replaced. While you may well think that this would never 361 361 happen to you, experience shows that given the right (unfortunate) circumstances, this can happen to anyone. 362 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id261382 9"></a>Large Directories</h3></div></div></div><p>362 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2613824"></a>Large Directories</h3></div></div></div><p> 363 363 There exist applications that create or manage directories containing many thousands of files. Such 364 364 applications typically generate many small files (less than 100 KB). At the best of times, under UNIX, … … 400 400 as specified in the <code class="filename">smb.conf</code> stanza. This means that smbd will not be able to find lower case 401 401 filenames with these settings. Note, this is done on a per-share basis. 402 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id26139 32"></a>Key Points Learned</h2></div></div></div><p>402 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2613927"></a>Key Points Learned</h2></div></div></div><p> 403 403 This chapter has touched in broad sweeps on a number of simple steps that can be taken 404 404 to ensure that your Samba network is resilient, scalable, and reliable, and that it … … 409 409 her an even break. 410 410 </p><p> 411 <a class="indexterm" name="id26139 53"></a>411 <a class="indexterm" name="id2613948"></a> 412 412 Last, but not least, you should not only keep the network design simple, but also be sure it is 413 413 well documented. This book may serve as your pattern for documenting every -
branches/samba-3.2.x/docs/htmldocs/Samba3-ByExample/RefSection.html
r204 r226 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Part III. Reference Section</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="nw4migration.html" title="Chapter 10. Migrating NetWare Server to Samba-3"><link rel="next" href="kerberos.html" title="Chapter 11. Active Directory, Kerberos, and Security"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Part III. Reference Section</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="nw4migration.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="kerberos.html">Next</a></td></tr></table><hr></div><div class="part" lang="en"><div class="titlepage"><div><div><h1 class="title"><a name="RefSection"></a>Part III. Reference Section</h1></div></div></div><div class="partintro" lang="en"><div><div><div><h1 class="title"><a name="id26036 20"></a>Reference Section</h1></div></div></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Part III. Reference Section</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="nw4migration.html" title="Chapter 10. Migrating NetWare Server to Samba-3"><link rel="next" href="kerberos.html" title="Chapter 11. Active Directory, Kerberos, and Security"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Part III. Reference Section</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="nw4migration.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="kerberos.html">Next</a></td></tr></table><hr></div><div class="part" lang="en"><div class="titlepage"><div><div><h1 class="title"><a name="RefSection"></a>Part III. Reference Section</h1></div></div></div><div class="partintro" lang="en"><div><div><div><h1 class="title"><a name="id2603615"></a>Reference Section</h1></div></div></div><p> 2 2 This section <span class="emphasis"><em>Samba-3 by Example</em></span> provides important reference material 3 3 that may help you to solve network performance issues, to answer some of the critiques 4 4 published regarding Samba, or just to gain a more broad understanding of how Samba can 5 5 play in a Windows networking world. 6 </p><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="chapter"><a href="kerberos.html">11. Active Directory, Kerberos, and Security</a></span></dt><dd><dl><dt><span class="sect1"><a href="kerberos.html#id260371 7">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2604367">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id2604384">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2604780">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#ch10expl">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2606410">Share Access Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2606759">Share Definition Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2607372">Share Point Directory and File Permissions</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2607775">Managing Windows 200x ACLs</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2608502">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id2608636">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="DomApps.html">12. Integrating Additional Services</a></span></dt><dd><dl><dt><span class="sect1"><a href="DomApps.html#id2609265">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id2609296">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2609396">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id2609429">Technical Issues</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id2609585">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2609603">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id2611455">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2611515">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="HA.html">13. Performance, Reliability, and Availability</a></span></dt><dd><dl><dt><span class="sect1"><a href="HA.html#id2612034">Introduction</a></span></dt><dt><span class="sect1"><a href="HA.html#id2612122">Dissection and Discussion</a></span></dt><dt><span class="sect1"><a href="HA.html#id2612593">Guidelines for Reliable Samba Operation</a></span></dt><dd><dl><dt><span class="sect2"><a href="HA.html#id2612620">Name Resolution</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613096">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613424">Use and Location of BDCs</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613499">Use One Consistent Version of MS Windows Client</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613521">For Scalability, Use SAN-Based Storage on Samba Servers</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613570">Distribute Network Load with MSDFS</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613625">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613671">Hardware Problems</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613829">Large Directories</a></span></dt></dl></dd><dt><span class="sect1"><a href="HA.html#id2613932">Key Points Learned</a></span></dt></dl></dd><dt><span class="chapter"><a href="ch14.html">14. Samba Support</a></span></dt><dd><dl><dt><span class="sect1"><a href="ch14.html#id2614102">Free Support</a></span></dt><dt><span class="sect1"><a href="ch14.html#id2614320">Commercial Support</a></span></dt></dl></dd><dt><span class="chapter"><a href="appendix.html">15. A Collection of Useful Tidbits</a></span></dt><dd><dl><dt><span class="sect1"><a href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></span></dt><dt><span class="sect1"><a href="appendix.html#id2615028">Samba System File Location</a></span></dt><dt><span class="sect1"><a href="appendix.html#id2615448">Starting Samba</a></span></dt><dt><span class="sect1"><a href="appendix.html#id2615793">DNS Configuration Files</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id2615805">The Forward Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2615854">The Reverse Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2615994">DNS Root Server Hint File</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id2616053">Initialization of the LDAP Database</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#id2616632">The LDAP Account Manager</a></span></dt><dt><span class="sect1"><a href="appendix.html#id2617629">IDEALX Management Console</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12dblck">Shared Data Integrity</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id2618109">Microsoft Access</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2618256">Act! Database Sharing</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2618341">Opportunistic Locking Controls</a></span></dt></dl></dd></dl></dd><dt><span class="chapter"><a href="primer.html">16. Networking Primer</a></span></dt><dd><dl><dt><span class="sect1"><a href="primer.html#id2618507">Requirements and Notes</a></span></dt><dt><span class="sect1"><a href="primer.html#id2618669">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id2618729">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#id2618846">Exercises</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id2618972">Single-Machine Broadcast Activity</a></span></dt><dt><span class="sect2"><a href="primer.html#secondmachine">Second Machine Startup Broadcast Interaction</a></span></dt><dt><span class="sect2"><a href="primer.html#id2620118">Simple Windows Client Connection Characteristics</a></span></dt><dt><span class="sect2"><a href="primer.html#id2620620">Windows 200x/XP Client Interaction with Samba-3</a></span></dt><dt><span class="sect2"><a href="primer.html#id2621188">Conclusions to Exercises</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01conc">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id2621302">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01qa">Questions and Answers</a></span></dt></dl></dd><dt><span class="appendix"><a href="apa.html">A.6 </p><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="chapter"><a href="kerberos.html">11. Active Directory, Kerberos, and Security</a></span></dt><dd><dl><dt><span class="sect1"><a href="kerberos.html#id2603712">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2604363">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id2604379">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2604776">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#ch10expl">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2606406">Share Access Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2606754">Share Definition Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2607367">Share Point Directory and File Permissions</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2607770">Managing Windows 200x ACLs</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2608497">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id2608631">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="DomApps.html">12. Integrating Additional Services</a></span></dt><dd><dl><dt><span class="sect1"><a href="DomApps.html#id2609260">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id2609291">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2609392">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id2609425">Technical Issues</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id2609581">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2609598">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id2611450">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2611510">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="HA.html">13. Performance, Reliability, and Availability</a></span></dt><dd><dl><dt><span class="sect1"><a href="HA.html#id2612030">Introduction</a></span></dt><dt><span class="sect1"><a href="HA.html#id2612117">Dissection and Discussion</a></span></dt><dt><span class="sect1"><a href="HA.html#id2612588">Guidelines for Reliable Samba Operation</a></span></dt><dd><dl><dt><span class="sect2"><a href="HA.html#id2612616">Name Resolution</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613092">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613419">Use and Location of BDCs</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613494">Use One Consistent Version of MS Windows Client</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613516">For Scalability, Use SAN-Based Storage on Samba Servers</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613566">Distribute Network Load with MSDFS</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613620">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613666">Hardware Problems</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613824">Large Directories</a></span></dt></dl></dd><dt><span class="sect1"><a href="HA.html#id2613927">Key Points Learned</a></span></dt></dl></dd><dt><span class="chapter"><a href="ch14.html">14. Samba Support</a></span></dt><dd><dl><dt><span class="sect1"><a href="ch14.html#id2614097">Free Support</a></span></dt><dt><span class="sect1"><a href="ch14.html#id2614316">Commercial Support</a></span></dt></dl></dd><dt><span class="chapter"><a href="appendix.html">15. A Collection of Useful Tidbits</a></span></dt><dd><dl><dt><span class="sect1"><a href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></span></dt><dt><span class="sect1"><a href="appendix.html#id2615023">Samba System File Location</a></span></dt><dt><span class="sect1"><a href="appendix.html#id2615443">Starting Samba</a></span></dt><dt><span class="sect1"><a href="appendix.html#id2615789">DNS Configuration Files</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id2615801">The Forward Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2615849">The Reverse Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2615989">DNS Root Server Hint File</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id2616048">Initialization of the LDAP Database</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#id2616627">The LDAP Account Manager</a></span></dt><dt><span class="sect1"><a href="appendix.html#id2617624">IDEALX Management Console</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12dblck">Shared Data Integrity</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id2618104">Microsoft Access</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2618252">Act! Database Sharing</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2618336">Opportunistic Locking Controls</a></span></dt></dl></dd></dl></dd><dt><span class="chapter"><a href="primer.html">16. Networking Primer</a></span></dt><dd><dl><dt><span class="sect1"><a href="primer.html#id2618502">Requirements and Notes</a></span></dt><dt><span class="sect1"><a href="primer.html#id2618664">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id2618724">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#id2618841">Exercises</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id2618968">Single-Machine Broadcast Activity</a></span></dt><dt><span class="sect2"><a href="primer.html#secondmachine">Second Machine Startup Broadcast Interaction</a></span></dt><dt><span class="sect2"><a href="primer.html#id2620113">Simple Windows Client Connection Characteristics</a></span></dt><dt><span class="sect2"><a href="primer.html#id2620615">Windows 200x/XP Client Interaction with Samba-3</a></span></dt><dt><span class="sect2"><a href="primer.html#id2621183">Conclusions to Exercises</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01conc">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id2621297">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01qa">Questions and Answers</a></span></dt></dl></dd><dt><span class="appendix"><a href="apa.html">A. 7 7 <acronym class="acronym">GNU</acronym> General Public License version 3 8 </a></span></dt><dd><dl><dt><span class="bridgehead"><a href="apa.html#id262196 8">A.8 </a></span></dt><dd><dl><dt><span class="bridgehead"><a href="apa.html#id2621963">A. 9 9 Preamble 10 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id26221 13">A.10 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622108">A. 11 11 TERMS AND CONDITIONS 12 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262211 7">A.12 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622112">A. 13 13 0. Definitions. 14 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262220 9">A.14 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622204">A. 15 15 1. Source Code. 16 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262230 8">A.16 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622303">A. 17 17 2. Basic Permissions. 18 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262234 7">A.18 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622342">A. 19 19 3. Protecting Users’ Legal Rights From Anti-Circumvention Law. 20 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262238 8">A.20 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622383">A. 21 21 4. Conveying Verbatim Copies. 22 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262241 5">A.22 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622410">A. 23 23 5. Conveying Modified Source Versions. 24 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id26225 10">A.24 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622506">A. 25 25 6. Conveying Non-Source Forms. 26 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622 700">A.26 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622696">A. 27 27 7. Additional Terms. 28 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262283 6">A.28 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622831">A. 29 29 8. Termination. 30 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id26228 80">A.30 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622875">A. 31 31 9. Acceptance Not Required for Having Copies. 32 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262289 9">A.32 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622894">A. 33 33 10. Automatic Licensing of Downstream Recipients. 34 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id26229 51">A.34 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622946">A. 35 35 11. Patents. 36 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262308 7">A.36 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2623082">A. 37 37 12. No Surrender of Others’ Freedom. 38 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262310 9">A.38 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2623104">A. 39 39 13. Use with the ???TITLE??? Affero General Public License. 40 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262313 7">A.40 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2623133">A. 41 41 14. Revised Versions of this License. 42 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2623 200">A.42 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2623195">A. 43 43 15. Disclaimer of Warranty. 44 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262322 6">A.44 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2623221">A. 45 45 16. Limitation of Liability. 46 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262324 6">A.46 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2623241">A. 47 47 17. Interpretation of Sections 15 and 16. 48 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id26232 63">A.48 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2623258">A. 49 49 END OF TERMS AND CONDITIONS 50 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262326 7">A.50 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2623262">A. 51 51 How to Apply These Terms to Your New Programs 52 52 </a></span></dt></dl></dd></dl></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="nw4migration.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="kerberos.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 10. Migrating NetWare Server to Samba-3 </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 11. Active Directory, Kerberos, and Security</td></tr></table></div></body></html> -
branches/samba-3.2.x/docs/htmldocs/Samba3-ByExample/apa.html
r204 r226 1 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Appendix A. GNU General Public License version 3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="primer.html" title="Chapter 16. Networking Primer"><link rel="next" href="go01.html" title="Glossary"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Appendix A. 2 2 <acronym class="acronym">GNU</acronym> General Public License version 3 3 </th></tr><tr><td width="20%" align="left"><a accesskey="p" href="primer.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="go01.html">Next</a></td></tr></table><hr></div><div class="appendix" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="id262193 8"></a>Appendix A.3 </th></tr><tr><td width="20%" align="left"><a accesskey="p" href="primer.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="go01.html">Next</a></td></tr></table><hr></div><div class="appendix" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="id2621934"></a>Appendix A. 4 4 <acronym class="acronym">GNU</acronym> General Public License version 3 5 </h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="bridgehead"><a href="apa.html#id262196 8">A.5 </h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="bridgehead"><a href="apa.html#id2621963">A. 6 6 Preamble 7 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id26221 13">A.7 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622108">A. 8 8 TERMS AND CONDITIONS 9 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262211 7">A.9 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622112">A. 10 10 0. Definitions. 11 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262220 9">A.11 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622204">A. 12 12 1. Source Code. 13 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262230 8">A.13 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622303">A. 14 14 2. Basic Permissions. 15 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262234 7">A.15 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622342">A. 16 16 3. Protecting Users’ Legal Rights From Anti-Circumvention Law. 17 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262238 8">A.17 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622383">A. 18 18 4. Conveying Verbatim Copies. 19 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262241 5">A.19 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622410">A. 20 20 5. Conveying Modified Source Versions. 21 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id26225 10">A.21 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622506">A. 22 22 6. Conveying Non-Source Forms. 23 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622 700">A.23 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622696">A. 24 24 7. Additional Terms. 25 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262283 6">A.25 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622831">A. 26 26 8. Termination. 27 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id26228 80">A.27 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622875">A. 28 28 9. Acceptance Not Required for Having Copies. 29 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262289 9">A.29 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622894">A. 30 30 10. Automatic Licensing of Downstream Recipients. 31 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id26229 51">A.31 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622946">A. 32 32 11. Patents. 33 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262308 7">A.33 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2623082">A. 34 34 12. No Surrender of Others’ Freedom. 35 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262310 9">A.35 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2623104">A. 36 36 13. Use with the ???TITLE??? Affero General Public License. 37 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262313 7">A.37 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2623133">A. 38 38 14. Revised Versions of this License. 39 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2623 200">A.39 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2623195">A. 40 40 15. Disclaimer of Warranty. 41 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262322 6">A.41 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2623221">A. 42 42 16. Limitation of Liability. 43 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262324 6">A.43 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2623241">A. 44 44 17. Interpretation of Sections 15 and 16. 45 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id26232 63">A.45 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2623258">A. 46 46 END OF TERMS AND CONDITIONS 47 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262326 7">A.47 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2623262">A. 48 48 How to Apply These Terms to Your New Programs 49 49 </a></span></dt></dl></div><p> … … 55 55 Everyone is permitted to copy and distribute verbatim copies of this license 56 56 document, but changing it is not allowed. 57 </p><h2><a name="id262196 8"></a>57 </p><h2><a name="id2621963"></a> 58 58 Preamble 59 59 </h2><p> … … 119 119 The precise terms and conditions for copying, distribution and modification 120 120 follow. 121 </p><h2><a name="id26221 13"></a>121 </p><h2><a name="id2622108"></a> 122 122 TERMS AND CONDITIONS 123 </h2><h2><a name="id262211 7"></a>123 </h2><h2><a name="id2622112"></a> 124 124 0. Definitions. 125 125 </h2><p> … … 163 163 a list of user commands or options, such as a menu, a prominent item in the 164 164 list meets this criterion. 165 </p><h2><a name="id262220 9"></a>165 </p><h2><a name="id2622204"></a> 166 166 1. Source Code. 167 167 </h2><p> … … 203 203 </p><p> 204 204 The Corresponding Source for a work in source code form is that same work. 205 </p><h2><a name="id262230 8"></a>205 </p><h2><a name="id2622303"></a> 206 206 2. Basic Permissions. 207 207 </h2><p> … … 228 228 conditions stated below. Sublicensing is not allowed; section 10 makes it 229 229 unnecessary. 230 </p><h2><a name="id262234 7"></a>230 </p><h2><a name="id2622342"></a> 231 231 3. Protecting Users’ Legal Rights From Anti-Circumvention Law. 232 232 </h2><p> … … 243 243 third parties’ legal rights to forbid circumvention of technological 244 244 measures. 245 </p><h2><a name="id262238 8"></a>245 </p><h2><a name="id2622383"></a> 246 246 4. Conveying Verbatim Copies. 247 247 </h2><p> … … 256 256 You may charge any price or no price for each copy that you convey, and you 257 257 may offer support or warranty protection for a fee. 258 </p><h2><a name="id262241 5"></a>258 </p><h2><a name="id2622410"></a> 259 259 5. Conveying Modified Source Versions. 260 260 </h2><p> … … 292 292 permit. Inclusion of a covered work in an aggregate does not cause 293 293 this License to apply to the other parts of the aggregate. 294 </p><h2><a name="id26225 10"></a>294 </p><h2><a name="id2622506"></a> 295 295 6. Conveying Non-Source Forms. 296 296 </h2><p> … … 387 387 and must require no special password or key for unpacking, reading or 388 388 copying. 389 </p><h2><a name="id2622 700"></a>389 </p><h2><a name="id2622696"></a> 390 390 7. Additional Terms. 391 391 </h2><p> … … 451 451 of a separately written license, or stated as exceptions; the above 452 452 requirements apply either way. 453 </p><h2><a name="id262283 6"></a>453 </p><h2><a name="id2622831"></a> 454 454 8. Termination. 455 455 </h2><p> … … 477 477 reinstated, you do not qualify to receive new licenses for the same 478 478 material under section 10. 479 </p><h2><a name="id26228 80"></a>479 </p><h2><a name="id2622875"></a> 480 480 9. Acceptance Not Required for Having Copies. 481 481 </h2><p> … … 488 488 Therefore, by modifying or propagating a covered work, you indicate your 489 489 acceptance of this License to do so. 490 </p><h2><a name="id262289 9"></a>490 </p><h2><a name="id2622894"></a> 491 491 10. Automatic Licensing of Downstream Recipients. 492 492 </h2><p> … … 513 513 by making, using, selling, offering for sale, or importing the Program or 514 514 any portion of it. 515 </p><h2><a name="id26229 51"></a>515 </p><h2><a name="id2622946"></a> 516 516 11. Patents. 517 517 </h2><p> … … 580 580 implied license or other defenses to infringement that may otherwise be 581 581 available to you under applicable patent law. 582 </p><h2><a name="id262308 7"></a>582 </p><h2><a name="id2623082"></a> 583 583 12. No Surrender of Others’ Freedom. 584 584 </h2><p> … … 592 592 Program, the only way you could satisfy both those terms and this License 593 593 would be to refrain entirely from conveying the Program. 594 </p><h2><a name="id262310 9"></a>594 </p><h2><a name="id2623104"></a> 595 595 13. Use with the <acronym class="acronym">GNU</acronym> Affero General Public License. 596 596 </h2><p> … … 603 603 section 13, concerning interaction through a network will apply to the 604 604 combination as such. 605 </p><h2><a name="id262313 7"></a>605 </p><h2><a name="id2623133"></a> 606 606 14. Revised Versions of this License. 607 607 </h2><p> … … 628 628 However, no additional obligations are imposed on any author or copyright 629 629 holder as a result of your choosing to follow a later version. 630 </p><h2><a name="id2623 200"></a>630 </p><h2><a name="id2623195"></a> 631 631 15. Disclaimer of Warranty. 632 632 </h2><p> … … 639 639 YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL 640 640 NECESSARY SERVICING, REPAIR OR CORRECTION. 641 </p><h2><a name="id262322 6"></a>641 </p><h2><a name="id2623221"></a> 642 642 16. Limitation of Liability. 643 643 </h2><p> … … 651 651 EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF 652 652 SUCH DAMAGES. 653 </p><h2><a name="id262324 6"></a>653 </p><h2><a name="id2623241"></a> 654 654 17. Interpretation of Sections 15 and 16. 655 655 </h2><p> … … 660 660 warranty or assumption of liability accompanies a copy of the Program in 661 661 return for a fee. 662 </p><h2><a name="id26232 63"></a>662 </p><h2><a name="id2623258"></a> 663 663 END OF TERMS AND CONDITIONS 664 </h2><h2><a name="id262326 7"></a>664 </h2><h2><a name="id2623262"></a> 665 665 How to Apply These Terms to Your New Programs 666 666 </h2><p> -
branches/samba-3.2.x/docs/htmldocs/Samba3-ByExample/appendix.html
r204 r226 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 15. A Collection of Useful Tidbits</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="ch14.html" title="Chapter 14. Samba Support"><link rel="next" href="primer.html" title="Chapter 16. Networking Primer"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 15. A Collection of Useful Tidbits</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="ch14.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="primer.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="appendix"></a>Chapter 15. A Collection of Useful Tidbits</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></span></dt><dt><span class="sect1"><a href="appendix.html#id261502 8">Samba System File Location</a></span></dt><dt><span class="sect1"><a href="appendix.html#id2615448">Starting Samba</a></span></dt><dt><span class="sect1"><a href="appendix.html#id2615793">DNS Configuration Files</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id2615805">The Forward Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2615854">The Reverse Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2615994">DNS Root Server Hint File</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id2616053">Initialization of the LDAP Database</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#id2616632">The LDAP Account Manager</a></span></dt><dt><span class="sect1"><a href="appendix.html#id2617629">IDEALX Management Console</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12dblck">Shared Data Integrity</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id2618109">Microsoft Access</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2618256">Act! Database Sharing</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2618341">Opportunistic Locking Controls</a></span></dt></dl></dd></dl></div><p>2 <a class="indexterm" name="id261444 9"></a>3 <a class="indexterm" name="id261445 5"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 15. A Collection of Useful Tidbits</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="ch14.html" title="Chapter 14. Samba Support"><link rel="next" href="primer.html" title="Chapter 16. Networking Primer"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 15. A Collection of Useful Tidbits</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="ch14.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="primer.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="appendix"></a>Chapter 15. A Collection of Useful Tidbits</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></span></dt><dt><span class="sect1"><a href="appendix.html#id2615023">Samba System File Location</a></span></dt><dt><span class="sect1"><a href="appendix.html#id2615443">Starting Samba</a></span></dt><dt><span class="sect1"><a href="appendix.html#id2615789">DNS Configuration Files</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id2615801">The Forward Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2615849">The Reverse Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2615989">DNS Root Server Hint File</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id2616048">Initialization of the LDAP Database</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#id2616627">The LDAP Account Manager</a></span></dt><dt><span class="sect1"><a href="appendix.html#id2617624">IDEALX Management Console</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12dblck">Shared Data Integrity</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id2618104">Microsoft Access</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2618252">Act! Database Sharing</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2618336">Opportunistic Locking Controls</a></span></dt></dl></dd></dl></div><p> 2 <a class="indexterm" name="id2614444"></a> 3 <a class="indexterm" name="id2614451"></a> 4 4 Information presented here is considered to be either basic or well-known material that is informative 5 5 yet helpful. Over the years, I have observed an interesting behavior. There is an expectation that … … 8 8 as shown in the example given below. 9 9 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="domjoin"></a>Joining a Domain: Windows 200x/XP Professional</h2></div></div></div><p> 10 <a class="indexterm" name="id261448 6"></a>10 <a class="indexterm" name="id2614481"></a> 11 11 Microsoft Windows NT/200x/XP Professional platforms can participate in Domain Security. 12 12 This section steps through the process for making a Windows 200x/XP Professional machine a 13 13 member of a Domain Security environment. It should be noted that this process is identical 14 14 when joining a domain that is controlled by Windows NT4/200x as well as a Samba PDC. 15 </p><div class="procedure"><a name="id261449 9"></a><p class="title"><b>Procedure 15.1. Steps to Join a Domain</b></p><ol type="1"><li><p>15 </p><div class="procedure"><a name="id2614495"></a><p class="title"><b>Procedure 15.1. Steps to Join a Domain</b></p><ol type="1"><li><p> 16 16 Click <span class="guimenu">Start</span>. 17 17 </p></li><li><p> … … 51 51 Joining the domain is now complete. 52 52 </p></li></ol></div><p> 53 <a class="indexterm" name="id261491 8"></a>54 <a class="indexterm" name="id261492 5"></a>53 <a class="indexterm" name="id2614913"></a> 54 <a class="indexterm" name="id2614920"></a> 55 55 The screen capture shown in <a class="link" href="appendix.html#swxpp007" title="Figure 15.4. The Computer Name Changes Panel Domain MIDEARTH">“The Computer Name Changes Panel Domain MIDEARTH”</a> has a button labeled <span class="guimenu">More...</span>. This button opens a 56 56 panel in which you can set (or change) the Primary DNS suffix of the computer. This is a parameter that mainly affects members 57 57 of Microsoft Active Directory. Active Directory is heavily oriented around the DNS namespace. 58 58 </p><p> 59 <a class="indexterm" name="id26149 51"></a>60 <a class="indexterm" name="id261495 8"></a>59 <a class="indexterm" name="id2614946"></a> 60 <a class="indexterm" name="id2614953"></a> 61 61 Where NetBIOS technology uses WINS as well as UDP broadcast as key mechanisms for name resolution, Active Directory servers 62 62 register their services with the Microsoft Dynamic DNS server. Windows clients must be able to query the correct DNS server 63 63 to find the services (like which machines are domain controllers or which machines have the Netlogon service running). 64 64 </p><p> 65 <a class="indexterm" name="id261497 6"></a>65 <a class="indexterm" name="id2614972"></a> 66 66 The default setting of the Primary DNS suffix is the Active Directory domain name. When you change the Primary DNS suffix, 67 67 this does not affect domain membership, but it can break network browsing and the ability to resolve your computer name to … … 71 71 Where the client is a member of a Samba domain, it is preferable to leave this field blank. 72 72 </p><p> 73 <a class="indexterm" name="id261 5000"></a>73 <a class="indexterm" name="id2614995"></a> 74 74 According to Microsoft documentation, “<span class="quote">If this computer belongs to a group with <code class="constant">Group Policy</code> 75 75 enabled on <code class="literal">Primary DNS suffice of this computer</code>, the string specified in the Group Policy is used 76 76 as the primary DNS suffix and you might need to restart your computer to view the correct setting. The local setting is 77 77 used only if Group Policy is disabled or unspecified.</span>” 78 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id261502 8"></a>Samba System File Location</h2></div></div></div><p><a class="indexterm" name="id2615035"></a><a class="indexterm" name="id2615043"></a><a class="indexterm" name="id2615051"></a>78 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2615023"></a>Samba System File Location</h2></div></div></div><p><a class="indexterm" name="id2615030"></a><a class="indexterm" name="id2615038"></a><a class="indexterm" name="id2615046"></a> 79 79 One of the frustrations expressed by subscribers to the Samba mailing lists revolves around the choice of where the default Samba Team 80 80 build and installation process locates its Samba files. The location, chosen in the early 1990s, for the default installation is … … 84 84 Several UNIX vendors, and Linux vendors in particular, elected to locate the Samba files in a location other than the Samba Team 85 85 default. 86 </p><p><a class="indexterm" name="id261508 7"></a><a class="indexterm" name="id2615098"></a><a class="indexterm" name="id2615106"></a><a class="indexterm" name="id2615117"></a><a class="indexterm" name="id2615125"></a><a class="indexterm" name="id2615136"></a><a class="indexterm" name="id2615144"></a><a class="indexterm" name="id2615152"></a><a class="indexterm" name="id2615159"></a><a class="indexterm" name="id2615167"></a><a class="indexterm" name="id2615175"></a><a class="indexterm" name="id2615183"></a><a class="indexterm" name="id2615191"></a><a class="indexterm" name="id2615199"></a><a class="indexterm" name="id2615207"></a><a class="indexterm" name="id2615215"></a>86 </p><p><a class="indexterm" name="id2615082"></a><a class="indexterm" name="id2615093"></a><a class="indexterm" name="id2615101"></a><a class="indexterm" name="id2615112"></a><a class="indexterm" name="id2615120"></a><a class="indexterm" name="id2615131"></a><a class="indexterm" name="id2615139"></a><a class="indexterm" name="id2615147"></a><a class="indexterm" name="id2615155"></a><a class="indexterm" name="id2615163"></a><a class="indexterm" name="id2615170"></a><a class="indexterm" name="id2615178"></a><a class="indexterm" name="id2615186"></a><a class="indexterm" name="id2615194"></a><a class="indexterm" name="id2615202"></a><a class="indexterm" name="id2615210"></a> 87 87 Linux vendors, working in conjunction with the Free Standards Group (FSG), Linux Standards Base (LSB), and File Hierarchy 88 88 System (FHS), have elected to locate the configuration files under the <code class="filename">/etc/samba</code> directory, common binary … … 93 93 <code class="filename">/usr/lib/samba</code> directory tree. The files located there include the dynamically loadable modules for the 94 94 passdb backend as well as for the VFS modules. 95 </p><p><a class="indexterm" name="id26152 84"></a><a class="indexterm" name="id2615292"></a><a class="indexterm" name="id2615300"></a>95 </p><p><a class="indexterm" name="id2615279"></a><a class="indexterm" name="id2615287"></a><a class="indexterm" name="id2615295"></a> 96 96 Samba creates runtime control files and generates log files. The runtime control files (tdb and dat files) are stored in 97 97 the <code class="filename">/var/lib/samba</code> directory. Log files are created in <code class="filename">/var/log/samba.</code> … … 99 99 When Samba is built and installed using the default Samba Team process, all files are located under the 100 100 <code class="filename">/usr/local/samba</code> directory tree. This makes it simple to find the files that Samba owns. 101 </p><p><a class="indexterm" name="id261533 9"></a>101 </p><p><a class="indexterm" name="id2615334"></a> 102 102 One way to find the Samba files that are installed on your UNIX/Linux system is to search for the location 103 103 of all files called <code class="literal">smbd</code>. Here is an example: … … 132 132 Many people have been caught by installation of Samba using the default Samba Team process when it was already installed 133 133 by the platform vendor's method. If your platform uses RPM format packages, you can check to see if Samba is installed by 134 executing:<a class="indexterm" name="id26154 12"></a>134 executing:<a class="indexterm" name="id2615407"></a> 135 135 </p><pre class="screen"> 136 136 <code class="prompt">root# </code> rpm -qa | grep samba … … 144 144 samba3-client-3.0.20-1 145 145 samba3-cifsmount-3.0.20-1 146 </pre><p><a class="indexterm" name="id261543 4"></a>146 </pre><p><a class="indexterm" name="id2615430"></a> 147 147 The package names, of course, vary according to how the vendor, or the binary package builder, prepared them. 148 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id261544 8"></a>Starting Samba</h2></div></div></div><p><a class="indexterm" name="id2615454"></a>148 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2615443"></a>Starting Samba</h2></div></div></div><p><a class="indexterm" name="id2615450"></a> 149 149 Samba essentially consists of two or three daemons. A daemon is a UNIX application that runs in the background and provides services. 150 150 An example of a service is the Apache Web server for which the daemon is called <code class="literal">httpd</code>. In the case of Samba, there … … 187 187 exit 0 188 188 </pre></div></div><br class="example-break"><div class="variablelist"><dl><dt><span class="term">nmbd</span></dt><dd><p> 189 <a class="indexterm" name="id261551 7"></a>190 <a class="indexterm" name="id26155 24"></a>189 <a class="indexterm" name="id2615512"></a> 190 <a class="indexterm" name="id2615519"></a> 191 191 This daemon handles all name registration and resolution requests. It is the primary vehicle involved 192 192 in network browsing. It handles all UDP-based protocols. The <code class="literal">nmbd</code> daemon should 193 193 be the first command started as part of the Samba startup process. 194 194 </p></dd><dt><span class="term">smbd</span></dt><dd><p> 195 <a class="indexterm" name="id26155 53"></a>196 <a class="indexterm" name="id26155 60"></a>195 <a class="indexterm" name="id2615549"></a> 196 <a class="indexterm" name="id2615556"></a> 197 197 This daemon handles all TCP/IP-based connection services for file- and print-based operations. It also 198 198 manages local authentication. It should be started immediately following the startup of <code class="literal">nmbd</code>. 199 199 </p></dd><dt><span class="term">winbindd</span></dt><dd><p> 200 <a class="indexterm" name="id261558 9"></a>201 <a class="indexterm" name="id261559 6"></a>200 <a class="indexterm" name="id2615584"></a> 201 <a class="indexterm" name="id2615591"></a> 202 202 This daemon should be started when Samba is a member of a Windows NT4 or ADS domain. It is also needed when 203 203 Samba has trust relationships with another domain. The <code class="literal">winbindd</code> daemon will check the … … 253 253 exit 1 254 254 esac 255 </pre></div></div><br class="example-break"><p><a class="indexterm" name="id261571 5"></a>255 </pre></div></div><br class="example-break"><p><a class="indexterm" name="id2615710"></a> 256 256 SUSE Linux implements individual control over each Samba daemon. A Samba control script that can be conveniently 257 257 executed from the command line is shown in <a class="link" href="appendix.html#ch12SL" title="Example 15.1. A Useful Samba Control Script for SUSE Linux">“A Useful Samba Control Script for SUSE Linux”</a>. This can be located in the directory 258 258 <code class="filename">/sbin</code> in a file called <code class="filename">samba</code>. This type of control script should be 259 259 owned by user root and group root, and set so that only root can execute it. 260 </p><p><a class="indexterm" name="id26157 50"></a>260 </p><p><a class="indexterm" name="id2615746"></a> 261 261 A sample startup script for a Red Hat Linux system is shown in <a class="link" href="appendix.html#ch12RHscript" title="Example 15.2. A Sample Samba Control Script for Red Hat Linux">“A Sample Samba Control Script for Red Hat Linux”</a>. 262 262 This file could be located in the directory <code class="filename">/etc/rc.d</code> and can be called … … 265 265 the Samba source code distribution tarball. The packaging files for each platform include a 266 266 startup control file. 267 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id26157 93"></a>DNS Configuration Files</h2></div></div></div><p>267 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2615789"></a>DNS Configuration Files</h2></div></div></div><p> 268 268 The following files are common to all DNS server configurations. Rather than repeat them multiple times, they 269 269 are presented here for general reference. 270 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id261580 5"></a>The Forward Zone File for the Loopback Adaptor</h3></div></div></div><p>270 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2615801"></a>The Forward Zone File for the Loopback Adaptor</h3></div></div></div><p> 271 271 The forward zone file for the loopback address never changes. An example file is shown 272 272 in <a class="link" href="appendix.html#loopback" title="Example 15.3. DNS Localhost Forward Zone File: /var/lib/named/localhost.zone">“DNS Localhost Forward Zone File: /var/lib/named/localhost.zone”</a>. All traffic destined for an IP address that is hosted on a … … 285 285 IN NS @ 286 286 IN A 127.0.0.1 287 </pre></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id26158 54"></a>The Reverse Zone File for the Loopback Adaptor</h3></div></div></div><p>287 </pre></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2615849"></a>The Reverse Zone File for the Loopback Adaptor</h3></div></div></div><p> 288 288 The reverse zone file for the loopback address as shown in <a class="link" href="appendix.html#dnsloopy" title="Example 15.4. DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone">“DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone”</a> 289 289 is necessary so that references to the address <code class="constant">127.0.0.1</code> can be … … 345 345 M.ROOT-SERVERS.NET. 3600000 A 202.12.27.33 346 346 ; End of File 347 </pre></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id26159 94"></a>DNS Root Server Hint File</h3></div></div></div><p>347 </pre></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2615989"></a>DNS Root Server Hint File</h3></div></div></div><p> 348 348 The content of the root hints file as shown in <a class="link" href="appendix.html#roothint" title="Example 15.5. DNS Root Name Server Hint File: /var/lib/named/root.hint">“DNS Root Name Server Hint File: /var/lib/named/root.hint”</a> changes slowly over time. 349 349 Periodically this file should be updated from the source shown. Because 350 350 of its size, this file is located at the end of this chapter. 351 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="altldapcfg"></a>Alternative LDAP Database Initialization</h2></div></div></div><p><a class="indexterm" name="id261602 5"></a><a class="indexterm" name="id2616036"></a>351 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="altldapcfg"></a>Alternative LDAP Database Initialization</h2></div></div></div><p><a class="indexterm" name="id2616020"></a><a class="indexterm" name="id2616031"></a> 352 352 The following procedure may be used as an alternative means of configuring 353 353 the initial LDAP database. Many administrators prefer to have greater control 354 354 over how system files get configured. 355 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id26160 53"></a>Initialization of the LDAP Database</h3></div></div></div><p><a class="indexterm" name="id2616060"></a><a class="indexterm" name="id2616068"></a><a class="indexterm" name="id2616079"></a>355 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2616048"></a>Initialization of the LDAP Database</h3></div></div></div><p><a class="indexterm" name="id2616055"></a><a class="indexterm" name="id2616063"></a><a class="indexterm" name="id2616075"></a> 356 356 The first step to get the LDAP server ready for action is to create the LDIF file from 357 357 which the LDAP database will be preloaded. This is necessary to create the containers … … 706 706 displayName: Domain Users 707 707 description: Domain Users 708 </pre></div></div><br class="example-break"></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id26166 32"></a>The LDAP Account Manager</h2></div></div></div><p>709 <a class="indexterm" name="id26166 40"></a>710 <a class="indexterm" name="id261664 6"></a>711 <a class="indexterm" name="id261665 5"></a>712 <a class="indexterm" name="id26166 62"></a>713 <a class="indexterm" name="id261666 9"></a>714 <a class="indexterm" name="id261667 5"></a>715 <a class="indexterm" name="id26166 82"></a>708 </pre></div></div><br class="example-break"></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2616627"></a>The LDAP Account Manager</h2></div></div></div><p> 709 <a class="indexterm" name="id2616635"></a> 710 <a class="indexterm" name="id2616641"></a> 711 <a class="indexterm" name="id2616651"></a> 712 <a class="indexterm" name="id2616657"></a> 713 <a class="indexterm" name="id2616664"></a> 714 <a class="indexterm" name="id2616670"></a> 715 <a class="indexterm" name="id2616677"></a> 716 716 The LDAP Account Manager (LAM) is an application suite that has been written in PHP. 717 717 LAM can be used with any Web server that has PHP4 support. It connects to the LDAP … … 725 725 of 2005. 726 726 </p><p> 727 <a class="indexterm" name="id26167 13"></a>728 <a class="indexterm" name="id26167 20"></a>729 <a class="indexterm" name="id261672 7"></a>727 <a class="indexterm" name="id2616709"></a> 728 <a class="indexterm" name="id2616715"></a> 729 <a class="indexterm" name="id2616722"></a> 730 730 Requirements: 731 731 </p><div class="itemizedlist"><ul type="disc"><li><p>A web server that will work with PHP4.</p></li><li><p>PHP4 (available from the <a class="ulink" href="http://www.php.net/" target="_top">PHP</a> home page.)</p></li><li><p>OpenLDAP 2.0 or later.</p></li><li><p>A Web browser that supports CSS.</p></li><li><p>Perl.</p></li><li><p>The gettext package.</p></li><li><p>mcrypt + mhash (optional).</p></li><li><p>It is also a good idea to install SSL support.</p></li></ul></div><p> 732 732 LAM is a useful tool that provides a simple Web-based device that can be used to 733 733 manage the contents of the LDAP directory to: 734 <a class="indexterm" name="id261678 8"></a>735 <a class="indexterm" name="id261679 5"></a>736 <a class="indexterm" name="id2616 802"></a>734 <a class="indexterm" name="id2616783"></a> 735 <a class="indexterm" name="id2616790"></a> 736 <a class="indexterm" name="id2616797"></a> 737 737 </p><div class="itemizedlist"><ul type="disc"><li><p>Display user/group/host and Domain entries.</p></li><li><p>Manage entries (Add/Delete/Edit).</p></li><li><p>Filter and sort entries.</p></li><li><p>Store and use multiple operating profiles.</p></li><li><p>Edit organizational units (OUs).</p></li><li><p>Upload accounts from a file.</p></li><li><p>Is compatible with Samba-2.2.x and Samba-3.</p></li></ul></div><p> 738 738 When correctly configured, LAM allows convenient management of UNIX (Posix) and Samba 739 739 user, group, and windows domain member machine accounts. 740 740 </p><p> 741 <a class="indexterm" name="id261685 6"></a>742 <a class="indexterm" name="id26168 62"></a>743 <a class="indexterm" name="id261686 9"></a>744 <a class="indexterm" name="id261687 6"></a>741 <a class="indexterm" name="id2616851"></a> 742 <a class="indexterm" name="id2616858"></a> 743 <a class="indexterm" name="id2616865"></a> 744 <a class="indexterm" name="id2616871"></a> 745 745 The default password is “<span class="quote">lam.</span>” It is highly recommended that you use only 746 746 an SSL connection to your Web server for all remote operations involving LAM. If you … … 761 761 <code class="filename">/srv/www/htdocs</code> directory. 762 762 </p></li><li><p> 763 <a class="indexterm" name="id261695 6"></a>763 <a class="indexterm" name="id2616951"></a> 764 764 Set file permissions using the following commands: 765 765 </p><pre class="screen"> … … 771 771 </pre><p> 772 772 </p></li><li><p> 773 <a class="indexterm" name="id261700 8"></a>773 <a class="indexterm" name="id2617004"></a> 774 774 Using your favorite editor create the following <code class="filename">config.cfg</code> 775 775 LAM configuration file: … … 779 779 <code class="prompt">root# </code> vi config.cfg 780 780 </pre><p> 781 <a class="indexterm" name="id26170 50"></a>782 <a class="indexterm" name="id261705 8"></a>781 <a class="indexterm" name="id2617045"></a> 782 <a class="indexterm" name="id2617054"></a> 783 783 An example file is shown in <a class="link" href="appendix.html#lamcfg" title="Example 15.11. Example LAM Configuration File config.cfg">“Example LAM Configuration File config.cfg”</a>. 784 784 This is the minimum configuration that must be completed. The LAM profile … … 795 795 change the settings to match local site needs. 796 796 </p></li></ol></div><p> 797 <a class="indexterm" name="id261711 8"></a>797 <a class="indexterm" name="id2617114"></a> 798 798 An example of a working file is shown here in <a class="link" href="appendix.html#lamconf" title="Example 15.12. LAM Profile Control File lam.conf">“LAM Profile Control File lam.conf”</a>. 799 799 This file has been stripped of comments to keep the size small. The comments … … 803 803 are preferred at your site. 804 804 </p><p> 805 <a class="indexterm" name="id26171 42"></a>805 <a class="indexterm" name="id2617137"></a> 806 806 It is important that your LDAP server is running at the time that LAM is 807 807 being configured. This permits you to validate correct operation. 808 808 An example of the LAM login screen is provided in <a class="link" href="appendix.html#lam-login" title="Figure 15.6. The LDAP Account Manager Login Screen">“The LDAP Account Manager Login Screen”</a>. 809 809 </p><div class="figure"><a name="lam-login"></a><p class="title"><b>Figure 15.6. The LDAP Account Manager Login Screen</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/lam-login.png" width="270" alt="The LDAP Account Manager Login Screen"></div></div></div><br class="figure-break"><p> 810 <a class="indexterm" name="id261720 5"></a>810 <a class="indexterm" name="id2617200"></a> 811 811 The LAM configuration editor has a number of options that must be managed correctly. 812 812 An example of use of the LAM configuration editor is shown in <a class="link" href="appendix.html#lam-config" title="Figure 15.7. The LDAP Account Manager Configuration Screen">“The LDAP Account Manager Configuration Screen”</a>. … … 818 818 using LAM to add additional users and groups. 819 819 </p><div class="figure"><a name="lam-config"></a><p class="title"><b>Figure 15.7. The LDAP Account Manager Configuration Screen</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/lam-config.png" width="270" alt="The LDAP Account Manager Configuration Screen"></div></div></div><br class="figure-break"><p> 820 <a class="indexterm" name="id261727 7"></a>820 <a class="indexterm" name="id2617272"></a> 821 821 LAM has some nice, but unusual features. For example, one unexpected feature in most application 822 822 screens permits the generation of a PDF file that lists configuration information. This is a well … … 824 824 space. 825 825 </p><p> 826 <a class="indexterm" name="id26172 92"></a>826 <a class="indexterm" name="id2617287"></a> 827 827 When you log onto LAM the opening screen drops you right into the user manager as shown in 828 828 <a class="link" href="appendix.html#lam-user" title="Figure 15.8. The LDAP Account Manager User Edit Screen">“The LDAP Account Manager User Edit Screen”</a>. This is a logical action as it permits the most-needed facility … … 838 838 memberships. 839 839 </p><div class="figure"><a name="lam-group"></a><p class="title"><b>Figure 15.9. The LDAP Account Manager Group Edit Screen</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/lam-groups.png" width="270" alt="The LDAP Account Manager Group Edit Screen"></div></div></div><br class="figure-break"><div class="figure"><a name="lam-group-mem"></a><p class="title"><b>Figure 15.10. The LDAP Account Manager Group Membership Edit Screen</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/lam-group-members.png" width="270" alt="The LDAP Account Manager Group Membership Edit Screen"></div></div></div><br class="figure-break"><p> 840 <a class="indexterm" name="id26174 72"></a><a class="indexterm" name="id2617477"></a>840 <a class="indexterm" name="id2617467"></a><a class="indexterm" name="id2617472"></a> 841 841 The final screen presented here is one that you should not normally need to use. Host accounts will 842 842 be automatically managed using the smbldap-tools scripts. This means that the screen <a class="link" href="appendix.html#lam-host" title="Figure 15.11. The LDAP Account Manager Host Edit Screen">“The LDAP Account Manager Host Edit Screen”</a> … … 884 884 cachetimeout: 5 885 885 pwdhash: SSHA 886 </pre></div></div><br class="example-break"></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id261762 9"></a>IDEALX Management Console</h2></div></div></div><p>886 </pre></div></div><br class="example-break"></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2617624"></a>IDEALX Management Console</h2></div></div></div><p> 887 887 IMC (the IDEALX Mamagement Console) is a tool that can be used as the basis for a comprehensive 888 888 web-based management interface for UNIX and Linux systems. … … 898 898 For further information regarding IMC refer to the web <a class="ulink" href="http://imc.sourceforge.net/" target="_top">site.</a> 899 899 Prebuilt RPM packages are also <a class="ulink" href="http://imc.sourceforge.net/download.html" target="_top">available.</a> 900 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="ch12-SUIDSGID"></a>Effect of Setting File and Directory SUID/SGID Permissions Explained</h2></div></div></div><a class="indexterm" name="id261773 5"></a><a class="indexterm" name="id2617741"></a><p>900 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="ch12-SUIDSGID"></a>Effect of Setting File and Directory SUID/SGID Permissions Explained</h2></div></div></div><a class="indexterm" name="id2617730"></a><a class="indexterm" name="id2617737"></a><p> 901 901 The setting of the SUID/SGID bits on the file or directory permissions flag has particular 902 902 consequences. If the file is executable and the SUID bit is set, it executes with the privilege … … 968 968 drw-rw-r-- 2 bobj Domain Users 12346 Dec 18 18:11 maryvfile.txt 969 969 </pre><p> 970 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="ch12dblck"></a>Shared Data Integrity</h2></div></div></div><p><a class="indexterm" name="id26179 72"></a><a class="indexterm" name="id2617980"></a>970 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="ch12dblck"></a>Shared Data Integrity</h2></div></div></div><p><a class="indexterm" name="id2617968"></a><a class="indexterm" name="id2617976"></a> 971 971 The integrity of shared data is often viewed as a particularly emotional issue, especially where 972 972 there are concurrent problems with multiuser data access. Contrary to the assertions of some who have … … 974 974 </p><p> 975 975 The solution to concurrent multiuser data access problems must consider three separate areas 976 from which the problem may stem:<a class="indexterm" name="id261800 9"></a><a class="indexterm" name="id2618020"></a><a class="indexterm" name="id2618031"></a>977 </p><div class="itemizedlist"><ul type="disc"><li><p>application-level locking controls</p></li><li><p>client-side locking controls</p></li><li><p>server-side locking controls</p></li></ul></div><p><a class="indexterm" name="id26180 64"></a><a class="indexterm" name="id2618072"></a>976 from which the problem may stem:<a class="indexterm" name="id2618004"></a><a class="indexterm" name="id2618015"></a><a class="indexterm" name="id2618027"></a> 977 </p><div class="itemizedlist"><ul type="disc"><li><p>application-level locking controls</p></li><li><p>client-side locking controls</p></li><li><p>server-side locking controls</p></li></ul></div><p><a class="indexterm" name="id2618059"></a><a class="indexterm" name="id2618067"></a> 978 978 Many database applications use some form of application-level access control. An example of one 979 979 well-known application that uses application-level locking is Microsoft Access. Detailed guidance 980 980 is provided here because this is the most common application for which problems have been reported. 981 </p><p><a class="indexterm" name="id261808 8"></a><a class="indexterm" name="id2618096"></a>981 </p><p><a class="indexterm" name="id2618084"></a><a class="indexterm" name="id2618092"></a> 982 982 Common applications that are affected by client- and server-side locking controls include MS 983 983 Excel and Act!. Important locking guidance is provided here. 984 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id261810 9"></a>Microsoft Access</h3></div></div></div><p>984 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2618104"></a>Microsoft Access</h3></div></div></div><p> 985 985 The best advice that can be given is to carefully read the Microsoft knowledgebase articles that 986 986 cover this area. Examples of relevant documents include: 987 </p><div class="itemizedlist"><ul type="disc"><li><p>http://support.microsoft.com/default.aspx?scid=kb;en-us;208778</p></li><li><p>http://support.microsoft.com/default.aspx?scid=kb;en-us;299373</p></li></ul></div><p><a class="indexterm" name="id261813 6"></a><a class="indexterm" name="id2618147"></a>987 </p><div class="itemizedlist"><ul type="disc"><li><p>http://support.microsoft.com/default.aspx?scid=kb;en-us;208778</p></li><li><p>http://support.microsoft.com/default.aspx?scid=kb;en-us;299373</p></li></ul></div><p><a class="indexterm" name="id2618131"></a><a class="indexterm" name="id2618143"></a> 988 988 Make sure that your MS Access database file is configured for multiuser access (not set for 989 989 exclusive open). Open MS Access on each client workstation, then set the following: <span class="guimenu">(Menu bar) Tools</span>+<span class="guimenu">Options</span>+<span class="guimenu">[tab] General</span>. Set network path to Default database folder: <code class="filename">\\server\share\folder</code>. 990 990 </p><p> 991 991 You can configure MS Access file sharing behavior as follows: click <span class="guimenu">[tab] Advanced</span>. 992 Set:<a class="indexterm" name="id261819 8"></a>993 </p><div class="itemizedlist"><ul type="disc"><li><p>Default open mode: Shared</p></li><li><p>Default Record Locking: Edited Record</p></li><li><p>Open databases using record_level locking</p></li></ul></div><p><a class="indexterm" name="id261822 8"></a>992 Set:<a class="indexterm" name="id2618194"></a> 993 </p><div class="itemizedlist"><ul type="disc"><li><p>Default open mode: Shared</p></li><li><p>Default Record Locking: Edited Record</p></li><li><p>Open databases using record_level locking</p></li></ul></div><p><a class="indexterm" name="id2618223"></a> 994 994 You must now commit the changes so that they will take effect. To do so, click 995 995 <span class="guimenu">Apply</span><span class="guimenu">Ok</span>. At this point, you should exit MS Access, restart 996 996 it, and then validate that these settings have not changed. 997 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id261825 6"></a>Act! Database Sharing</h3></div></div></div><p><a class="indexterm" name="id2618263"></a><a class="indexterm" name="id2618271"></a>997 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2618252"></a>Act! Database Sharing</h3></div></div></div><p><a class="indexterm" name="id2618258"></a><a class="indexterm" name="id2618266"></a> 998 998 Where the server sharing the ACT! database(s) is running Samba,or Windows NT, 200x, or XP, you 999 999 must disable opportunistic locking on the server and all workstations. Failure to do so … … 1003 1003 as well as from article 1004 1004 <a class="ulink" href="http://itdomino.saleslogix.com/act.nsf/docid/200110485036" target="_top">200110485036</a>. 1005 </p><p><a class="indexterm" name="id2618 301"></a><a class="indexterm" name="id2618309"></a>1005 </p><p><a class="indexterm" name="id2618297"></a><a class="indexterm" name="id2618305"></a> 1006 1006 These documents clearly state that opportunistic locking must be disabled on both 1007 1007 the server (Samba in the case we are interested in here), as well as on every workstation … … 1011 1011 Registered Act! users may download this utility from the Act! Web 1012 1012 <a class="ulink" href="http://www.act.com/support/updates/index.cfm" target="_top">site.</a> 1013 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id26183 41"></a>Opportunistic Locking Controls</h3></div></div></div><p><a class="indexterm" name="id2618348"></a>1013 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2618336"></a>Opportunistic Locking Controls</h3></div></div></div><p><a class="indexterm" name="id2618343"></a> 1014 1014 Third-party Windows applications may not be compatible with the use of opportunistic file 1015 and record locking. For applications that are known not to be compatible,<sup>[<a name="id26183 60" href="#ftn.id2618360" class="footnote">14</a>]</sup> oplock1015 and record locking. For applications that are known not to be compatible,<sup>[<a name="id2618355" href="#ftn.id2618355" class="footnote">14</a>]</sup> oplock 1016 1016 support may need to be disabled both on the Samba server and on the Windows workstations. 1017 </p><p><a class="indexterm" name="id26183 74"></a><a class="indexterm" name="id2618382"></a><a class="indexterm" name="id2618390"></a>1017 </p><p><a class="indexterm" name="id2618369"></a><a class="indexterm" name="id2618377"></a><a class="indexterm" name="id2618385"></a> 1018 1018 Oplocks enable a Windows client to cache parts of a file that are being 1019 1019 edited. Another windows client may then request to open the file with the … … 1022 1022 doing so, that workstation must flush the file from cache memory to the 1023 1023 disk or network drive. 1024 </p><p><a class="indexterm" name="id26184 11"></a>1024 </p><p><a class="indexterm" name="id2618406"></a> 1025 1025 Disabling of Oplocks usage may require server and client changes. 1026 1026 Oplocks may be disabled by file, by file pattern, on the share, or on the -
branches/samba-3.2.x/docs/htmldocs/Samba3-ByExample/ch14.html
r204 r226 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 14. Samba Support</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="HA.html" title="Chapter 13. Performance, Reliability, and Availability"><link rel="next" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 14. Samba Support</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="HA.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="appendix.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en-US"><div class="titlepage"><div><div><h2 class="title"><a name="id26139 71"></a>Chapter 14. Samba Support</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ch14.html#id2614102">Free Support</a></span></dt><dt><span class="sect1"><a href="ch14.html#id2614320">Commercial Support</a></span></dt></dl></div><p>2 <a class="indexterm" name="id26139 81"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 14. Samba Support</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="HA.html" title="Chapter 13. Performance, Reliability, and Availability"><link rel="next" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 14. Samba Support</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="HA.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="appendix.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en-US"><div class="titlepage"><div><div><h2 class="title"><a name="id2613966"></a>Chapter 14. Samba Support</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ch14.html#id2614097">Free Support</a></span></dt><dt><span class="sect1"><a href="ch14.html#id2614316">Commercial Support</a></span></dt></dl></div><p> 2 <a class="indexterm" name="id2613976"></a> 3 3 One of the most difficult to answer questions in the information technology industry is, “<span class="quote">What is 4 4 support?</span>”. That question irritates some folks, as much as common answers may annoy others. 5 5 </p><p> 6 <a class="indexterm" name="id261399 7"></a>6 <a class="indexterm" name="id2613993"></a> 7 7 The most aggravating situation pertaining to support is typified when, as a Linux user, a call is made to 8 8 an Internet service provider who, instead of listening to the problem to find a solution, blandly replies: … … 16 16 inconvenience, loss of productivity, disorientation, uncertainty, and real or perceived risk. 17 17 </p><p> 18 <a class="indexterm" name="id261402 8"></a>19 <a class="indexterm" name="id261403 5"></a>20 <a class="indexterm" name="id26140 42"></a>18 <a class="indexterm" name="id2614023"></a> 19 <a class="indexterm" name="id2614030"></a> 20 <a class="indexterm" name="id2614037"></a> 21 21 One of the forces that has become a driving force for the adoption of open source software is the fact that 22 22 many IT businesses have provided services that have perhaps failed to deliver what the customer expected, or 23 23 that have been found wanting for other reasons. 24 24 </p><p> 25 <a class="indexterm" name="id261405 6"></a>26 <a class="indexterm" name="id26140 63"></a>25 <a class="indexterm" name="id2614052"></a> 26 <a class="indexterm" name="id2614059"></a> 27 27 In recognition of the need for needs satisfaction as the primary experience an information technology user or 28 28 consumer expects, the information provided in this chapter may help someone to avoid an unpleasant experience 29 29 in respect of problem resolution. 30 30 </p><p> 31 <a class="indexterm" name="id261407 8"></a>32 <a class="indexterm" name="id261408 5"></a>33 <a class="indexterm" name="id26140 92"></a>31 <a class="indexterm" name="id2614073"></a> 32 <a class="indexterm" name="id2614080"></a> 33 <a class="indexterm" name="id2614087"></a> 34 34 In the open source software arena there are two support options: free support and paid-for (commercial) 35 35 support. 36 </p><div class="sect1" lang="en-US"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2614 102"></a>Free Support</h2></div></div></div><p>37 <a class="indexterm" name="id26141 10"></a>38 <a class="indexterm" name="id261411 6"></a>39 <a class="indexterm" name="id26141 23"></a>40 <a class="indexterm" name="id26141 30"></a>41 <a class="indexterm" name="id261413 7"></a>42 <a class="indexterm" name="id26141 44"></a>36 </p><div class="sect1" lang="en-US"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2614097"></a>Free Support</h2></div></div></div><p> 37 <a class="indexterm" name="id2614105"></a> 38 <a class="indexterm" name="id2614112"></a> 39 <a class="indexterm" name="id2614119"></a> 40 <a class="indexterm" name="id2614126"></a> 41 <a class="indexterm" name="id2614132"></a> 42 <a class="indexterm" name="id2614139"></a> 43 43 Free support may be obtained from friends, colleagues, user groups, mailing lists, and interactive help 44 44 facilities. An example of an interactive dacility is the Internet relay chat (IRC) channels that host user 45 45 supported mutual assistance. 46 46 </p><p> 47 <a class="indexterm" name="id261415 8"></a>48 <a class="indexterm" name="id261416 5"></a>49 <a class="indexterm" name="id26141 72"></a>50 <a class="indexterm" name="id261417 9"></a>51 <a class="indexterm" name="id261418 6"></a>47 <a class="indexterm" name="id2614154"></a> 48 <a class="indexterm" name="id2614161"></a> 49 <a class="indexterm" name="id2614167"></a> 50 <a class="indexterm" name="id2614174"></a> 51 <a class="indexterm" name="id2614181"></a> 52 52 The Samba project maintains a mailing list that is commonly used to discuss solutions to Samba deployments. 53 53 Information regarding subscription to the Samba mailing list can be found on the Samba <a class="ulink" href="https://lists.samba.org/mailman/" target="_top">web</a> site. The public mailing list that can be used to obtain … … 56 56 the Samba <a class="ulink" href="http://www.samba.org/samba.irc.html" target="_top">IRC</a> web page. 57 57 </p><p> 58 <a class="indexterm" name="id261422 7"></a>59 <a class="indexterm" name="id26142 34"></a>60 <a class="indexterm" name="id26142 41"></a>61 <a class="indexterm" name="id261424 8"></a>58 <a class="indexterm" name="id2614222"></a> 59 <a class="indexterm" name="id2614229"></a> 60 <a class="indexterm" name="id2614236"></a> 61 <a class="indexterm" name="id2614243"></a> 62 62 As a general rule, it is considered poor net behavior to contact a Samba Team member directly 63 63 for free support. Most active members of the Samba Team work exceptionally long hours to assist … … 67 67 to show appropriate discretion and reservation in all direct contact. 68 68 </p><p> 69 <a class="indexterm" name="id261426 7"></a>70 <a class="indexterm" name="id261427 4"></a>71 <a class="indexterm" name="id26142 81"></a>69 <a class="indexterm" name="id2614263"></a> 70 <a class="indexterm" name="id2614270"></a> 71 <a class="indexterm" name="id2614276"></a> 72 72 When you stumble across a Samba bug, often the quickest way to get it resolved is by posting 73 73 a bug <a class="ulink" href="https://bugzilla.samba.org/" target="_top">report</a>. All such reports are mailed to … … 77 77 that will permit the problem to be reproduced. 78 78 </p><p> 79 <a class="indexterm" name="id261430 6"></a>79 <a class="indexterm" name="id2614301"></a> 80 80 We all recognize that sometimes free support does not provide the answer that is sought within 81 81 the time-frame required. At other times the problem is elusive and you may lack the experience 82 82 necessary to isolate the problem and thus to resolve it. This is a situation where is may be 83 83 prudent to purchase paid-for support. 84 </p></div><div class="sect1" lang="en-US"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id26143 20"></a>Commercial Support</h2></div></div></div><p>84 </p></div><div class="sect1" lang="en-US"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2614316"></a>Commercial Support</h2></div></div></div><p> 85 85 There are six basic support oriented services that are most commonly sought by Samba sites: 86 86 </p><div class="itemizedlist"><ul type="disc"><li><p>Assistance with network design</p></li><li><p>Staff Training</p></li><li><p>Assistance with Samba network deployment and installation</p></li><li><p>Priority telephone or email Samba configuration assistance</p></li><li><p>Trouble-shooting and diagnostic assistance</p></li><li><p>Provision of quality assured ready-to-install Samba binary packages</p></li></ul></div><p> 87 <a class="indexterm" name="id261436 7"></a>88 <a class="indexterm" name="id26143 74"></a>87 <a class="indexterm" name="id2614362"></a> 88 <a class="indexterm" name="id2614369"></a> 89 89 Information regarding companies that provide professional Samba support can be obtained by performing a Google 90 90 search, as well as by reference to the Samba <a class="ulink" href="http://www.samba.org/samba/support.html" target="_top">Support</a> web page. Companies who notify the Samba Team … … 94 94 them. 95 95 </p><p> 96 <a class="indexterm" name="id2614 400"></a>96 <a class="indexterm" name="id2614395"></a> 97 97 The policy within the Samba Team is to treat all commercial support providers equally and to show no 98 98 preference. As a result, Samba Team members who provide commercial support are lumped in with everyone else. … … 100 100 is pro-community; so do what you can to help a local business to prosper. 101 101 </p><p> 102 <a class="indexterm" name="id261441 6"></a>102 <a class="indexterm" name="id2614412"></a> 103 103 Open source software support can be found in any quality, at any price and in any place you can 104 104 to obtain it. Over 180 companies around the world provide Samba support, there is no excuse for -
branches/samba-3.2.x/docs/htmldocs/Samba3-ByExample/go01.html
r204 r226 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Glossary</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="apa.html" title="Appendix A. GNU General Public License version 3"><link rel="next" href="ix01.html" title="Index"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Glossary</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="apa.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="ix01.html">Next</a></td></tr></table><hr></div><div class="glossary"><div class="titlepage"><div><div><h2 class="title"><a name="id262345 5"></a>Glossary</h2></div></div></div><dl><dt>Access Control List</dt><dd><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Glossary</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="apa.html" title="Appendix A. GNU General Public License version 3"><link rel="next" href="ix01.html" title="Index"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Glossary</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="apa.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="ix01.html">Next</a></td></tr></table><hr></div><div class="glossary"><div class="titlepage"><div><div><h2 class="title"><a name="id2623451"></a>Glossary</h2></div></div></div><dl><dt>Access Control List</dt><dd><p> 2 2 A detailed list of permissions granted to users or groups with respect to file and network 3 3 resource access. -
branches/samba-3.2.x/docs/htmldocs/Samba3-ByExample/happy.html
r204 r226 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 5. Making Happy Users</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="Big500users.html" title="Chapter 4. The 500-User Office"><link rel="next" href="2000users.html" title="Chapter 6. A Distributed 2000-User Network"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 5. Making Happy Users</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="Big500users.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="2000users.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="happy"></a>Chapter 5. Making Happy Users</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="happy.html#id256415 4">Regarding LDAP Directories and Windows Computer Accounts</a></span></dt><dt><span class="sect1"><a href="happy.html#id2564296">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id2564394">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2564531">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id2564988">Technical Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id2566867">Political Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id2566882">Installation Checklist</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2567062">Samba Server Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbeidealx">Install and Configure Idealx smbldap-tools Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id2569962">LDAP Initialization and Creation of User and Group Accounts</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-ptrcfg">Printer Configuration</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a></span></dt><dt><span class="sect1"><a href="happy.html#id2573911">Miscellaneous Server Preparation Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id2573932">Configuring Directory Share Point Roots</a></span></dt><dt><span class="sect2"><a href="happy.html#id2574027">Configuring Profile Directories</a></span></dt><dt><span class="sect2"><a href="happy.html#id2574271">Preparation of Logon Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id2574382">Assigning User Rights and Privileges</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2574516">Windows Client Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></span></dt><dt><span class="sect2"><a href="happy.html#id2575269">Configuration of MS Outlook to Relocate PST File</a></span></dt><dt><span class="sect2"><a href="happy.html#id2575585">Configure Delete Cached Profiles on Logout</a></span></dt><dt><span class="sect2"><a href="happy.html#id2575764">Uploading Printer Drivers to Samba Servers</a></span></dt><dt><span class="sect2"><a href="happy.html#id2576267">Software Installation</a></span></dt><dt><span class="sect2"><a href="happy.html#id2576303">Roll-out Image Creation</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2576337">Key Points Learned</a></span></dt><dt><span class="sect1"><a href="happy.html#id2576452">Questions and Answers</a></span></dt></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 5. Making Happy Users</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="Big500users.html" title="Chapter 4. The 500-User Office"><link rel="next" href="2000users.html" title="Chapter 6. A Distributed 2000-User Network"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 5. Making Happy Users</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="Big500users.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="2000users.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="happy"></a>Chapter 5. Making Happy Users</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="happy.html#id2564150">Regarding LDAP Directories and Windows Computer Accounts</a></span></dt><dt><span class="sect1"><a href="happy.html#id2564292">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id2564389">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2564526">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id2564983">Technical Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id2566862">Political Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id2566878">Installation Checklist</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2567058">Samba Server Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbeidealx">Install and Configure Idealx smbldap-tools Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id2569957">LDAP Initialization and Creation of User and Group Accounts</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-ptrcfg">Printer Configuration</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a></span></dt><dt><span class="sect1"><a href="happy.html#id2573907">Miscellaneous Server Preparation Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id2573927">Configuring Directory Share Point Roots</a></span></dt><dt><span class="sect2"><a href="happy.html#id2574022">Configuring Profile Directories</a></span></dt><dt><span class="sect2"><a href="happy.html#id2574266">Preparation of Logon Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id2574377">Assigning User Rights and Privileges</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2574511">Windows Client Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></span></dt><dt><span class="sect2"><a href="happy.html#id2575264">Configuration of MS Outlook to Relocate PST File</a></span></dt><dt><span class="sect2"><a href="happy.html#id2575580">Configure Delete Cached Profiles on Logout</a></span></dt><dt><span class="sect2"><a href="happy.html#id2575759">Uploading Printer Drivers to Samba Servers</a></span></dt><dt><span class="sect2"><a href="happy.html#id2576262">Software Installation</a></span></dt><dt><span class="sect2"><a href="happy.html#id2576298">Roll-out Image Creation</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2576332">Key Points Learned</a></span></dt><dt><span class="sect1"><a href="happy.html#id2576448">Questions and Answers</a></span></dt></dl></div><p> 2 2 It is said that “<span class="quote">a day that is without troubles is not fulfilling. Rather, give 3 3 me a day of troubles well handled so that I can be content with my achievements.</span>” … … 7 7 may create problems for some network users. The following lists some of the problems that 8 8 may occur: 9 </p><a class="indexterm" name="id25637 33"></a><a class="indexterm" name="id2563739"></a><a class="indexterm" name="id2563748"></a><a class="indexterm" name="id2563755"></a><a class="indexterm" name="id2563762"></a><div class="caution" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Caution</h3><p>9 </p><a class="indexterm" name="id2563728"></a><a class="indexterm" name="id2563735"></a><a class="indexterm" name="id2563744"></a><a class="indexterm" name="id2563750"></a><a class="indexterm" name="id2563757"></a><div class="caution" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Caution</h3><p> 10 10 A significant number of network administrators have responded to the guidance given 11 11 here. It should be noted that there are sites that have a single PDC for many hundreds of … … 20 20 clients is conservative and if followed will minimize problems but it is not absolute. 21 21 </p></div><div class="variablelist"><dl><dt><span class="term">Users experiencing difficulty logging onto the network</span></dt><dd><p> 22 <a class="indexterm" name="id256380 7"></a>23 <a class="indexterm" name="id256381 6"></a>22 <a class="indexterm" name="id2563803"></a> 23 <a class="indexterm" name="id2563812"></a> 24 24 When a Windows client logs onto the network, many data packets are exchanged 25 25 between the client and the server that is providing the network logon services. … … 31 31 characteristics. 32 32 </p><p> 33 <a class="indexterm" name="id256383 6"></a>34 <a class="indexterm" name="id25638 43"></a>35 <a class="indexterm" name="id25638 50"></a>33 <a class="indexterm" name="id2563832"></a> 34 <a class="indexterm" name="id2563838"></a> 35 <a class="indexterm" name="id2563845"></a> 36 36 If the domain controller provides only network logon services 37 37 and all file and print activity is handled by domain member servers, one domain … … 47 47 the Samba server as well as network bandwidth utilization. 48 48 </p></dd><dt><span class="term">Slow logons and log-offs</span></dt><dd><p> 49 <a class="indexterm" name="id25638 83"></a>49 <a class="indexterm" name="id2563879"></a> 50 50 Slow logons and log-offs may be caused by many factors that include: 51 51 52 52 </p><div class="itemizedlist"><ul type="disc"><li><p> 53 <a class="indexterm" name="id256389 7"></a>54 <a class="indexterm" name="id256390 9"></a>53 <a class="indexterm" name="id2563892"></a> 54 <a class="indexterm" name="id2563904"></a> 55 55 Excessive delays in the resolution of a NetBIOS name to its IP 56 56 address. This may be observed when an overloaded domain controller … … 58 58 a WINS server (this assumes that there is a single network segment). 59 59 </p></li><li><p> 60 <a class="indexterm" name="id256392 7"></a>61 <a class="indexterm" name="id25639 34"></a>62 <a class="indexterm" name="id25639 40"></a>60 <a class="indexterm" name="id2563922"></a> 61 <a class="indexterm" name="id2563929"></a> 62 <a class="indexterm" name="id2563936"></a> 63 63 Network traffic collisions due to overloading of the network 64 64 segment. One short-term workaround to this may be to replace 65 65 network HUBs with Ethernet switches. 66 66 </p></li><li><p> 67 <a class="indexterm" name="id256395 5"></a>67 <a class="indexterm" name="id2563950"></a> 68 68 Defective networking hardware. Over the past few years, we have seen 69 69 on the Samba mailing list a significant increase in the number of … … 73 73 the cause of the problem. 74 74 </p></li><li><p> 75 <a class="indexterm" name="id256397 5"></a>76 <a class="indexterm" name="id256398 4"></a>75 <a class="indexterm" name="id2563971"></a> 76 <a class="indexterm" name="id2563980"></a> 77 77 Excessively large roaming profiles. This type of problem is typically 78 78 the result of poor user education as well as poor network management. … … 82 82 on the part of network management. 83 83 </p></li><li><p> 84 <a class="indexterm" name="id256400 5"></a>84 <a class="indexterm" name="id2564000"></a> 85 85 You should verify that the Windows XP WebClient service is not running. 86 86 The use of the WebClient service has been implicated in many Windows … … 91 91 of factors, including: 92 92 </p><div class="itemizedlist"><ul type="disc"><li><p> 93 <a class="indexterm" name="id256403 7"></a>93 <a class="indexterm" name="id2564033"></a> 94 94 Network overload (typically indicated by a high network collision rate) 95 95 </p></li><li><p> 96 96 Server overload 97 97 </p></li><li><p> 98 <a class="indexterm" name="id256405 7"></a>98 <a class="indexterm" name="id2564052"></a> 99 99 Timeout causing the client to close a connection that is in use but has 100 100 been latent (no traffic) for some time (5 minutes or more) 101 101 </p></li><li><p> 102 <a class="indexterm" name="id25640 73"></a>102 <a class="indexterm" name="id2564068"></a> 103 103 Defective networking hardware 104 104 </p></li></ul></div><p> 105 <a class="indexterm" name="id256408 7"></a>105 <a class="indexterm" name="id2564083"></a> 106 106 No matter what the cause, a sudden loss of access to network resources can 107 107 result in BSOD (blue screen of death) situations that necessitate rebooting of the client … … 110 110 problem, data corruption. 111 111 </p></dd><dt><span class="term">Potential data corruption</span></dt><dd><p> 112 <a class="indexterm" name="id25641 21"></a>112 <a class="indexterm" name="id2564116"></a> 113 113 Data corruption is one of the most serious problems. It leads to uncertainty, anger, and 114 114 frustration, and generally precipitates immediate corrective demands. Management response … … 124 124 methods to improve the reliability of your network environment, but be warned that all such steps 125 125 demand the price of complexity. 126 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id256415 4"></a>Regarding LDAP Directories and Windows Computer Accounts</h2></div></div></div><p>127 <a class="indexterm" name="id25641 63"></a>126 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2564150"></a>Regarding LDAP Directories and Windows Computer Accounts</h2></div></div></div><p> 127 <a class="indexterm" name="id2564158"></a> 128 128 Computer (machine) accounts can be placed wherever you like in an LDAP directory subject to some 129 129 constraints that are described in this section. 130 130 </p><p> 131 <a class="indexterm" name="id256417 8"></a>132 <a class="indexterm" name="id256418 4"></a>133 <a class="indexterm" name="id25641 91"></a>134 <a class="indexterm" name="id256419 8"></a>131 <a class="indexterm" name="id2564173"></a> 132 <a class="indexterm" name="id2564180"></a> 133 <a class="indexterm" name="id2564187"></a> 134 <a class="indexterm" name="id2564194"></a> 135 135 The POSIX and SambaSAMAccount components of computer (machine) accounts are both used by Samba. 136 136 That is, machine accounts are treated inside Samba in the same way that Windows NT4/200X treats … … 138 138 the machine account ends in a $ character, as do trust accounts. 139 139 </p><p> 140 <a class="indexterm" name="id256421 5"></a>141 <a class="indexterm" name="id25642 21"></a>140 <a class="indexterm" name="id2564210"></a> 141 <a class="indexterm" name="id2564217"></a> 142 142 The need for Windows user, group, machine, trust, and other such accounts to be tied to a valid UNIX UID 143 143 is a design decision that was made a long way back in the history of Samba development. It is … … 145 145 Samba-3.x series. 146 146 </p><p> 147 <a class="indexterm" name="id256423 6"></a>148 <a class="indexterm" name="id25642 43"></a>147 <a class="indexterm" name="id2564232"></a> 148 <a class="indexterm" name="id2564238"></a> 149 149 The resolution of a UID from the Windows SID is achieved within Samba through a mechanism that 150 150 must refer back to the host operating system on which Samba is running. The name service … … 159 159 all account entities can be located in an LDAP directory. 160 160 </p><p> 161 <a class="indexterm" name="id25642 80"></a>161 <a class="indexterm" name="id2564276"></a> 162 162 For many the weapon of choice is to use the PADL nss_ldap utility. This utility must 163 163 be configured so that computer accounts can be resolved to a POSIX/UNIX account UID. That … … 165 165 in the documentation is directed at providing working examples only. The design 166 166 of an LDAP directory is a complex subject that is beyond the scope of this documentation. 167 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id256429 6"></a>Introduction</h2></div></div></div><p>167 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2564292"></a>Introduction</h2></div></div></div><p> 168 168 You just opened an email from Christine that reads: 169 169 </p><p> … … 194 194 </p></td><td width="10%" valign="top"> </td></tr><tr><td width="10%" valign="top"> </td><td colspan="2" align="right" valign="top">--<span class="attribution">Christine</span></td></tr></table></div><p> 195 195 </p><p> 196 <a class="indexterm" name="id256435 8"></a>197 <a class="indexterm" name="id256436 5"></a>196 <a class="indexterm" name="id2564354"></a> 197 <a class="indexterm" name="id2564361"></a> 198 198 Every compromise has consequences. Having a large routed (i.e., multisegment) network with only a 199 199 single domain controller is a poor design that has obvious operational effects that may … … 205 205 Please let Stan know what the estimated cost will be so I can approve the expense. Do not wait 206 206 for approval; I appreciate the urgency. 207 </p></td><td width="10%" valign="top"> </td></tr><tr><td width="10%" valign="top"> </td><td colspan="2" align="right" valign="top">--<span class="attribution">Bob</span></td></tr></table></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id25643 94"></a>Assignment Tasks</h3></div></div></div><p>207 </p></td><td width="10%" valign="top"> </td></tr><tr><td width="10%" valign="top"> </td><td colspan="2" align="right" valign="top">--<span class="attribution">Bob</span></td></tr></table></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2564389"></a>Assignment Tasks</h3></div></div></div><p> 208 208 The priority of assigned tasks in this chapter is: 209 209 </p><div class="orderedlist"><ol type="1"><li><p> 210 <a class="indexterm" name="id25644 13"></a>211 <a class="indexterm" name="id25644 23"></a>212 <a class="indexterm" name="id256442 9"></a>213 <a class="indexterm" name="id256443 6"></a><a class="indexterm" name="id2564442"></a>210 <a class="indexterm" name="id2564409"></a> 211 <a class="indexterm" name="id2564418"></a> 212 <a class="indexterm" name="id2564425"></a> 213 <a class="indexterm" name="id2564431"></a><a class="indexterm" name="id2564437"></a> 214 214 Implement Backup Domain Controllers (BDCs) in each building. This involves 215 215 a change from a <span class="emphasis"><em>tdbsam</em></span> backend that was used in the previous … … 218 218 You can implement a single central LDAP server for this purpose. 219 219 </p></li><li><p> 220 <a class="indexterm" name="id25644 64"></a>221 <a class="indexterm" name="id25644 71"></a>222 <a class="indexterm" name="id256447 8"></a>223 <a class="indexterm" name="id256448 5"></a>220 <a class="indexterm" name="id2564459"></a> 221 <a class="indexterm" name="id2564466"></a> 222 <a class="indexterm" name="id2564473"></a> 223 <a class="indexterm" name="id2564480"></a> 224 224 Rectify the problem of excessive logon times. This involves redirection of 225 225 folders to network shares as well as modification of all user desktops to … … 227 227 create a new default profile that can be used for all new users. 228 228 </p></li></ol></div><p> 229 <a class="indexterm" name="id2564 503"></a>229 <a class="indexterm" name="id2564499"></a> 230 230 You configure a new MS Windows XP Professional workstation disk image that you roll out 231 231 to all desktop users. The instructions you have created are followed on a staging machine 232 232 from which all changes can be carefully tested before inflicting them on your network users. 233 233 </p><p> 234 <a class="indexterm" name="id256451 8"></a>234 <a class="indexterm" name="id2564514"></a> 235 235 This is the last network example in which specific mention of printing is made. The example 236 236 again makes use of the CUPS printing system. 237 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id25645 31"></a>Dissection and Discussion</h2></div></div></div><p>238 <a class="indexterm" name="id256453 9"></a>239 <a class="indexterm" name="id256454 5"></a>240 <a class="indexterm" name="id25645 52"></a>237 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2564526"></a>Dissection and Discussion</h2></div></div></div><p> 238 <a class="indexterm" name="id2564534"></a> 239 <a class="indexterm" name="id2564541"></a> 240 <a class="indexterm" name="id2564547"></a> 241 241 The implementation of Samba BDCs necessitates the installation and configuration of LDAP. 242 242 For this site, you use OpenLDAP, the open source software LDAP server platform. Commercial 243 243 LDAP servers in current use with Samba-3 include: 244 244 </p><div class="itemizedlist"><ul type="disc"><li><p> 245 <a class="indexterm" name="id256456 9"></a>245 <a class="indexterm" name="id2564565"></a> 246 246 Novell <a class="ulink" href="http://www.novell.com/products/edirectory/" target="_top">eDirectory</a> 247 247 is being successfully used by some sites. Information on how to use eDirectory can be 248 248 obtained from the Samba mailing lists or from Novell. 249 249 </p></li><li><p> 250 <a class="indexterm" name="id256458 9"></a>250 <a class="indexterm" name="id2564585"></a> 251 251 IBM <a class="ulink" href="http://www-306.ibm.com/software/tivoli/products/directory-server/" target="_top">Tivoli 252 252 Directory Server</a> can be used to provide the Samba LDAP backend. Example schema … … 254 254 <code class="filename">~samba/example/LDAP.</code> 255 255 </p></li><li><p> 256 <a class="indexterm" name="id256461 6"></a>256 <a class="indexterm" name="id2564612"></a> 257 257 Sun <a class="ulink" href="http://www.sun.com/software/software/products/identity_srvr/home_identity.xml" target="_top">ONE Identity 258 258 Server product suite</a> provides an LDAP server that can be used for Samba. … … 265 265 help you to get OpenLDAP and Samba-3 running as required, albeit with some learning curve challenges. 266 266 </p><p> 267 <a class="indexterm" name="id25646 54"></a>267 <a class="indexterm" name="id2564649"></a> 268 268 For most sites, the deployment of Microsoft Active Directory from the shrink-wrapped installation is quite 269 269 adequate. If you are migrating from Microsoft Active Directory, be warned that OpenLDAP does not include … … 271 271 requires an understanding of what you are doing, why you are doing it, and the tools that you must use. 272 272 </p><p> 273 <a class="indexterm" name="id25646 71"></a>274 <a class="indexterm" name="id256467 8"></a>275 <a class="indexterm" name="id256468 5"></a>276 <a class="indexterm" name="id256469 4"></a>277 <a class="indexterm" name="id2564 703"></a>278 <a class="indexterm" name="id25647 10"></a>279 <a class="indexterm" name="id256471 9"></a>273 <a class="indexterm" name="id2564666"></a> 274 <a class="indexterm" name="id2564673"></a> 275 <a class="indexterm" name="id2564680"></a> 276 <a class="indexterm" name="id2564690"></a> 277 <a class="indexterm" name="id2564699"></a> 278 <a class="indexterm" name="id2564706"></a> 279 <a class="indexterm" name="id2564715"></a> 280 280 When installed and configured, an OpenLDAP Identity Management backend for Samba functions well. 281 281 High availability operation may be obtained through directory replication/synchronization and … … 287 287 with Microsoft Active Directory. 288 288 </p><p> 289 <a class="indexterm" name="id256474 4"></a>290 <a class="indexterm" name="id256475 4"></a>291 <a class="indexterm" name="id25647 61"></a>292 <a class="indexterm" name="id256476 8"></a>289 <a class="indexterm" name="id2564740"></a> 290 <a class="indexterm" name="id2564750"></a> 291 <a class="indexterm" name="id2564756"></a> 292 <a class="indexterm" name="id2564763"></a> 293 293 A comparison of OpenLDAP with Microsoft Active Directory does not do justice to either. OpenLDAP is an LDAP directory 294 294 tool-set. Microsoft Active Directory Server is an implementation of an LDAP server that is largely preconfigured … … 301 301 of OpenLDAP. 302 302 </p><p> 303 <a class="indexterm" name="id256479 8"></a>304 <a class="indexterm" name="id256480 7"></a>303 <a class="indexterm" name="id2564793"></a> 304 <a class="indexterm" name="id2564802"></a> 305 305 You may wish to consider outsourcing the development of your OpenLDAP directory to an expert, particularly 306 306 if you find the challenge of learning about LDAP directories, schemas, configuration, and management … … 310 310 that is required for use as a passdb backend. 311 311 </p><p> 312 <a class="indexterm" name="id256482 5"></a>312 <a class="indexterm" name="id2564820"></a> 313 313 For those who are willing to brave the process of installing and configuring LDAP and Samba-3 interoperability, 314 314 there are a few nice Web-based tools that may help you to manage your users and groups more effectively. … … 335 335 by Jerry Carter quite useful. 336 336 </p><p> 337 <a class="indexterm" name="id25649 23"></a>338 <a class="indexterm" name="id256492 9"></a>339 <a class="indexterm" name="id256493 8"></a>340 <a class="indexterm" name="id256494 5"></a>337 <a class="indexterm" name="id2564918"></a> 338 <a class="indexterm" name="id2564925"></a> 339 <a class="indexterm" name="id2564934"></a> 340 <a class="indexterm" name="id2564941"></a> 341 341 Mary's problems are due to two factors. First, the absence of a domain controller on the local network is the 342 342 main cause of the errors that result in blue screen crashes. Second, Mary has a large profile that must … … 346 346 staff morale. The following procedures solve this problem. 347 347 </p><p> 348 <a class="indexterm" name="id256496 8"></a>348 <a class="indexterm" name="id2564963"></a> 349 349 There is also an opportunity to implement smart printing features. You add this to the Samba configuration 350 350 so that future printer changes can be managed without need to change desktop configurations. … … 353 353 in the default desktop profile. Only one example of printing configuration is given. It is assumed that 354 354 you can extrapolate the principles and use them to install all printers that may be needed. 355 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id256498 8"></a>Technical Issues</h3></div></div></div><p>356 <a class="indexterm" name="id256499 5"></a>357 <a class="indexterm" name="id256500 5"></a>358 <a class="indexterm" name="id25650 14"></a>355 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2564983"></a>Technical Issues</h3></div></div></div><p> 356 <a class="indexterm" name="id2564991"></a> 357 <a class="indexterm" name="id2565000"></a> 358 <a class="indexterm" name="id2565009"></a> 359 359 The solution provided is a minimal approach to getting OpenLDAP running as an identity management directory 360 360 server for UNIX system accounts as well as for Samba. From the OpenLDAP perspective, UNIX system … … 362 362 attributes Samba needs. Samba-3 can use the LDAP backend to store: 363 363 </p><div class="itemizedlist"><ul type="disc"><li><p>Windows Networking User Accounts</p></li><li><p>Windows NT Group Accounts</p></li><li><p>Mapping Information between UNIX Groups and Windows NT Groups</p></li><li><p>ID Mappings for SIDs to UIDs (also for foreign Domain SIDs)</p></li></ul></div><p> 364 <a class="indexterm" name="id256505 4"></a>365 <a class="indexterm" name="id25650 61"></a>366 <a class="indexterm" name="id256506 8"></a>367 <a class="indexterm" name="id256507 5"></a>368 <a class="indexterm" name="id25650 82"></a>369 <a class="indexterm" name="id256508 9"></a>370 <a class="indexterm" name="id256509 8"></a>371 <a class="indexterm" name="id256510 4"></a>372 <a class="indexterm" name="id25651 11"></a>364 <a class="indexterm" name="id2565050"></a> 365 <a class="indexterm" name="id2565057"></a> 366 <a class="indexterm" name="id2565064"></a> 367 <a class="indexterm" name="id2565071"></a> 368 <a class="indexterm" name="id2565078"></a> 369 <a class="indexterm" name="id2565084"></a> 370 <a class="indexterm" name="id2565093"></a> 371 <a class="indexterm" name="id2565100"></a> 372 <a class="indexterm" name="id2565106"></a> 373 373 The use of LDAP with Samba-3 makes it necessary to store UNIX accounts as well as Windows Networking 374 374 accounts in the LDAP backend. This implies the need to use the … … 379 379 of the UNIX username to the UID. The relationships are demonstrated in <a class="link" href="happy.html#sbehap-LDAPdiag" title="Figure 5.1. The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts">“The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts”</a>. 380 380 </p><div class="figure"><a name="sbehap-LDAPdiag"></a><p class="title"><b>Figure 5.1. The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/UNIX-Samba-and-LDAP.png" width="270" alt="The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts"></div></div></div><br class="figure-break"><p> 381 <a class="indexterm" name="id256519 7"></a>382 <a class="indexterm" name="id2565 204"></a>381 <a class="indexterm" name="id2565192"></a> 382 <a class="indexterm" name="id2565199"></a> 383 383 You configure OpenLDAP so that it is operational. Before deploying the OpenLDAP, you really 384 384 ought to learn how to configure secure communications over LDAP so that site security is not 385 385 at risk. This is not covered in the following guidance. 386 386 </p><p> 387 <a class="indexterm" name="id25652 20"></a>388 <a class="indexterm" name="id256522 7"></a>389 <a class="indexterm" name="id256523 6"></a>390 <a class="indexterm" name="id25652 43"></a>387 <a class="indexterm" name="id2565216"></a> 388 <a class="indexterm" name="id2565222"></a> 389 <a class="indexterm" name="id2565232"></a> 390 <a class="indexterm" name="id2565238"></a> 391 391 When OpenLDAP has been made operative, you configure the PDC called <code class="constant">MASSIVE</code>. 392 392 You initialize the Samba <code class="filename">secrets.tdb<sub></sub></code> file. Then you … … 396 396 that help to manage user and group configuration. 397 397 </p><p> 398 <a class="indexterm" name="id256527 7"></a>399 <a class="indexterm" name="id25652 84"></a>400 <a class="indexterm" name="id25652 90"></a>398 <a class="indexterm" name="id2565272"></a> 399 <a class="indexterm" name="id2565279"></a> 400 <a class="indexterm" name="id2565286"></a> 401 401 In order to effect folder redirection and to add robustness to the implementation, 402 402 create a network default profile. All network users workstations are configured to use … … 404 404 when the user logs off. 405 405 </p><p> 406 <a class="indexterm" name="id25653 10"></a>406 <a class="indexterm" name="id2565306"></a> 407 407 The profile is configured so that users cannot change the appearance 408 408 of their desktop. This is known as a mandatory profile. You make certain that users 409 409 are able to use their computers efficiently. 410 410 </p><p> 411 <a class="indexterm" name="id25653 24"></a>411 <a class="indexterm" name="id2565319"></a> 412 412 A network logon script is used to deliver flexible but consistent network drive 413 413 connections. 414 414 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="sbehap-ppc"></a>Addition of Machines to the Domain</h4></div></div></div><p> 415 <a class="indexterm" name="id256534 5"></a>416 <a class="indexterm" name="id25653 51"></a>417 <a class="indexterm" name="id256535 6"></a>418 <a class="indexterm" name="id25653 62"></a>415 <a class="indexterm" name="id2565341"></a> 416 <a class="indexterm" name="id2565346"></a> 417 <a class="indexterm" name="id2565352"></a> 418 <a class="indexterm" name="id2565357"></a> 419 419 Samba versions prior to 3.0.11 necessitated the use of a domain administrator account 420 420 that maps to the UNIX UID=0. The UNIX operating system permits only the <code class="constant">root</code> … … 426 426 how any user can now be given the ability to add machines to the domain using a normal user account 427 427 that has been given the appropriate privileges. 428 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2565 500"></a>Roaming Profile Background</h4></div></div></div><p>428 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2565495"></a>Roaming Profile Background</h4></div></div></div><p> 429 429 As XP roaming profiles grow, so does the amount of time it takes to log in and out. 430 430 </p><p> 431 <a class="indexterm" name="id25655 12"></a>432 <a class="indexterm" name="id256551 9"></a>433 <a class="indexterm" name="id256552 6"></a>434 <a class="indexterm" name="id25655 33"></a>431 <a class="indexterm" name="id2565508"></a> 432 <a class="indexterm" name="id2565515"></a> 433 <a class="indexterm" name="id2565522"></a> 434 <a class="indexterm" name="id2565528"></a> 435 435 An XP roaming profile consists of the <code class="constant">HKEY_CURRENT_USER</code> hive file 436 436 <code class="filename">NTUSER.DAT</code> and a number of folders (My Documents, Application Data, … … 454 454 instead of the <code class="filename">My Documents</code> folder for saving documents. 455 455 </p><p> 456 <a class="indexterm" name="id25656 12"></a>456 <a class="indexterm" name="id2565607"></a> 457 457 Using a folder other than <code class="filename">My Documents</code> is a nuisance for 458 458 some users, since many applications use it by default. 459 459 </p><p> 460 <a class="indexterm" name="id25656 30"></a>461 <a class="indexterm" name="id256563 7"></a>462 <a class="indexterm" name="id25656 44"></a>460 <a class="indexterm" name="id2565626"></a> 461 <a class="indexterm" name="id2565632"></a> 462 <a class="indexterm" name="id2565639"></a> 463 463 The secret to rapid loading of roaming profiles is to prevent unnecessary data from 464 464 being copied back and forth, without losing any functionality. This is not difficult; … … 466 466 as changing some paths in each user's <code class="filename">NTUSER.DAT</code> hive. 467 467 </p><p> 468 <a class="indexterm" name="id256566 5"></a>469 <a class="indexterm" name="id25656 72"></a>468 <a class="indexterm" name="id2565661"></a> 469 <a class="indexterm" name="id2565668"></a> 470 470 Every user profile has its own <code class="filename">NTUSER.DAT</code> file. This means 471 471 you need to edit every user's profile, unless a better method can be … … 476 476 they are redirected. 477 477 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="sbehap-locgrppol"></a>The Local Group Policy</h4></div></div></div><p> 478 <a class="indexterm" name="id25657 13"></a>479 <a class="indexterm" name="id25657 20"></a>480 <a class="indexterm" name="id256572 6"></a>481 <a class="indexterm" name="id25657 33"></a>478 <a class="indexterm" name="id2565708"></a> 479 <a class="indexterm" name="id2565715"></a> 480 <a class="indexterm" name="id2565722"></a> 481 <a class="indexterm" name="id2565728"></a> 482 482 Without an Active Directory PDC, you cannot take full advantage of Group Policy 483 483 Objects. However, you can still make changes to the Local Group Policy by using … … 493 493 semicolon-separated list. Note that this change must be made on all clients 494 494 that are using roaming profiles. 495 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2565 800"></a>Profile Changes</h4></div></div></div><p>496 <a class="indexterm" name="id256580 8"></a>497 <a class="indexterm" name="id256581 5"></a>495 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2565796"></a>Profile Changes</h4></div></div></div><p> 496 <a class="indexterm" name="id2565803"></a> 497 <a class="indexterm" name="id2565810"></a> 498 498 There are two changes that should be done to each user's profile. Move each of 499 499 the directories that you have excluded from being copied back and forth out of … … 502 502 path (<code class="filename">C:\Documents and Settings\%USERNAME%</code>). 503 503 </p><p> 504 <a class="indexterm" name="id25658 42"></a>505 <a class="indexterm" name="id256584 9"></a>504 <a class="indexterm" name="id2565838"></a> 505 <a class="indexterm" name="id2565845"></a> 506 506 The above modifies existing user profiles. So that newly created profiles have 507 507 these settings, you need to modify the <code class="filename">NTUSER.DAT</code> in … … 510 510 <code class="filename">NTUSER.DAT</code> to a Linux box and using <code class="literal">regedt32</code>. 511 511 The basic method is described under <a class="link" href="happy.html#redirfold" title="Configuration of Default Profile with Folder Redirection">“Configuration of Default Profile with Folder Redirection”</a>. 512 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id256589 5"></a>Using a Network Default User Profile</h4></div></div></div><p>513 <a class="indexterm" name="id2565 903"></a>514 <a class="indexterm" name="id25659 10"></a>512 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2565890"></a>Using a Network Default User Profile</h4></div></div></div><p> 513 <a class="indexterm" name="id2565898"></a> 514 <a class="indexterm" name="id2565905"></a> 515 515 If you are using Samba as your PDC, you should create a file share called 516 516 <code class="constant">NETLOGON</code> and within that create a directory called … … 521 521 See also <a class="ulink" href="http://isg.ee.ethz.ch/tools/realmen/det/skel.en.html" target="_top"> 522 522 the Real Men Don't Click</a> Web site. 523 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id25659 53"></a>Installation of Printer Driver Auto-Download</h4></div></div></div><p>524 <a class="indexterm" name="id25659 62"></a>525 <a class="indexterm" name="id25659 71"></a>526 <a class="indexterm" name="id256597 8"></a>523 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2565949"></a>Installation of Printer Driver Auto-Download</h4></div></div></div><p> 524 <a class="indexterm" name="id2565957"></a> 525 <a class="indexterm" name="id2565966"></a> 526 <a class="indexterm" name="id2565973"></a> 527 527 The subject of printing is quite topical. Printing problems run second place to name 528 528 resolution issues today. So far in this book, you have experienced only what is generally … … 533 533 <code class="literal">Raw-Print-Through</code> printing. 534 534 </p><p> 535 <a class="indexterm" name="id256600 6"></a>536 <a class="indexterm" name="id256601 6"></a>535 <a class="indexterm" name="id2566002"></a> 536 <a class="indexterm" name="id2566011"></a> 537 537 Samba permits the configuration of <code class="literal">smart</code> printing using the Microsoft 538 538 Windows point-and-click (also called drag-and-drop) printing. What this provides is … … 548 548 suited to the printer to which the job is dispatched. 549 549 </p><p> 550 <a class="indexterm" name="id25660 63"></a>551 <a class="indexterm" name="id25660 70"></a>552 <a class="indexterm" name="id256607 7"></a>550 <a class="indexterm" name="id2566058"></a> 551 <a class="indexterm" name="id2566065"></a> 552 <a class="indexterm" name="id2566072"></a> 553 553 The CUPS printing subsystem is capable of intelligent printing. It has the capacity to 554 554 detect the data format and apply a print filter. This means that it is feasible to install … … 575 575 </p><p> 576 576 Here are some diagnostic guidelines that can be referred to when things go wrong: 577 </p><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id25661 43"></a>Preliminary Advice: Dangers Can Be Avoided</h5></div></div></div><p>577 </p><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2566139"></a>Preliminary Advice: Dangers Can Be Avoided</h5></div></div></div><p> 578 578 The best advice regarding how to mend a broken leg is “<span class="quote">Never break a leg!</span>” 579 579 </p><p> 580 <a class="indexterm" name="id25661 60"></a>580 <a class="indexterm" name="id2566155"></a> 581 581 Newcomers to Samba and LDAP seem to struggle a great deal at first. If you want advice 582 582 regarding the best way to remedy LDAP and Samba problems: “<span class="quote">Avoid them like the plague!</span>” … … 594 594 book and adapt them without first working through the examples provided. A little 595 595 thing overlooked can cause untold pain and may permanently tarnish your experience. 596 </p></div></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2566 203"></a>The Name Service Caching Daemon</h5></div></div></div><p>596 </p></div></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2566199"></a>The Name Service Caching Daemon</h5></div></div></div><p> 597 597 The name service caching daemon (nscd) is a primary cause of difficulties with name 598 598 resolution, particularly where <code class="literal">winbind</code> is used. Winbind does its … … 661 661 <code class="prompt">root# </code> rcnscd off 662 662 </pre><p> 663 </p></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id256637 7"></a>Debugging LDAP</h5></div></div></div><p>664 <a class="indexterm" name="id256638 5"></a>665 <a class="indexterm" name="id25663 92"></a>666 <a class="indexterm" name="id256639 9"></a>663 </p></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2566373"></a>Debugging LDAP</h5></div></div></div><p> 664 <a class="indexterm" name="id2566381"></a> 665 <a class="indexterm" name="id2566388"></a> 666 <a class="indexterm" name="id2566394"></a> 667 667 In the example <code class="filename">/etc/openldap/slapd.conf</code> control file 668 668 (see <a class="link" href="happy.html#sbehap-dbconf" title="Example 5.1. LDAP DB_CONFIG File">“LDAP DB_CONFIG File”</a>) there is an entry for <code class="constant">loglevel 256</code>. … … 670 670 and restart <code class="literal">slapd</code>. 671 671 </p><p> 672 <a class="indexterm" name="id256643 5"></a>673 <a class="indexterm" name="id25664 42"></a>672 <a class="indexterm" name="id2566430"></a> 673 <a class="indexterm" name="id2566437"></a> 674 674 LDAP log information can be directed into a file that is separate from the normal system 675 675 log files by changing the <code class="filename">/etc/syslog.conf</code> file so it has the following … … 690 690 customization with the intent that LDAP log files will be stored at a location 691 691 that meets local site needs and wishes more fully. 692 </p></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id25664 83"></a>Debugging NSS_LDAP</h5></div></div></div><p>692 </p></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2566479"></a>Debugging NSS_LDAP</h5></div></div></div><p> 693 693 The basic mechanism for diagnosing problems with the nss_ldap utility involves adding to the 694 694 <code class="filename">/etc/ldap.conf</code> file the following parameters: … … 703 703 </p><p> 704 704 The diagnostic process should follow these steps: 705 </p><div class="procedure"><a name="id256652 7"></a><p class="title"><b>Procedure 5.1. NSS_LDAP Diagnostic Steps</b></p><ol type="1"><li><p>705 </p><div class="procedure"><a name="id2566522"></a><p class="title"><b>Procedure 5.1. NSS_LDAP Diagnostic Steps</b></p><ol type="1"><li><p> 706 706 Verify the <code class="constant">nss_base_passwd, nss_base_shadow, nss_base_group</code> entries 707 707 in the <code class="filename">/etc/ldap.conf</code> file and compare them closely with the directory … … 793 793 <code class="filename">/etc/ldap.secrets</code> file is correct, as specified in the 794 794 <code class="filename">/etc/openldap/slapd.conf</code> file. 795 </p></li></ol></div></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id256677 8"></a>Debugging Samba</h5></div></div></div><p>795 </p></li></ol></div></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2566774"></a>Debugging Samba</h5></div></div></div><p> 796 796 The following parameters in the <code class="filename">smb.conf</code> file can be useful in tracking down Samba-related problems: 797 797 </p><pre class="screen"> … … 823 823 Search for hints of what may have failed by looking for the words <span class="emphasis"><em>fail</em></span> 824 824 and <span class="emphasis"><em>error</em></span>. 825 </p></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id256684 9"></a>Debugging on the Windows Client</h5></div></div></div><p>825 </p></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2566844"></a>Debugging on the Windows Client</h5></div></div></div><p> 826 826 MS Windows 2000 Professional and Windows XP Professional clients can be configured 827 827 to create a netlogon.log file that can be very helpful in diagnosing network logon problems. Search 828 828 the Microsoft knowledge base for detailed instructions. The techniques vary a little with each 829 829 version of MS Windows. 830 </p></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id256686 7"></a>Political Issues</h3></div></div></div><p>830 </p></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2566862"></a>Political Issues</h3></div></div></div><p> 831 831 MS Windows network users are generally very sensitive to limits that may be imposed when 832 832 confronted with locked-down workstation configurations. The challenge you face must 833 833 be promoted as a choice between reliable, fast network operation and a constant flux 834 834 of problems that result in user irritation. 835 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id25668 82"></a>Installation Checklist</h3></div></div></div><p>835 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2566878"></a>Installation Checklist</h3></div></div></div><p> 836 836 You are starting a complex project. Even though you went through the installation of a complex 837 837 network in <a class="link" href="Big500users.html" title="Chapter 4. The 500-User Office">“The 500-User Office”</a>, this network is a bigger challenge because of the … … 841 841 been completed. The following task list may help you to keep track of the task items 842 842 that are covered: 843 </p><div class="itemizedlist"><ul type="disc"><li><p>Samba-3 PDC Server Configuration</p><div class="orderedlist"><ol type="1"><li><p>DHCP and DNS servers</p></li><li><p>OpenLDAP server</p></li><li><p>PAM and NSS client tools</p></li><li><p>Samba-3 PDC</p></li><li><p>Idealx smbldap scripts</p></li><li><p>LDAP initialization</p></li><li><p>Create user and group accounts</p></li><li><p>Printers</p></li><li><p>Share point directory roots</p></li><li><p>Profile directories</p></li><li><p>Logon scripts</p></li><li><p>Configuration of user rights and privileges</p></li></ol></div></li><li><p>Samba-3 BDC Server Configuration</p><div class="orderedlist"><ol type="1"><li><p>DHCP and DNS servers</p></li><li><p>PAM and NSS client tools</p></li><li><p>Printers</p></li><li><p>Share point directory roots</p></li><li><p>Profiles directories</p></li></ol></div></li><li><p>Windows XP Client Configuration</p><div class="orderedlist"><ol type="1"><li><p>Default profile folder redirection</p></li><li><p>MS Outlook PST file relocation</p></li><li><p>Delete roaming profile on logout</p></li><li><p>Upload printer drivers to Samba servers</p></li><li><p>Install software</p></li><li><p>Creation of roll-out images</p></li></ol></div></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id25670 62"></a>Samba Server Implementation</h2></div></div></div><p>844 <a class="indexterm" name="id25670 70"></a>845 <a class="indexterm" name="id256707 7"></a>843 </p><div class="itemizedlist"><ul type="disc"><li><p>Samba-3 PDC Server Configuration</p><div class="orderedlist"><ol type="1"><li><p>DHCP and DNS servers</p></li><li><p>OpenLDAP server</p></li><li><p>PAM and NSS client tools</p></li><li><p>Samba-3 PDC</p></li><li><p>Idealx smbldap scripts</p></li><li><p>LDAP initialization</p></li><li><p>Create user and group accounts</p></li><li><p>Printers</p></li><li><p>Share point directory roots</p></li><li><p>Profile directories</p></li><li><p>Logon scripts</p></li><li><p>Configuration of user rights and privileges</p></li></ol></div></li><li><p>Samba-3 BDC Server Configuration</p><div class="orderedlist"><ol type="1"><li><p>DHCP and DNS servers</p></li><li><p>PAM and NSS client tools</p></li><li><p>Printers</p></li><li><p>Share point directory roots</p></li><li><p>Profiles directories</p></li></ol></div></li><li><p>Windows XP Client Configuration</p><div class="orderedlist"><ol type="1"><li><p>Default profile folder redirection</p></li><li><p>MS Outlook PST file relocation</p></li><li><p>Delete roaming profile on logout</p></li><li><p>Upload printer drivers to Samba servers</p></li><li><p>Install software</p></li><li><p>Creation of roll-out images</p></li></ol></div></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2567058"></a>Samba Server Implementation</h2></div></div></div><p> 844 <a class="indexterm" name="id2567066"></a> 845 <a class="indexterm" name="id2567073"></a> 846 846 The network design shown in <a class="link" href="happy.html#chap6net" title="Figure 5.2. Network Topology 500 User Network Using ldapsam passdb backend">“Network Topology 500 User Network Using ldapsam passdb backend”</a> is not comprehensive. It is assumed 847 847 that you will install additional file servers and possibly additional BDCs. 848 848 </p><div class="figure"><a name="chap6net"></a><p class="title"><b>Figure 5.2. Network Topology 500 User Network Using ldapsam passdb backend</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap6-net.png" width="270" alt="Network Topology 500 User Network Using ldapsam passdb backend"></div></div></div><br class="figure-break"><p> 849 <a class="indexterm" name="id25671 40"></a>850 <a class="indexterm" name="id256714 7"></a>849 <a class="indexterm" name="id2567135"></a> 850 <a class="indexterm" name="id2567142"></a> 851 851 All configuration files and locations are shown for SUSE Linux 9.2 and are equally valid for SUSE 852 852 Linux Enterprise Server 9. The file locations for Red Hat Linux are similar. You may need to … … 869 869 <a class="link" href="Big500users.html#ch5-dnshcp-setup" title="Installation of DHCP, DNS, and Samba Control Files">“Installation of DHCP, DNS, and Samba Control Files”</a> before commencing at <a class="link" href="happy.html#ldapsetup" title="OpenLDAP Server Configuration">“OpenLDAP Server Configuration”</a>. 870 870 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ldapsetup"></a>OpenLDAP Server Configuration</h3></div></div></div><p> 871 <a class="indexterm" name="id256722 8"></a>872 <a class="indexterm" name="id256723 5"></a>873 <a class="indexterm" name="id25672 42"></a>871 <a class="indexterm" name="id2567224"></a> 872 <a class="indexterm" name="id2567230"></a> 873 <a class="indexterm" name="id2567237"></a> 874 874 Confirm that the packages shown in <a class="link" href="happy.html#oldapreq" title="Table 5.2. Required OpenLDAP Linux Packages">“Required OpenLDAP Linux Packages”</a> are installed on your system. 875 875 </p><div class="table"><a name="oldapreq"></a><p class="title"><b>Table 5.2. Required OpenLDAP Linux Packages</b></p><div class="table-contents"><table summary="Required OpenLDAP Linux Packages" border="1"><colgroup><col align="left"><col align="left"><col align="left"></colgroup><thead><tr><th align="center">SUSE Linux 8.x</th><th align="center">SUSE Linux 9.x</th><th align="center">Red Hat Linux</th></tr></thead><tbody><tr><td align="left">nss_ldap</td><td align="left">nss_ldap</td><td align="left">nss_ldap</td></tr><tr><td align="left">pam_ldap</td><td align="left">pam_ldap</td><td align="left">pam_ldap</td></tr><tr><td align="left">openldap2</td><td align="left">openldap2</td><td align="left">openldap</td></tr><tr><td align="left">openldap2-client</td><td align="left">openldap2-client</td><td align="left"> </td></tr></tbody></table></div></div><br class="table-break"><p> … … 877 877 for bootstrapping the LDAP and Samba-3 configuration is relatively straightforward. If you 878 878 follow these guidelines, the resulting system should work fine. 879 </p><div class="procedure"><a name="id25673 74"></a><p class="title"><b>Procedure 5.2. OpenLDAP Server Configuration Steps</b></p><ol type="1"><li><p>880 <a class="indexterm" name="id256738 5"></a>879 </p><div class="procedure"><a name="id2567369"></a><p class="title"><b>Procedure 5.2. OpenLDAP Server Configuration Steps</b></p><ol type="1"><li><p> 880 <a class="indexterm" name="id2567381"></a> 881 881 Install the file shown in <a class="link" href="happy.html#sbehap-slapdconf" title="Example 5.2. LDAP Master Configuration File /etc/openldap/slapd.conf Part A">“LDAP Master Configuration File /etc/openldap/slapd.conf Part A”</a> in the directory 882 882 <code class="filename">/etc/openldap</code>. 883 883 </p></li><li><p> 884 <a class="indexterm" name="id25674 13"></a>885 <a class="indexterm" name="id25674 20"></a>886 <a class="indexterm" name="id256742 7"></a>884 <a class="indexterm" name="id2567409"></a> 885 <a class="indexterm" name="id2567416"></a> 886 <a class="indexterm" name="id2567423"></a> 887 887 Remove all files from the directory <code class="filename">/data/ldap</code>, making certain that 888 888 the directory exists with permissions: … … 893 893 This may require you to add a user and a group account for LDAP if they do not exist. 894 894 </p></li><li><p> 895 <a class="indexterm" name="id25674 63"></a>895 <a class="indexterm" name="id2567458"></a> 896 896 Install the file shown in <a class="link" href="happy.html#sbehap-dbconf" title="Example 5.1. LDAP DB_CONFIG File">“LDAP DB_CONFIG File”</a> in the directory 897 897 <code class="filename">/data/ldap</code>. In the event that this file is added after <code class="constant">ldap</code> … … 900 900 <code class="filename">/data/ldap</code> directory, and then restarting the <code class="constant">LDAP</code> server. 901 901 </p></li><li><p> 902 <a class="indexterm" name="id256751 6"></a>902 <a class="indexterm" name="id2567511"></a> 903 903 Performance logging can be enabled and should preferably be sent to a file on 904 904 a file system that is large enough to handle significantly sized logs. To enable … … 976 976 index default sub 977 977 </pre></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="sbehap-PAM-NSS"></a>PAM and NSS Client Configuration</h3></div></div></div><p> 978 <a class="indexterm" name="id256767 5"></a>979 <a class="indexterm" name="id25676 82"></a>980 <a class="indexterm" name="id256768 8"></a>978 <a class="indexterm" name="id2567670"></a> 979 <a class="indexterm" name="id2567677"></a> 980 <a class="indexterm" name="id2567684"></a> 981 981 The steps that follow involve configuration of LDAP, NSS LDAP-based resolution of users and 982 982 groups. Also, so that LDAP-based accounts can log onto the system, the steps ahead configure 983 983 the Pluggable Authentication Modules (PAM) to permit LDAP-based authentication. 984 984 </p><p> 985 <a class="indexterm" name="id2567 703"></a>986 <a class="indexterm" name="id25677 12"></a>985 <a class="indexterm" name="id2567698"></a> 986 <a class="indexterm" name="id2567708"></a> 987 987 Since you have chosen to put UNIX user and group accounts into the LDAP database, it is likely 988 988 that you may want to use them for UNIX system (Linux) local machine logons. This necessitates … … 991 991 module also has the ability to redirect authentication requests through LDAP. 992 992 </p><p> 993 <a class="indexterm" name="id25677 41"></a>994 <a class="indexterm" name="id256774 7"></a>995 <a class="indexterm" name="id256775 4"></a>996 <a class="indexterm" name="id25677 61"></a>993 <a class="indexterm" name="id2567736"></a> 994 <a class="indexterm" name="id2567743"></a> 995 <a class="indexterm" name="id2567750"></a> 996 <a class="indexterm" name="id2567757"></a> 997 997 You have chosen to configure these services by directly editing the system files, but of course, you 998 998 know that this configuration can be done using system tools provided by the Linux system vendor. … … 1000 1000 configuration of SUSE Linux as an LDAP client. Red Hat Linux provides the <code class="literal">authconfig</code> 1001 1001 tool for this. 1002 </p><div class="procedure"><a name="id2567 801"></a><p class="title"><b>Procedure 5.3. PAM and NSS Client Configuration Steps</b></p><div class="example"><a name="sbehap-nss01"></a><p class="title"><b>Example 5.4. Configuration File for NSS LDAP Support <code class="filename">/etc/ldap.conf</code></b></p><div class="example-contents"><pre class="screen">1002 </p><div class="procedure"><a name="id2567796"></a><p class="title"><b>Procedure 5.3. PAM and NSS Client Configuration Steps</b></p><div class="example"><a name="sbehap-nss01"></a><p class="title"><b>Example 5.4. Configuration File for NSS LDAP Support <code class="filename">/etc/ldap.conf</code></b></p><div class="example-contents"><pre class="screen"> 1003 1003 host 127.0.0.1 1004 1004 … … 1043 1043 ssl off 1044 1044 </pre></div></div><br class="example-break"><ol type="1"><li><p> 1045 <a class="indexterm" name="id25678 12"></a>1046 <a class="indexterm" name="id25678 20"></a>1047 <a class="indexterm" name="id256782 6"></a>1045 <a class="indexterm" name="id2567808"></a> 1046 <a class="indexterm" name="id2567815"></a> 1047 <a class="indexterm" name="id2567822"></a> 1048 1048 Execute the following command to find where the <code class="filename">nss_ldap</code> module 1049 1049 expects to find its control file: … … 1058 1058 <a class="link" href="happy.html#sbehap-nss02" title="Example 5.5. Configuration File for NSS LDAP Clients Support /etc/ldap.conf">“Configuration File for NSS LDAP Clients Support /etc/ldap.conf”</a> into the path that was obtained from the step above. 1059 1059 </p></li><li><p> 1060 <a class="indexterm" name="id25679 61"></a>1060 <a class="indexterm" name="id2567956"></a> 1061 1061 Edit the NSS control file (<code class="filename">/etc/nsswitch.conf</code>) so that the lines that 1062 1062 control user and group resolution will obtain information from the normal system files as … … 1081 1081 <code class="filename">nsswitch.conf</code> file is a significant cause of operational problems with LDAP. 1082 1082 </p></li><li><p> 1083 <a class="indexterm" name="id256803 6"></a>1083 <a class="indexterm" name="id2568031"></a> 1084 1084 For PAM LDAP configuration on this SUSE Linux 9.0 system, the simplest solution is to edit the following 1085 1085 files in the <code class="filename">/etc/pam.d</code> directory: <code class="literal">login</code>, <code class="literal">password</code>, … … 1103 1103 </pre><p> 1104 1104 </p><p> 1105 <a class="indexterm" name="id256811 5"></a>1105 <a class="indexterm" name="id2568111"></a> 1106 1106 On other Linux systems that do not have an LDAP-enabled <code class="literal">pam_unix2.so</code> module, 1107 1107 you must edit these files by adding the <code class="literal">pam_ldap.so</code> modules as shown here: … … 1127 1127 LDAP, you probably want to use it rather than add an additional module. 1128 1128 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="sbehap-massive"></a>Samba-3 PDC Configuration</h3></div></div></div><p> 1129 <a class="indexterm" name="id256819 9"></a>1129 <a class="indexterm" name="id2568194"></a> 1130 1130 Verify that the Samba-3.0.20 (or later) packages are installed on each SUSE Linux server 1131 1131 before following the steps below. If Samba-3.0.20 (or later) is not installed, you have the … … 1134 1134 Red Hat Fedora Core and Red Hat Enterprise Linux Server 3 and 4, are included on the CD-ROM that 1135 1135 is included with this book. 1136 </p><div class="procedure"><a name="id256821 4"></a><p class="title"><b>Procedure 5.4. Configuration of PDC Called <code class="constant">MASSIVE</code></b></p><ol type="1"><li><p>1136 </p><div class="procedure"><a name="id2568210"></a><p class="title"><b>Procedure 5.4. Configuration of PDC Called <code class="constant">MASSIVE</code></b></p><ol type="1"><li><p> 1137 1137 Install the files in <a class="link" href="happy.html#sbehap-massive-smbconfa" title="Example 5.6. LDAP Based smb.conf File, Server: MASSIVE global Section: Part A">“LDAP Based smb.conf File, Server: MASSIVE global Section: Part A”</a>, 1138 1138 <a class="link" href="happy.html#sbehap-massive-smbconfb" title="Example 5.7. LDAP Based smb.conf File, Server: MASSIVE global Section: Part B">“LDAP Based smb.conf File, Server: MASSIVE global Section: Part B”</a>, <a class="link" href="happy.html#sbehap-shareconfa" title="Example 5.10. LDAP Based smb.conf File, Shares Section Part A">“LDAP Based smb.conf File, Shares Section Part A”</a>, … … 1144 1144 the next step. 1145 1145 </p></li><li><p> 1146 <a class="indexterm" name="id25682 92"></a>1146 <a class="indexterm" name="id2568287"></a> 1147 1147 Create and verify the contents of the <code class="filename">smb.conf</code> file that is generated by: 1148 1148 </p><pre class="screen"> … … 1181 1181 </pre><p> 1182 1182 </p></li><li><p> 1183 <a class="indexterm" name="id25683 91"></a>1184 <a class="indexterm" name="id256839 8"></a>1183 <a class="indexterm" name="id2568387"></a> 1184 <a class="indexterm" name="id2568393"></a> 1185 1185 Samba-3 communicates with the LDAP server. The password that it uses to 1186 1186 authenticate to the LDAP server must be stored in the <code class="filename">secrets.tdb</code> … … 1195 1195 </pre><p> 1196 1196 </p></li><li><p> 1197 <a class="indexterm" name="id256844 7"></a>1198 <a class="indexterm" name="id25684 54"></a>1197 <a class="indexterm" name="id2568442"></a> 1198 <a class="indexterm" name="id2568449"></a> 1199 1199 Samba-3 generates a Windows Security Identifier (SID) only when <code class="literal">smbd</code> 1200 1200 has been started. For this reason, you start Samba. After a few seconds delay, … … 1230 1230 When a positive domain SID has been reported, stop Samba. 1231 1231 </p></li><li><p> 1232 <a class="indexterm" name="id256856 6"></a>1233 <a class="indexterm" name="id25685 72"></a>1234 <a class="indexterm" name="id256857 9"></a>1235 <a class="indexterm" name="id256858 6"></a>1232 <a class="indexterm" name="id2568561"></a> 1233 <a class="indexterm" name="id2568568"></a> 1234 <a class="indexterm" name="id2568575"></a> 1235 <a class="indexterm" name="id2568581"></a> 1236 1236 Configure the NFS server for your Linux system. So you can complete the steps that 1237 1237 follow, enter into the <code class="filename">/etc/exports</code> the following entry: … … 1251 1251 Your Samba-3 PDC is now ready to communicate with the LDAP password backend. Let's get on with 1252 1252 configuration of the LDAP server. 1253 </p><div class="example"><a name="sbehap-massive-smbconfa"></a><p class="title"><b>Example 5.6. LDAP Based <code class="filename">smb.conf</code> File, Server: MASSIVE global Section: Part A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id25686 72"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id2568684"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id2568696"></a><em class="parameter"><code>netbios name = MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id2568708"></a><em class="parameter"><code>interfaces = eth1, lo</code></em></td></tr><tr><td><a class="indexterm" name="id2568720"></a><em class="parameter"><code>bind interfaces only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2568732"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2568744"></a><em class="parameter"><code>enable privileges = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2568756"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2568768"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2568779"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2568791"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2568803"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id2568814"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2568826"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2568838"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2568850"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2568862"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2568874"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id2568886"></a><em class="parameter"><code>delete user script = /opt/IDEALX/sbin/smbldap-userdel "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id2568899"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd -p "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id2568911"></a><em class="parameter"><code>delete group script = /opt/IDEALX/sbin/smbldap-groupdel "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id2568924"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/smbldap-groupmod -m "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id2568936"></a><em class="parameter"><code>delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id2568950"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g "%g" "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id2568962"></a><em class="parameter"><code>add machine script = /opt/IDEALX/sbin/smbldap-useradd -w "%u"</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-massive-smbconfb"></a><p class="title"><b>Example 5.7. LDAP Based <code class="filename">smb.conf</code> File, Server: MASSIVE global Section: Part B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id2569000"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2569012"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2569024"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2569035"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2569047"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2569059"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2569071"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2569083"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2569095"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2569107"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2569119"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2569131"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2569143"></a><em class="parameter"><code>idmap backend = ldap:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2569155"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2569167"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2569178"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2569190"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2569202"></a><em class="parameter"><code>printer admin = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="sbeidealx"></a>Install and Configure Idealx smbldap-tools Scripts</h3></div></div></div><p>1254 <a class="indexterm" name="id256922 8"></a>1253 </p><div class="example"><a name="sbehap-massive-smbconfa"></a><p class="title"><b>Example 5.6. LDAP Based <code class="filename">smb.conf</code> File, Server: MASSIVE global Section: Part A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2568668"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id2568680"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id2568691"></a><em class="parameter"><code>netbios name = MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id2568703"></a><em class="parameter"><code>interfaces = eth1, lo</code></em></td></tr><tr><td><a class="indexterm" name="id2568715"></a><em class="parameter"><code>bind interfaces only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2568727"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2568739"></a><em class="parameter"><code>enable privileges = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2568751"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2568763"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2568775"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2568786"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2568798"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id2568810"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2568821"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2568834"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2568845"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2568857"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2568869"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id2568882"></a><em class="parameter"><code>delete user script = /opt/IDEALX/sbin/smbldap-userdel "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id2568894"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd -p "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id2568906"></a><em class="parameter"><code>delete group script = /opt/IDEALX/sbin/smbldap-groupdel "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id2568919"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/smbldap-groupmod -m "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id2568932"></a><em class="parameter"><code>delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id2568945"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g "%g" "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id2568958"></a><em class="parameter"><code>add machine script = /opt/IDEALX/sbin/smbldap-useradd -w "%u"</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-massive-smbconfb"></a><p class="title"><b>Example 5.7. LDAP Based <code class="filename">smb.conf</code> File, Server: MASSIVE global Section: Part B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id2568995"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2569007"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2569019"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2569031"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2569042"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2569054"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2569066"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2569078"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2569090"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2569102"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2569114"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2569126"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2569138"></a><em class="parameter"><code>idmap backend = ldap:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2569150"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2569162"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2569174"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2569186"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2569197"></a><em class="parameter"><code>printer admin = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="sbeidealx"></a>Install and Configure Idealx smbldap-tools Scripts</h3></div></div></div><p> 1254 <a class="indexterm" name="id2569224"></a> 1255 1255 The Idealx scripts, or equivalent, are necessary to permit Samba-3 to manage accounts 1256 1256 on the LDAP server. You have chosen the Idealx scripts because they are the best-known … … 1269 1269 The scripts are not needed on BDC machines because all LDAP updates are handled by 1270 1270 the PDC alone. 1271 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id256929 5"></a>Installation of smbldap-tools from the Tarball</h4></div></div></div><p>1271 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2569290"></a>Installation of smbldap-tools from the Tarball</h4></div></div></div><p> 1272 1272 To perform a manual installation of the smbldap-tools scripts, the following procedure may be used: 1273 1273 </p><div class="procedure"><a name="idealxscript"></a><p class="title"><b>Procedure 5.5. Unpacking and Installation Steps for the <code class="constant">smbldap-tools</code> Tarball</b></p><ol type="1"><li><p> … … 1321 1321 The smbldap-tools scripts are now ready for the configuration step outlined in 1322 1322 <a class="link" href="happy.html#smbldap-init" title="Configuration of smbldap-tools">“Configuration of smbldap-tools”</a>. 1323 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id256954 7"></a>Installing smbldap-tools from the RPM Package</h4></div></div></div><p>1323 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2569543"></a>Installing smbldap-tools from the RPM Package</h4></div></div></div><p> 1324 1324 In the event that you have elected to use the RPM package provided by Idealx, download the 1325 1325 source RPM <code class="filename">smbldap-tools-0.9.1-1.src.rpm</code>, then follow this procedure: 1326 </p><div class="procedure"><a name="id256956 6"></a><p class="title"><b>Procedure 5.6. Installation Steps for <code class="constant">smbldap-tools</code> RPM's</b></p><ol type="1"><li><p>1326 </p><div class="procedure"><a name="id2569561"></a><p class="title"><b>Procedure 5.6. Installation Steps for <code class="constant">smbldap-tools</code> RPM's</b></p><ol type="1"><li><p> 1327 1327 Install the source RPM that has been downloaded as follows: 1328 1328 </p><pre class="screen"> … … 1369 1369 The smbldap-tools require that the NetBIOS name (machine name) of the Samba server be included 1370 1370 in the <code class="filename">smb.conf</code> file. 1371 </p><div class="procedure"><a name="id25697 60"></a><p class="title"><b>Procedure 5.7. Configuration Steps for <code class="constant">smbldap-tools</code> to Enable Use</b></p><ol type="1"><li><p>1371 </p><div class="procedure"><a name="id2569756"></a><p class="title"><b>Procedure 5.7. Configuration Steps for <code class="constant">smbldap-tools</code> to Enable Use</b></p><ol type="1"><li><p> 1372 1372 Change into the directory that contains the <code class="filename">configure.pl</code> script. 1373 1373 </p><pre class="screen"> … … 1475 1475 </p></li></ol></div><p> 1476 1476 The smbldap-tools are now ready for use. 1477 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id25699 62"></a>LDAP Initialization and Creation of User and Group Accounts</h3></div></div></div><p>1477 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2569957"></a>LDAP Initialization and Creation of User and Group Accounts</h3></div></div></div><p> 1478 1478 The LDAP database must be populated with well-known Windows domain user accounts and domain group 1479 1479 accounts before Samba can be used. The following procedures step you through the process. … … 1488 1488 Addition of an account to the LDAP backend can be done in two ways: 1489 1489 </p><div class="itemizedlist"><ul type="disc"><li><p> 1490 <a class="indexterm" name="id256999 6"></a>1491 <a class="indexterm" name="id25 70003"></a>1492 <a class="indexterm" name="id25700 10"></a>1493 <a class="indexterm" name="id257001 7"></a>1494 <a class="indexterm" name="id25700 23"></a>1495 <a class="indexterm" name="id25700 30"></a>1490 <a class="indexterm" name="id2569991"></a> 1491 <a class="indexterm" name="id2569998"></a> 1492 <a class="indexterm" name="id2570005"></a> 1493 <a class="indexterm" name="id2570012"></a> 1494 <a class="indexterm" name="id2570019"></a> 1495 <a class="indexterm" name="id2570026"></a> 1496 1496 If you always have a user account in the <code class="filename">/etc/passwd</code> on every 1497 1497 server or in a NIS(+) backend, it is not necessary to add POSIX accounts for them in … … 1511 1511 is included on the enclosed CD-ROM under <code class="filename">Chap06/Tools.</code> 1512 1512 </p></li></ul></div><p> 1513 <a class="indexterm" name="id25700 90"></a>1513 <a class="indexterm" name="id2570086"></a> 1514 1514 If you wish to have more control over how the LDAP database is initialized or 1515 1515 if you don't want to use the Idealx smbldap-tools, you should refer to 1516 1516 <a class="link" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">“A Collection of Useful Tidbits”</a>, <a class="link" href="appendix.html#altldapcfg" title="Alternative LDAP Database Initialization">“Alternative LDAP Database Initialization”</a>. 1517 1517 </p><p> 1518 <a class="indexterm" name="id257011 7"></a>1518 <a class="indexterm" name="id2570113"></a> 1519 1519 The following steps initialize the LDAP database, and then you can add user and group 1520 1520 accounts that Samba can use. You use the <code class="literal">smbldap-populate</code> to … … 1522 1522 The list of users does not cover all 500 network users; it provides examples only. 1523 1523 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 1524 <a class="indexterm" name="id257014 7"></a>1525 <a class="indexterm" name="id257015 6"></a>1526 <a class="indexterm" name="id257016 5"></a>1524 <a class="indexterm" name="id2570142"></a> 1525 <a class="indexterm" name="id2570151"></a> 1526 <a class="indexterm" name="id2570160"></a> 1527 1527 In the following examples, as the LDAP database is initialized, we do create a container 1528 1528 for Computer (machine) accounts. In the Samba-3 <code class="filename">smb.conf</code> files, specific use is made … … 1601 1601 </pre><p> 1602 1602 </p></li><li><p> 1603 <a class="indexterm" name="id257058 5"></a>1603 <a class="indexterm" name="id2570581"></a> 1604 1604 So that we can use a global IDMAP repository, the LDAP directory must have a container object for IDMAP data. 1605 1605 There are several ways you can check that your LDAP database is able to receive IDMAP information. One of … … 1610 1610 ou: idmap 1611 1611 </pre><p> 1612 <a class="indexterm" name="id257060 9"></a>1612 <a class="indexterm" name="id2570604"></a> 1613 1613 If the execution of this command does not return IDMAP entries, you need to create an LDIF 1614 1614 template file (see <a class="link" href="happy.html#sbehap-ldifadd" title="Example 5.12. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF">“LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF”</a>). You can add the required entries using … … 1620 1620 Samba automatically populates this LDAP directory container when it needs to. 1621 1621 </p></li><li><p> 1622 <a class="indexterm" name="id257064 9"></a>1622 <a class="indexterm" name="id2570644"></a> 1623 1623 It looks like all has gone well, as expected. Let's confirm that this is the case 1624 1624 by running a few tests. First we check the contents of the database directly … … 1658 1658 This looks good so far. 1659 1659 </p></li><li><p> 1660 <a class="indexterm" name="id2570 700"></a>1660 <a class="indexterm" name="id2570695"></a> 1661 1661 The next step is to prove that the LDAP server is running and responds to a 1662 1662 search request. Execute the following as shown (output has been cut to save space): … … 1703 1703 Good. It is all working just fine. 1704 1704 </p></li><li><p> 1705 <a class="indexterm" name="id257075 7"></a>1705 <a class="indexterm" name="id2570752"></a> 1706 1706 You must now make certain that the NSS resolver can interrogate LDAP also. 1707 1707 Execute the following commands: … … 1716 1716 Domain Computers:x:553: 1717 1717 </pre><p> 1718 <a class="indexterm" name="id257078 6"></a>1718 <a class="indexterm" name="id2570782"></a> 1719 1719 This demonstrates that the <code class="literal">nss_ldap</code> library is functioning 1720 1720 as it should. If these two steps fail to produce this information, refer to … … 1723 1723 have been successfully completed. 1724 1724 </p></li><li><p> 1725 <a class="indexterm" name="id257081 7"></a>1726 <a class="indexterm" name="id25708 24"></a>1727 <a class="indexterm" name="id25708 31"></a>1725 <a class="indexterm" name="id2570812"></a> 1726 <a class="indexterm" name="id2570819"></a> 1727 <a class="indexterm" name="id2570826"></a> 1728 1728 Our database is now ready for the addition of network users. For each user for 1729 1729 whom an account must be created, execute the following: … … 1741 1741 where <code class="constant">username</code> is the login ID for each user. 1742 1742 </p></li><li><p> 1743 <a class="indexterm" name="id25708 92"></a>1743 <a class="indexterm" name="id2570887"></a> 1744 1744 Now verify that the UNIX (POSIX) accounts can be resolved via NSS by executing the 1745 1745 following: … … 1769 1769 by system tools that make a getentpw() system call. 1770 1770 </p></li><li><p> 1771 <a class="indexterm" name="id257095 8"></a>1771 <a class="indexterm" name="id2570953"></a> 1772 1772 The root account must have UID=0; if not, this means that operations conducted from 1773 1773 a Windows client using tools such as the Domain User Manager fails under UNIX because … … 1803 1803 This is precisely what we want to see. 1804 1804 </p></li><li><p> 1805 <a class="indexterm" name="id257105 7"></a>1806 <a class="indexterm" name="id25710 64"></a>1805 <a class="indexterm" name="id2571052"></a> 1806 <a class="indexterm" name="id2571059"></a> 1807 1807 The final validation step involves making certain that Samba-3 can obtain the user 1808 1808 accounts from the LDAP ldapsam passwd backend. Execute the following command as shown: … … 1835 1835 This looks good. Of course, you fully expected that it would all work, didn't you? 1836 1836 </p></li><li><p> 1837 <a class="indexterm" name="id257110 9"></a>1837 <a class="indexterm" name="id2571104"></a> 1838 1838 Now you add the group accounts that are used on the Abmas network. Execute 1839 1839 the following exactly as shown: … … 1846 1846 output is of no concern. 1847 1847 </p></li><li><p> 1848 <a class="indexterm" name="id25711 51"></a>1848 <a class="indexterm" name="id2571146"></a> 1849 1849 You really do want to confirm that UNIX group resolution from LDAP is functioning 1850 1850 as it should. Let's do this as shown here: … … 1863 1863 as our own site-specific group accounts, are correctly listed. This is looking good. 1864 1864 </p></li><li><p> 1865 <a class="indexterm" name="id25711 84"></a>1865 <a class="indexterm" name="id2571179"></a> 1866 1866 The final step we need to validate is that Samba can see all the Windows domain groups 1867 1867 and that they are correctly mapped to the respective UNIX group account. To do this, … … 1918 1918 </pre><p> 1919 1919 </p></li><li><p> 1920 <a class="indexterm" name="id257139 9"></a>1920 <a class="indexterm" name="id2571394"></a> 1921 1921 You may now check Samba-3 operation as follows: 1922 1922 </p><pre class="screen"> … … 1964 1964 The server <code class="constant">MASSIVE</code> is now configured, and it is time to move onto the next task. 1965 1965 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="sbehap-ptrcfg"></a>Printer Configuration</h3></div></div></div><p> 1966 <a class="indexterm" name="id25715 10"></a>1966 <a class="indexterm" name="id2571505"></a> 1967 1967 The configuration for Samba-3 to enable CUPS raw-print-through printing has already been 1968 1968 taken care of in the <code class="filename">smb.conf</code> file. The only preparation needed for <code class="constant">smart</code> 1969 1969 printing to be possible involves creation of the directories in which Samba-3 stores 1970 1970 Windows printing driver files. 1971 </p><div class="procedure"><a name="id25715 32"></a><p class="title"><b>Procedure 5.9. Printer Configuration Steps</b></p><ol type="1"><li><p>1971 </p><div class="procedure"><a name="id2571527"></a><p class="title"><b>Procedure 5.9. Printer Configuration Steps</b></p><ol type="1"><li><p> 1972 1972 Configure all network-attached printers to have a fixed IP address. 1973 1973 </p></li><li><p> … … 1981 1981 to port 9100. Use any other port the manufacturer specifies for direct mode, 1982 1982 raw printing. This allows the CUPS spooler to print using raw mode protocols. 1983 <a class="indexterm" name="id25715 93"></a>1984 <a class="indexterm" name="id2571 600"></a>1983 <a class="indexterm" name="id2571588"></a> 1984 <a class="indexterm" name="id2571595"></a> 1985 1985 </p></li><li><p> 1986 <a class="indexterm" name="id25716 13"></a>1987 <a class="indexterm" name="id25716 20"></a>1986 <a class="indexterm" name="id2571608"></a> 1987 <a class="indexterm" name="id2571615"></a> 1988 1988 Only on the server to which the printer is attached, configure the CUPS Print 1989 1989 Queues as follows: … … 1992 1992 -v socket://<em class="parameter"><code>printer-name</code></em>.abmas.biz:9100 -E 1993 1993 </pre><p> 1994 <a class="indexterm" name="id257165 6"></a>1994 <a class="indexterm" name="id2571651"></a> 1995 1995 This step creates the necessary print queue to use no assigned print filter. This 1996 1996 is ideal for raw printing, that is, printing without use of filters. … … 2012 2012 </pre><p> 2013 2013 </p></li><li><p> 2014 <a class="indexterm" name="id257173 7"></a>2015 <a class="indexterm" name="id25717 44"></a>2016 <a class="indexterm" name="id25717 51"></a>2014 <a class="indexterm" name="id2571732"></a> 2015 <a class="indexterm" name="id2571739"></a> 2016 <a class="indexterm" name="id2571746"></a> 2017 2017 Edit the file <code class="filename">/etc/cups/mime.convs</code> to uncomment the line: 2018 2018 </p><pre class="screen"> … … 2020 2020 </pre><p> 2021 2021 </p></li><li><p> 2022 <a class="indexterm" name="id257177 8"></a>2022 <a class="indexterm" name="id2571774"></a> 2023 2023 Edit the file <code class="filename">/etc/cups/mime.types</code> to uncomment the line: 2024 2024 </p><pre class="screen"> … … 2039 2039 <code class="prompt">root# </code> chmod -R ug=rwx,o=rx /var/lib/samba/drivers 2040 2040 </pre><p> 2041 </p></li></ol></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="sbehap-bldg1"></a>Samba-3 BDC Configuration</h2></div></div></div><div class="procedure"><a name="id25718 62"></a><p class="title"><b>Procedure 5.10. Configuration of BDC Called: <code class="constant">BLDG1</code></b></p><ol type="1"><li><p>2041 </p></li></ol></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="sbehap-bldg1"></a>Samba-3 BDC Configuration</h2></div></div></div><div class="procedure"><a name="id2571857"></a><p class="title"><b>Procedure 5.10. Configuration of BDC Called: <code class="constant">BLDG1</code></b></p><ol type="1"><li><p> 2042 2042 Install the files in <a class="link" href="happy.html#sbehap-bldg1-smbconf" title="Example 5.8. LDAP Based smb.conf File, Server: BLDG1">“LDAP Based smb.conf File, Server: BLDG1”</a>, 2043 2043 <a class="link" href="happy.html#sbehap-shareconfa" title="Example 5.10. LDAP Based smb.conf File, Shares Section Part A">“LDAP Based smb.conf File, Shares Section Part A”</a>, and <a class="link" href="happy.html#sbehap-shareconfb" title="Example 5.11. LDAP Based smb.conf File, Shares Section Part B">“LDAP Based smb.conf File, Shares Section Part B”</a> … … 2082 2082 This is the correct output. If the accounts that have UIDs above 512 are not shown, there is a problem. 2083 2083 </p></li><li><p> 2084 <a class="indexterm" name="id25720 22"></a>2084 <a class="indexterm" name="id2572017"></a> 2085 2085 The next step in the verification process involves testing the operation of UNIX group 2086 2086 resolution via the NSS LDAP resolver. Execute these commands: … … 2112 2112 is able to communicate correctly with the LDAP server (<code class="constant">MASSIVE</code>). 2113 2113 </p></li><li><p> 2114 <a class="indexterm" name="id25720 63"></a>2114 <a class="indexterm" name="id2572058"></a> 2115 2115 You must now set the LDAP administrative password into the Samba-3 <code class="filename">secrets.tdb</code> 2116 2116 file by executing this command: … … 2144 2144 This indicates that the domain security account for the BDC has been correctly created. 2145 2145 </p></li><li><p> 2146 <a class="indexterm" name="id25721 64"></a>2146 <a class="indexterm" name="id2572159"></a> 2147 2147 Verify that user and group account resolution works via Samba-3 tools as follows: 2148 2148 </p><pre class="screen"> … … 2232 2232 </p></li><li><p> 2233 2233 Follow carefully the steps shown in <a class="link" href="happy.html#sbehap-bldg1" title="Samba-3 BDC Configuration">“Samba-3 BDC Configuration”</a>, starting at step 2. 2234 </p></li></ol></div><div class="example"><a name="sbehap-bldg1-smbconf"></a><p class="title"><b>Example 5.8. LDAP Based <code class="filename">smb.conf</code> File, Server: BLDG1</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id25725 10"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id2572522"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id2572533"></a><em class="parameter"><code>netbios name = BLDG1</code></em></td></tr><tr><td><a class="indexterm" name="id2572545"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2572558"></a><em class="parameter"><code>enable privileges = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2572569"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2572581"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2572593"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2572604"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2572616"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id2572628"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2572640"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2572652"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2572664"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2572676"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2572688"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2572700"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2572711"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2572723"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id2572735"></a><em class="parameter"><code>wins server = 172.16.0.1</code></em></td></tr><tr><td><a class="indexterm" name="id2572746"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2572758"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2572770"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2572782"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2572794"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2572806"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2572818"></a><em class="parameter"><code>idmap backend = ldap:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2572831"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2572842"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2572854"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2572866"></a><em class="parameter"><code>printer admin = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-bldg2-smbconf"></a><p class="title"><b>Example 5.9. LDAP Based <code class="filename">smb.conf</code> File, Server: BLDG2</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2572912"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id2572924"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id2572936"></a><em class="parameter"><code>netbios name = BLDG2</code></em></td></tr><tr><td><a class="indexterm" name="id2572948"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2572960"></a><em class="parameter"><code>enable privileges = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2572972"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2572984"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2572996"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2573007"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2573019"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id2573031"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2573042"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2573054"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2573066"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2573078"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2573090"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2573102"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2573114"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2573126"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id2573137"></a><em class="parameter"><code>wins server = 172.16.0.1</code></em></td></tr><tr><td><a class="indexterm" name="id2573149"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2573161"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2573173"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2573185"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2573197"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2573209"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2573221"></a><em class="parameter"><code>idmap backend = ldap:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2573233"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2573245"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2573257"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2573268"></a><em class="parameter"><code>printer admin = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-shareconfa"></a><p class="title"><b>Example 5.10. LDAP Based <code class="filename">smb.conf</code> File, Shares Section Part A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id2573315"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id2573326"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id2573338"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id2573358"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id2573370"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id2573382"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id2573402"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id2573414"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id2573426"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2573446"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2573458"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2573470"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2573481"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2573502"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2573514"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2573525"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2573537"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2573549"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-shareconfb"></a><p class="title"><b>Example 5.11. LDAP Based <code class="filename">smb.conf</code> File, Shares Section Part B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id2573595"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id2573606"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id2573618"></a><em class="parameter"><code>admin users = bjordan</code></em></td></tr><tr><td><a class="indexterm" name="id2573629"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2573650"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2573662"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2573674"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2573685"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2573706"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2573717"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2573729"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2573741"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id2573762"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id2573773"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id2573785"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2573797"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id2573818"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2573829"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2573841"></a><em class="parameter"><code>browseable = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2573853"></a><em class="parameter"><code>guest ok = no</code></em></td></tr><tr><td><a class="indexterm" name="id2573864"></a><em class="parameter"><code>read only = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2573876"></a><em class="parameter"><code>write list = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-ldifadd"></a><p class="title"><b>Example 5.12. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF</b></p><div class="example-contents"><pre class="screen">2234 </p></li></ol></div><div class="example"><a name="sbehap-bldg1-smbconf"></a><p class="title"><b>Example 5.8. LDAP Based <code class="filename">smb.conf</code> File, Server: BLDG1</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2572505"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id2572517"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id2572529"></a><em class="parameter"><code>netbios name = BLDG1</code></em></td></tr><tr><td><a class="indexterm" name="id2572541"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2572553"></a><em class="parameter"><code>enable privileges = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2572565"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2572577"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2572588"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2572600"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2572612"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id2572623"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2572635"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2572647"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2572659"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2572671"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2572683"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2572695"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2572707"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2572718"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id2572730"></a><em class="parameter"><code>wins server = 172.16.0.1</code></em></td></tr><tr><td><a class="indexterm" name="id2572742"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2572754"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2572766"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2572778"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2572790"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2572802"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2572814"></a><em class="parameter"><code>idmap backend = ldap:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2572826"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2572838"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2572850"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2572861"></a><em class="parameter"><code>printer admin = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-bldg2-smbconf"></a><p class="title"><b>Example 5.9. LDAP Based <code class="filename">smb.conf</code> File, Server: BLDG2</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2572908"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id2572920"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id2572931"></a><em class="parameter"><code>netbios name = BLDG2</code></em></td></tr><tr><td><a class="indexterm" name="id2572943"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2572955"></a><em class="parameter"><code>enable privileges = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2572967"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2572979"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2572991"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2573002"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2573014"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id2573026"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2573038"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2573050"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2573062"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2573074"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2573086"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2573098"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2573109"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2573121"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id2573133"></a><em class="parameter"><code>wins server = 172.16.0.1</code></em></td></tr><tr><td><a class="indexterm" name="id2573144"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2573156"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2573168"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2573180"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2573192"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2573204"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2573216"></a><em class="parameter"><code>idmap backend = ldap:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2573229"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2573240"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2573252"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2573264"></a><em class="parameter"><code>printer admin = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-shareconfa"></a><p class="title"><b>Example 5.10. LDAP Based <code class="filename">smb.conf</code> File, Shares Section Part A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id2573310"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id2573322"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id2573334"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id2573354"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id2573366"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id2573377"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id2573398"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id2573410"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id2573421"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2573442"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2573454"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2573465"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2573477"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2573497"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2573509"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2573521"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2573532"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2573544"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-shareconfb"></a><p class="title"><b>Example 5.11. LDAP Based <code class="filename">smb.conf</code> File, Shares Section Part B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id2573590"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id2573602"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id2573613"></a><em class="parameter"><code>admin users = bjordan</code></em></td></tr><tr><td><a class="indexterm" name="id2573625"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2573645"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2573657"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2573669"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2573680"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2573701"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2573713"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2573725"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2573736"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id2573757"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id2573769"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id2573781"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2573792"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id2573813"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2573825"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2573836"></a><em class="parameter"><code>browseable = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2573848"></a><em class="parameter"><code>guest ok = no</code></em></td></tr><tr><td><a class="indexterm" name="id2573860"></a><em class="parameter"><code>read only = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2573871"></a><em class="parameter"><code>write list = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-ldifadd"></a><p class="title"><b>Example 5.12. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF</b></p><div class="example-contents"><pre class="screen"> 2235 2235 dn: ou=Idmap,dc=abmas,dc=biz 2236 2236 objectClass: organizationalUnit 2237 2237 ou: idmap 2238 2238 structuralObjectClass: organizationalUnit 2239 </pre></div></div><br class="example-break"></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id25739 11"></a>Miscellaneous Server Preparation Tasks</h2></div></div></div><p>2239 </pre></div></div><br class="example-break"></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2573907"></a>Miscellaneous Server Preparation Tasks</h2></div></div></div><p> 2240 2240 My father would say, “<span class="quote">Dinner is not over until the dishes have been done.</span>” 2241 2241 The makings of a great network environment take a lot of effort and attention to detail. … … 2244 2244 a few more steps that must be completed so that your network runs like a well-rehearsed 2245 2245 orchestra. 2246 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id25739 32"></a>Configuring Directory Share Point Roots</h3></div></div></div><p>2246 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2573927"></a>Configuring Directory Share Point Roots</h3></div></div></div><p> 2247 2247 In your <code class="filename">smb.conf</code> file, you have specified Windows shares. Each has a <em class="parameter"><code>path</code></em> 2248 2248 parameter. Even though it is obvious to all, one of the common Samba networking problems is … … 2262 2262 <code class="prompt">root# </code> chmod -R ug+rwx,o+rx-w /apps 2263 2263 </pre><p> 2264 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id257402 7"></a>Configuring Profile Directories</h3></div></div></div><p>2264 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2574022"></a>Configuring Profile Directories</h3></div></div></div><p> 2265 2265 You made a conscious decision to do everything it would take to improve network client 2266 2266 performance. One of your decisions was to implement folder redirection. This means that Windows … … 2287 2287 </pre><p> 2288 2288 </p><p> 2289 <a class="indexterm" name="id25741 43"></a>2290 <a class="indexterm" name="id25741 50"></a>2289 <a class="indexterm" name="id2574138"></a> 2290 <a class="indexterm" name="id2574145"></a> 2291 2291 You have three options insofar as the dynamically loaded portion of the roaming profile 2292 2292 is concerned: … … 2296 2296 that is, just by changing the filename extension. 2297 2297 </p><p> 2298 <a class="indexterm" name="id257419 9"></a>2299 <a class="indexterm" name="id257420 6"></a>2298 <a class="indexterm" name="id2574195"></a> 2299 <a class="indexterm" name="id2574202"></a> 2300 2300 The location of the profile that a user can obtain is set in the user's account in the LDAP passdb backend. 2301 2301 You can manage this using the Idealx smbldap-tools or using the … … 2310 2310 <code class="prompt">root# </code> chmod 700 /var/lib/samba/profiles/<span class="emphasis"><em>username</em></span> 2311 2311 </pre><p> 2312 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id25742 71"></a>Preparation of Logon Scripts</h3></div></div></div><p>2313 <a class="indexterm" name="id257427 9"></a>2312 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2574266"></a>Preparation of Logon Scripts</h3></div></div></div><p> 2313 <a class="indexterm" name="id2574274"></a> 2314 2314 The use of a logon script with Windows XP Professional is an option that every site should consider. 2315 2315 Unless you have locked down the desktop so the user cannot change anything, there is risk that … … 2336 2336 Section 24.4. A quick Web search will bring up a host of options. One of the most popular logon 2337 2337 facilities in use today is called <a class="ulink" href="http://www.kixtart.org" target="_top">KiXtart</a>. 2338 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id25743 82"></a>Assigning User Rights and Privileges</h3></div></div></div><p>2338 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2574377"></a>Assigning User Rights and Privileges</h3></div></div></div><p> 2339 2339 The ability to perform tasks such as joining Windows clients to the domain can be assigned to 2340 2340 normal user accounts. By default, only the domain administrator account (<code class="constant">root</code> on UNIX … … 2348 2348 are granted rights can be restricted to particular machines. It is left to the network administrator 2349 2349 to determine which rights should be provided and to whom. 2350 </p><div class="procedure"><a name="id257441 8"></a><p class="title"><b>Procedure 5.12. Steps for Assignment of User Rights and Privileges</b></p><ol type="1"><li><p>2350 </p><div class="procedure"><a name="id2574413"></a><p class="title"><b>Procedure 5.12. Steps for Assignment of User Rights and Privileges</b></p><ol type="1"><li><p> 2351 2351 Log onto the PDC as the <code class="constant">root</code> account. 2352 2352 </p></li><li><p> … … 2406 2406 SeDiskOperatorPrivilege 2407 2407 </pre><p> 2408 </p></li></ol></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id257451 6"></a>Windows Client Configuration</h2></div></div></div><p>2409 <a class="indexterm" name="id25745 24"></a>2408 </p></li></ol></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2574511"></a>Windows Client Configuration</h2></div></div></div><p> 2409 <a class="indexterm" name="id2574519"></a> 2410 2410 In the next few sections, you can configure a new Windows XP Professional disk image on a staging 2411 2411 machine. You will configure all software, printer settings, profile and policy handling, and desktop … … 2420 2420 2421 2421 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="redirfold"></a>Configuration of Default Profile with Folder Redirection</h3></div></div></div><p> 2422 <a class="indexterm" name="id25745 74"></a>2422 <a class="indexterm" name="id2574569"></a> 2423 2423 Log onto the Windows XP Professional workstation as the local <code class="constant">Administrator</code>. 2424 2424 It is necessary to expose folders that are generally hidden to provide access to the 2425 2425 <code class="constant">Default User</code> folder. 2426 </p><div class="procedure"><a name="id25745 92"></a><p class="title"><b>Procedure 5.13. Expose Hidden Folders</b></p><ol type="1"><li><p>2426 </p><div class="procedure"><a name="id2574587"></a><p class="title"><b>Procedure 5.13. Expose Hidden Folders</b></p><ol type="1"><li><p> 2427 2427 Launch the Windows Explorer by clicking 2428 2428 <span class="guimenu">Start</span> → <span class="guimenuitem">My Computer</span> → <span class="guimenuitem">Tools</span> → <span class="guimenuitem">Folder Options</span> → <span class="guimenuitem">View Tab</span>. … … 2430 2430 and click <span class="guibutton">OK</span>. Exit Windows Explorer. 2431 2431 </p></li><li><p> 2432 <a class="indexterm" name="id257465 8"></a>2432 <a class="indexterm" name="id2574654"></a> 2433 2433 Launch the Registry Editor. Click 2434 2434 <span class="guimenu">Start</span> → <span class="guimenuitem">Run</span>. Key in <code class="literal">regedt32</code>, and click … … 2436 2436 </p></li></ol></div><p> 2437 2437 </p><div class="procedure"><a name="sbehap-rdrfldr"></a><p class="title"><b>Procedure 5.14. Redirect Folders in Default System User Profile</b></p><ol type="1"><li><p> 2438 <a class="indexterm" name="id257471 6"></a>2439 <a class="indexterm" name="id25747 23"></a>2438 <a class="indexterm" name="id2574712"></a> 2439 <a class="indexterm" name="id2574718"></a> 2440 2440 Give focus to <code class="constant">HKEY_LOCAL_MACHINE</code> hive entry in the left panel. 2441 2441 Click <span class="guimenu">File</span> → <span class="guimenuitem">Load Hive...</span> → <span class="guimenuitem">Documents and Settings</span> → <span class="guimenuitem">Default User</span> → <span class="guimenuitem">NTUSER</span> → <span class="guimenuitem">Open</span>. In the dialog box that opens, enter the key name … … 2449 2449 The right panel reveals the contents as shown in <a class="link" href="happy.html#XP-screen001" title="Figure 5.3. Windows XP Professional User Shared Folders">“Windows XP Professional User Shared Folders”</a>. 2450 2450 </p></li><li><p> 2451 <a class="indexterm" name="id257481 6"></a>2452 <a class="indexterm" name="id25748 22"></a>2451 <a class="indexterm" name="id2574811"></a> 2452 <a class="indexterm" name="id2574818"></a> 2453 2453 You edit hive keys. Acceptable values to replace the 2454 2454 <code class="constant">%USERPROFILE%</code> variable includes: … … 2457 2457 <code class="constant">\\MASSIVE\profdata</code></p></li><li><p>A network redirection (UNC name) that contains a macro such as </p><p><code class="constant">%LOGONSERVER%\profdata\</code></p></li></ul></div><p> 2458 2458 </p></li><li><p> 2459 <a class="indexterm" name="id257486 9"></a>2459 <a class="indexterm" name="id2574864"></a> 2460 2460 Set the registry keys as shown in <a class="link" href="happy.html#proffold" title="Table 5.4. Default Profile Redirections">“Default Profile Redirections”</a>. Your implementation makes the assumption 2461 2461 that users have statically located machines. Notebook computers (mobile users) need to be … … 2465 2465 Click <span class="guimenu">File</span> → <span class="guimenuitem">Unload Hive...</span> → <span class="guimenuitem">Yes</span>. 2466 2466 </p></li><li><p> 2467 <a class="indexterm" name="id25749 24"></a>2467 <a class="indexterm" name="id2574919"></a> 2468 2468 Click <span class="guimenu">File</span> → <span class="guimenuitem">Exit</span>. This exits the 2469 2469 Registry Editor. … … 2472 2472 have redirected is in the exclusion list. 2473 2473 </p></li><li><p> 2474 You are now ready to copy<sup>[<a name="id257496 8" href="#ftn.id2574968" class="footnote">11</a>]</sup>2474 You are now ready to copy<sup>[<a name="id2574963" href="#ftn.id2574963" class="footnote">11</a>]</sup> 2475 2475 the Default User profile to the Samba domain controllers. Launch Microsoft Windows Explorer, 2476 2476 and use it to copy the full contents of the directory <code class="filename">Default User</code> that … … 2483 2483 desktop behavior should be returned to the original Microsoft settings. The following steps achieve 2484 2484 that ojective: 2485 </p><div class="procedure"><a name="id257503 5"></a><p class="title"><b>Procedure 5.15. Reset Folder Display to Original Behavior</b></p><ul><li><p>2485 </p><div class="procedure"><a name="id2575030"></a><p class="title"><b>Procedure 5.15. Reset Folder Display to Original Behavior</b></p><ul><li><p> 2486 2486 To launch the Windows Explorer, click 2487 2487 <span class="guimenu">Start</span> → <span class="guimenuitem">My Computer</span> → <span class="guimenuitem">Tools</span> → <span class="guimenuitem">Folder Options</span> → <span class="guimenuitem">View Tab</span>. 2488 2488 Deselect <span class="guilabel">Show hidden files and folders</span>, and click <span class="guibutton">OK</span>. 2489 2489 Exit Windows Explorer. 2490 </p></li></ul></div><div class="figure"><a name="XP-screen001"></a><p class="title"><b>Figure 5.3. Windows XP Professional User Shared Folders</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/XP-screen001.png" width="351" alt="Windows XP Professional User Shared Folders"></div></div></div><br class="figure-break"><div class="table"><a name="proffold"></a><p class="title"><b>Table 5.4. Default Profile Redirections</b></p><div class="table-contents"><table summary="Default Profile Redirections" border="1"><colgroup><col align="left"><col align="left"></colgroup><thead><tr><th align="left">Registry Key</th><th align="left">Redirected Value</th></tr></thead><tbody><tr><td align="left">Cache</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\InternetFiles</td></tr><tr><td align="left">Cookies</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\Cookies</td></tr><tr><td align="left">History</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\History</td></tr><tr><td align="left">Local AppData</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\AppData</td></tr><tr><td align="left">Local Settings</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\LocalSettings</td></tr><tr><td align="left">My Pictures</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\MyPictures</td></tr><tr><td align="left">Personal</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\MyDocuments</td></tr><tr><td align="left">Recent</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\Recent</td></tr></tbody></table></div></div><br class="table-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id257526 9"></a>Configuration of MS Outlook to Relocate PST File</h3></div></div></div><p>2491 <a class="indexterm" name="id257527 8"></a>2492 <a class="indexterm" name="id257528 6"></a>2490 </p></li></ul></div><div class="figure"><a name="XP-screen001"></a><p class="title"><b>Figure 5.3. Windows XP Professional User Shared Folders</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/XP-screen001.png" width="351" alt="Windows XP Professional User Shared Folders"></div></div></div><br class="figure-break"><div class="table"><a name="proffold"></a><p class="title"><b>Table 5.4. Default Profile Redirections</b></p><div class="table-contents"><table summary="Default Profile Redirections" border="1"><colgroup><col align="left"><col align="left"></colgroup><thead><tr><th align="left">Registry Key</th><th align="left">Redirected Value</th></tr></thead><tbody><tr><td align="left">Cache</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\InternetFiles</td></tr><tr><td align="left">Cookies</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\Cookies</td></tr><tr><td align="left">History</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\History</td></tr><tr><td align="left">Local AppData</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\AppData</td></tr><tr><td align="left">Local Settings</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\LocalSettings</td></tr><tr><td align="left">My Pictures</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\MyPictures</td></tr><tr><td align="left">Personal</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\MyDocuments</td></tr><tr><td align="left">Recent</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\Recent</td></tr></tbody></table></div></div><br class="table-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2575264"></a>Configuration of MS Outlook to Relocate PST File</h3></div></div></div><p> 2491 <a class="indexterm" name="id2575273"></a> 2492 <a class="indexterm" name="id2575282"></a> 2493 2493 Microsoft Outlook can store a Personal Storage file, generally known as a PST file. 2494 2494 It is the nature of email storage that this file grows, at times quite rapidly. … … 2499 2499 To redirect the Outlook PST file in Outlook 2003 (older versions of Outlook behave 2500 2500 slightly differently), follow these steps: 2501 </p><div class="procedure"><a name="id257530 9"></a><p class="title"><b>Procedure 5.16. Outlook PST File Relocation</b></p><ol type="1"><li><p>2501 </p><div class="procedure"><a name="id2575304"></a><p class="title"><b>Procedure 5.16. Outlook PST File Relocation</b></p><ol type="1"><li><p> 2502 2502 Close Outlook if it is open. 2503 2503 </p></li><li><p> … … 2529 2529 Go back to the <span class="guimenu">Data Files</span> window, then delete the old data file entry. 2530 2530 </p></li></ol></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 2531 <a class="indexterm" name="id257545 9"></a>2531 <a class="indexterm" name="id2575454"></a> 2532 2532 You may have to remove and reinstall the Outlook Address Book (Contacts) entries, otherwise 2533 2533 the user may be not be able to retrieve contacts when addressing a new email message. 2534 2534 </p></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 2535 <a class="indexterm" name="id25754 73"></a>2535 <a class="indexterm" name="id2575469"></a> 2536 2536 Outlook Express is not at all like MS OutLook. It stores file very differently also. Outlook 2537 2537 Express storage files can not be redirected to network shares. The options panel will not permit … … 2542 2542 registry, experience has shown that data corruption and loss of email messages will result. 2543 2543 </p><p> 2544 <a class="indexterm" name="id257549 6"></a>2545 <a class="indexterm" name="id2575 503"></a>2544 <a class="indexterm" name="id2575491"></a> 2545 <a class="indexterm" name="id2575498"></a> 2546 2546 In the same vane as MS Outlook, Outlook Express data stores can become very large. When used with 2547 2547 roaming profiles this can result in excruciatingly long login and logout behavior will files are … … 2549 2549 profiles are used. 2550 2550 </p></div><p> 2551 <a class="indexterm" name="id257551 8"></a>2551 <a class="indexterm" name="id2575514"></a> 2552 2552 Microsoft does not support storing PST files on network shares, although the practice does appear 2553 2553 to be rather popular. Anyone who does relocation the PST file to a network resource should refer … … 2555 2555 understand the issues. 2556 2556 </p><p> 2557 <a class="indexterm" name="id257553 9"></a>2557 <a class="indexterm" name="id2575535"></a> 2558 2558 Apart from manually moving PST files to a network share, it is possible to set the default PST 2559 2559 location for new accounts by following the instructions at the WindowsITPro <a class="ulink" href="http://www.windowsitpro.com/Windows/Article/ArticleID/48228/48228.html" target="_top">web</a> site. 2560 2560 </p><p> 2561 <a class="indexterm" name="id25755 60"></a>2561 <a class="indexterm" name="id2575555"></a> 2562 2562 User feedback suggests that disabling of oplocks on PST files will significantly improve 2563 2563 network performance by reducing locking overheads. One way this can be done is to add to the … … 2566 2566 veto oplock files = /*.pdf/*.PST/ 2567 2567 </pre><p> 2568 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id257558 5"></a>Configure Delete Cached Profiles on Logout</h3></div></div></div><p>2568 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2575580"></a>Configure Delete Cached Profiles on Logout</h3></div></div></div><p> 2569 2569 Configure the Windows XP Professional client to auto-delete roaming profiles on logout: 2570 2570 </p><p> 2571 <a class="indexterm" name="id257559 8"></a>2571 <a class="indexterm" name="id2575593"></a> 2572 2572 Click 2573 2573 <span class="guimenu">Start</span> → <span class="guimenuitem">Run</span>. In the dialog box, enter <code class="literal">MMC</code> and click <span class="guibutton">OK</span>. … … 2577 2577 <span class="guimenu">File</span> → <span class="guimenuitem">Add/Remove Snap-in</span> → <span class="guimenuitem">Add</span> → <span class="guimenuitem">Group Policy</span> → <span class="guimenuitem">Add</span> → <span class="guimenuitem">Finish</span> → <span class="guimenuitem">Close</span> → <span class="guimenuitem">OK</span>. 2578 2578 </p><p> 2579 <a class="indexterm" name="id25756 93"></a>2579 <a class="indexterm" name="id2575689"></a> 2580 2580 The Microsoft Management Console now shows the <span class="guimenu">Group Policy</span> 2581 2581 utility that enables you to set the policies needed. In the left panel, click … … 2585 2585 Close the Microsoft Management Console. The settings take immediate effect and persist onto all image copies 2586 2586 made of this system to deploy the new standard desktop system. 2587 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id25757 64"></a>Uploading Printer Drivers to Samba Servers</h3></div></div></div><p>2588 <a class="indexterm" name="id25757 72"></a>2587 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2575759"></a>Uploading Printer Drivers to Samba Servers</h3></div></div></div><p> 2588 <a class="indexterm" name="id2575768"></a> 2589 2589 Users want to be able to use network printers. You have a vested interest in making 2590 2590 it easy for them to print. You have chosen to install the printer drivers onto the Samba … … 2593 2593 print to the printer chosen. The following procedure must be followed for every network 2594 2594 printer: 2595 </p><div class="procedure"><a name="id25757 90"></a><p class="title"><b>Procedure 5.17. Steps to Install Printer Drivers on the Samba Servers</b></p><ol type="1"><li><p>2595 </p><div class="procedure"><a name="id2575786"></a><p class="title"><b>Procedure 5.17. Steps to Install Printer Drivers on the Samba Servers</b></p><ol type="1"><li><p> 2596 2596 Join your Windows XP Professional workstation (the staging machine) to the 2597 2597 <code class="constant">MEGANET2</code> domain. If you are not sure of the procedure, … … 2618 2618 button that is next to the <span class="guimenu">Driver</span> box. This launches the “<span class="quote">Add Printer Wizard</span>”. 2619 2619 </p></li><li><p> 2620 <a class="indexterm" name="id25759 80"></a>2621 <a class="indexterm" name="id257598 9"></a>2620 <a class="indexterm" name="id2575975"></a> 2621 <a class="indexterm" name="id2575984"></a> 2622 2622 The “<span class="quote">Add Printer Driver Wizard on <code class="constant">MASSIVE</code></span>” panel 2623 2623 is now presented. Click <span class="guimenu">Next</span> to continue. From the left panel, select the … … 2628 2628 directed at the network server <code class="constant">\\massive\ps01-color</code>. 2629 2629 </p></li><li><p> 2630 <a class="indexterm" name="id257603 8"></a>2631 <a class="indexterm" name="id257604 7"></a>2632 <a class="indexterm" name="id257605 6"></a>2633 <a class="indexterm" name="id257606 5"></a>2634 <a class="indexterm" name="id257607 4"></a>2635 <a class="indexterm" name="id25760 84"></a>2630 <a class="indexterm" name="id2576033"></a> 2631 <a class="indexterm" name="id2576042"></a> 2632 <a class="indexterm" name="id2576051"></a> 2633 <a class="indexterm" name="id2576060"></a> 2634 <a class="indexterm" name="id2576070"></a> 2635 <a class="indexterm" name="id2576079"></a> 2636 2636 The driver upload completes in anywhere from a few seconds to a few minutes. When it completes, 2637 2637 you are returned to the <span class="guimenu">Advanced</span> tab in the <span class="guimenu">Properties</span> panel. … … 2642 2642 (Applicable to Active Directory use only.) 2643 2643 </p></li><li><p> 2644 <a class="indexterm" name="id257613 8"></a>2644 <a class="indexterm" name="id2576134"></a> 2645 2645 Click <span class="guimenu">OK</span>. It will take a minute or so to upload the settings to the server. 2646 2646 You are now returned to the <span class="guimenu">Printers and Faxes on Massive</span> monitor. … … 2654 2654 click <span class="guimenu">Apply</span> again. 2655 2655 </p></li><li><p> 2656 <a class="indexterm" name="id25762 12"></a>2656 <a class="indexterm" name="id2576207"></a> 2657 2657 Verify that all printer settings are at the desired configuration. When you are satisfied that they are, 2658 2658 click the <span class="guimenu">General</span> tab. Now click the <span class="guimenu">Print Test Page</span> button. … … 2664 2664 When you have finished uploading drivers to all printers, close all applications. The next task 2665 2665 is to install software your users require to do their work. 2666 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id257626 7"></a>Software Installation</h3></div></div></div><p>2666 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2576262"></a>Software Installation</h3></div></div></div><p> 2667 2667 Your network has both fixed desktop workstations as well as notebook computers. As a general rule, it is 2668 2668 a good idea to not tamper with the operating system that is provided by the notebook computer manufacturer. … … 2679 2679 and migrate that to the Samba server for later reuse when creating custom mandatory profiles, just in 2680 2680 case a user may have specific needs you had not anticipated. 2681 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2576 303"></a>Roll-out Image Creation</h3></div></div></div><p>2681 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2576298"></a>Roll-out Image Creation</h3></div></div></div><p> 2682 2682 The final steps before preparing the distribution Norton Ghost image file you might follow are: 2683 2683 </p><div class="blockquote"><blockquote class="blockquote"><p> … … 2688 2688 in better performance and often significantly reduces the size of the compressed disk image. That 2689 2689 also means it will take less time to deploy the image onto 500 workstations. 2690 </p></blockquote></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id257633 7"></a>Key Points Learned</h2></div></div></div><p>2690 </p></blockquote></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2576332"></a>Key Points Learned</h2></div></div></div><p> 2691 2691 This chapter introduced many new concepts. Is it a sad fact that the example presented deliberately 2692 2692 avoided any consideration of security. Security does not just happen; you must design it into your total … … 2697 2697 of compromise. 2698 2698 </p><p> 2699 <a class="indexterm" name="id257635 8"></a>2700 <a class="indexterm" name="id257636 8"></a>2699 <a class="indexterm" name="id2576354"></a> 2700 <a class="indexterm" name="id2576363"></a> 2701 2701 As a minimum, the LDAP server must be protected by way of Access Control Lists (ACLs), and it must be 2702 2702 configured to use secure protocols for all communications over the network. Of course, secure networking … … 2725 2725 </p></li><li><p> 2726 2726 Use of the CUPS printing system together with Samba-based printer driver auto-download. 2727 </p></li></ul></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id25764 52"></a>Questions and Answers</h2></div></div></div><p>2727 </p></li></ul></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2576448"></a>Questions and Answers</h2></div></div></div><p> 2728 2728 Well, here we are at the end of this chapter and we have only ten questions to help you to 2729 2729 remember so much. There are bound to be some sticky issues here. 2730 </p><div class="qandaset"><dl><dt> <a href="happy.html#id25764 71">2730 </p><div class="qandaset"><dl><dt> <a href="happy.html#id2576466"> 2731 2731 Why did you not cover secure practices? Isn't it rather irresponsible to instruct 2732 2732 network administrators to implement insecure solutions? 2733 </a></dt><dt> <a href="happy.html#id257651 5">2733 </a></dt><dt> <a href="happy.html#id2576510"> 2734 2734 You have focused much on SUSE Linux and little on the market leader, Red Hat. Do 2735 2735 you have a problem with Red Hat Linux? Doesn't that make your guidance irrelevant 2736 2736 to the Linux I might be using? 2737 </a></dt><dt> <a href="happy.html#id257657 6">2737 </a></dt><dt> <a href="happy.html#id2576571"> 2738 2738 You did not use SWAT to configure Samba. Is there something wrong with it? 2739 </a></dt><dt> <a href="happy.html#id257661 5">2739 </a></dt><dt> <a href="happy.html#id2576610"> 2740 2740 You have exposed a well-used password not24get. Is that 2741 2741 not irresponsible? 2742 </a></dt><dt> <a href="happy.html#id25766 40">2742 </a></dt><dt> <a href="happy.html#id2576635"> 2743 2743 The Idealx smbldap-tools create many domain group accounts that are not used. Is that 2744 2744 a good thing? 2745 </a></dt><dt> <a href="happy.html#id257666 6">2745 </a></dt><dt> <a href="happy.html#id2576662"> 2746 2746 Can I use LDAP just for Samba accounts and not for UNIX system accounts? 2747 </a></dt><dt> <a href="happy.html#id25766 92">2747 </a></dt><dt> <a href="happy.html#id2576687"> 2748 2748 Why are the Windows domain RID portions not the same as the UNIX UID? 2749 </a></dt><dt> <a href="happy.html#id257672 7">2749 </a></dt><dt> <a href="happy.html#id2576723"> 2750 2750 Printer configuration examples all show printing to the HP port 9100. Does this 2751 2751 mean that I must have HP printers for these solutions to work? 2752 </a></dt><dt> <a href="happy.html#id257675 6">2752 </a></dt><dt> <a href="happy.html#id2576752"> 2753 2753 Is folder redirection dangerous? I've heard that you can lose your data that way. 2754 </a></dt><dt> <a href="happy.html#id25767 84">2754 </a></dt><dt> <a href="happy.html#id2576779"> 2755 2755 Is it really necessary to set a local Group Policy to exclude the redirected 2756 2756 folders from the roaming profile? 2757 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id25764 71"></a><a name="id2576473"></a></td><td align="left" valign="top"><p>2757 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2576466"></a><a name="id2576468"></a></td><td align="left" valign="top"><p> 2758 2758 Why did you not cover secure practices? Isn't it rather irresponsible to instruct 2759 2759 network administrators to implement insecure solutions? … … 2774 2774 that you should implement a network without provision for data recovery and for disaster 2775 2775 management? Back to our focus: The deployment of Samba has been clearly demonstrated. 2776 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id257651 5"></a><a name="id2576517"></a></td><td align="left" valign="top"><p>2776 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2576510"></a><a name="id2576512"></a></td><td align="left" valign="top"><p> 2777 2777 You have focused much on SUSE Linux and little on the market leader, Red Hat. Do 2778 2778 you have a problem with Red Hat Linux? Doesn't that make your guidance irrelevant … … 2801 2801 features of both products (companies also). No bias in presentation is intended. 2802 2802 Oh, before I forget, I particularly like Debian Linux; that is my favorite playground. 2803 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id257657 6"></a><a name="id2576578"></a></td><td align="left" valign="top"><p>2803 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2576571"></a><a name="id2576573"></a></td><td align="left" valign="top"><p> 2804 2804 You did not use SWAT to configure Samba. Is there something wrong with it? 2805 2805 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 2812 2812 and insecure. Many will not touch it with a barge-pole. By not introducing SWAT, I 2813 2813 hope to have brought their interests on board. SWAT is well covered is <span class="emphasis"><em>TOSHARG2</em></span>. 2814 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id257661 5"></a><a name="id2576617"></a></td><td align="left" valign="top"><p>2814 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2576610"></a><a name="id2576613"></a></td><td align="left" valign="top"><p> 2815 2815 You have exposed a well-used password <span class="emphasis"><em>not24get</em></span>. Is that 2816 2816 not irresponsible? … … 2819 2819 used throughout. I guess you can figure out that in a real deployment it would make 2820 2820 sense to use a more secure and original password. 2821 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id25766 40"></a><a name="id2576642"></a></td><td align="left" valign="top"><p>2821 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2576635"></a><a name="id2576638"></a></td><td align="left" valign="top"><p> 2822 2822 The Idealx smbldap-tools create many domain group accounts that are not used. Is that 2823 2823 a good thing? … … 2827 2827 and, besides, it does no harm to create accounts that are not now used at some time 2828 2828 Samba may well use them. 2829 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id257666 6"></a><a name="id2576669"></a></td><td align="left" valign="top"><p>2829 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2576662"></a><a name="id2576664"></a></td><td align="left" valign="top"><p> 2830 2830 Can I use LDAP just for Samba accounts and not for UNIX system accounts? 2831 2831 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 2835 2835 password files in sync? I think that having everything in LDAP makes a lot of sense 2836 2836 for the UNIX administrator who is still learning the craft and is migrating from MS Windows. 2837 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id25766 92"></a><a name="id2576694"></a></td><td align="left" valign="top"><p>2837 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2576687"></a><a name="id2576689"></a></td><td align="left" valign="top"><p> 2838 2838 Why are the Windows domain RID portions not the same as the UNIX UID? 2839 2839 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 2844 2844 permit you to override that to some extent. See the <code class="filename">smb.conf</code> man page entry 2845 2845 for <em class="parameter"><code>algorithmic rid base</code></em>. 2846 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id257672 7"></a><a name="id2576730"></a></td><td align="left" valign="top"><p>2846 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2576723"></a><a name="id2576725"></a></td><td align="left" valign="top"><p> 2847 2847 Printer configuration examples all show printing to the HP port 9100. Does this 2848 2848 mean that I must have HP printers for these solutions to work? … … 2854 2854 argument to the <code class="constant">lpadmin -v</code> option that is right for your 2855 2855 printer. 2856 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id257675 6"></a><a name="id2576759"></a></td><td align="left" valign="top"><p>2856 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2576752"></a><a name="id2576754"></a></td><td align="left" valign="top"><p> 2857 2857 Is folder redirection dangerous? I've heard that you can lose your data that way. 2858 2858 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 2864 2864 folder. That was not the case, so by declining to move the data back, he wiped out 2865 2865 the data. You cannot hold the tool responsible for that. Caveat emptor still applies. 2866 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id25767 84"></a><a name="id2576786"></a></td><td align="left" valign="top"><p>2866 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2576779"></a><a name="id2576781"></a></td><td align="left" valign="top"><p> 2867 2867 Is it really necessary to set a local Group Policy to exclude the redirected 2868 2868 folders from the roaming profile? … … 2870 2870 Yes. If you do not do this, the data will still be copied from the network folder 2871 2871 (share) to the local cached copy of the profile. 2872 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id257496 8" href="#id2574968" class="para">11</a>] </sup>2872 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id2574963" href="#id2574963" class="para">11</a>] </sup> 2873 2873 There is an alternate method by which a default user profile can be added to the 2874 2874 <code class="constant">NETLOGON</code> share. This facility in the Windows System tool -
branches/samba-3.2.x/docs/htmldocs/Samba3-ByExample/index.html
r204 r226 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Samba-3 by Example</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="next" href="pr01.html" title="About the Cover Artwork"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Samba-3 by Example</th></tr><tr><td width="20%" align="left"> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="pr01.html">Next</a></td></tr></table><hr></div><div class="book" lang="en"><div class="titlepage"><div><div><h1 class="title"><a name="S3bE"></a>Samba-3 by Example</h1></div><div><h2 class="subtitle">Practical Exercises in Successful Samba Deployment</h2></div><div><div class="authorgroup"><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div></div><div><p class="pubdate">July, 2006</p></div></div><hr></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="preface"><a href="pr01.html">About the Cover Artwork</a></span></dt><dt><span class="preface"><a href="pr02.html">Acknowledgments</a></span></dt><dt><span class="preface"><a href="pr03.html">Foreword</a></span></dt><dd><dl><dt><span class="sect1"><a href="pr03.html#id249589 8">By John M. Weathersby, Executive Director, OSSI</a></span></dt></dl></dd><dt><span class="preface"><a href="preface.html">Preface</a></span></dt><dd><dl><dt><span class="sect1"><a href="preface.html#id2496086">Why Is This Book Necessary?</a></span></dt><dd><dl><dt><span class="sect2"><a href="preface.html#id2494873">Samba 3.0.20 Update Edition</a></span></dt></dl></dd><dt><span class="sect1"><a href="preface.html#id2494769">Prerequisites</a></span></dt><dt><span class="sect1"><a href="preface.html#id2494801">Approach</a></span></dt><dt><span class="sect1"><a href="preface.html#id2542046">Summary of Topics</a></span></dt><dt><span class="sect1"><a href="preface.html#id2542784">Conventions Used</a></span></dt></dl></dd><dt><span class="part"><a href="ExNetworks.html">I. Example Network Configurations</a></span></dt><dd><dl><dt><span class="chapter"><a href="simple.html">1. No-Frills Samba Servers</a></span></dt><dd><dl><dt><span class="sect1"><a href="simple.html#id2542993">Introduction</a></span></dt><dt><span class="sect1"><a href="simple.html#id2543034">Assignment Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="simple.html#id2543078">Drafting Office</a></span></dt><dt><span class="sect2"><a href="simple.html#id2543849">Charity Administration Office</a></span></dt><dt><span class="sect2"><a href="simple.html#AccountingOffice">Accounting Office</a></span></dt></dl></dd><dt><span class="sect1"><a href="simple.html#id2547514">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="small.html">2. Small Office Networking</a></span></dt><dd><dl><dt><span class="sect1"><a href="small.html#id2547998">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2548021">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2548082">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2548136">Technical Issues</a></span></dt><dt><span class="sect2"><a href="small.html#id2548347">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2548369">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2550069">Validation</a></span></dt><dt><span class="sect2"><a href="small.html#id2550774">Notebook Computers: A Special Case</a></span></dt><dt><span class="sect2"><a href="small.html#id2550800">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2550876">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="secure.html">3. Secure Office Networking</a></span></dt><dd><dl><dt><span class="sect1"><a href="secure.html#id2551387">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id2551439">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2551688">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id2551704">Technical Issues</a></span></dt><dt><span class="sect2"><a href="secure.html#id2552156">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2552197">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#ch4bsc">Basic System Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id2553134">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4ptrcfg">Printer Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4valid">Validation</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4appscfg">Application Share Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id2557769">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2557831">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="Big500users.html">4. The 500-User Office</a></span></dt><dd><dl><dt><span class="sect1"><a href="Big500users.html#id2558352">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id2558397">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id2558503">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id2558539">Technical Issues</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2558741">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id2558764">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#ch5-dnshcp-setup">Installation of DHCP, DNS, and Samba Control Files</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2559494">Server Preparation: All Servers</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2560058">Server-Specific Preparation</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5-procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2563258">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id2563317">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="happy.html">5. Making Happy Users</a></span></dt><dd><dl><dt><span class="sect1"><a href="happy.html#id2564154">Regarding LDAP Directories and Windows Computer Accounts</a></span></dt><dt><span class="sect1"><a href="happy.html#id2564296">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id2564394">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2564531">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id2564988">Technical Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id2566867">Political Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id2566882">Installation Checklist</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2567062">Samba Server Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbeidealx">Install and Configure Idealx smbldap-tools Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id2569962">LDAP Initialization and Creation of User and Group Accounts</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-ptrcfg">Printer Configuration</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a></span></dt><dt><span class="sect1"><a href="happy.html#id2573911">Miscellaneous Server Preparation Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id2573932">Configuring Directory Share Point Roots</a></span></dt><dt><span class="sect2"><a href="happy.html#id2574027">Configuring Profile Directories</a></span></dt><dt><span class="sect2"><a href="happy.html#id2574271">Preparation of Logon Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id2574382">Assigning User Rights and Privileges</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2574516">Windows Client Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></span></dt><dt><span class="sect2"><a href="happy.html#id2575269">Configuration of MS Outlook to Relocate PST File</a></span></dt><dt><span class="sect2"><a href="happy.html#id2575585">Configure Delete Cached Profiles on Logout</a></span></dt><dt><span class="sect2"><a href="happy.html#id2575764">Uploading Printer Drivers to Samba Servers</a></span></dt><dt><span class="sect2"><a href="happy.html#id2576267">Software Installation</a></span></dt><dt><span class="sect2"><a href="happy.html#id2576303">Roll-out Image Creation</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2576337">Key Points Learned</a></span></dt><dt><span class="sect1"><a href="happy.html#id2576452">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="2000users.html">6. A Distributed 2000-User Network</a></span></dt><dd><dl><dt><span class="sect1"><a href="2000users.html#id2576874">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id2576904">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id2576972">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id2577245">Technical Issues</a></span></dt><dt><span class="sect2"><a href="2000users.html#id2578189">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id2578207">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id2581365">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id2581512">Questions and Answers</a></span></dt></dl></dd></dl></dd><dt><span class="part"><a href="DMSMig.html">II. Domain Members, Updating Samba and Migration</a></span></dt><dd><dl><dt><span class="chapter"><a href="unixclients.html">7. Adding Domain Member Servers and Clients</a></span></dt><dd><dl><dt><span class="sect1"><a href="unixclients.html#id2582370">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id2582424">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id2582459">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id2582487">Technical Issues</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id2583136">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id2583237">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></span></dt><dt><span class="sect2"><a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></span></dt><dt><span class="sect2"><a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a></span></dt><dt><span class="sect2"><a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id2589442">UNIX/Linux Client Domain Member</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id2590017">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id2590071">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="upgrades.html">8. Updating Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="upgrades.html#id2591231">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id2591327">Cautions and Notes</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id2592656">Upgrading from Samba 1.x and 2.x to Samba-3</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2593024">Applicable to All Samba 2.x to Samba-3 Upgrades</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2593358">Samba-2.x with LDAP Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id2593539">Updating a Samba-3 Installation</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id2593650">Samba-3 to Samba-3 Updates on the Same Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2593853">Migrating Samba-3 to a New Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2594268">Migration of Samba Accounts to Active Directory</a></span></dt></dl></dd></dl></dd><dt><span class="chapter"><a href="ntmigration.html">9. Migrating NT4 Domain to Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="ntmigration.html#id2594439">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2594524">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2594579">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2594765">Technical Issues</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2595088">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2595114">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2595255">NT4 Migration Using LDAP Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2597714">NT4 Migration Using tdbsam Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2598120">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2598159">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="nw4migration.html">10. Migrating NetWare Server to Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="nw4migration.html#id2599134">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id2599251">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id2599364">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id2599440">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id2599631">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id2599640">NetWare Migration Using LDAP Backend</a></span></dt></dl></dd></dl></dd></dl></dd><dt><span class="part"><a href="RefSection.html">III. Reference Section</a></span></dt><dd><dl><dt><span class="chapter"><a href="kerberos.html">11. Active Directory, Kerberos, and Security</a></span></dt><dd><dl><dt><span class="sect1"><a href="kerberos.html#id2603717">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2604367">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id2604384">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2604780">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#ch10expl">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2606410">Share Access Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2606759">Share Definition Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2607372">Share Point Directory and File Permissions</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2607775">Managing Windows 200x ACLs</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2608502">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id2608636">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="DomApps.html">12. Integrating Additional Services</a></span></dt><dd><dl><dt><span class="sect1"><a href="DomApps.html#id2609265">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id2609296">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2609396">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id2609429">Technical Issues</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id2609585">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2609603">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id2611455">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2611515">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="HA.html">13. Performance, Reliability, and Availability</a></span></dt><dd><dl><dt><span class="sect1"><a href="HA.html#id2612034">Introduction</a></span></dt><dt><span class="sect1"><a href="HA.html#id2612122">Dissection and Discussion</a></span></dt><dt><span class="sect1"><a href="HA.html#id2612593">Guidelines for Reliable Samba Operation</a></span></dt><dd><dl><dt><span class="sect2"><a href="HA.html#id2612620">Name Resolution</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613096">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613424">Use and Location of BDCs</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613499">Use One Consistent Version of MS Windows Client</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613521">For Scalability, Use SAN-Based Storage on Samba Servers</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613570">Distribute Network Load with MSDFS</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613625">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613671">Hardware Problems</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613829">Large Directories</a></span></dt></dl></dd><dt><span class="sect1"><a href="HA.html#id2613932">Key Points Learned</a></span></dt></dl></dd><dt><span class="chapter"><a href="ch14.html">14. Samba Support</a></span></dt><dd><dl><dt><span class="sect1"><a href="ch14.html#id2614102">Free Support</a></span></dt><dt><span class="sect1"><a href="ch14.html#id2614320">Commercial Support</a></span></dt></dl></dd><dt><span class="chapter"><a href="appendix.html">15. A Collection of Useful Tidbits</a></span></dt><dd><dl><dt><span class="sect1"><a href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></span></dt><dt><span class="sect1"><a href="appendix.html#id2615028">Samba System File Location</a></span></dt><dt><span class="sect1"><a href="appendix.html#id2615448">Starting Samba</a></span></dt><dt><span class="sect1"><a href="appendix.html#id2615793">DNS Configuration Files</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id2615805">The Forward Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2615854">The Reverse Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2615994">DNS Root Server Hint File</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id2616053">Initialization of the LDAP Database</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#id2616632">The LDAP Account Manager</a></span></dt><dt><span class="sect1"><a href="appendix.html#id2617629">IDEALX Management Console</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12dblck">Shared Data Integrity</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id2618109">Microsoft Access</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2618256">Act! Database Sharing</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2618341">Opportunistic Locking Controls</a></span></dt></dl></dd></dl></dd><dt><span class="chapter"><a href="primer.html">16. Networking Primer</a></span></dt><dd><dl><dt><span class="sect1"><a href="primer.html#id2618507">Requirements and Notes</a></span></dt><dt><span class="sect1"><a href="primer.html#id2618669">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id2618729">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#id2618846">Exercises</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id2618972">Single-Machine Broadcast Activity</a></span></dt><dt><span class="sect2"><a href="primer.html#secondmachine">Second Machine Startup Broadcast Interaction</a></span></dt><dt><span class="sect2"><a href="primer.html#id2620118">Simple Windows Client Connection Characteristics</a></span></dt><dt><span class="sect2"><a href="primer.html#id2620620">Windows 200x/XP Client Interaction with Samba-3</a></span></dt><dt><span class="sect2"><a href="primer.html#id2621188">Conclusions to Exercises</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01conc">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id2621302">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01qa">Questions and Answers</a></span></dt></dl></dd><dt><span class="appendix"><a href="apa.html">A.1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Samba-3 by Example</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="next" href="pr01.html" title="About the Cover Artwork"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Samba-3 by Example</th></tr><tr><td width="20%" align="left"> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="pr01.html">Next</a></td></tr></table><hr></div><div class="book" lang="en"><div class="titlepage"><div><div><h1 class="title"><a name="S3bE"></a>Samba-3 by Example</h1></div><div><h2 class="subtitle">Practical Exercises in Successful Samba Deployment</h2></div><div><div class="authorgroup"><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div></div><div><p class="pubdate">July, 2006</p></div></div><hr></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="preface"><a href="pr01.html">About the Cover Artwork</a></span></dt><dt><span class="preface"><a href="pr02.html">Acknowledgments</a></span></dt><dt><span class="preface"><a href="pr03.html">Foreword</a></span></dt><dd><dl><dt><span class="sect1"><a href="pr03.html#id2495890">By John M. Weathersby, Executive Director, OSSI</a></span></dt></dl></dd><dt><span class="preface"><a href="preface.html">Preface</a></span></dt><dd><dl><dt><span class="sect1"><a href="preface.html#id2496079">Why Is This Book Necessary?</a></span></dt><dd><dl><dt><span class="sect2"><a href="preface.html#id2494865">Samba 3.0.20 Update Edition</a></span></dt></dl></dd><dt><span class="sect1"><a href="preface.html#id2494761">Prerequisites</a></span></dt><dt><span class="sect1"><a href="preface.html#id2494793">Approach</a></span></dt><dt><span class="sect1"><a href="preface.html#id2542043">Summary of Topics</a></span></dt><dt><span class="sect1"><a href="preface.html#id2542780">Conventions Used</a></span></dt></dl></dd><dt><span class="part"><a href="ExNetworks.html">I. Example Network Configurations</a></span></dt><dd><dl><dt><span class="chapter"><a href="simple.html">1. No-Frills Samba Servers</a></span></dt><dd><dl><dt><span class="sect1"><a href="simple.html#id2542989">Introduction</a></span></dt><dt><span class="sect1"><a href="simple.html#id2543030">Assignment Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="simple.html#id2543074">Drafting Office</a></span></dt><dt><span class="sect2"><a href="simple.html#id2543845">Charity Administration Office</a></span></dt><dt><span class="sect2"><a href="simple.html#AccountingOffice">Accounting Office</a></span></dt></dl></dd><dt><span class="sect1"><a href="simple.html#id2547510">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="small.html">2. Small Office Networking</a></span></dt><dd><dl><dt><span class="sect1"><a href="small.html#id2547993">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2548016">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2548078">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2548131">Technical Issues</a></span></dt><dt><span class="sect2"><a href="small.html#id2548343">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2548364">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2550065">Validation</a></span></dt><dt><span class="sect2"><a href="small.html#id2550769">Notebook Computers: A Special Case</a></span></dt><dt><span class="sect2"><a href="small.html#id2550795">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2550871">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="secure.html">3. Secure Office Networking</a></span></dt><dd><dl><dt><span class="sect1"><a href="secure.html#id2551382">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id2551434">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2551684">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id2551699">Technical Issues</a></span></dt><dt><span class="sect2"><a href="secure.html#id2552152">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2552192">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#ch4bsc">Basic System Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id2553129">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4ptrcfg">Printer Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4valid">Validation</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4appscfg">Application Share Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id2557764">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2557826">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="Big500users.html">4. The 500-User Office</a></span></dt><dd><dl><dt><span class="sect1"><a href="Big500users.html#id2558348">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id2558393">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id2558499">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id2558534">Technical Issues</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2558737">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id2558760">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#ch5-dnshcp-setup">Installation of DHCP, DNS, and Samba Control Files</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2559489">Server Preparation: All Servers</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2560054">Server-Specific Preparation</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5-procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2563254">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id2563312">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="happy.html">5. Making Happy Users</a></span></dt><dd><dl><dt><span class="sect1"><a href="happy.html#id2564150">Regarding LDAP Directories and Windows Computer Accounts</a></span></dt><dt><span class="sect1"><a href="happy.html#id2564292">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id2564389">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2564526">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id2564983">Technical Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id2566862">Political Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id2566878">Installation Checklist</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2567058">Samba Server Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbeidealx">Install and Configure Idealx smbldap-tools Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id2569957">LDAP Initialization and Creation of User and Group Accounts</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-ptrcfg">Printer Configuration</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a></span></dt><dt><span class="sect1"><a href="happy.html#id2573907">Miscellaneous Server Preparation Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id2573927">Configuring Directory Share Point Roots</a></span></dt><dt><span class="sect2"><a href="happy.html#id2574022">Configuring Profile Directories</a></span></dt><dt><span class="sect2"><a href="happy.html#id2574266">Preparation of Logon Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id2574377">Assigning User Rights and Privileges</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2574511">Windows Client Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></span></dt><dt><span class="sect2"><a href="happy.html#id2575264">Configuration of MS Outlook to Relocate PST File</a></span></dt><dt><span class="sect2"><a href="happy.html#id2575580">Configure Delete Cached Profiles on Logout</a></span></dt><dt><span class="sect2"><a href="happy.html#id2575759">Uploading Printer Drivers to Samba Servers</a></span></dt><dt><span class="sect2"><a href="happy.html#id2576262">Software Installation</a></span></dt><dt><span class="sect2"><a href="happy.html#id2576298">Roll-out Image Creation</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2576332">Key Points Learned</a></span></dt><dt><span class="sect1"><a href="happy.html#id2576448">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="2000users.html">6. A Distributed 2000-User Network</a></span></dt><dd><dl><dt><span class="sect1"><a href="2000users.html#id2576869">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id2576899">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id2576967">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id2577240">Technical Issues</a></span></dt><dt><span class="sect2"><a href="2000users.html#id2578184">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id2578202">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="2000users.html#id2581360">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="2000users.html#id2581507">Questions and Answers</a></span></dt></dl></dd></dl></dd><dt><span class="part"><a href="DMSMig.html">II. Domain Members, Updating Samba and Migration</a></span></dt><dd><dl><dt><span class="chapter"><a href="unixclients.html">7. Adding Domain Member Servers and Clients</a></span></dt><dd><dl><dt><span class="sect1"><a href="unixclients.html#id2582366">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id2582419">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id2582454">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id2582483">Technical Issues</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id2583132">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id2583232">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></span></dt><dt><span class="sect2"><a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></span></dt><dt><span class="sect2"><a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a></span></dt><dt><span class="sect2"><a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id2589438">UNIX/Linux Client Domain Member</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id2590012">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id2590066">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="upgrades.html">8. Updating Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="upgrades.html#id2591226">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id2591322">Cautions and Notes</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id2592651">Upgrading from Samba 1.x and 2.x to Samba-3</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2593019">Applicable to All Samba 2.x to Samba-3 Upgrades</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2593353">Samba-2.x with LDAP Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id2593535">Updating a Samba-3 Installation</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id2593645">Samba-3 to Samba-3 Updates on the Same Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2593848">Migrating Samba-3 to a New Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2594263">Migration of Samba Accounts to Active Directory</a></span></dt></dl></dd></dl></dd><dt><span class="chapter"><a href="ntmigration.html">9. Migrating NT4 Domain to Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="ntmigration.html#id2594435">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2594520">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2594574">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2594760">Technical Issues</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2595084">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2595109">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2595250">NT4 Migration Using LDAP Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2597709">NT4 Migration Using tdbsam Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2598116">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2598154">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="nw4migration.html">10. Migrating NetWare Server to Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="nw4migration.html#id2599130">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id2599246">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id2599359">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id2599436">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id2599626">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id2599635">NetWare Migration Using LDAP Backend</a></span></dt></dl></dd></dl></dd></dl></dd><dt><span class="part"><a href="RefSection.html">III. Reference Section</a></span></dt><dd><dl><dt><span class="chapter"><a href="kerberos.html">11. Active Directory, Kerberos, and Security</a></span></dt><dd><dl><dt><span class="sect1"><a href="kerberos.html#id2603712">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2604363">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id2604379">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2604776">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#ch10expl">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2606406">Share Access Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2606754">Share Definition Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2607367">Share Point Directory and File Permissions</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2607770">Managing Windows 200x ACLs</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2608497">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id2608631">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="DomApps.html">12. Integrating Additional Services</a></span></dt><dd><dl><dt><span class="sect1"><a href="DomApps.html#id2609260">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id2609291">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2609392">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id2609425">Technical Issues</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id2609581">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2609598">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id2611450">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2611510">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="HA.html">13. Performance, Reliability, and Availability</a></span></dt><dd><dl><dt><span class="sect1"><a href="HA.html#id2612030">Introduction</a></span></dt><dt><span class="sect1"><a href="HA.html#id2612117">Dissection and Discussion</a></span></dt><dt><span class="sect1"><a href="HA.html#id2612588">Guidelines for Reliable Samba Operation</a></span></dt><dd><dl><dt><span class="sect2"><a href="HA.html#id2612616">Name Resolution</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613092">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613419">Use and Location of BDCs</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613494">Use One Consistent Version of MS Windows Client</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613516">For Scalability, Use SAN-Based Storage on Samba Servers</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613566">Distribute Network Load with MSDFS</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613620">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613666">Hardware Problems</a></span></dt><dt><span class="sect2"><a href="HA.html#id2613824">Large Directories</a></span></dt></dl></dd><dt><span class="sect1"><a href="HA.html#id2613927">Key Points Learned</a></span></dt></dl></dd><dt><span class="chapter"><a href="ch14.html">14. Samba Support</a></span></dt><dd><dl><dt><span class="sect1"><a href="ch14.html#id2614097">Free Support</a></span></dt><dt><span class="sect1"><a href="ch14.html#id2614316">Commercial Support</a></span></dt></dl></dd><dt><span class="chapter"><a href="appendix.html">15. A Collection of Useful Tidbits</a></span></dt><dd><dl><dt><span class="sect1"><a href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></span></dt><dt><span class="sect1"><a href="appendix.html#id2615023">Samba System File Location</a></span></dt><dt><span class="sect1"><a href="appendix.html#id2615443">Starting Samba</a></span></dt><dt><span class="sect1"><a href="appendix.html#id2615789">DNS Configuration Files</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id2615801">The Forward Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2615849">The Reverse Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2615989">DNS Root Server Hint File</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id2616048">Initialization of the LDAP Database</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#id2616627">The LDAP Account Manager</a></span></dt><dt><span class="sect1"><a href="appendix.html#id2617624">IDEALX Management Console</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12dblck">Shared Data Integrity</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id2618104">Microsoft Access</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2618252">Act! Database Sharing</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2618336">Opportunistic Locking Controls</a></span></dt></dl></dd></dl></dd><dt><span class="chapter"><a href="primer.html">16. Networking Primer</a></span></dt><dd><dl><dt><span class="sect1"><a href="primer.html#id2618502">Requirements and Notes</a></span></dt><dt><span class="sect1"><a href="primer.html#id2618664">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id2618724">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#id2618841">Exercises</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id2618968">Single-Machine Broadcast Activity</a></span></dt><dt><span class="sect2"><a href="primer.html#secondmachine">Second Machine Startup Broadcast Interaction</a></span></dt><dt><span class="sect2"><a href="primer.html#id2620113">Simple Windows Client Connection Characteristics</a></span></dt><dt><span class="sect2"><a href="primer.html#id2620615">Windows 200x/XP Client Interaction with Samba-3</a></span></dt><dt><span class="sect2"><a href="primer.html#id2621183">Conclusions to Exercises</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01conc">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id2621297">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01qa">Questions and Answers</a></span></dt></dl></dd><dt><span class="appendix"><a href="apa.html">A. 2 2 <acronym class="acronym">GNU</acronym> General Public License version 3 3 </a></span></dt><dd><dl><dt><span class="bridgehead"><a href="apa.html#id262196 8">A.3 </a></span></dt><dd><dl><dt><span class="bridgehead"><a href="apa.html#id2621963">A. 4 4 Preamble 5 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id26221 13">A.5 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622108">A. 6 6 TERMS AND CONDITIONS 7 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262211 7">A.7 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622112">A. 8 8 0. Definitions. 9 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262220 9">A.9 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622204">A. 10 10 1. Source Code. 11 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262230 8">A.11 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622303">A. 12 12 2. Basic Permissions. 13 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262234 7">A.13 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622342">A. 14 14 3. Protecting Users’ Legal Rights From Anti-Circumvention Law. 15 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262238 8">A.15 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622383">A. 16 16 4. Conveying Verbatim Copies. 17 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262241 5">A.17 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622410">A. 18 18 5. Conveying Modified Source Versions. 19 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id26225 10">A.19 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622506">A. 20 20 6. Conveying Non-Source Forms. 21 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622 700">A.21 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622696">A. 22 22 7. Additional Terms. 23 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262283 6">A.23 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622831">A. 24 24 8. Termination. 25 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id26228 80">A.25 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622875">A. 26 26 9. Acceptance Not Required for Having Copies. 27 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262289 9">A.27 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622894">A. 28 28 10. Automatic Licensing of Downstream Recipients. 29 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id26229 51">A.29 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2622946">A. 30 30 11. Patents. 31 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262308 7">A.31 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2623082">A. 32 32 12. No Surrender of Others’ Freedom. 33 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262310 9">A.33 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2623104">A. 34 34 13. Use with the ???TITLE??? Affero General Public License. 35 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262313 7">A.35 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2623133">A. 36 36 14. Revised Versions of this License. 37 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2623 200">A.37 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2623195">A. 38 38 15. Disclaimer of Warranty. 39 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262322 6">A.39 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2623221">A. 40 40 16. Limitation of Liability. 41 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262324 6">A.41 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2623241">A. 42 42 17. Interpretation of Sections 15 and 16. 43 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id26232 63">A.43 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2623258">A. 44 44 END OF TERMS AND CONDITIONS 45 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id262326 7">A.45 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id2623262">A. 46 46 How to Apply These Terms to Your New Programs 47 47 </a></span></dt></dl></dd></dl></dd><dt><span class="glossary"><a href="go01.html">Glossary</a></span></dt><dt><span class="index"><a href="ix01.html">Index</a></span></dt></dl></div><div class="list-of-figures"><p><b>List of Figures</b></p><dl><dt>1.1. <a href="simple.html#charitynet">Charity Administration Office Network</a></dt><dt>1.2. <a href="simple.html#acctingnet2">Accounting Office Network Topology</a></dt><dt>2.1. <a href="small.html#acct2net">Abmas Accounting 52-User Network Topology</a></dt><dt>3.1. <a href="secure.html#ch04net">Abmas Network Topology 130 Users</a></dt><dt>4.1. <a href="Big500users.html#chap05net">Network Topology 500 User Network Using tdbsam passdb backend.</a></dt><dt>5.1. <a href="happy.html#sbehap-LDAPdiag">The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts</a></dt><dt>5.2. <a href="happy.html#chap6net">Network Topology 500 User Network Using ldapsam passdb backend</a></dt><dt>5.3. <a href="happy.html#XP-screen001">Windows XP Professional User Shared Folders</a></dt><dt>6.1. <a href="2000users.html#chap7idres">Samba and Authentication Backend Search Pathways</a></dt><dt>6.2. <a href="2000users.html#ch7singleLDAP">Samba Configuration to Use a Single LDAP Server</a></dt><dt>6.3. <a href="2000users.html#ch7dualLDAP">Samba Configuration to Use a Dual (Fail-over) LDAP Server</a></dt><dt>6.4. <a href="2000users.html#ch7dualadd">Samba Configuration to Use Dual LDAP Databases - Broken - Do Not Use!</a></dt><dt>6.5. <a href="2000users.html#ch7dualok">Samba Configuration to Use Two LDAP Databases - The result is additive.</a></dt><dt>6.6. <a href="2000users.html#chap7net">Network Topology 2000 User Complex Design A</a></dt><dt>6.7. <a href="2000users.html#chap7net2">Network Topology 2000 User Complex Design B</a></dt><dt>7.1. <a href="unixclients.html#ch09openmag">Open Magazine Samba Survey</a></dt><dt>7.2. <a href="unixclients.html#ch9-sambadc">Samba Domain: Samba Member Server</a></dt><dt>7.3. <a href="unixclients.html#ch9-adsdc">Active Directory Domain: Samba Member Server</a></dt><dt>9.1. <a href="ntmigration.html#ch8-migration">Schematic Explaining the <code class="literal">net rpc vampire</code> Process</a></dt><dt>9.2. <a href="ntmigration.html#NT4DUM">View of Accounts in NT4 Domain User Manager</a></dt><dt>15.1. <a href="appendix.html#swxpp001">The General Panel.</a></dt><dt>15.2. <a href="appendix.html#swxpp004">The Computer Name Panel.</a></dt><dt>15.3. <a href="appendix.html#swxpp006">The Computer Name Changes Panel</a></dt><dt>15.4. <a href="appendix.html#swxpp007">The Computer Name Changes Panel Domain MIDEARTH</a></dt><dt>15.5. <a href="appendix.html#swxpp008">Computer Name Changes User name and Password Panel</a></dt><dt>15.6. <a href="appendix.html#lam-login">The LDAP Account Manager Login Screen</a></dt><dt>15.7. <a href="appendix.html#lam-config">The LDAP Account Manager Configuration Screen</a></dt><dt>15.8. <a href="appendix.html#lam-user">The LDAP Account Manager User Edit Screen</a></dt><dt>15.9. <a href="appendix.html#lam-group">The LDAP Account Manager Group Edit Screen</a></dt><dt>15.10. <a href="appendix.html#lam-group-mem">The LDAP Account Manager Group Membership Edit Screen</a></dt><dt>15.11. <a href="appendix.html#lam-host">The LDAP Account Manager Host Edit Screen</a></dt><dt>15.12. <a href="appendix.html#imcidealx">The IMC Samba User Account Screen</a></dt><dt>16.1. <a href="primer.html#pktcap01">Windows Me Broadcasts The First 10 Minutes</a></dt><dt>16.2. <a href="primer.html#pktcap02">Windows Me Later Broadcast Sample</a></dt><dt>16.3. <a href="primer.html#hostannounce">Typical Windows 9x/Me Host Announcement</a></dt><dt>16.4. <a href="primer.html#nullconnect">Typical Windows 9x/Me NULL SessionSetUp AndX Request</a></dt><dt>16.5. <a href="primer.html#userconnect">Typical Windows 9x/Me User SessionSetUp AndX Request</a></dt><dt>16.6. <a href="primer.html#XPCap01">Typical Windows XP NULL Session Setup AndX Request</a></dt><dt>16.7. <a href="primer.html#XPCap02">Typical Windows XP User Session Setup AndX Request</a></dt></dl></div><div class="list-of-tables"><p><b>List of Tables</b></p><dl><dt>1. <a href="preface.html#pref-new">Samba Changes 3.0.2 to 3.0.20</a></dt><dt>1.1. <a href="simple.html#acctingnet">Accounting Office Network Information</a></dt><dt>3.1. <a href="secure.html#chap4netid">Abmas.US ISP Information</a></dt><dt>3.2. <a href="secure.html#namedrscfiles">DNS (named) Resource Files</a></dt><dt>4.1. <a href="Big500users.html#ch5-filelocations">Domain: <code class="constant">MEGANET</code>, File Locations for Servers</a></dt><dt>5.1. <a href="happy.html#sbehap-privs">Current Privilege Capabilities</a></dt><dt>5.2. <a href="happy.html#oldapreq">Required OpenLDAP Linux Packages</a></dt><dt>5.3. <a href="happy.html#sbehap-bigacct">Abmas Network Users and Groups</a></dt><dt>5.4. <a href="happy.html#proffold">Default Profile Redirections</a></dt><dt>9.1. <a href="ntmigration.html#ch8-vampire">Samba <code class="filename">smb.conf</code> Scripts Essential to Samba Operation</a></dt><dt>13.1. <a href="HA.html#ProbList">Effect of Common Problems</a></dt><dt>16.1. <a href="primer.html#capsstats01">Windows Me Startup Broadcast Capture Statistics</a></dt><dt>16.2. <a href="primer.html#capsstats02">Second Machine (Windows 98) Capture Statistics</a></dt></dl></div><div class="list-of-examples"><p><b>List of Examples</b></p><dl><dt>1.1. <a href="simple.html#draft-smbconf">Drafting Office <code class="filename">smb.conf</code> File</a></dt><dt>1.2. <a href="simple.html#charity-smbconfnew">Charity Administration Office <code class="filename">smb.conf</code> New-style File</a></dt><dt>1.3. <a href="simple.html#charity-smbconf">Charity Administration Office <code class="filename">smb.conf</code> Old-style File</a></dt><dt>1.4. <a href="simple.html#MEreg">Windows Me Registry Edit File: Disable Password Caching</a></dt><dt>1.5. <a href="simple.html#acctconf">Accounting Office Network <code class="filename">smb.conf</code> Old Style Configuration File</a></dt><dt>2.1. <a href="small.html#initGrps">Script to Map Windows NT Groups to UNIX Groups</a></dt><dt>2.2. <a href="small.html#dhcp01">Abmas Accounting DHCP Server Configuration File <code class="filename">/etc/dhcpd.conf</code></a></dt><dt>2.3. <a href="small.html#acct2conf">Accounting Office Network <code class="filename">smb.conf</code> File [globals] Section</a></dt><dt>2.4. <a href="small.html#acct3conf">Accounting Office Network <code class="filename">smb.conf</code> File Services and Shares Section</a></dt><dt>3.1. <a href="secure.html#ch4memoryest">Estimation of Memory Requirements</a></dt><dt>3.2. <a href="secure.html#ch4diskest">Estimation of Disk Storage Requirements</a></dt><dt>3.3. <a href="secure.html#ch4natfw">NAT Firewall Configuration Script</a></dt><dt>3.4. <a href="secure.html#promisnet">130 User Network with <span class="emphasis"><em>tdbsam</em></span> [globals] Section</a></dt><dt>3.5. <a href="secure.html#promisnetsvca">130 User Network with <span class="emphasis"><em>tdbsam</em></span> Services Section Part A</a></dt><dt>3.6. <a href="secure.html#promisnetsvcb">130 User Network with <span class="emphasis"><em>tdbsam</em></span> Services Section Part B</a></dt><dt>3.7. <a href="secure.html#ch4initGrps">Script to Map Windows NT Groups to UNIX Groups</a></dt><dt>3.8. <a href="secure.html#prom-dhcp">DHCP Server Configuration File <code class="filename">/etc/dhcpd.conf</code></a></dt><dt>3.9. <a href="secure.html#ch4namedcfg">DNS Master Configuration File <code class="filename">/etc/named.conf</code> Master Section</a></dt><dt>3.10. <a href="secure.html#ch4namedvarfwd">DNS Master Configuration File <code class="filename">/etc/named.conf</code> Forward Lookup Definition Section</a></dt><dt>3.11. <a href="secure.html#ch4namedvarrev">DNS Master Configuration File <code class="filename">/etc/named.conf</code> Reverse Lookup Definition Section</a></dt><dt>3.12. <a href="secure.html#eth1zone">DNS 192.168.1 Reverse Zone File</a></dt><dt>3.13. <a href="secure.html#eth2zone">DNS 192.168.2 Reverse Zone File</a></dt><dt>3.14. <a href="secure.html#abmasbiz">DNS Abmas.biz Forward Zone File</a></dt><dt>3.15. <a href="secure.html#abmasus">DNS Abmas.us Forward Zone File</a></dt><dt>4.1. <a href="Big500users.html#ch5-massivesmb">Server: MASSIVE (PDC), File: <code class="filename">/etc/samba/smb.conf</code></a></dt><dt>4.2. <a href="Big500users.html#ch5-dc-common">Server: MASSIVE (PDC), File: <code class="filename">/etc/samba/dc-common.conf</code></a></dt><dt>4.3. <a href="Big500users.html#ch5-commonsmb">Common Samba Configuration File: <code class="filename">/etc/samba/common.conf</code></a></dt><dt>4.4. <a href="Big500users.html#ch5-bldg1-smb">Server: BLDG1 (Member), File: smb.conf</a></dt><dt>4.5. <a href="Big500users.html#ch5-bldg2-smb">Server: BLDG2 (Member), File: smb.conf</a></dt><dt>4.6. <a href="Big500users.html#ch5-dommem-smb">Common Domain Member Include File: dom-mem.conf</a></dt><dt>4.7. <a href="Big500users.html#massive-dhcp">Server: MASSIVE, File: dhcpd.conf</a></dt><dt>4.8. <a href="Big500users.html#bldg1dhcp">Server: BLDG1, File: dhcpd.conf</a></dt><dt>4.9. <a href="Big500users.html#bldg2dhcp">Server: BLDG2, File: dhcpd.conf</a></dt><dt>4.10. <a href="Big500users.html#massive-nameda">Server: MASSIVE, File: named.conf, Part: A</a></dt><dt>4.11. <a href="Big500users.html#massive-namedb">Server: MASSIVE, File: named.conf, Part: B</a></dt><dt>4.12. <a href="Big500users.html#massive-namedc">Server: MASSIVE, File: named.conf, Part: C</a></dt><dt>4.13. <a href="Big500users.html#abmasbizdns">Forward Zone File: abmas.biz.hosts</a></dt><dt>4.14. <a href="Big500users.html#abmasusdns">Forward Zone File: abmas.biz.hosts</a></dt><dt>4.15. <a href="Big500users.html#bldg12nameda">Servers: BLDG1/BLDG2, File: named.conf, Part: A</a></dt><dt>4.16. <a href="Big500users.html#bldg12namedb">Servers: BLDG1/BLDG2, File: named.conf, Part: B</a></dt><dt>4.17. <a href="Big500users.html#ch5-initgrps">Initialize Groups Script, File: /etc/samba/initGrps.sh</a></dt><dt>5.1. <a href="happy.html#sbehap-dbconf">LDAP DB_CONFIG File</a></dt><dt>5.2. <a href="happy.html#sbehap-slapdconf">LDAP Master Configuration File <code class="filename">/etc/openldap/slapd.conf</code> Part A</a></dt><dt>5.3. <a href="happy.html#sbehap-slapdconf2">LDAP Master Configuration File <code class="filename">/etc/openldap/slapd.conf</code> Part B</a></dt><dt>5.4. <a href="happy.html#sbehap-nss01">Configuration File for NSS LDAP Support <code class="filename">/etc/ldap.conf</code></a></dt><dt>5.5. <a href="happy.html#sbehap-nss02">Configuration File for NSS LDAP Clients Support <code class="filename">/etc/ldap.conf</code></a></dt><dt>5.6. <a href="happy.html#sbehap-massive-smbconfa">LDAP Based <code class="filename">smb.conf</code> File, Server: MASSIVE global Section: Part A</a></dt><dt>5.7. <a href="happy.html#sbehap-massive-smbconfb">LDAP Based <code class="filename">smb.conf</code> File, Server: MASSIVE global Section: Part B</a></dt><dt>5.8. <a href="happy.html#sbehap-bldg1-smbconf">LDAP Based <code class="filename">smb.conf</code> File, Server: BLDG1</a></dt><dt>5.9. <a href="happy.html#sbehap-bldg2-smbconf">LDAP Based <code class="filename">smb.conf</code> File, Server: BLDG2</a></dt><dt>5.10. <a href="happy.html#sbehap-shareconfa">LDAP Based <code class="filename">smb.conf</code> File, Shares Section Part A</a></dt><dt>5.11. <a href="happy.html#sbehap-shareconfb">LDAP Based <code class="filename">smb.conf</code> File, Shares Section Part B</a></dt><dt>5.12. <a href="happy.html#sbehap-ldifadd">LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF</a></dt><dt>6.1. <a href="2000users.html#ch7-LDAP-master">LDAP Master Server Configuration File <code class="filename">/etc/openldap/slapd.conf</code></a></dt><dt>6.2. <a href="2000users.html#ch7-LDAP-slave">LDAP Slave Configuration File <code class="filename">/etc/openldap/slapd.conf</code></a></dt><dt>6.3. <a href="2000users.html#ch7-massmbconfA">Primary Domain Controller <code class="filename">smb.conf</code> File Part A</a></dt><dt>6.4. <a href="2000users.html#ch7-massmbconfB">Primary Domain Controller <code class="filename">smb.conf</code> File Part B</a></dt><dt>6.5. <a href="2000users.html#ch7-massmbconfC">Primary Domain Controller <code class="filename">smb.conf</code> File Part C</a></dt><dt>6.6. <a href="2000users.html#ch7-slvsmbocnfA">Backup Domain Controller <code class="filename">smb.conf</code> File Part A</a></dt><dt>6.7. <a href="2000users.html#ch7-slvsmbocnfB">Backup Domain Controller <code class="filename">smb.conf</code> File Part B</a></dt><dt>7.1. <a href="unixclients.html#ch9-sdmsdc">Samba Domain Member in Samba Domain Using LDAP <code class="filename">smb.conf</code> File</a></dt><dt>7.2. <a href="unixclients.html#ch9-ldifadd">LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF</a></dt><dt>7.3. <a href="unixclients.html#ch9-sdmlcnf">Configuration File for NSS LDAP Support <code class="filename">/etc/ldap.conf</code></a></dt><dt>7.4. <a href="unixclients.html#ch9-sdmnss">NSS using LDAP for Identity Resolution File: <code class="filename">/etc/nsswitch.conf</code></a></dt><dt>7.5. <a href="unixclients.html#ch0-NT4DSDM">Samba Domain Member Server Using Winbind <code class="filename">smb.conf</code> File for NT4 Domain</a></dt><dt>7.6. <a href="unixclients.html#ch0-NT4DSCM">Samba Domain Member Server Using Local Accounts <code class="filename">smb.conf</code> File for NT4 Domain</a></dt><dt>7.7. <a href="unixclients.html#ch9-adssdm">Samba Domain Member <code class="filename">smb.conf</code> File for Active Directory Membership</a></dt><dt>7.8. <a href="unixclients.html#sbe-idmapridex">Example <code class="filename">smb.conf</code> File Using <code class="constant">idmap_rid</code></a></dt><dt>7.9. <a href="unixclients.html#sbeunxa">Typical ADS Style Domain <code class="filename">smb.conf</code> File</a></dt><dt>7.10. <a href="unixclients.html#sbewinbindex">ADS Membership Using RFC2307bis Identity Resolution <code class="filename">smb.conf</code> File</a></dt><dt>7.11. <a href="unixclients.html#ch9-pamwnbdlogin">SUSE: PAM <code class="filename">login</code> Module Using Winbind</a></dt><dt>7.12. <a href="unixclients.html#ch9-pamwbndxdm">SUSE: PAM <code class="filename">xdm</code> Module Using Winbind</a></dt><dt>7.13. <a href="unixclients.html#ch9-rhsysauth">Red Hat 9: PAM System Authentication File: <code class="filename">/etc/pam.d/system-auth</code> Module Using Winbind</a></dt><dt>9.1. <a href="ntmigration.html#sbent4smb">NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: A</a></dt><dt>9.2. <a href="ntmigration.html#sbent4smb2">NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: B</a></dt><dt>9.3. <a href="ntmigration.html#sbentslapd">NT4 Migration LDAP Server Configuration File: <code class="filename">/etc/openldap/slapd.conf</code> Part A</a></dt><dt>9.4. <a href="ntmigration.html#sbentslapd2">NT4 Migration LDAP Server Configuration File: <code class="filename">/etc/openldap/slapd.conf</code> Part B</a></dt><dt>9.5. <a href="ntmigration.html#sbrntldapconf">NT4 Migration NSS LDAP File: <code class="filename">/etc/ldap.conf</code></a></dt><dt>9.6. <a href="ntmigration.html#sbentnss">NT4 Migration NSS Control File: <code class="filename">/etc/nsswitch.conf</code> (Stage:1)</a></dt><dt>9.7. <a href="ntmigration.html#sbentnss2">NT4 Migration NSS Control File: <code class="filename">/etc/nsswitch.conf</code> (Stage:2)</a></dt><dt>10.1. <a href="nw4migration.html#sbeamg">A Rough Tool to Create an LDIF File from the System Account Files</a></dt><dt>10.2. <a href="nw4migration.html#ch8ldap">NSS LDAP Control File /etc/ldap.conf</a></dt><dt>10.3. <a href="nw4migration.html#sbepu2">The PAM Control File <code class="filename">/etc/security/pam_unix2.conf</code></a></dt><dt>10.4. <a href="nw4migration.html#ch8smbconf">Samba Configuration File smb.conf Part A</a></dt><dt>10.5. <a href="nw4migration.html#ch8smbconf2">Samba Configuration File smb.conf Part B</a></dt><dt>10.6. <a href="nw4migration.html#ch8smbconf3">Samba Configuration File smb.conf Part C</a></dt><dt>10.7. <a href="nw4migration.html#ch8smbconf4">Samba Configuration File smb.conf Part D</a></dt><dt>10.8. <a href="nw4migration.html#ch8smbconf5">Samba Configuration File smb.conf Part E</a></dt><dt>10.9. <a href="nw4migration.html#sbersync">Rsync Script</a></dt><dt>10.10. <a href="nw4migration.html#sbexcld">Rsync Files Exclusion List <code class="filename">/root/excludes.txt</code></a></dt><dt>10.11. <a href="nw4migration.html#ch8ideal">Idealx smbldap-tools Control File Part A</a></dt><dt>10.12. <a href="nw4migration.html#ch8ideal2">Idealx smbldap-tools Control File Part B</a></dt><dt>10.13. <a href="nw4migration.html#ch8ideal3">Idealx smbldap-tools Control File Part C</a></dt><dt>10.14. <a href="nw4migration.html#ch8ideal4">Idealx smbldap-tools Control File Part D</a></dt><dt>10.15. <a href="nw4migration.html#ch8kix">Kixtart Control File File: logon.kix</a></dt><dt>10.16. <a href="nw4migration.html#ch8kix2">Kixtart Control File File: main.kix</a></dt><dt>10.17. <a href="nw4migration.html#ch8kix3">Kixtart Control File File: setup.kix, Part A</a></dt><dt>10.18. <a href="nw4migration.html#ch8kix3b">Kixtart Control File File: setup.kix, Part B</a></dt><dt>10.19. <a href="nw4migration.html#ch8kix4">Kixtart Control File File: acct.kix</a></dt><dt>12.1. <a href="DomApps.html#ch10-krb5conf">Kerberos Configuration File: <code class="filename">/etc/krb5.conf</code></a></dt><dt>12.2. <a href="DomApps.html#ch10-smbconf">Samba Configuration File: <code class="filename">/etc/samba/smb.conf</code></a></dt><dt>12.3. <a href="DomApps.html#ch10-etcnsscfg">NSS Configuration File Extract File: <code class="filename">/etc/nsswitch.conf</code></a></dt><dt>12.4. <a href="DomApps.html#etcsquidcfg">Squid Configuration File Extract <code class="filename">/etc/squid.conf</code> [ADMINISTRATIVE PARAMETERS Section]</a></dt><dt>12.5. <a href="DomApps.html#etcsquid2">Squid Configuration File extract File: <code class="filename">/etc/squid.conf</code> [AUTHENTICATION PARAMETERS Section]</a></dt><dt>15.1. <a href="appendix.html#ch12SL">A Useful Samba Control Script for SUSE Linux</a></dt><dt>15.2. <a href="appendix.html#ch12RHscript">A Sample Samba Control Script for Red Hat Linux</a></dt><dt>15.3. <a href="appendix.html#loopback">DNS Localhost Forward Zone File: <code class="filename">/var/lib/named/localhost.zone</code></a></dt><dt>15.4. <a href="appendix.html#dnsloopy">DNS Localhost Reverse Zone File: <code class="filename">/var/lib/named/127.0.0.zone</code></a></dt><dt>15.5. <a href="appendix.html#roothint">DNS Root Name Server Hint File: <code class="filename">/var/lib/named/root.hint</code></a></dt><dt>15.6. <a href="appendix.html#sbehap-ldapreconfa">LDAP Pre-configuration Script: <code class="filename">SMBLDAP-ldif-preconfig.sh</code> Part A</a></dt><dt>15.7. <a href="appendix.html#sbehap-ldapreconfb">LDAP Pre-configuration Script: <code class="filename">SMBLDAP-ldif-preconfig.sh</code> Part B</a></dt><dt>15.8. <a href="appendix.html#sbehap-ldapreconfc">LDAP Pre-configuration Script: <code class="filename">SMBLDAP-ldif-preconfig.sh</code> Part C</a></dt><dt>15.9. <a href="appendix.html#sbehap-ldifpata">LDIF Pattern File Used to Pre-configure LDAP Part A</a></dt><dt>15.10. <a href="appendix.html#sbehap-ldifpatb">LDIF Pattern File Used to Pre-configure LDAP Part B</a></dt><dt>15.11. <a href="appendix.html#lamcfg">Example LAM Configuration File <code class="filename">config.cfg</code></a></dt><dt>15.12. <a href="appendix.html#lamconf">LAM Profile Control File <code class="filename">lam.conf</code></a></dt></dl></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="pr01.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top"> </td><td width="20%" align="center"> </td><td width="40%" align="right" valign="top"> About the Cover Artwork</td></tr></table></div></body></html> -
branches/samba-3.2.x/docs/htmldocs/Samba3-ByExample/ix01.html
r204 r226 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Index</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="go01.html" title="Glossary"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Index</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="go01.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> </td></tr></table><hr></div><div class="index"><div class="titlepage"><div><div><h2 class="title"><a name="id262395 8"></a>Index</h2></div></div></div><div class="index"><div class="indexdiv"><h3>Symbols</h3><dl><dt>%LOGONSERVER%, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>%USERNAME%, <a class="indexterm" href="happy.html#id2565500">Roaming Profile Background</a>, <a class="indexterm" href="happy.html#id2565800">Profile Changes</a></dt><dt>%USERPROFILE%, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>/data/ldap, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>/etc/cups/mime.convs, <a class="indexterm" href="simple.html#id2544190">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a></dt><dt>/etc/cups/mime.types, <a class="indexterm" href="simple.html#id2544190">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a></dt><dt>/etc/dhcpd.conf, <a class="indexterm" href="small.html#id2548369">Implementation</a>, <a class="indexterm" href="small.html#id2550069">Validation</a>, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>/etc/exports, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></dt><dt>/etc/group, <a class="indexterm" href="happy.html#id2564988">Technical Issues</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="upgrades.html#id2593865">Replacing a Domain Member Server</a>, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a>, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>/etc/hosts, <a class="indexterm" href="simple.html#id2543220">Implementation</a>, <a class="indexterm" href="small.html#id2548369">Implementation</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="Big500users.html#id2559494">Server Preparation: All Servers</a>, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a>, <a class="indexterm" href="DomApps.html#id2609852">Kerberos Configuration</a>, <a class="indexterm" href="HA.html#id2612632">Bad Hostnames</a></dt><dt>/etc/krb5.conf, <a class="indexterm" href="unixclients.html#id2588512">IDMAP Storage in LDAP using Winbind</a>, <a class="indexterm" href="DomApps.html#id2609852">Kerberos Configuration</a></dt><dt>/etc/ldap.conf, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="unixclients.html#id2588512">IDMAP Storage in LDAP using Winbind</a>, <a class="indexterm" href="unixclients.html#id2589106">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a class="indexterm" href="ntmigration.html#id2595255">NT4 Migration Using LDAP Backend</a>, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a></dt><dt>/etc/mime.convs, <a class="indexterm" href="small.html#id2548369">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id2559494">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>/etc/mime.types, <a class="indexterm" href="small.html#id2548369">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id2559494">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>/etc/named.conf, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></dt><dt>/etc/nsswitch.conf, <a class="indexterm" href="small.html#id2548369">Implementation</a>, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="Big500users.html#id2560072">Configuration for Server: MASSIVE</a>, <a class="indexterm" href="Big500users.html#ch5-domsvrspec">Configuration Specific to Domain Member Servers: BLDG1, BLDG2</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#id2587908">IDMAP_RID with Winbind</a>, <a class="indexterm" href="unixclients.html#id2589106">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id2595255">NT4 Migration Using LDAP Backend</a></dt><dt>/etc/openldap/slapd.conf, <a class="indexterm" href="happy.html#id2566377">Debugging LDAP</a>, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a>, <a class="indexterm" href="2000users.html#id2578207">Implementation</a></dt><dt>/etc/passwd, <a class="indexterm" href="small.html#id2548369">Implementation</a>, <a class="indexterm" href="secure.html#id2553134">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2560072">Configuration for Server: MASSIVE</a>, <a class="indexterm" href="happy.html#id2569962">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id2593865">Replacing a Domain Member Server</a>, <a class="indexterm" href="ntmigration.html#id2594765">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id2599440">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2607372">Share Point Directory and File Permissions</a>, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a class="indexterm" href="primer.html#id2620355">Findings and Comments</a></dt><dt>/etc/rc.d/boot.local, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="Big500users.html#id2560072">Configuration for Server: MASSIVE</a></dt><dt>/etc/rc.d/rc.local, <a class="indexterm" href="small.html#id2548369">Implementation</a></dt><dt>/etc/resolv.conf, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a>, <a class="indexterm" href="Big500users.html#id2559494">Server Preparation: All Servers</a></dt><dt>/etc/samba, <a class="indexterm" href="appendix.html#id2615028">Samba System File Location</a></dt><dt>/etc/samba/secrets.tdb, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>/etc/samba/smbusers, <a class="indexterm" href="Big500users.html#id2559494">Server Preparation: All Servers</a></dt><dt>/etc/shadow, <a class="indexterm" href="upgrades.html#id2593865">Replacing a Domain Member Server</a>, <a class="indexterm" href="nw4migration.html#id2599440">Technical Issues</a></dt><dt>/etc/squid/squid.conf, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>/etc/syslog.conf, <a class="indexterm" href="happy.html#id2566377">Debugging LDAP</a></dt><dt>/etc/xinetd.d, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a>, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dt>/lib/libnss_ldap.so.2, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dt>/opt/IDEALX/sbin, <a class="indexterm" href="ntmigration.html#id2595255">NT4 Migration Using LDAP Backend</a></dt><dt>/proc/sys/net/ipv4/ip_forward, <a class="indexterm" href="small.html#id2548369">Implementation</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a></dt><dt>/usr/bin, <a class="indexterm" href="appendix.html#id2615028">Samba System File Location</a></dt><dt>/usr/lib/samba, <a class="indexterm" href="appendix.html#id2615028">Samba System File Location</a></dt><dt>/usr/local, <a class="indexterm" href="appendix.html#id2615028">Samba System File Location</a></dt><dt>/usr/local/samba, <a class="indexterm" href="appendix.html#id2615028">Samba System File Location</a></dt><dt>/usr/local/samba/var/locks, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></dt><dt>/usr/sbin, <a class="indexterm" href="appendix.html#id2615028">Samba System File Location</a></dt><dt>/usr/share, <a class="indexterm" href="appendix.html#id2615028">Samba System File Location</a></dt><dt>/usr/share/samba/swat, <a class="indexterm" href="appendix.html#id2615028">Samba System File Location</a></dt><dt>/usr/share/swat, <a class="indexterm" href="appendix.html#id2615028">Samba System File Location</a></dt><dt>/var/cache/samba, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></dt><dt>/var/lib/samba, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="appendix.html#id2615028">Samba System File Location</a></dt><dt>/var/log/ldaplogs, <a class="indexterm" href="happy.html#id2566377">Debugging LDAP</a></dt><dt>/var/log/samba, <a class="indexterm" href="appendix.html#id2615028">Samba System File Location</a></dt><dt>8-bit, <a class="indexterm" href="upgrades.html#id2592490">International Language Support</a></dt></dl></div><div class="indexdiv"><h3></h3><dl><dt>, <a class="indexterm" href="simple.html#id2543220">Implementation</a>, <a class="indexterm" href="simple.html#id2544190">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id2548369">Implementation</a>, <a class="indexterm" href="secure.html#id2553134">Samba Configuration</a>, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a>, <a class="indexterm" href="Big500users.html#id2558764">Implementation</a>, <a class="indexterm" href="happy.html#sbehap-ppc">Addition of Machines to the Domain</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a class="indexterm" href="2000users.html#id2578207">Implementation</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id2587908">IDMAP_RID with Winbind</a>, <a class="indexterm" href="unixclients.html#id2588512">IDMAP Storage in LDAP using Winbind</a>, <a class="indexterm" href="unixclients.html#id2589106">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a class="indexterm" href="upgrades.html#sbeug1">Location of config files</a>, <a class="indexterm" href="ntmigration.html#id2595255">NT4 Migration Using LDAP Backend</a>, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a>, <a class="indexterm" href="DomApps.html#id2610793">NSS Configuration</a></dt><dd><dl><dt>Domain account, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>liability, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a></dt><dt>logon, <a class="indexterm" href="simple.html#id2544190">Implementation</a></dt><dt>problem, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a></dt><dt>transparent inter-operability, <a class="indexterm" href="DomApps.html#id2611515">Questions and Answers</a></dt></dl></dd></dl></div><div class="indexdiv"><h3>A</h3><dl><dt>abmas-netfw.sh, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a></dt><dt>accept, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a></dt><dt>accepts liability, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a></dt><dt>access, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2606898">Checkpoint Controls</a></dt><dt>access control, <a class="indexterm" href="kerberos.html#id2606064">Kerberos Exposed</a>, <a class="indexterm" href="kerberos.html#id2607829">Using the MMC Computer Management Interface</a></dt><dt>Access Control Lists (see ACLs)</dt><dt>access control settings, <a class="indexterm" href="kerberos.html#id2606410">Share Access Controls</a></dt><dt>access controls, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2606759">Share Definition Controls</a></dt><dt>accessible, <a class="indexterm" href="kerberos.html#id2607372">Share Point Directory and File Permissions</a></dt><dt>account, <a class="indexterm" href="happy.html#id2564154">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="kerberos.html#id2606410">Share Access Controls</a></dt><dd><dl><dt>ADS Domain, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt></dl></dd><dt>account credentials, <a class="indexterm" href="primer.html#id2620355">Findings and Comments</a></dt><dt>account information, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a></dt><dt>account names, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a></dt><dt>account policies, <a class="indexterm" href="appendix.html#id2616632">The LDAP Account Manager</a></dt><dt>accountable, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a>, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a></dt><dt>accounts</dt><dd><dl><dt>authoritative, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a></dt><dt>Domain, <a class="indexterm" href="ntmigration.html#id2594439">Introduction</a>, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a></dt><dt>group, <a class="indexterm" href="ntmigration.html#id2594439">Introduction</a>, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a></dt><dt>machine, <a class="indexterm" href="ntmigration.html#id2594439">Introduction</a>, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a></dt><dt>manage, <a class="indexterm" href="appendix.html#id2616632">The LDAP Account Manager</a></dt><dt>user, <a class="indexterm" href="ntmigration.html#id2594439">Introduction</a>, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a></dt></dl></dd><dt>ACL, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a>, <a class="indexterm" href="kerberos.html#id2606898">Checkpoint Controls</a></dt><dt>ACLs, <a class="indexterm" href="happy.html#id2576337">Key Points Learned</a>, <a class="indexterm" href="kerberos.html#id2606410">Share Access Controls</a>, <a class="indexterm" href="kerberos.html#id2606759">Share Definition Controls</a></dt><dt>acquisitions, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a></dt><dt>Act!, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>ACT! database, <a class="indexterm" href="appendix.html#id2618256">Act! Database Sharing</a></dt><dt>Act!Diag, <a class="indexterm" href="appendix.html#id2618256">Act! Database Sharing</a></dt><dt>Active Directory, <a class="indexterm" href="happy.html#id2564531">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#sbehap-locgrppol">The Local Group Policy</a>, <a class="indexterm" href="2000users.html#id2576972">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#id2582424">Assignment Tasks</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id2587908">IDMAP_RID with Winbind</a>, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a>, <a class="indexterm" href="kerberos.html#id2608502">Key Points Learned</a>, <a class="indexterm" href="kerberos.html#id2608636">Questions and Answers</a>, <a class="indexterm" href="DomApps.html">Integrating Additional Services</a>, <a class="indexterm" href="DomApps.html#id2609296">Assignment Tasks</a>, <a class="indexterm" href="DomApps.html#id2609429">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id2610240">Samba Configuration</a>, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dd><dl><dt>authentication, <a class="indexterm" href="DomApps.html#id2611058">Squid Configuration</a></dt><dt>domain, <a class="indexterm" href="DomApps.html#id2610240">Samba Configuration</a></dt><dt>join, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>management tools, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>realm, <a class="indexterm" href="HA.html#id2612632">Bad Hostnames</a></dt><dt>Replacement, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>server, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id2609852">Kerberos Configuration</a></dt><dt>Server, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>tree, <a class="indexterm" href="DomApps.html#id2610240">Samba Configuration</a></dt></dl></dd><dt>active directory, <a class="indexterm" href="ntmigration.html#id2594765">Technical Issues</a></dt><dt>AD printer publishing, <a class="indexterm" href="happy.html#id2575764">Uploading Printer Drivers to Samba Servers</a></dt><dt>ADAM, <a class="indexterm" href="happy.html#id2564531">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#id2588512">IDMAP Storage in LDAP using Winbind</a></dt><dt>add group script, <a class="indexterm" href="upgrades.html#id2593024">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>add machine script, <a class="indexterm" href="upgrades.html#id2593024">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>Add Printer Wizard</dt><dd><dl><dt>APW, <a class="indexterm" href="happy.html#id2575764">Uploading Printer Drivers to Samba Servers</a></dt></dl></dd><dt>add user script, <a class="indexterm" href="upgrades.html#id2593024">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>add user to group script, <a class="indexterm" href="upgrades.html#id2593024">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>adduser, <a class="indexterm" href="small.html#id2548369">Implementation</a>, <a class="indexterm" href="secure.html#id2553134">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2560072">Configuration for Server: MASSIVE</a></dt><dt>adequate precautions, <a class="indexterm" href="upgrades.html#id2591231">Introduction</a></dt><dt>administrative installation, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a></dt><dt>administrative rights, <a class="indexterm" href="kerberos.html#id2606898">Checkpoint Controls</a></dt><dt>administrator, <a class="indexterm" href="small.html#id2548369">Implementation</a>, <a class="indexterm" href="secure.html#id2553134">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2559494">Server Preparation: All Servers</a></dt><dt>ADMT, <a class="indexterm" href="upgrades.html#id2594268">Migration of Samba Accounts to Active Directory</a></dt><dt>ADS, <a class="indexterm" href="unixclients.html#id2588512">IDMAP Storage in LDAP using Winbind</a>, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id2609852">Kerberos Configuration</a>, <a class="indexterm" href="HA.html#id2612632">Bad Hostnames</a></dt><dd><dl><dt>server, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt></dl></dd><dt>ADS Domain, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>affordability, <a class="indexterm" href="2000users.html#id2577378">The Nature of Windows Networking Protocols</a></dt><dt>alarm, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a></dt><dt>algorithm, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>allow trusted domains, <a class="indexterm" href="unixclients.html#id2587908">IDMAP_RID with Winbind</a></dt><dt>alternative, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a></dt><dt>analysis, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>anonymous connection, <a class="indexterm" href="small.html#id2550069">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>Apache Web server, <a class="indexterm" href="DomApps.html#id2611515">Questions and Answers</a></dt><dt>appliance mode, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a></dt><dt>application server, <a class="indexterm" href="secure.html#id2551704">Technical Issues</a>, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a></dt><dt>application servers, <a class="indexterm" href="2000users.html#id2577378">The Nature of Windows Networking Protocols</a></dt><dt>application/octet-stream, <a class="indexterm" href="simple.html#id2544190">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id2548369">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id2559494">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>APW, <a class="indexterm" href="happy.html#id2575764">Uploading Printer Drivers to Samba Servers</a></dt><dt>arp, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>assessment, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a></dt><dt>assistance, <a class="indexterm" href="ch14.html#id2614102">Free Support</a></dt><dt>assumptions, <a class="indexterm" href="HA.html#id2613932">Key Points Learned</a></dt><dt>authconfig, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dt>authenticate, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a>, <a class="indexterm" href="DomApps.html#id2610240">Samba Configuration</a></dt><dt>authenticated, <a class="indexterm" href="DomApps.html#id2609296">Assignment Tasks</a></dt><dt>authenticated connection, <a class="indexterm" href="small.html#id2550069">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>authentication, <a class="indexterm" href="2000users.html#id2577378">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id2599364">Dissection and Discussion</a>, <a class="indexterm" href="DomApps.html">Integrating Additional Services</a>, <a class="indexterm" href="DomApps.html#id2609429">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id2610793">NSS Configuration</a>, <a class="indexterm" href="DomApps.html#id2611515">Questions and Answers</a></dt><dd><dl><dt>plain-text, <a class="indexterm" href="DomApps.html#id2611515">Questions and Answers</a></dt></dl></dd><dt>authentication process, <a class="indexterm" href="unixclients.html#id2583237">Implementation</a></dt><dt>authentication protocols, <a class="indexterm" href="DomApps.html#id2611455">Key Points Learned</a></dt><dt>authoritative, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a></dt><dt>authorized location, <a class="indexterm" href="kerberos.html#id2606064">Kerberos Exposed</a></dt><dt>auto-generated SID, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a></dt><dt>automatically allocate, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a></dt><dt>availability, <a class="indexterm" href="HA.html">Performance, Reliability, and Availability</a></dt></dl></div><div class="indexdiv"><h3>B</h3><dl><dt>backends, <a class="indexterm" href="DomApps.html">Integrating Additional Services</a></dt><dt>background communication, <a class="indexterm" href="2000users.html#id2581512">Questions and Answers</a></dt><dt>Backup, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a></dt><dt>Backup Domain Controller (see BDC)</dt><dt>bandwidth, <a class="indexterm" href="DomApps.html#id2609296">Assignment Tasks</a></dt><dd><dl><dt>requirements, <a class="indexterm" href="2000users.html#id2577284">User Needs</a></dt></dl></dd><dt>bandwidth calculations, <a class="indexterm" href="secure.html#id2551990">Hardware Requirements</a></dt><dt>BDC, <a class="indexterm" href="Big500users.html#id2558539">Technical Issues</a>, <a class="indexterm" href="happy.html">Making Happy Users</a>, <a class="indexterm" href="happy.html#id2564394">Assignment Tasks</a>, <a class="indexterm" href="happy.html#id2564531">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#id2567062">Samba Server Implementation</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="2000users.html#id2577378">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="2000users.html#id2581365">Key Points Learned</a>, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a>, <a class="indexterm" href="ntmigration.html#id2597714">NT4 Migration Using tdbsam Backend</a>, <a class="indexterm" href="HA.html#id2613424">Use and Location of BDCs</a></dt><dt>benefit, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a></dt><dt>best practices, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a></dt><dt>bias, <a class="indexterm" href="kerberos.html#id2608636">Questions and Answers</a></dt><dt>binary database, <a class="indexterm" href="secure.html#id2552197">Implementation</a></dt><dt>binary files, <a class="indexterm" href="upgrades.html#id2593539">Updating a Samba-3 Installation</a></dt><dt>binary package, <a class="indexterm" href="upgrades.html#id2593539">Updating a Samba-3 Installation</a></dt><dt>bind interfaces only, <a class="indexterm" href="secure.html#id2552197">Implementation</a></dt><dt>broadcast, <a class="indexterm" href="HA.html#id2612824">Routed Networks</a>, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dd><dl><dt>directed, <a class="indexterm" href="2000users.html#id2577378">The Nature of Windows Networking Protocols</a></dt><dt>mailslot, <a class="indexterm" href="2000users.html#id2577378">The Nature of Windows Networking Protocols</a></dt></dl></dd><dt>broadcast messages, <a class="indexterm" href="secure.html#id2552197">Implementation</a></dt><dt>broadcast storms, <a class="indexterm" href="HA.html#id2612997">Network Collisions</a></dt><dt>broken, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a></dt><dt>broken behavior, <a class="indexterm" href="HA.html#id2612122">Dissection and Discussion</a></dt><dt>browse, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>browse master, <a class="indexterm" href="primer.html#id2619106">Findings</a></dt><dt>Browse Master, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dt>browse.dat, <a class="indexterm" href="upgrades.html#id2593865">Replacing a Domain Member Server</a></dt><dt>Browser Election Service, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dt>browsing, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id2609429">Technical Issues</a>, <a class="indexterm" href="primer.html#id2618729">Assignment Tasks</a></dt><dt>budgetted, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a></dt><dt>bug fixes, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a></dt><dt>bug report, <a class="indexterm" href="ch14.html#id2614102">Free Support</a></dt></dl></div><div class="indexdiv"><h3>C</h3><dl><dt>cache, <a class="indexterm" href="appendix.html#id2618341">Opportunistic Locking Controls</a></dt><dt>cache directories, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>caching, <a class="indexterm" href="HA.html#id2613096">Samba Configuration</a></dt><dt>case-sensitive, <a class="indexterm" href="DomApps.html#id2609852">Kerberos Configuration</a></dt><dt>centralized storage, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a></dt><dt>character set, <a class="indexterm" href="upgrades.html#id2592490">International Language Support</a></dt><dt>check samba daemons, <a class="indexterm" href="small.html#id2550069">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>check-point, <a class="indexterm" href="kerberos.html#id2606759">Share Definition Controls</a></dt><dt>check-point controls, <a class="indexterm" href="kerberos.html#id2606898">Checkpoint Controls</a></dt><dt>Checkpoint Controls, <a class="indexterm" href="kerberos.html#id2606898">Checkpoint Controls</a></dt><dt>chgrp, <a class="indexterm" href="DomApps.html#id2610240">Samba Configuration</a></dt><dt>chkconfig, <a class="indexterm" href="simple.html#id2543220">Implementation</a>, <a class="indexterm" href="simple.html#id2544190">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id2548369">Implementation</a>, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a>, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a>, <a class="indexterm" href="2000users.html#id2578207">Implementation</a></dt><dt>chmod, <a class="indexterm" href="DomApps.html#id2610240">Samba Configuration</a></dt><dt>choice, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>chown, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>CIFS, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a>, <a class="indexterm" href="primer.html#id2619106">Findings</a></dt><dt>cifsfs, <a class="indexterm" href="HA.html#id2612122">Dissection and Discussion</a></dt><dt>clean database, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a></dt><dt>clients per DC, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>Clock skew, <a class="indexterm" href="DomApps.html#id2609852">Kerberos Configuration</a></dt><dt>cluster, <a class="indexterm" href="HA.html#id2612034">Introduction</a></dt><dt>clustering, <a class="indexterm" href="HA.html#id2612034">Introduction</a>, <a class="indexterm" href="HA.html#id2613521">For Scalability, Use SAN-Based Storage on Samba Servers</a></dt><dt>code maintainer, <a class="indexterm" href="ch14.html#id2614102">Free Support</a></dt><dt>codepage, <a class="indexterm" href="upgrades.html#id2592490">International Language Support</a></dt><dt>collision rates, <a class="indexterm" href="HA.html#id2612997">Network Collisions</a></dt><dt>commercial, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a></dt><dt>commercial software, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a></dt><dt>commercial support, <a class="indexterm" href="ch14.html">Samba Support</a>, <a class="indexterm" href="ch14.html#id2614320">Commercial Support</a></dt><dt>Common Internet File System (see CIFS)</dt><dt>comparison</dt><dd><dl><dt>Active Directory & OpenLDAP, <a class="indexterm" href="happy.html#id2564531">Dissection and Discussion</a></dt></dl></dd><dt>compat, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>compatible, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>compile-time, <a class="indexterm" href="upgrades.html#sbeug1">Location of config files</a></dt><dt>complexities, <a class="indexterm" href="HA.html#id2612122">Dissection and Discussion</a></dt><dt>compromise, <a class="indexterm" href="happy.html#id2564296">Introduction</a>, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a>, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>computer account, <a class="indexterm" href="DomApps.html#id2610240">Samba Configuration</a></dt><dt>Computer Management, <a class="indexterm" href="kerberos.html#id2606410">Share Access Controls</a>, <a class="indexterm" href="kerberos.html#id2608636">Questions and Answers</a></dt><dt>computer name, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a></dt><dt>condemns, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>conferences, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>configuration files, <a class="indexterm" href="upgrades.html#id2591231">Introduction</a></dt><dt>configure.pl, <a class="indexterm" href="ntmigration.html#id2595255">NT4 Migration Using LDAP Backend</a></dt><dt>connection, <a class="indexterm" href="kerberos.html#id2606410">Share Access Controls</a></dt><dt>connectivity, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a></dt><dt>consequential risk, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>consultant, <a class="indexterm" href="simple.html#id2543078">Drafting Office</a>, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a>, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a></dt><dt>consumer, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>consumer expects, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>contiguous directory, <a class="indexterm" href="2000users.html#id2578207">Implementation</a></dt><dt>contributions, <a class="indexterm" href="upgrades.html">Updating Samba-3</a></dt><dt>control files, <a class="indexterm" href="upgrades.html#id2593539">Updating a Samba-3 Installation</a></dt><dt>convmv, <a class="indexterm" href="upgrades.html#id2592490">International Language Support</a></dt><dt>copy, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a></dt><dt>corrective action, <a class="indexterm" href="HA.html#id2613671">Hardware Problems</a></dt><dt>cost, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a></dt><dt>cost-benefit, <a class="indexterm" href="nw4migration.html#id2599251">Assignment Tasks</a></dt><dt>country of origin, <a class="indexterm" href="ch14.html#id2614320">Commercial Support</a></dt><dt>Courier-IMAP, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a></dt><dt>credential, <a class="indexterm" href="kerberos.html#id2606759">Share Definition Controls</a></dt><dt>credentials, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>crippled, <a class="indexterm" href="ntmigration.html#id2594579">Dissection and Discussion</a></dt><dt>criticism, <a class="indexterm" href="kerberos.html">Active Directory, Kerberos, and Security</a>, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a></dt><dt>Critics, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>Cryptographic, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>CUPS, <a class="indexterm" href="simple.html#id2543979">Dissection and Discussion</a>, <a class="indexterm" href="small.html#id2548136">Technical Issues</a>, <a class="indexterm" href="small.html#id2548369">Implementation</a>, <a class="indexterm" href="small.html#id2550800">Key Points Learned</a>, <a class="indexterm" href="secure.html#id2552197">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id2559494">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#id2564394">Assignment Tasks</a>, <a class="indexterm" href="happy.html#id2565953">Installation of Printer Driver Auto-Download</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dd><dl><dt>queue, <a class="indexterm" href="small.html#id2548369">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id2559494">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt></dl></dd><dt>cupsd, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a></dt><dt>customer expected, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>customers, <a class="indexterm" href="ch14.html">Samba Support</a></dt></dl></div><div class="indexdiv"><h3>D</h3><dl><dt>daemon, <a class="indexterm" href="simple.html#validate1">Validation</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a>, <a class="indexterm" href="DomApps.html#id2609429">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id2611515">Questions and Answers</a>, <a class="indexterm" href="appendix.html#id2615448">Starting Samba</a></dt><dt>daemon control, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dt>data</dt><dd><dl><dt>corruption, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>integrity, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a></dt></dl></dd><dt>data corruption, <a class="indexterm" href="HA.html#id2613671">Hardware Problems</a>, <a class="indexterm" href="appendix.html#id2618256">Act! Database Sharing</a></dt><dt>data integrity, <a class="indexterm" href="HA.html#id2613671">Hardware Problems</a>, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>data storage, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a></dt><dt>database, <a class="indexterm" href="2000users.html#id2576972">Dissection and Discussion</a>, <a class="indexterm" href="2000users.html#id2581512">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id2599364">Dissection and Discussion</a></dt><dt>database applications, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>DB_CONFIG, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>DCE, <a class="indexterm" href="kerberos.html#id2606064">Kerberos Exposed</a></dt><dt>DDNS (see dynamic DNS)</dt><dt>Debian, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>default installation, <a class="indexterm" href="appendix.html#id2615028">Samba System File Location</a></dt><dt>default password, <a class="indexterm" href="appendix.html#id2616632">The LDAP Account Manager</a></dt><dt>default profile, <a class="indexterm" href="happy.html#id2564394">Assignment Tasks</a>, <a class="indexterm" href="happy.html#id2564988">Technical Issues</a></dt><dt>Default User, <a class="indexterm" href="happy.html#id2565800">Profile Changes</a>, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>defective</dt><dd><dl><dt>cables, <a class="indexterm" href="HA.html#id2613671">Hardware Problems</a></dt><dt>HUBs, <a class="indexterm" href="HA.html#id2613671">Hardware Problems</a></dt><dt>switches, <a class="indexterm" href="HA.html#id2613671">Hardware Problems</a></dt></dl></dd><dt>defects, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>defensible standards, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>defragmentation, <a class="indexterm" href="secure.html#ch4wincfg">Windows Client Configuration</a></dt><dt>delete group script, <a class="indexterm" href="upgrades.html#id2593024">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>delete user from group script, <a class="indexterm" href="upgrades.html#id2593024">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>delimiter, <a class="indexterm" href="kerberos.html#id2606898">Checkpoint Controls</a></dt><dt>dependability, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>deployment, <a class="indexterm" href="ch14.html#id2614102">Free Support</a></dt><dt>desired security setting, <a class="indexterm" href="kerberos.html#id2608291">Setting Posix ACLs in UNIX/Linux</a></dt><dt>development, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>DHCP, <a class="indexterm" href="small.html#id2548136">Technical Issues</a>, <a class="indexterm" href="small.html#id2548369">Implementation</a>, <a class="indexterm" href="small.html#id2550800">Key Points Learned</a>, <a class="indexterm" href="secure.html#ch4wincfg">Windows Client Configuration</a>, <a class="indexterm" href="Big500users.html#ch5wincfg">Windows Client Configuration</a>, <a class="indexterm" href="2000users.html#id2577378">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="2000users.html#id2581512">Questions and Answers</a></dt><dd><dl><dt>client, <a class="indexterm" href="HA.html#id2612632">Bad Hostnames</a></dt><dt>relay, <a class="indexterm" href="Big500users.html#id2558539">Technical Issues</a></dt><dt>Relay Agent, <a class="indexterm" href="2000users.html#id2581512">Questions and Answers</a></dt><dt>request, <a class="indexterm" href="2000users.html#id2581512">Questions and Answers</a></dt><dt>requests, <a class="indexterm" href="Big500users.html#id2558539">Technical Issues</a></dt><dt>servers, <a class="indexterm" href="2000users.html#id2581512">Questions and Answers</a></dt><dt>traffic, <a class="indexterm" href="2000users.html#id2581512">Questions and Answers</a></dt></dl></dd><dt>dhcp client validation, <a class="indexterm" href="small.html#id2550069">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>DHCP Server, <a class="indexterm" href="small.html#id2548369">Implementation</a></dt><dt>DHCP server, <a class="indexterm" href="secure.html#id2551704">Technical Issues</a></dt><dt>diagnostic, <a class="indexterm" href="unixclients.html#id2588512">IDMAP Storage in LDAP using Winbind</a></dt><dt>diffusion, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>digital rights, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>digital sign'n'seal, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>digits, <a class="indexterm" href="HA.html#id2612632">Bad Hostnames</a></dt><dt>diligence, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>directory, <a class="indexterm" href="2000users.html#id2576972">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#id2583136">Political Issues</a>, <a class="indexterm" href="upgrades.html#sbeug1">Location of config files</a></dt><dd><dl><dt>Computers container, <a class="indexterm" href="happy.html#id2569962">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>management, <a class="indexterm" href="happy.html#id2564531">Dissection and Discussion</a></dt><dt>People container, <a class="indexterm" href="happy.html#id2569962">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>replication, <a class="indexterm" href="happy.html#id2564531">Dissection and Discussion</a></dt><dt>schema, <a class="indexterm" href="happy.html#id2564531">Dissection and Discussion</a></dt><dt>server, <a class="indexterm" href="happy.html#id2564988">Technical Issues</a></dt><dt>synchronization, <a class="indexterm" href="happy.html#id2564531">Dissection and Discussion</a></dt></dl></dd><dt>directory tree, <a class="indexterm" href="kerberos.html#id2608291">Setting Posix ACLs in UNIX/Linux</a></dt><dt>disable, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a></dt><dt>disaster recovery, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a></dt><dt>disk image, <a class="indexterm" href="happy.html#id2564394">Assignment Tasks</a></dt><dt>disruptive, <a class="indexterm" href="ntmigration.html#id2594579">Dissection and Discussion</a></dt><dt>distributed, <a class="indexterm" href="2000users.html#id2577725">Identity Management Needs</a>, <a class="indexterm" href="2000users.html#id2578207">Implementation</a>, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a>, <a class="indexterm" href="HA.html#id2613570">Distribute Network Load with MSDFS</a></dt><dt>distributed domain, <a class="indexterm" href="2000users.html#id2577725">Identity Management Needs</a></dt><dt>DMB, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dt>DMS, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id2593865">Replacing a Domain Member Server</a></dt><dt>DNS, <a class="indexterm" href="small.html#id2548136">Technical Issues</a>, <a class="indexterm" href="small.html#id2548369">Implementation</a>, <a class="indexterm" href="secure.html#id2551704">Technical Issues</a>, <a class="indexterm" href="2000users.html#id2577378">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a>, <a class="indexterm" href="HA.html#id2612632">Bad Hostnames</a>, <a class="indexterm" href="HA.html#id2612824">Routed Networks</a>, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dd><dl><dt>configuration, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a></dt><dt>Dynamic, <a class="indexterm" href="2000users.html#id2581512">Questions and Answers</a></dt><dt>dynamic, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dt>lookup, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a>, <a class="indexterm" href="DomApps.html#id2609852">Kerberos Configuration</a></dt><dt>name lookup, <a class="indexterm" href="HA.html#id2612632">Bad Hostnames</a></dt><dt>SRV records, <a class="indexterm" href="DomApps.html#id2609852">Kerberos Configuration</a></dt><dt>suffix, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt></dl></dd><dt>DNS server, <a class="indexterm" href="small.html#id2548369">Implementation</a>, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></dt><dt>document the settings, <a class="indexterm" href="HA.html#id2613096">Samba Configuration</a></dt><dt>documentation, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>documented, <a class="indexterm" href="HA.html#id2613096">Samba Configuration</a></dt><dt>Domain, <a class="indexterm" href="small.html#id2548136">Technical Issues</a></dt><dd><dl><dt>groups, <a class="indexterm" href="small.html#id2548136">Technical Issues</a></dt></dl></dd><dt>domain</dt><dd><dl><dt>Active Directory, <a class="indexterm" href="DomApps.html#id2609429">Technical Issues</a></dt><dt>controller, <a class="indexterm" href="upgrades.html#id2594067">Replacing a Domain Controller</a></dt><dt>joining, <a class="indexterm" href="appendix.html">A Collection of Useful Tidbits</a></dt><dt>trusted, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a></dt></dl></dd><dt>Domain accounts, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a></dt><dt>Domain Administrator, <a class="indexterm" href="kerberos.html#id2606410">Share Access Controls</a></dt><dt>Domain Controller, <a class="indexterm" href="small.html#id2550800">Key Points Learned</a>, <a class="indexterm" href="2000users.html#id2577378">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2583237">Implementation</a>, <a class="indexterm" href="HA.html#id2613424">Use and Location of BDCs</a></dt><dd><dl><dt>closest, <a class="indexterm" href="2000users.html#id2577378">The Nature of Windows Networking Protocols</a></dt></dl></dd><dt>domain controller, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id2593024">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>domain controllers, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a></dt><dt>Domain Controllers, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a></dt><dt>Domain Groups</dt><dd><dl><dt>well-known, <a class="indexterm" href="appendix.html#id2616053">Initialization of the LDAP Database</a></dt></dl></dd><dt>Domain join, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>domain master, <a class="indexterm" href="ntmigration.html#id2595255">NT4 Migration Using LDAP Backend</a>, <a class="indexterm" href="ntmigration.html#id2597714">NT4 Migration Using tdbsam Backend</a></dt><dt>Domain Master Browser (see DMB)</dt><dt>Domain Member, <a class="indexterm" href="HA.html#id2613424">Use and Location of BDCs</a></dt><dd><dl><dt>authoritative</dt><dd><dl><dt>local accounts, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a></dt></dl></dd><dt>client, <a class="indexterm" href="unixclients.html#id2583237">Implementation</a></dt><dt>desktop, <a class="indexterm" href="unixclients.html#id2582370">Introduction</a></dt><dt>server, <a class="indexterm" href="unixclients.html#id2582370">Introduction</a>, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2583237">Implementation</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>servers, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2606898">Checkpoint Controls</a></dt><dt>workstations, <a class="indexterm" href="unixclients.html#id2583237">Implementation</a></dt></dl></dd><dt>domain member</dt><dd><dl><dt>servers, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a></dt></dl></dd><dt>Domain Member server, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2608636">Questions and Answers</a></dt><dt>Domain Member servers, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a></dt><dt>domain members, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a></dt><dt>domain name space, <a class="indexterm" href="2000users.html#id2577725">Identity Management Needs</a></dt><dt>domain replication, <a class="indexterm" href="2000users.html#id2581512">Questions and Answers</a></dt><dt>domain SID, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a></dt><dt>Domain SID, <a class="indexterm" href="ntmigration.html#id2594765">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a></dt><dt>domain tree, <a class="indexterm" href="2000users.html#id2577725">Identity Management Needs</a></dt><dt>Domain User Manager, <a class="indexterm" href="happy.html#id2574027">Configuring Profile Directories</a></dt><dt>Domain users, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>DOS, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a></dt><dt>dos2unix, <a class="indexterm" href="secure.html#id2553134">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2560072">Configuration for Server: MASSIVE</a></dt><dt>down-grade, <a class="indexterm" href="upgrades.html#id2591231">Introduction</a></dt><dt>drive letters, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a></dt><dt>drive mapping, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>dumb printing, <a class="indexterm" href="happy.html#id2565953">Installation of Printer Driver Auto-Download</a></dt><dt>dump, <a class="indexterm" href="ntmigration.html#id2594765">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a></dt><dt>duplicate accounts, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt><dt>dynamic DNS, <a class="indexterm" href="secure.html#id2551704">Technical Issues</a></dt></dl></div><div class="indexdiv"><h3>E</h3><dl><dt>e-Directory, <a class="indexterm" href="nw4migration.html#id2599364">Dissection and Discussion</a></dt><dt>Easy Software Products, <a class="indexterm" href="happy.html#id2565953">Installation of Printer Driver Auto-Download</a></dt><dt>economically sustainable, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a></dt><dt>eDirectory, <a class="indexterm" href="happy.html#id2564531">Dissection and Discussion</a></dt><dt>education, <a class="indexterm" href="2000users.html#id2577725">Identity Management Needs</a></dt><dt>election, <a class="indexterm" href="primer.html#id2619106">Findings</a></dt><dt>employment, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a>, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a></dt><dt>enable, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a></dt><dt>encrypted, <a class="indexterm" href="primer.html#id2620355">Findings and Comments</a></dt><dt>encrypted password, <a class="indexterm" href="primer.html#id2620620">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>encrypted passwords, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a></dt><dt>End User License Agreement (see EULA)</dt><dt>enumerating, <a class="indexterm" href="DomApps.html#id2610240">Samba Configuration</a></dt><dt>essential, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a></dt><dt>ethereal, <a class="indexterm" href="primer.html#id2618846">Exercises</a></dt><dt>Ethernet switch, <a class="indexterm" href="small.html#id2548136">Technical Issues</a></dt><dt>ethernet switch, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>EULA, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a></dt><dt>Everyone, <a class="indexterm" href="kerberos.html#id2606410">Share Access Controls</a></dt><dt>Excel, <a class="indexterm" href="kerberos.html#id2607372">Share Point Directory and File Permissions</a></dt><dt>exclusive open, <a class="indexterm" href="appendix.html#id2618109">Microsoft Access</a></dt><dt>experiment, <a class="indexterm" href="kerberos.html">Active Directory, Kerberos, and Security</a></dt><dt>export, <a class="indexterm" href="ntmigration.html#id2594765">Technical Issues</a></dt><dt>extent, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a></dt><dt>External Domains, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a></dt><dt>extreme demand, <a class="indexterm" href="HA.html#id2612593">Guidelines for Reliable Samba Operation</a></dt></dl></div><div class="indexdiv"><h3>F</h3><dl><dt>fail, <a class="indexterm" href="2000users.html#id2577378">The Nature of Windows Networking Protocols</a></dt><dt>fail-over, <a class="indexterm" href="2000users.html#id2577725">Identity Management Needs</a>, <a class="indexterm" href="2000users.html#id2578207">Implementation</a></dt><dt>failed, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>failed join, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id2587908">IDMAP_RID with Winbind</a></dt><dt>failure, <a class="indexterm" href="DomApps.html#id2610240">Samba Configuration</a></dt><dt>familiar, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>fatal problem, <a class="indexterm" href="HA.html#id2613096">Samba Configuration</a></dt><dt>fear, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>fears, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>Fedora, <a class="indexterm" href="simple.html#id2543078">Drafting Office</a></dt><dt>FHS, <a class="indexterm" href="appendix.html#id2615028">Samba System File Location</a></dt><dt>file and print server, <a class="indexterm" href="DomApps.html#id2611515">Questions and Answers</a></dt><dt>file and print service, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a></dt><dt>file caching, <a class="indexterm" href="HA.html#id2613096">Samba Configuration</a>, <a class="indexterm" href="appendix.html#id2618341">Opportunistic Locking Controls</a></dt><dt>File Hierarchy System (see FHS)</dt><dt>file locations, <a class="indexterm" href="appendix.html#id2615028">Samba System File Location</a></dt><dt>file permissions, <a class="indexterm" href="appendix.html#id2616632">The LDAP Account Manager</a></dt><dt>file server</dt><dd><dl><dt>read-only, <a class="indexterm" href="simple.html#id2543162">Dissection and Discussion</a></dt></dl></dd><dt>file servers, <a class="indexterm" href="happy.html#id2567062">Samba Server Implementation</a></dt><dt>file system, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dd><dl><dt>access control, <a class="indexterm" href="secure.html#id2553134">Samba Configuration</a></dt><dt>Ext3, <a class="indexterm" href="simple.html#id2543220">Implementation</a></dt><dt>permissions, <a class="indexterm" href="secure.html#id2553134">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2560072">Configuration for Server: MASSIVE</a></dt></dl></dd><dt>file system security, <a class="indexterm" href="kerberos.html#id2608636">Questions and Answers</a></dt><dt>filter, <a class="indexterm" href="kerberos.html#id2606410">Share Access Controls</a></dt><dt>financial responsibility, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a></dt><dt>firewall, <a class="indexterm" href="secure.html#id2551704">Technical Issues</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a></dt><dt>fix, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a></dt><dt>flaws, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a></dt><dt>flexibility, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>flush</dt><dd><dl><dt>cache memory, <a class="indexterm" href="appendix.html#id2618341">Opportunistic Locking Controls</a></dt></dl></dd><dt>folder redirection, <a class="indexterm" href="happy.html#id2564988">Technical Issues</a>, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a>, <a class="indexterm" href="2000users.html#id2581512">Questions and Answers</a></dt><dt>force group, <a class="indexterm" href="kerberos.html#id2607210">Override Controls</a>, <a class="indexterm" href="kerberos.html#id2608636">Questions and Answers</a></dt><dt>force user, <a class="indexterm" href="simple.html#id2543979">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id2607210">Override Controls</a>, <a class="indexterm" href="kerberos.html#id2608636">Questions and Answers</a></dt><dt>forced settings, <a class="indexterm" href="kerberos.html#id2607210">Override Controls</a></dt><dt>foreign, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>foreign SID, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>forwarded, <a class="indexterm" href="HA.html#id2612824">Routed Networks</a></dt><dt>foundation members, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>Free Standards Group (see FSG)</dt><dt>free support, <a class="indexterm" href="ch14.html">Samba Support</a>, <a class="indexterm" href="ch14.html#id2614102">Free Support</a></dt><dt>front-end, <a class="indexterm" href="HA.html#id2612122">Dissection and Discussion</a></dt><dd><dl><dt>server, <a class="indexterm" href="HA.html#id2613570">Distribute Network Load with MSDFS</a></dt></dl></dd><dt>frustration, <a class="indexterm" href="upgrades.html#id2591231">Introduction</a></dt><dt>FSG, <a class="indexterm" href="appendix.html#id2615028">Samba System File Location</a></dt><dt>FTP</dt><dd><dl><dt>proxy, <a class="indexterm" href="DomApps.html#id2611515">Questions and Answers</a></dt></dl></dd><dt>full control, <a class="indexterm" href="kerberos.html#id2606410">Share Access Controls</a>, <a class="indexterm" href="kerberos.html#id2608120">Using MS Windows Explorer (File Manager)</a></dt><dt>fully qualified, <a class="indexterm" href="kerberos.html#id2606898">Checkpoint Controls</a></dt><dt>functional differences, <a class="indexterm" href="upgrades.html#id2591327">Cautions and Notes</a></dt></dl></div><div class="indexdiv"><h3>G</h3><dl><dt>generation, <a class="indexterm" href="upgrades.html#id2591327">Cautions and Notes</a></dt><dt>Gentoo, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>getent, <a class="indexterm" href="happy.html#id2569962">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id2587908">IDMAP_RID with Winbind</a></dt><dt>getfacl, <a class="indexterm" href="kerberos.html#id2608291">Setting Posix ACLs in UNIX/Linux</a></dt><dt>getgrnam, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a></dt><dt>getpwnam, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>getpwnam(), <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a></dt><dt>GID, <a class="indexterm" href="2000users.html#id2578207">Implementation</a>, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a></dt><dt>Goettingen, <a class="indexterm" href="DomApps.html#id2611515">Questions and Answers</a></dt><dt>government, <a class="indexterm" href="2000users.html#id2577725">Identity Management Needs</a></dt><dt>GPL, <a class="indexterm" href="secure.html#id2557218">Comments Regarding Software Terms of Use</a></dt><dt>group account, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>group management, <a class="indexterm" href="secure.html#id2552197">Implementation</a></dt><dt>group mapping, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a></dt><dt>group membership, <a class="indexterm" href="small.html#id2548369">Implementation</a>, <a class="indexterm" href="secure.html#id2553134">Samba Configuration</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="kerberos.html#id2607372">Share Point Directory and File Permissions</a></dt><dt>group names, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a></dt><dt>group policies, <a class="indexterm" href="ntmigration.html#id2594439">Introduction</a></dt><dt>Group Policy, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dt>Group Policy editor, <a class="indexterm" href="happy.html#sbehap-locgrppol">The Local Group Policy</a></dt><dt>Group Policy Objects, <a class="indexterm" href="happy.html#sbehap-locgrppol">The Local Group Policy</a></dt><dt>groupadd, <a class="indexterm" href="simple.html#id2544190">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="upgrades.html#id2593024">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a></dt><dt>groupdel, <a class="indexterm" href="upgrades.html#id2593024">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a></dt><dt>groupmem, <a class="indexterm" href="ntmigration.html#id2595255">NT4 Migration Using LDAP Backend</a></dt><dt>groupmod, <a class="indexterm" href="upgrades.html#id2593024">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a></dt><dt>GSS-API, <a class="indexterm" href="primer.html#id2620620">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>guest account, <a class="indexterm" href="primer.html#id2620355">Findings and Comments</a>, <a class="indexterm" href="primer.html#chap01conc">Dissection and Discussion</a>, <a class="indexterm" href="primer.html#id2621302">Technical Issues</a>, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt></dl></div><div class="indexdiv"><h3>H</h3><dl><dt>hackers, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a></dt><dt>hardware prices, <a class="indexterm" href="HA.html#id2613671">Hardware Problems</a></dt><dt>hardware problems, <a class="indexterm" href="HA.html#id2613671">Hardware Problems</a></dt><dt>Heimdal, <a class="indexterm" href="DomApps.html#id2609603">Implementation</a>, <a class="indexterm" href="DomApps.html#id2609852">Kerberos Configuration</a></dt><dt>Heimdal Kerberos, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="kerberos.html#id2606064">Kerberos Exposed</a></dt><dt>Heimdal kerberos, <a class="indexterm" href="unixclients.html#id2588512">IDMAP Storage in LDAP using Winbind</a></dt><dt>help, <a class="indexterm" href="ch14.html#id2614102">Free Support</a></dt><dt>helper agent, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>hesiod, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>hierarchy of control, <a class="indexterm" href="kerberos.html#id2606759">Share Definition Controls</a></dt><dt>high availability, <a class="indexterm" href="happy.html#id2564531">Dissection and Discussion</a></dt><dt>hire, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a></dt><dt>HKEY_CURRENT_USER, <a class="indexterm" href="happy.html#id2565500">Roaming Profile Background</a></dt><dt>HKEY_LOCAL_MACHINE, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>HKEY_LOCAL_USER, <a class="indexterm" href="2000users.html#id2581512">Questions and Answers</a></dt><dt>host announcement, <a class="indexterm" href="primer.html#id2618729">Assignment Tasks</a>, <a class="indexterm" href="primer.html#id2619758">Findings</a></dt><dt>hostname, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a></dt><dt>hosts, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a></dt><dt>HUB, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>Hybrid, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dt>hypothetical, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a></dt></dl></div><div class="indexdiv"><h3>I</h3><dl><dt>Idealx, <a class="indexterm" href="upgrades.html#id2593024">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id2595255">NT4 Migration Using LDAP Backend</a></dt><dd><dl><dt>smbldap-tools, <a class="indexterm" href="happy.html#sbeidealx">Install and Configure Idealx smbldap-tools Scripts</a>, <a class="indexterm" href="happy.html#id2569962">LDAP Initialization and Creation of User and Group Accounts</a></dt></dl></dd><dt>identifiers, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a></dt><dt>identity, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2606064">Kerberos Exposed</a></dt><dd><dl><dt>management, <a class="indexterm" href="happy.html#id2564988">Technical Issues</a></dt></dl></dd><dt>identity management, <a class="indexterm" href="Big500users.html#id2558539">Technical Issues</a>, <a class="indexterm" href="2000users.html#id2576972">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#id2583136">Political Issues</a>, <a class="indexterm" href="nw4migration.html#id2599364">Dissection and Discussion</a></dt><dt>Identity Management, <a class="indexterm" href="happy.html#id2564531">Dissection and Discussion</a>, <a class="indexterm" href="2000users.html#id2577378">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="2000users.html#id2577725">Identity Management Needs</a></dt><dt>Identity management, <a class="indexterm" href="unixclients.html#id2589442">UNIX/Linux Client Domain Member</a></dt><dt>Identity resolution, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id2589442">UNIX/Linux Client Domain Member</a>, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a></dt><dt>Identity resolver, <a class="indexterm" href="DomApps.html#id2611515">Questions and Answers</a></dt><dt>IDMAP, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#id2587908">IDMAP_RID with Winbind</a></dt><dt>idmap backend, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a></dt><dt>IDMAP backend, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a></dt><dt>idmap gid, <a class="indexterm" href="unixclients.html#id2587908">IDMAP_RID with Winbind</a></dt><dt>idmap uid, <a class="indexterm" href="unixclients.html#id2587908">IDMAP_RID with Winbind</a></dt><dt>idmap_rid, <a class="indexterm" href="unixclients.html#id2587908">IDMAP_RID with Winbind</a></dt><dt>IMAP, <a class="indexterm" href="nw4migration.html#id2599440">Technical Issues</a></dt><dt>import, <a class="indexterm" href="ntmigration.html#id2594765">Technical Issues</a></dt><dt>income, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a></dt><dt>independent expert, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a></dt><dt>inetd, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a></dt><dt>inetOrgPerson, <a class="indexterm" href="nw4migration.html#id2599440">Technical Issues</a></dt><dt>inheritance, <a class="indexterm" href="kerberos.html#id2608291">Setting Posix ACLs in UNIX/Linux</a></dt><dt>initGrps.sh, <a class="indexterm" href="small.html#id2548369">Implementation</a>, <a class="indexterm" href="secure.html#id2553134">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2560072">Configuration for Server: MASSIVE</a></dt><dt>initial credentials, <a class="indexterm" href="DomApps.html#id2609852">Kerberos Configuration</a></dt><dt>inoperative, <a class="indexterm" href="ntmigration.html#id2594579">Dissection and Discussion</a></dt><dt>install, <a class="indexterm" href="upgrades.html">Updating Samba-3</a></dt><dt>installation, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a></dt><dt>integrate, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a></dt><dt>integrity, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a>, <a class="indexterm" href="kerberos.html#id2606064">Kerberos Exposed</a></dt><dt>inter-domain, <a class="indexterm" href="upgrades.html#id2593024">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>inter-operability, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2608502">Key Points Learned</a>, <a class="indexterm" href="DomApps.html#id2611515">Questions and Answers</a></dt><dt>interactive help, <a class="indexterm" href="ch14.html#id2614102">Free Support</a></dt><dt>interdomain trusts, <a class="indexterm" href="2000users.html#id2577725">Identity Management Needs</a></dt><dt>interfaces, <a class="indexterm" href="secure.html#id2552197">Implementation</a></dt><dt>intermittent, <a class="indexterm" href="HA.html#id2613671">Hardware Problems</a></dt><dt>internationalization, <a class="indexterm" href="upgrades.html#id2592490">International Language Support</a></dt><dt>Internet Explorer, <a class="indexterm" href="DomApps.html#id2609429">Technical Issues</a></dt><dt>Internet Information Server, <a class="indexterm" href="DomApps.html#id2611515">Questions and Answers</a></dt><dt>interoperability, <a class="indexterm" href="happy.html#id2564531">Dissection and Discussion</a></dt><dt>IP forwarding, <a class="indexterm" href="small.html#id2548369">Implementation</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="Big500users.html#id2560072">Configuration for Server: MASSIVE</a></dt><dt>IPC$, <a class="indexterm" href="primer.html#id2620355">Findings and Comments</a></dt><dt>iptables, <a class="indexterm" href="secure.html#id2551704">Technical Issues</a></dt><dt>IRC, <a class="indexterm" href="ch14.html#id2614102">Free Support</a></dt><dt>isolated, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a></dt><dt>Italian, <a class="indexterm" href="DomApps.html#id2611515">Questions and Answers</a></dt></dl></div><div class="indexdiv"><h3>J</h3><dl><dt>jobs, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a></dt><dt>joining a domain, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt></dl></div><div class="indexdiv"><h3>K</h3><dl><dt>KDC, <a class="indexterm" href="DomApps.html#id2609852">Kerberos Configuration</a></dt><dt>Kerberos, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a>, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2608502">Key Points Learned</a>, <a class="indexterm" href="DomApps.html#id2609429">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id2609603">Implementation</a>, <a class="indexterm" href="DomApps.html#id2609852">Kerberos Configuration</a></dt><dd><dl><dt>Heimdal, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>interoperability, <a class="indexterm" href="kerberos.html#id2606064">Kerberos Exposed</a></dt><dt>libraries, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>MIT, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>unspecified fields, <a class="indexterm" href="kerberos.html#id2606064">Kerberos Exposed</a></dt></dl></dd><dt>kerberos, <a class="indexterm" href="kerberos.html#id2606064">Kerberos Exposed</a></dt><dd><dl><dt>server, <a class="indexterm" href="kerberos.html#id2606064">Kerberos Exposed</a></dt></dl></dd><dt>Kerberos ticket, <a class="indexterm" href="DomApps.html#id2610240">Samba Configuration</a></dt><dt>kinit, <a class="indexterm" href="DomApps.html#id2609852">Kerberos Configuration</a></dt><dt>Kixtart, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a></dt><dt>klist, <a class="indexterm" href="DomApps.html#id2609852">Kerberos Configuration</a></dt><dt>krb5, <a class="indexterm" href="DomApps.html#id2609603">Implementation</a></dt><dt>krb5.conf, <a class="indexterm" href="DomApps.html#id2609852">Kerberos Configuration</a></dt></dl></div><div class="indexdiv"><h3>L</h3><dl><dt>LAM, <a class="indexterm" href="appendix.html#id2616632">The LDAP Account Manager</a></dt><dd><dl><dt>configuration editor, <a class="indexterm" href="appendix.html#id2616632">The LDAP Account Manager</a></dt><dt>configuration file, <a class="indexterm" href="appendix.html#id2616632">The LDAP Account Manager</a></dt><dt>login screen, <a class="indexterm" href="appendix.html#id2616632">The LDAP Account Manager</a></dt><dt>opening screen, <a class="indexterm" href="appendix.html#id2616632">The LDAP Account Manager</a></dt><dt>profile, <a class="indexterm" href="appendix.html#id2616632">The LDAP Account Manager</a></dt><dt>wizard, <a class="indexterm" href="appendix.html#id2616632">The LDAP Account Manager</a></dt></dl></dd><dt>large domain, <a class="indexterm" href="unixclients.html#id2587908">IDMAP_RID with Winbind</a></dt><dt>LDAP, <a class="indexterm" href="Big500users.html#id2558539">Technical Issues</a>, <a class="indexterm" href="happy.html#id2564394">Assignment Tasks</a>, <a class="indexterm" href="happy.html#id2564531">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#id2564988">Technical Issues</a>, <a class="indexterm" href="happy.html#id2566143">Preliminary Advice: Dangers Can Be Avoided</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="2000users.html#id2576874">Introduction</a>, <a class="indexterm" href="2000users.html#id2576972">Dissection and Discussion</a>, <a class="indexterm" href="2000users.html#id2577725">Identity Management Needs</a>, <a class="indexterm" href="2000users.html#id2578207">Implementation</a>, <a class="indexterm" href="2000users.html#id2581365">Key Points Learned</a>, <a class="indexterm" href="2000users.html#id2581512">Questions and Answers</a>, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id2593024">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id2594524">Assignment Tasks</a>, <a class="indexterm" href="ntmigration.html#id2594765">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id2599364">Dissection and Discussion</a>, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a>, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dd><dl><dt>backend, <a class="indexterm" href="2000users.html#id2577725">Identity Management Needs</a></dt><dt>database, <a class="indexterm" href="happy.html#id2569962">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="2000users.html#id2577725">Identity Management Needs</a>, <a class="indexterm" href="2000users.html#id2581512">Questions and Answers</a>, <a class="indexterm" href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></dt><dt>directory, <a class="indexterm" href="happy.html#id2564154">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="2000users.html#id2577725">Identity Management Needs</a></dt><dt>fail-over, <a class="indexterm" href="2000users.html#id2578207">Implementation</a></dt><dt>initial configuration, <a class="indexterm" href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></dt><dt>master, <a class="indexterm" href="2000users.html#id2577725">Identity Management Needs</a></dt><dt>master/slave</dt><dd><dl><dt>background communication, <a class="indexterm" href="2000users.html#id2581512">Questions and Answers</a></dt></dl></dd><dt>preload, <a class="indexterm" href="2000users.html#id2578207">Implementation</a></dt><dt>schema, <a class="indexterm" href="upgrades.html#id2593683">Updating from Samba Versions between 3.0.6 and 3.0.10</a></dt><dt>secure, <a class="indexterm" href="happy.html#id2564988">Technical Issues</a></dt><dt>server, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a></dt><dt>slave, <a class="indexterm" href="2000users.html#id2577725">Identity Management Needs</a></dt><dt>updates, <a class="indexterm" href="2000users.html#id2577725">Identity Management Needs</a></dt></dl></dd><dt>ldap, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>LDAP Account Manager (see LAM)</dt><dt>LDAP backend, <a class="indexterm" href="ntmigration.html#id2594765">Technical Issues</a></dt><dt>LDAP database, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a></dt><dt>LDAP Interchange Format (see LDIF)</dt><dt>LDAP server, <a class="indexterm" href="2000users.html#id2577725">Identity Management Needs</a></dt><dt>LDAP-transfer-LDIF.txt, <a class="indexterm" href="2000users.html#id2578207">Implementation</a></dt><dt>ldap.conf, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>ldapadd, <a class="indexterm" href="happy.html#id2569962">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>ldapsam, <a class="indexterm" href="happy.html#id2569962">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="2000users.html#id2576972">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="upgrades.html#id2593683">Updating from Samba Versions between 3.0.6 and 3.0.10</a>, <a class="indexterm" href="ntmigration.html#id2594524">Assignment Tasks</a>, <a class="indexterm" href="DomApps.html">Integrating Additional Services</a></dt><dt>ldapsam backend, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>ldapsearch, <a class="indexterm" href="happy.html#id2569962">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>LDIF, <a class="indexterm" href="happy.html#id2564988">Technical Issues</a>, <a class="indexterm" href="2000users.html#id2578207">Implementation</a>, <a class="indexterm" href="nw4migration.html#id2599440">Technical Issues</a>, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a>, <a class="indexterm" href="appendix.html#id2616053">Initialization of the LDAP Database</a></dt><dt>leadership, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>Lightweight Directory Access Protocol (see LDAP)</dt><dt>limit, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a></dt><dt>Linux desktop, <a class="indexterm" href="unixclients.html#id2582370">Introduction</a></dt><dt>Linux Standards Base (see LSB)</dt><dt>LMB, <a class="indexterm" href="primer.html#id2619106">Findings</a>, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dt>LMHOSTS, <a class="indexterm" href="HA.html#id2612824">Routed Networks</a></dt><dt>load distribution, <a class="indexterm" href="HA.html#id2613521">For Scalability, Use SAN-Based Storage on Samba Servers</a></dt><dt>local accounts, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a></dt><dt>Local Group Policy, <a class="indexterm" href="happy.html#id2565500">Roaming Profile Background</a></dt><dt>Local Master Announcement, <a class="indexterm" href="primer.html#id2619758">Findings</a></dt><dt>Local Master Browser (see LMB)</dt><dt>localhost, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="HA.html#id2612632">Bad Hostnames</a></dt><dt>lock directory, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></dt><dt>locking</dt><dd><dl><dt>Application level, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>Client side, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>Server side, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt></dl></dd><dt>logging, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>login, <a class="indexterm" href="secure.html#id2551704">Technical Issues</a></dt><dt>loglevel, <a class="indexterm" href="happy.html#id2566377">Debugging LDAP</a></dt><dt>logon credentials, <a class="indexterm" href="DomApps.html#id2611515">Questions and Answers</a></dt><dt>logon hours, <a class="indexterm" href="ntmigration.html#id2594765">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2608502">Key Points Learned</a></dt><dt>logon machines, <a class="indexterm" href="ntmigration.html#id2594765">Technical Issues</a></dt><dt>logon path, <a class="indexterm" href="secure.html#id2552197">Implementation</a></dt><dt>logon process, <a class="indexterm" href="unixclients.html#id2583237">Implementation</a></dt><dt>logon scrip, <a class="indexterm" href="secure.html#id2553134">Samba Configuration</a></dt><dt>logon script, <a class="indexterm" href="secure.html#id2552197">Implementation</a>, <a class="indexterm" href="happy.html#id2564988">Technical Issues</a>, <a class="indexterm" href="happy.html#id2574271">Preparation of Logon Scripts</a>, <a class="indexterm" href="ntmigration.html#id2594765">Technical Issues</a></dt><dt>logon server, <a class="indexterm" href="2000users.html#id2577378">The Nature of Windows Networking Protocols</a></dt><dt>logon services, <a class="indexterm" href="secure.html#id2552197">Implementation</a></dt><dt>logon time, <a class="indexterm" href="happy.html#id2564394">Assignment Tasks</a></dt><dt>logon traffic, <a class="indexterm" href="2000users.html#id2577378">The Nature of Windows Networking Protocols</a></dt><dt>logon.kix, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a></dt><dt>loopback, <a class="indexterm" href="simple.html#validate1">Validation</a></dt><dt>low performance, <a class="indexterm" href="HA.html#id2613671">Hardware Problems</a></dt><dt>lower-case, <a class="indexterm" href="ntmigration.html#id2595114">Implementation</a></dt><dt>lpadmin, <a class="indexterm" href="simple.html#id2544190">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id2548369">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>LSB, <a class="indexterm" href="appendix.html#id2615028">Samba System File Location</a></dt></dl></div><div class="indexdiv"><h3>M</h3><dl><dt>machine, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a></dt><dt>machine account, <a class="indexterm" href="happy.html#id2564154">Regarding LDAP Directories and Windows Computer Accounts</a></dt><dt>machine accounts, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a></dt><dt>machine secret password, <a class="indexterm" href="Big500users.html#id2558539">Technical Issues</a></dt><dt>MACHINE.SID, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a></dt><dt>mailing list, <a class="indexterm" href="ch14.html#id2614102">Free Support</a></dt><dt>mailing lists, <a class="indexterm" href="ch14.html#id2614102">Free Support</a></dt><dt>managed, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>management, <a class="indexterm" href="unixclients.html#id2583136">Political Issues</a>, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a></dt><dd><dl><dt>group, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>User, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt></dl></dd><dt>mandatory profile, <a class="indexterm" href="happy.html#id2564988">Technical Issues</a>, <a class="indexterm" href="happy.html#id2574027">Configuring Profile Directories</a></dt><dt>Mandrake, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>mapped drives, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a></dt><dt>mapping, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id2609852">Kerberos Configuration</a></dt><dd><dl><dt>consistent, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt></dl></dd><dt>Mars_NWE, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>master, <a class="indexterm" href="2000users.html#id2576972">Dissection and Discussion</a></dt><dt>material, <a class="indexterm" href="appendix.html">A Collection of Useful Tidbits</a></dt><dt>memberUID, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a></dt><dt>memory requirements, <a class="indexterm" href="secure.html#id2551990">Hardware Requirements</a></dt><dt>merge, <a class="indexterm" href="ntmigration.html#id2594765">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a></dt><dt>merged, <a class="indexterm" href="ntmigration.html#id2594765">Technical Issues</a></dt><dt>meta-directory, <a class="indexterm" href="2000users.html#id2581512">Questions and Answers</a></dt><dt>meta-service, <a class="indexterm" href="kerberos.html#id2608636">Questions and Answers</a></dt><dt>Microsoft Access, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>Microsoft Excel, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>Microsoft ISA, <a class="indexterm" href="DomApps.html#id2609296">Assignment Tasks</a></dt><dt>Microsoft Management Console (see MMC)</dt><dt>Microsoft Office, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a>, <a class="indexterm" href="kerberos.html#id2607372">Share Point Directory and File Permissions</a></dt><dt>Microsoft Outlook</dt><dd><dl><dt>PST files, <a class="indexterm" href="2000users.html#id2581512">Questions and Answers</a></dt></dl></dd><dt>migrate, <a class="indexterm" href="upgrades.html">Updating Samba-3</a>, <a class="indexterm" href="ntmigration.html#id2594765">Technical Issues</a></dt><dt>migration, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id2548369">Implementation</a>, <a class="indexterm" href="happy.html#id2564394">Assignment Tasks</a>, <a class="indexterm" href="ntmigration.html#id2594439">Introduction</a>, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dd><dl><dt>objectives, <a class="indexterm" href="ntmigration.html#id2594579">Dissection and Discussion</a></dt></dl></dd><dt>Migration speed, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a></dt><dt>mime type, <a class="indexterm" href="simple.html#id2544190">Implementation</a>, <a class="indexterm" href="small.html#id2548369">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id2559494">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>mime types, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a></dt><dt>missing RPC's, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>MIT, <a class="indexterm" href="DomApps.html#id2609603">Implementation</a>, <a class="indexterm" href="DomApps.html#id2609852">Kerberos Configuration</a></dt><dt>MIT Kerberos, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="kerberos.html#id2606064">Kerberos Exposed</a></dt><dt>MIT kerberos, <a class="indexterm" href="unixclients.html#id2588512">IDMAP Storage in LDAP using Winbind</a></dt><dt>MIT KRB5, <a class="indexterm" href="DomApps.html#id2610240">Samba Configuration</a></dt><dt>mixed mode, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>mixed-mode, <a class="indexterm" href="kerberos.html#id2608636">Questions and Answers</a></dt><dt>MMC, <a class="indexterm" href="happy.html#id2575585">Configure Delete Cached Profiles on Logout</a>, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2608636">Questions and Answers</a></dt><dt>mobile computing, <a class="indexterm" href="small.html#id2548082">Dissection and Discussion</a></dt><dt>mobility, <a class="indexterm" href="2000users.html#id2577245">Technical Issues</a></dt><dt>modularization, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>modules, <a class="indexterm" href="DomApps.html#id2611515">Questions and Answers</a></dt><dt>MS Access</dt><dd><dl><dt>validate, <a class="indexterm" href="appendix.html#id2618109">Microsoft Access</a></dt></dl></dd><dt>MS Outlook, <a class="indexterm" href="happy.html#id2575269">Configuration of MS Outlook to Relocate PST File</a></dt><dd><dl><dt>PST, <a class="indexterm" href="happy.html#id2575269">Configuration of MS Outlook to Relocate PST File</a></dt><dt>PST file, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>MS Windows Server 2003, <a class="indexterm" href="DomApps.html#id2609603">Implementation</a></dt><dt>MS Word, <a class="indexterm" href="kerberos.html#id2607372">Share Point Directory and File Permissions</a></dt><dt>MSDFS, <a class="indexterm" href="HA.html#id2613570">Distribute Network Load with MSDFS</a></dt><dt>multi-subnet, <a class="indexterm" href="HA.html#id2612824">Routed Networks</a></dt><dt>multi-user</dt><dd><dl><dt>access, <a class="indexterm" href="appendix.html#id2618109">Microsoft Access</a></dt><dt>data access, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt></dl></dd><dt>multiple directories, <a class="indexterm" href="2000users.html#id2577725">Identity Management Needs</a></dt><dt>multiple domain controllers, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>multiple group mappings, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a></dt><dt>mutual assistance, <a class="indexterm" href="ch14.html#id2614102">Free Support</a></dt><dt>My Documents, <a class="indexterm" href="happy.html#id2565500">Roaming Profile Background</a></dt><dt>My Network Places, <a class="indexterm" href="simple.html#id2544190">Implementation</a></dt><dt>mysqlsam, <a class="indexterm" href="2000users.html#id2578207">Implementation</a></dt></dl></div><div class="indexdiv"><h3>N</h3><dl><dt>name resolution, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a>, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a>, <a class="indexterm" href="primer.html#id2618729">Assignment Tasks</a></dt><dd><dl><dt>Defective, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt></dl></dd><dt>name resolve order, <a class="indexterm" href="secure.html#id2552197">Implementation</a></dt><dt>name service switch, <a class="indexterm" href="small.html#id2548369">Implementation</a> (see NSS)</dt><dt>named, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="Big500users.html#id2559494">Server Preparation: All Servers</a></dt><dt>NAT, <a class="indexterm" href="secure.html#id2551704">Technical Issues</a></dt><dt>native, <a class="indexterm" href="kerberos.html#id2608636">Questions and Answers</a></dt><dt>net</dt><dd><dl><dt>ads</dt><dd><dl><dt>info, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>join, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a>, <a class="indexterm" href="DomApps.html#id2610240">Samba Configuration</a></dt><dt>status, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt></dl></dd><dt>getlocalsid, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a></dt><dt>group, <a class="indexterm" href="ntmigration.html#id2597714">NT4 Migration Using tdbsam Backend</a></dt><dt>groupmap</dt><dd><dl><dt>add, <a class="indexterm" href="secure.html#id2553134">Samba Configuration</a></dt><dt>list, <a class="indexterm" href="secure.html#id2553134">Samba Configuration</a>, <a class="indexterm" href="happy.html#id2569962">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>modify, <a class="indexterm" href="secure.html#id2553134">Samba Configuration</a></dt></dl></dd><dt>rpc</dt><dd><dl><dt>info, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a></dt><dt>join, <a class="indexterm" href="Big500users.html#ch5-domsvrspec">Configuration Specific to Domain Member Servers: BLDG1, BLDG2</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id2597714">NT4 Migration Using tdbsam Backend</a></dt><dt>vampire, <a class="indexterm" href="upgrades.html">Updating Samba-3</a>, <a class="indexterm" href="ntmigration.html#id2597714">NT4 Migration Using tdbsam Backend</a></dt></dl></dd><dt>setlocalsid, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a></dt></dl></dd><dt>NetBIOS, <a class="indexterm" href="2000users.html#id2577378">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a>, <a class="indexterm" href="HA.html#id2612632">Bad Hostnames</a>, <a class="indexterm" href="HA.html#id2612824">Routed Networks</a>, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dd><dl><dt>name cache, <a class="indexterm" href="2000users.html#id2581512">Questions and Answers</a></dt><dt>name resolution</dt><dd><dl><dt>delays, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>Node Type, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt></dl></dd><dt>netbios</dt><dd><dl><dt>machine name, <a class="indexterm" href="upgrades.html#id2592158">Change of hostname</a></dt></dl></dd><dt>netbios forwarding, <a class="indexterm" href="HA.html#id2612997">Network Collisions</a></dt><dt>NetBIOS name, <a class="indexterm" href="DomApps.html#id2609852">Kerberos Configuration</a></dt><dd><dl><dt>aliases, <a class="indexterm" href="2000users.html#id2577725">Identity Management Needs</a></dt></dl></dd><dt>netbios name, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id2592158">Change of hostname</a>, <a class="indexterm" href="HA.html#id2612632">Bad Hostnames</a></dt><dt>NETLOGON, <a class="indexterm" href="happy.html#id2565895">Using a Network Default User Profile</a>, <a class="indexterm" href="happy.html#id2574516">Windows Client Configuration</a></dt><dt>netlogon, <a class="indexterm" href="2000users.html#id2577378">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a></dt><dt>Netlogon, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dt>netmask, <a class="indexterm" href="simple.html#id2543220">Implementation</a></dt><dt>Netware, <a class="indexterm" href="small.html">Small Office Networking</a></dt><dt>NetWare, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a>, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a></dt><dt>network</dt><dd><dl><dt>administrators, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>analyzer, <a class="indexterm" href="primer.html#id2618729">Assignment Tasks</a></dt><dt>bandwidth, <a class="indexterm" href="2000users.html#id2577725">Identity Management Needs</a>, <a class="indexterm" href="2000users.html#id2581512">Questions and Answers</a></dt><dt>broadcast, <a class="indexterm" href="primer.html#id2618669">Introduction</a></dt><dt>captures, <a class="indexterm" href="primer.html#id2618507">Requirements and Notes</a></dt><dt>collisions, <a class="indexterm" href="HA.html#id2612997">Network Collisions</a></dt><dt>load, <a class="indexterm" href="HA.html#id2612997">Network Collisions</a></dt><dt>logon, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>logon scripts, <a class="indexterm" href="ntmigration.html#id2594579">Dissection and Discussion</a></dt><dt>management, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a></dt><dt>multi-segment, <a class="indexterm" href="happy.html#id2564296">Introduction</a></dt><dt>overload, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>performance, <a class="indexterm" href="HA.html#id2613096">Samba Configuration</a></dt><dt>routed, <a class="indexterm" href="2000users.html#id2576972">Dissection and Discussion</a></dt><dt>secure, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a></dt><dt>segment, <a class="indexterm" href="happy.html#id2564531">Dissection and Discussion</a></dt><dt>services, <a class="indexterm" href="DomApps.html#id2611515">Questions and Answers</a></dt><dt>sniffer, <a class="indexterm" href="primer.html#id2618507">Requirements and Notes</a></dt><dt>timeout, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>timeouts, <a class="indexterm" href="HA.html#id2612997">Network Collisions</a></dt><dt>trace, <a class="indexterm" href="primer.html#id2618729">Assignment Tasks</a></dt><dt>traffic</dt><dd><dl><dt>observation, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt></dl></dd><dt>wide-area, <a class="indexterm" href="happy.html#id2564531">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt></dl></dd><dt>Network Address Translation (see NAT)</dt><dt>network administrators, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>network attached storage (see NAS)</dt><dt>network bandwidth</dt><dd><dl><dt>utilization, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>Network Default Profile, <a class="indexterm" href="happy.html#id2565500">Roaming Profile Background</a></dt><dt>network hardware</dt><dd><dl><dt>defective, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>network hygiene, <a class="indexterm" href="HA.html#id2612122">Dissection and Discussion</a></dt><dt>network Identities, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a></dt><dt>network load factors, <a class="indexterm" href="Big500users.html#id2558503">Dissection and Discussion</a></dt><dt>Network Neighborhood, <a class="indexterm" href="simple.html#validate1">Validation</a>, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>network segment, <a class="indexterm" href="HA.html#id2613424">Use and Location of BDCs</a></dt><dt>network segments, <a class="indexterm" href="secure.html#id2551990">Hardware Requirements</a></dt><dt>network share, <a class="indexterm" href="happy.html#id2564394">Assignment Tasks</a></dt><dt>networking</dt><dd><dl><dt>client, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a></dt></dl></dd><dt>networking hardware</dt><dd><dl><dt>defective, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>networking protocols, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>next generation, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>NextFreeUnixId, <a class="indexterm" href="ntmigration.html#id2595255">NT4 Migration Using LDAP Backend</a></dt><dt>NFS server, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></dt><dt>NICs, <a class="indexterm" href="HA.html#id2613671">Hardware Problems</a></dt><dt>NIS, <a class="indexterm" href="happy.html#id2569962">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="2000users.html#id2577725">Identity Management Needs</a>, <a class="indexterm" href="2000users.html#id2581512">Questions and Answers</a>, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2583136">Political Issues</a>, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a></dt><dt>nis, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>NIS schema, <a class="indexterm" href="2000users.html#id2581512">Questions and Answers</a></dt><dt>NIS server, <a class="indexterm" href="2000users.html#id2581512">Questions and Answers</a></dt><dt>NIS+, <a class="indexterm" href="2000users.html#id2577725">Identity Management Needs</a></dt><dt>nisplus, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>NLM, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>nmap, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>nmbd, <a class="indexterm" href="small.html#id2550069">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="upgrades.html#id2593865">Replacing a Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id2610240">Samba Configuration</a>, <a class="indexterm" href="appendix.html#id2615448">Starting Samba</a></dt><dt>nobody, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a class="indexterm" href="primer.html#id2620355">Findings and Comments</a></dt><dt>Novell, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a>, <a class="indexterm" href="nw4migration.html#id2599134">Introduction</a></dt><dt>Novell SUSE SLES 9, <a class="indexterm" href="ntmigration.html#id2595255">NT4 Migration Using LDAP Backend</a></dt><dt>NSS, <a class="indexterm" href="happy.html#id2564154">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="happy.html#id2564988">Technical Issues</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#id2587908">IDMAP_RID with Winbind</a>, <a class="indexterm" href="unixclients.html#id2589442">UNIX/Linux Client Domain Member</a>, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a>, <a class="indexterm" href="DomApps.html#id2610793">NSS Configuration</a> (see same service switch)</dt><dt>nss_ldap, <a class="indexterm" href="happy.html#id2564154">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="happy.html#id2564988">Technical Issues</a>, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="happy.html#id2569962">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#id2589106">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a class="indexterm" href="upgrades.html#id2593865">Replacing a Domain Member Server</a>, <a class="indexterm" href="ntmigration.html#id2595255">NT4 Migration Using LDAP Backend</a></dt><dt>nt acl support, <a class="indexterm" href="simple.html#id2543979">Dissection and Discussion</a></dt><dt>NT4 registry, <a class="indexterm" href="ntmigration.html#id2594579">Dissection and Discussion</a></dt><dt>NTLM, <a class="indexterm" href="DomApps.html#id2609429">Technical Issues</a></dt><dt>NTLM authentication daemon, <a class="indexterm" href="DomApps.html#id2609429">Technical Issues</a></dt><dt>NTLMSSP, <a class="indexterm" href="DomApps.html#id2611455">Key Points Learned</a>, <a class="indexterm" href="DomApps.html#id2611515">Questions and Answers</a>, <a class="indexterm" href="primer.html#id2620620">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>NTLMSSP_AUTH, <a class="indexterm" href="primer.html#id2620620">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>ntlm_auth, <a class="indexterm" href="DomApps.html#id2610240">Samba Configuration</a>, <a class="indexterm" href="DomApps.html#id2611515">Questions and Answers</a></dt><dt>NTP, <a class="indexterm" href="DomApps.html#id2609852">Kerberos Configuration</a></dt><dt>NTUSER.DAT, <a class="indexterm" href="happy.html#id2565500">Roaming Profile Background</a>, <a class="indexterm" href="happy.html#id2565800">Profile Changes</a>, <a class="indexterm" href="happy.html#id2565895">Using a Network Default User Profile</a>, <a class="indexterm" href="2000users.html#id2581512">Questions and Answers</a></dt><dt>NULL connection, <a class="indexterm" href="simple.html#validate1">Validation</a></dt><dt>NULL session, <a class="indexterm" href="primer.html#id2620355">Findings and Comments</a></dt><dt>NULL-Session, <a class="indexterm" href="primer.html#id2621156">Discussion</a></dt></dl></div><div class="indexdiv"><h3>O</h3><dl><dt>objectClass, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a></dt><dt>off-site storage, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a></dt><dt>Open Magazine, <a class="indexterm" href="unixclients.html">Adding Domain Member Servers and Clients</a></dt><dt>Open Source, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a></dt><dt>OpenLDAP, <a class="indexterm" href="happy.html#id2564531">Dissection and Discussion</a>, <a class="indexterm" href="2000users.html#id2576972">Dissection and Discussion</a>, <a class="indexterm" href="2000users.html#id2581512">Questions and Answers</a>, <a class="indexterm" href="unixclients.html#id2583136">Political Issues</a>, <a class="indexterm" href="nw4migration.html#id2599440">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a>, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2608502">Key Points Learned</a>, <a class="indexterm" href="appendix.html#id2616632">The LDAP Account Manager</a></dt><dt>openldap, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>OpenOffice, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a></dt><dt>operating profiles, <a class="indexterm" href="appendix.html#id2616632">The LDAP Account Manager</a></dt><dt>oplock break, <a class="indexterm" href="kerberos.html#id2607210">Override Controls</a></dt><dt>oplocks, <a class="indexterm" href="HA.html#id2613096">Samba Configuration</a></dt><dt>Oplocks</dt><dd><dl><dt>disabled, <a class="indexterm" href="appendix.html#id2618341">Opportunistic Locking Controls</a></dt></dl></dd><dt>opportunistic</dt><dd><dl><dt>locking, <a class="indexterm" href="kerberos.html#id2607210">Override Controls</a></dt></dl></dd><dt>opportunistic locking, <a class="indexterm" href="secure.html#id2552197">Implementation</a>, <a class="indexterm" href="HA.html#id2613096">Samba Configuration</a>, <a class="indexterm" href="appendix.html#id2618256">Act! Database Sharing</a></dt><dt>optimized, <a class="indexterm" href="HA.html#id2613096">Samba Configuration</a></dt><dt>organizational units, <a class="indexterm" href="appendix.html#id2616632">The LDAP Account Manager</a></dt><dt>OS/2, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a></dt><dt>Outlook</dt><dd><dl><dt>PST, <a class="indexterm" href="happy.html#id2575269">Configuration of MS Outlook to Relocate PST File</a></dt></dl></dd><dt>Outlook Address Book, <a class="indexterm" href="happy.html#id2575269">Configuration of MS Outlook to Relocate PST File</a></dt><dt>Outlook Express, <a class="indexterm" href="secure.html#id2552156">Political Issues</a>, <a class="indexterm" href="happy.html#id2575269">Configuration of MS Outlook to Relocate PST File</a></dt><dt>over-ride, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>over-ride controls, <a class="indexterm" href="kerberos.html#id2607210">Override Controls</a></dt><dt>over-rule, <a class="indexterm" href="kerberos.html#id2606410">Share Access Controls</a>, <a class="indexterm" href="kerberos.html#id2608120">Using MS Windows Explorer (File Manager)</a></dt><dt>overheads, <a class="indexterm" href="kerberos.html#id2607210">Override Controls</a></dt><dt>ownership, <a class="indexterm" href="kerberos.html#id2607372">Share Point Directory and File Permissions</a></dt></dl></div><div class="indexdiv"><h3>P</h3><dl><dt>package, <a class="indexterm" href="simple.html#id2543220">Implementation</a></dt><dt>package names, <a class="indexterm" href="appendix.html#id2615028">Samba System File Location</a></dt><dt>packages, <a class="indexterm" href="upgrades.html#id2593539">Updating a Samba-3 Installation</a></dt><dt>PADL, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2588512">IDMAP Storage in LDAP using Winbind</a></dt><dt>PADL LDAP tools, <a class="indexterm" href="happy.html#id2564988">Technical Issues</a></dt><dt>PADL Software, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>paid-for support, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>PAM, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="unixclients.html#id2589442">UNIX/Linux Client Domain Member</a>, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a></dt><dt>pam_ldap, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>pam_ldap.so, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dt>pam_unix2.so, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dd><dl><dt>use_ldap, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt></dl></dd><dt>parameters, <a class="indexterm" href="upgrades.html#id2593024">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>passdb backend, <a class="indexterm" href="secure.html#id2552197">Implementation</a>, <a class="indexterm" href="Big500users.html">The 500-User Office</a>, <a class="indexterm" href="happy.html#id2564531">Dissection and Discussion</a>, <a class="indexterm" href="2000users.html#id2576972">Dissection and Discussion</a>, <a class="indexterm" href="2000users.html#id2578207">Implementation</a>, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a>, <a class="indexterm" href="upgrades.html">Updating Samba-3</a>, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id2593024">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="upgrades.html#id2593683">Updating from Samba Versions between 3.0.6 and 3.0.10</a>, <a class="indexterm" href="ntmigration.html#id2594524">Assignment Tasks</a>, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a></dt><dt>passdb.tdb, <a class="indexterm" href="ntmigration.html#id2594765">Technical Issues</a></dt><dt>passwd, <a class="indexterm" href="simple.html#id2544190">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="secure.html#id2553134">Samba Configuration</a></dt><dt>password</dt><dd><dl><dt>backend, <a class="indexterm" href="small.html#id2548369">Implementation</a>, <a class="indexterm" href="secure.html#id2553134">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2560072">Configuration for Server: MASSIVE</a></dt></dl></dd><dt>password caching, <a class="indexterm" href="simple.html#id2544190">Implementation</a></dt><dt>password change, <a class="indexterm" href="kerberos.html#id2608502">Key Points Learned</a></dt><dt>password length, <a class="indexterm" href="primer.html#id2620118">Simple Windows Client Connection Characteristics</a>, <a class="indexterm" href="primer.html#id2620620">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>payroll, <a class="indexterm" href="nw4migration.html#id2599134">Introduction</a></dt><dt>pdbedit, <a class="indexterm" href="happy.html#id2569962">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a class="indexterm" href="ntmigration.html#id2597714">NT4 Migration Using tdbsam Backend</a>, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a></dt><dt>PDC, <a class="indexterm" href="Big500users.html#id2558397">Assignment Tasks</a>, <a class="indexterm" href="Big500users.html#id2558539">Technical Issues</a>, <a class="indexterm" href="happy.html">Making Happy Users</a>, <a class="indexterm" href="happy.html#id2564988">Technical Issues</a>, <a class="indexterm" href="happy.html#sbehap-locgrppol">The Local Group Policy</a>, <a class="indexterm" href="2000users.html#id2577378">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id2593024">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id2595114">Implementation</a>, <a class="indexterm" href="ntmigration.html#id2595255">NT4 Migration Using LDAP Backend</a>, <a class="indexterm" href="ntmigration.html#id2597714">NT4 Migration Using tdbsam Backend</a>, <a class="indexterm" href="HA.html#id2613424">Use and Location of BDCs</a></dt><dt>PDC/BDC ratio, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>PDF, <a class="indexterm" href="appendix.html#id2616632">The LDAP Account Manager</a></dt><dt>performance, <a class="indexterm" href="happy.html#id2564531">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id2608636">Questions and Answers</a>, <a class="indexterm" href="HA.html">Performance, Reliability, and Availability</a>, <a class="indexterm" href="HA.html#id2612034">Introduction</a>, <a class="indexterm" href="HA.html#id2612997">Network Collisions</a></dt><dt>performance degradation, <a class="indexterm" href="kerberos.html#id2607210">Override Controls</a>, <a class="indexterm" href="HA.html#id2613096">Samba Configuration</a></dt><dt>Perl, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a>, <a class="indexterm" href="appendix.html#id2616632">The LDAP Account Manager</a></dt><dt>permission, <a class="indexterm" href="kerberos.html#id2607372">Share Point Directory and File Permissions</a></dt><dt>permissions, <a class="indexterm" href="simple.html#id2544190">Implementation</a>, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2606410">Share Access Controls</a>, <a class="indexterm" href="kerberos.html#id2606898">Checkpoint Controls</a>, <a class="indexterm" href="kerberos.html#id2607372">Share Point Directory and File Permissions</a>, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dd><dl><dt>excessive, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>group, <a class="indexterm" href="kerberos.html#id2607372">Share Point Directory and File Permissions</a></dt><dt>user, <a class="indexterm" href="kerberos.html#id2607372">Share Point Directory and File Permissions</a></dt></dl></dd><dt>Permissions, <a class="indexterm" href="kerberos.html#id2607829">Using the MMC Computer Management Interface</a></dt><dt>permits, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>permitted group, <a class="indexterm" href="kerberos.html#id2607829">Using the MMC Computer Management Interface</a></dt><dt>PHP, <a class="indexterm" href="appendix.html#id2616632">The LDAP Account Manager</a></dt><dt>PHP4, <a class="indexterm" href="appendix.html#id2616632">The LDAP Account Manager</a></dt><dt>pile-driver, <a class="indexterm" href="kerberos.html#id2606759">Share Definition Controls</a></dt><dt>ping, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>pitfalls, <a class="indexterm" href="appendix.html#id2616632">The LDAP Account Manager</a></dt><dt>plain-text, <a class="indexterm" href="DomApps.html#id2611515">Questions and Answers</a></dt><dt>Pluggable Authentication Modules (see PAM)</dt><dt>policy, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a></dt><dt>poor performance, <a class="indexterm" href="HA.html#id2612122">Dissection and Discussion</a></dt><dt>POP3, <a class="indexterm" href="nw4migration.html#id2599440">Technical Issues</a></dt><dt>Posix, <a class="indexterm" href="simple.html#id2543979">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#id2564988">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id2595114">Implementation</a>, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a>, <a class="indexterm" href="appendix.html#id2616632">The LDAP Account Manager</a></dt><dt>POSIX, <a class="indexterm" href="happy.html#id2564154">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a></dt><dt>Posix accounts, <a class="indexterm" href="happy.html#id2569962">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a></dt><dt>Posix ACLs, <a class="indexterm" href="kerberos.html#id2607775">Managing Windows 200x ACLs</a></dt><dt>PosixAccount, <a class="indexterm" href="happy.html#id2569962">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>posixAccount, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a></dt><dt>Postfix, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a></dt><dt>Postscript, <a class="indexterm" href="happy.html#id2565953">Installation of Printer Driver Auto-Download</a></dt><dt>powers, <a class="indexterm" href="kerberos.html#id2606759">Share Definition Controls</a></dt><dt>practices, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a></dt><dt>precaution, <a class="indexterm" href="upgrades.html#id2591231">Introduction</a></dt><dt>presence and leadership, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>price paid, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a></dt><dt>primary group, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="kerberos.html#id2607372">Share Point Directory and File Permissions</a></dt><dt>principals, <a class="indexterm" href="kerberos.html#id2606064">Kerberos Exposed</a></dt><dt>print filter, <a class="indexterm" href="small.html#id2548369">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id2559494">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>print queue, <a class="indexterm" href="simple.html#id2543849">Charity Administration Office</a>, <a class="indexterm" href="simple.html#id2543979">Dissection and Discussion</a></dt><dt>print spooler, <a class="indexterm" href="simple.html#id2543849">Charity Administration Office</a></dt><dt>Print Test Page, <a class="indexterm" href="happy.html#id2575764">Uploading Printer Drivers to Samba Servers</a></dt><dt>printcap name, <a class="indexterm" href="secure.html#id2552197">Implementation</a></dt><dt>printer validation, <a class="indexterm" href="small.html#id2550069">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>printers</dt><dd><dl><dt>Advanced, <a class="indexterm" href="happy.html#id2575764">Uploading Printer Drivers to Samba Servers</a></dt><dt>Default Settings, <a class="indexterm" href="happy.html#id2575764">Uploading Printer Drivers to Samba Servers</a></dt><dt>General, <a class="indexterm" href="happy.html#id2575764">Uploading Printer Drivers to Samba Servers</a></dt><dt>Properties, <a class="indexterm" href="happy.html#id2575764">Uploading Printer Drivers to Samba Servers</a></dt><dt>Security, <a class="indexterm" href="happy.html#id2575764">Uploading Printer Drivers to Samba Servers</a></dt><dt>Sharing, <a class="indexterm" href="happy.html#id2575764">Uploading Printer Drivers to Samba Servers</a></dt></dl></dd><dt>printing, <a class="indexterm" href="secure.html#id2552197">Implementation</a></dt><dd><dl><dt>drag-and-drop, <a class="indexterm" href="happy.html#id2565953">Installation of Printer Driver Auto-Download</a>, <a class="indexterm" href="happy.html#id2575764">Uploading Printer Drivers to Samba Servers</a></dt><dt>dumb, <a class="indexterm" href="happy.html#id2565953">Installation of Printer Driver Auto-Download</a></dt><dt>point-n-click, <a class="indexterm" href="happy.html#id2565953">Installation of Printer Driver Auto-Download</a></dt><dt>raw, <a class="indexterm" href="simple.html#id2543979">Dissection and Discussion</a></dt></dl></dd><dt>privacy, <a class="indexterm" href="2000users.html#id2577725">Identity Management Needs</a></dt><dt>Privilege Attribute Certificates (see PAC)</dt><dt>privilege controls, <a class="indexterm" href="kerberos.html#id2607372">Share Point Directory and File Permissions</a></dt><dt>privileged pipe, <a class="indexterm" href="DomApps.html#id2610240">Samba Configuration</a></dt><dt>privileges, <a class="indexterm" href="2000users.html#id2577725">Identity Management Needs</a>, <a class="indexterm" href="upgrades.html#id2593762">Updating from Samba Versions after 3.0.6 to a Current Release</a>, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2606759">Share Definition Controls</a></dt><dt>problem report, <a class="indexterm" href="ch14.html#id2614102">Free Support</a></dt><dt>problem resolution, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>product defects, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a></dt><dt>professional support, <a class="indexterm" href="ch14.html#id2614102">Free Support</a></dt><dt>profile</dt><dd><dl><dt>default, <a class="indexterm" href="happy.html#id2564394">Assignment Tasks</a></dt><dt>mandatory, <a class="indexterm" href="2000users.html#id2577378">The Nature of Windows Networking Protocols</a></dt><dt>roaming, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>profile path, <a class="indexterm" href="ntmigration.html#id2594765">Technical Issues</a></dt><dt>profile share, <a class="indexterm" href="secure.html#id2552197">Implementation</a></dt><dt>profiles, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a></dt><dt>profiles share, <a class="indexterm" href="ntmigration.html#id2594579">Dissection and Discussion</a></dt><dt>programmer, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a></dt><dt>project, <a class="indexterm" href="ch14.html#id2614102">Free Support</a></dt><dt>project maintainers, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>Properties, <a class="indexterm" href="kerberos.html#id2607829">Using the MMC Computer Management Interface</a></dt><dt>proprietary, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>protected, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>protection, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>protocol</dt><dd><dl><dt>negotiation, <a class="indexterm" href="2000users.html#id2577378">The Nature of Windows Networking Protocols</a></dt></dl></dd><dt>protocol analysis, <a class="indexterm" href="primer.html#id2618507">Requirements and Notes</a></dt><dt>protocols, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>provided services, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>proxy, <a class="indexterm" href="DomApps.html#id2609296">Assignment Tasks</a>, <a class="indexterm" href="DomApps.html#id2609429">Technical Issues</a></dt><dt>PST file, <a class="indexterm" href="happy.html#id2575269">Configuration of MS Outlook to Relocate PST File</a></dt><dt>public specifications, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>purchase support, <a class="indexterm" href="ch14.html#id2614102">Free Support</a></dt></dl></div><div class="indexdiv"><h3>Q</h3><dl><dt>Qbasic, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a></dt><dt>qualified problem, <a class="indexterm" href="ch14.html#id2614102">Free Support</a></dt></dl></div><div class="indexdiv"><h3>R</h3><dl><dt>RAID, <a class="indexterm" href="secure.html#id2551990">Hardware Requirements</a></dt><dt>RAID controllers, <a class="indexterm" href="HA.html#id2613671">Hardware Problems</a></dt><dt>Raw Print Through, <a class="indexterm" href="happy.html#id2565953">Installation of Printer Driver Auto-Download</a></dt><dt>raw printing, <a class="indexterm" href="small.html#id2548369">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id2559494">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>Rbase, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a></dt><dt>rcldap, <a class="indexterm" href="2000users.html#id2578207">Implementation</a></dt><dt>realm, <a class="indexterm" href="unixclients.html#id2587908">IDMAP_RID with Winbind</a>, <a class="indexterm" href="unixclients.html#id2588512">IDMAP Storage in LDAP using Winbind</a>, <a class="indexterm" href="DomApps.html#id2609852">Kerberos Configuration</a></dt><dt>recognize, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>record locking, <a class="indexterm" href="appendix.html#id2618109">Microsoft Access</a></dt><dt>recursively, <a class="indexterm" href="kerberos.html#id2608291">Setting Posix ACLs in UNIX/Linux</a></dt><dt>Red Hat, <a class="indexterm" href="simple.html#id2543078">Drafting Office</a>, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>Red Hat Fedora Linux, <a class="indexterm" href="DomApps.html#id2610240">Samba Configuration</a></dt><dt>Red Hat Linux, <a class="indexterm" href="simple.html#id2543979">Dissection and Discussion</a>, <a class="indexterm" href="simple.html#AccountingOffice">Accounting Office</a>, <a class="indexterm" href="happy.html#id2567062">Samba Server Implementation</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="2000users.html#id2578207">Implementation</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id2609603">Implementation</a>, <a class="indexterm" href="DomApps.html#id2610240">Samba Configuration</a></dt><dt>redirected folders, <a class="indexterm" href="happy.html#id2565500">Roaming Profile Background</a>, <a class="indexterm" href="2000users.html#id2577378">The Nature of Windows Networking Protocols</a></dt><dt>refereed standards, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>regedit, <a class="indexterm" href="simple.html#id2544190">Implementation</a></dt><dt>regedt32, <a class="indexterm" href="happy.html#id2565800">Profile Changes</a>, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>registry, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a></dt><dd><dl><dt>keys</dt><dd><dl><dt>SAM, <a class="indexterm" href="ntmigration.html#id2594579">Dissection and Discussion</a></dt><dt>SECURITY, <a class="indexterm" href="ntmigration.html#id2594579">Dissection and Discussion</a></dt></dl></dd></dl></dd><dt>registry change, <a class="indexterm" href="kerberos.html#id2608636">Questions and Answers</a></dt><dt>Registry Editor, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>registry hacks, <a class="indexterm" href="kerberos.html#id2608636">Questions and Answers</a></dt><dt>registry keys, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>reimburse, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a></dt><dt>rejected, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="kerberos.html#id2606410">Share Access Controls</a></dt><dt>rejoin, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a></dt><dt>reliability, <a class="indexterm" href="HA.html">Performance, Reliability, and Availability</a></dt><dt>remote announce, <a class="indexterm" href="HA.html#id2612824">Routed Networks</a></dt><dt>remote browse sync, <a class="indexterm" href="HA.html#id2612824">Routed Networks</a></dt><dt>remote procedure call (see RPC)</dt><dt>replicate, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a>, <a class="indexterm" href="HA.html#id2613625">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></dt><dt>replicated, <a class="indexterm" href="2000users.html#id2576972">Dissection and Discussion</a></dt><dt>requesting payment, <a class="indexterm" href="ch14.html#id2614102">Free Support</a></dt><dt>resilient, <a class="indexterm" href="HA.html#id2612593">Guidelines for Reliable Samba Operation</a></dt><dt>resolution, <a class="indexterm" href="upgrades.html#id2593865">Replacing a Domain Member Server</a></dt><dt>resolve, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a>, <a class="indexterm" href="HA.html#id2612632">Bad Hostnames</a></dt><dt>response, <a class="indexterm" href="unixclients.html#id2587908">IDMAP_RID with Winbind</a></dt><dt>responsibility, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a></dt><dt>responsible, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>restrict anonymous, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>restricted export, <a class="indexterm" href="kerberos.html#id2606064">Kerberos Exposed</a></dt><dt>Restrictive security, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>reverse DNS, <a class="indexterm" href="DomApps.html#id2609852">Kerberos Configuration</a></dt><dt>rfc2307bis, <a class="indexterm" href="unixclients.html#id2589106">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a></dt><dt>RID, <a class="indexterm" href="unixclients.html#id2587908">IDMAP_RID with Winbind</a>, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a></dt><dt>risk, <a class="indexterm" href="secure.html#id2551704">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a></dt><dt>road-map, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dd><dl><dt>published, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt></dl></dd><dt>roaming profile, <a class="indexterm" href="happy.html#id2564988">Technical Issues</a>, <a class="indexterm" href="happy.html#id2565500">Roaming Profile Background</a>, <a class="indexterm" href="happy.html#id2574027">Configuring Profile Directories</a>, <a class="indexterm" href="2000users.html#id2577284">User Needs</a>, <a class="indexterm" href="2000users.html#id2581512">Questions and Answers</a></dt><dt>roaming profiles, <a class="indexterm" href="secure.html#id2551704">Technical Issues</a>, <a class="indexterm" href="secure.html#id2552197">Implementation</a>, <a class="indexterm" href="happy.html#id2565500">Roaming Profile Background</a></dt><dt>routed network, <a class="indexterm" href="HA.html#id2613424">Use and Location of BDCs</a></dt><dt>router, <a class="indexterm" href="small.html#id2548369">Implementation</a></dt><dt>routers, <a class="indexterm" href="2000users.html#id2581512">Questions and Answers</a>, <a class="indexterm" href="HA.html#id2612824">Routed Networks</a></dt><dt>RPC, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="kerberos.html#id2606064">Kerberos Exposed</a></dt><dt>rpc, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a></dt><dt>rpcclient, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a></dt><dt>RPM, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="nw4migration.html#id2599364">Dissection and Discussion</a></dt><dd><dl><dt>install, <a class="indexterm" href="simple.html#id2543220">Implementation</a></dt></dl></dd><dt>rpm, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a class="indexterm" href="appendix.html#id2615028">Samba System File Location</a></dt><dt>RPMs, <a class="indexterm" href="DomApps.html#id2610240">Samba Configuration</a></dt><dt>rpms, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>rsync, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a>, <a class="indexterm" href="HA.html#id2613625">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></dt><dt>rsyncd.conf, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a></dt><dt>run-time control files, <a class="indexterm" href="appendix.html#id2615028">Samba System File Location</a></dt></dl></div><div class="indexdiv"><h3>S</h3><dl><dt>safe-guards, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>SAM, <a class="indexterm" href="ntmigration.html#id2594579">Dissection and Discussion</a></dt><dt>samba, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dd><dl><dt>starting samba, <a class="indexterm" href="simple.html#id2543220">Implementation</a></dt></dl></dd><dt>Samba, <a class="indexterm" href="DomApps.html#id2610240">Samba Configuration</a></dt><dt>Samba accounts, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a></dt><dt>samba cluster, <a class="indexterm" href="HA.html#id2612034">Introduction</a></dt><dt>samba control script, <a class="indexterm" href="appendix.html#id2615448">Starting Samba</a></dt><dt>Samba Domain, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a></dt><dt>Samba Domain server, <a class="indexterm" href="kerberos.html#id2607829">Using the MMC Computer Management Interface</a></dt><dt>Samba RPM Packages, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></dt><dt>Samba Tea, <a class="indexterm" href="DomApps.html#id2610240">Samba Configuration</a></dt><dt>sambaDomainName, <a class="indexterm" href="ntmigration.html#id2595255">NT4 Migration Using LDAP Backend</a></dt><dt>sambaGroupMapping, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a></dt><dt>SambaSAMAccount, <a class="indexterm" href="happy.html#id2564154">Regarding LDAP Directories and Windows Computer Accounts</a></dt><dt>SambaSamAccount, <a class="indexterm" href="happy.html#id2569962">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>sambaSamAccount, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a></dt><dt>SambaXP conference, <a class="indexterm" href="DomApps.html#id2611515">Questions and Answers</a></dt><dt>SAN, <a class="indexterm" href="HA.html#id2613521">For Scalability, Use SAN-Based Storage on Samba Servers</a></dt><dt>SAS, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a></dt><dt>scalability, <a class="indexterm" href="HA.html#id2612034">Introduction</a></dt><dt>scalable, <a class="indexterm" href="2000users.html#id2577725">Identity Management Needs</a></dt><dt>schannel, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2608502">Key Points Learned</a>, <a class="indexterm" href="kerberos.html#id2608636">Questions and Answers</a></dt><dt>schema, <a class="indexterm" href="unixclients.html#id2589106">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id2593358">Samba-2.x with LDAP Support</a>, <a class="indexterm" href="upgrades.html#id2593683">Updating from Samba Versions between 3.0.6 and 3.0.10</a></dt><dt>scripts, <a class="indexterm" href="appendix.html#id2616632">The LDAP Account Manager</a></dt><dt>secondary group, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>secret, <a class="indexterm" href="kerberos.html#id2606064">Kerberos Exposed</a></dt><dt>secrets.tdb, <a class="indexterm" href="happy.html#id2564988">Technical Issues</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#sbeug1">Location of config files</a></dt><dt>secure, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a></dt><dt>secure account password, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a></dt><dt>secure connections, <a class="indexterm" href="appendix.html#id2616632">The LDAP Account Manager</a></dt><dt>secure networking, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>secure networking protocols, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>security, <a class="indexterm" href="happy.html#id2564988">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a>, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a>, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2607372">Share Point Directory and File Permissions</a>, <a class="indexterm" href="kerberos.html#id2608636">Questions and Answers</a></dt><dd><dl><dt>identifier, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a></dt><dt>share mode, <a class="indexterm" href="simple.html#id2543979">Dissection and Discussion</a></dt><dt>user mode, <a class="indexterm" href="simple.html#id2546232">Dissection and Discussion</a></dt></dl></dd><dt>Security, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2607829">Using the MMC Computer Management Interface</a></dt><dt>Security Account Manager (see SAM)</dt><dt>security controls, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>security descriptors, <a class="indexterm" href="ntmigration.html#id2594579">Dissection and Discussion</a></dt><dt>security fixes, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>security updates, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>SerNet, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id2610240">Samba Configuration</a></dt><dt>server</dt><dd><dl><dt>domain member, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a></dt><dt>stand-alone, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a></dt></dl></dd><dt>service, <a class="indexterm" href="2000users.html#id2578207">Implementation</a></dt><dd><dl><dt>smb</dt><dd><dl><dt>start, <a class="indexterm" href="Big500users.html#ch5-domsvrspec">Configuration Specific to Domain Member Servers: BLDG1, BLDG2</a></dt></dl></dd></dl></dd><dt>Service Packs, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a></dt><dt>services, <a class="indexterm" href="DomApps.html#id2611455">Key Points Learned</a></dt><dt>services provided, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>session setup, <a class="indexterm" href="primer.html#id2620118">Simple Windows Client Connection Characteristics</a>, <a class="indexterm" href="primer.html#id2620620">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>Session Setup, <a class="indexterm" href="primer.html#id2620118">Simple Windows Client Connection Characteristics</a></dt><dt>SessionSetUpAndX, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a></dt><dt>set primary group script, <a class="indexterm" href="upgrades.html#id2593024">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>setfacl, <a class="indexterm" href="kerberos.html#id2608291">Setting Posix ACLs in UNIX/Linux</a></dt><dt>severely degrade, <a class="indexterm" href="HA.html#id2613096">Samba Configuration</a></dt><dt>SFU, <a class="indexterm" href="unixclients.html#id2589392">IDMAP, Active Directory, and MS Services for UNIX 3.5</a></dt><dt>SGID, <a class="indexterm" href="simple.html#id2543979">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id2607372">Share Point Directory and File Permissions</a>, <a class="indexterm" href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></dt><dt>shadow-utils, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a></dt><dt>Share Access Controls, <a class="indexterm" href="kerberos.html#id2606410">Share Access Controls</a></dt><dt>share ACLs, <a class="indexterm" href="kerberos.html#id2608636">Questions and Answers</a></dt><dt>share definition, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>Share Definition</dt><dd><dl><dt>Controls, <a class="indexterm" href="kerberos.html#id2606759">Share Definition Controls</a></dt></dl></dd><dt>share definition controls, <a class="indexterm" href="kerberos.html#id2606759">Share Definition Controls</a>, <a class="indexterm" href="kerberos.html#id2606898">Checkpoint Controls</a>, <a class="indexterm" href="kerberos.html#id2607372">Share Point Directory and File Permissions</a>, <a class="indexterm" href="kerberos.html#id2608636">Questions and Answers</a></dt><dt>share level access controls, <a class="indexterm" href="kerberos.html#id2608636">Questions and Answers</a></dt><dt>share level ACL, <a class="indexterm" href="kerberos.html#id2608636">Questions and Answers</a></dt><dt>Share Permissions, <a class="indexterm" href="kerberos.html#id2606410">Share Access Controls</a></dt><dt>shared resource, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2608291">Setting Posix ACLs in UNIX/Linux</a></dt><dt>shares, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>SID, <a class="indexterm" href="secure.html#ch4wincfg">Windows Client Configuration</a>, <a class="indexterm" href="happy.html#id2564154">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="2000users.html#id2577725">Identity Management Needs</a>, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2587908">IDMAP_RID with Winbind</a>, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id2592224">Change of Workgroup (Domain) Name</a>, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a>, <a class="indexterm" href="appendix.html#id2616053">Initialization of the LDAP Database</a></dt><dt>side effects, <a class="indexterm" href="kerberos.html#id2607775">Managing Windows 200x ACLs</a></dt><dt>Sign'n'seal, <a class="indexterm" href="kerberos.html#id2608502">Key Points Learned</a>, <a class="indexterm" href="kerberos.html#id2608636">Questions and Answers</a></dt><dt>silent return, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>simple, <a class="indexterm" href="HA.html#id2612122">Dissection and Discussion</a></dt><dt>Single Sign-On (see SSO)</dt><dt>slapcat, <a class="indexterm" href="happy.html#id2569962">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a></dt><dt>slapd, <a class="indexterm" href="happy.html#id2566377">Debugging LDAP</a></dt><dt>slapd.conf, <a class="indexterm" href="ntmigration.html#id2595255">NT4 Migration Using LDAP Backend</a></dt><dt>slave, <a class="indexterm" href="2000users.html#id2576972">Dissection and Discussion</a></dt><dt>slow logon, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>slow network, <a class="indexterm" href="HA.html#id2613671">Hardware Problems</a></dt><dt>slurpd, <a class="indexterm" href="2000users.html#id2578207">Implementation</a>, <a class="indexterm" href="2000users.html#id2581512">Questions and Answers</a></dt><dt>smart printing, <a class="indexterm" href="happy.html#id2564531">Dissection and Discussion</a></dt><dt>SMB, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a></dt><dt>SMB passwords, <a class="indexterm" href="2000users.html#id2578207">Implementation</a></dt><dt>SMB/CIFS, <a class="indexterm" href="DomApps.html#id2611515">Questions and Answers</a></dt><dt>smbclient, <a class="indexterm" href="simple.html#validate1">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="happy.html#id2569962">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="DomApps.html#id2611515">Questions and Answers</a></dt><dt>smbd, <a class="indexterm" href="simple.html#validate1">Validation</a>, <a class="indexterm" href="simple.html#id2544190">Implementation</a>, <a class="indexterm" href="small.html#id2550069">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#sbeug1">Location of config files</a>, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="upgrades.html#id2593865">Replacing a Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id2610240">Samba Configuration</a>, <a class="indexterm" href="DomApps.html#id2611515">Questions and Answers</a>, <a class="indexterm" href="appendix.html#id2615448">Starting Samba</a></dt><dd><dl><dt>location of files, <a class="indexterm" href="appendix.html#id2615028">Samba System File Location</a></dt></dl></dd><dt>smbfs, <a class="indexterm" href="HA.html#id2612122">Dissection and Discussion</a></dt><dt>smbldap-groupadd, <a class="indexterm" href="happy.html#id2569962">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a></dt><dt>smbldap-groupmod, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a></dt><dt>smbldap-passwd, <a class="indexterm" href="happy.html#id2569962">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>smbldap-populate, <a class="indexterm" href="happy.html#id2569962">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>smbldap-tools, <a class="indexterm" href="ntmigration.html#id2595255">NT4 Migration Using LDAP Backend</a>, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a>, <a class="indexterm" href="appendix.html#id2616632">The LDAP Account Manager</a></dt><dt>smbldap-tools updating, <a class="indexterm" href="ntmigration.html#id2595255">NT4 Migration Using LDAP Backend</a></dt><dt>smbldap-useradd, <a class="indexterm" href="happy.html#id2569962">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="2000users.html#id2578207">Implementation</a></dt><dt>smbldap-usermod, <a class="indexterm" href="happy.html#id2569962">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a></dt><dt>smbmnt, <a class="indexterm" href="HA.html#id2612122">Dissection and Discussion</a></dt><dt>smbmount, <a class="indexterm" href="HA.html#id2612122">Dissection and Discussion</a></dt><dt>smbpasswd, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id2548136">Technical Issues</a>, <a class="indexterm" href="small.html#id2548369">Implementation</a>, <a class="indexterm" href="secure.html#id2551704">Technical Issues</a>, <a class="indexterm" href="secure.html#id2553134">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2559494">Server Preparation: All Servers</a>, <a class="indexterm" href="Big500users.html#id2560072">Configuration for Server: MASSIVE</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="happy.html#id2569962">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a class="indexterm" href="2000users.html#id2576972">Dissection and Discussion</a>, <a class="indexterm" href="2000users.html#id2578207">Implementation</a>, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a>, <a class="indexterm" href="upgrades.html">Updating Samba-3</a>, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id2593024">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id2594765">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a>, <a class="indexterm" href="DomApps.html">Integrating Additional Services</a></dt><dt>smbumnt, <a class="indexterm" href="HA.html#id2612122">Dissection and Discussion</a></dt><dt>smbumount, <a class="indexterm" href="HA.html#id2612122">Dissection and Discussion</a></dt><dt>SMTP, <a class="indexterm" href="nw4migration.html#id2599440">Technical Issues</a></dt><dt>snap-shot, <a class="indexterm" href="ntmigration.html#id2594579">Dissection and Discussion</a></dt><dt>socket address, <a class="indexterm" href="HA.html#id2613096">Samba Configuration</a></dt><dt>socket options, <a class="indexterm" href="HA.html#id2613096">Samba Configuration</a></dt><dt>software, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a></dt><dt>solve, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a></dt><dt>source code, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a></dt><dt>SPNEGO, <a class="indexterm" href="primer.html#id2620620">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>SQL, <a class="indexterm" href="2000users.html#id2576972">Dissection and Discussion</a>, <a class="indexterm" href="2000users.html#id2581512">Questions and Answers</a></dt><dt>Squid, <a class="indexterm" href="DomApps.html#id2609603">Implementation</a>, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a class="indexterm" href="DomApps.html#id2610240">Samba Configuration</a>, <a class="indexterm" href="DomApps.html#id2611058">Squid Configuration</a></dt><dt>squid, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a class="indexterm" href="DomApps.html#id2610240">Samba Configuration</a></dt><dt>Squid proxy, <a class="indexterm" href="DomApps.html#id2609429">Technical Issues</a></dt><dt>SRVTOOLS.EXE, <a class="indexterm" href="secure.html#id2552197">Implementation</a>, <a class="indexterm" href="happy.html#id2574027">Configuring Profile Directories</a>, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2608636">Questions and Answers</a></dt><dt>SSL, <a class="indexterm" href="appendix.html#id2616632">The LDAP Account Manager</a></dt><dt>stand-alone server, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a></dt><dt>starting CUPS, <a class="indexterm" href="simple.html#id2544190">Implementation</a>, <a class="indexterm" href="small.html#id2548369">Implementation</a>, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a>, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dt>starting dhcpd, <a class="indexterm" href="small.html#id2548369">Implementation</a>, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a>, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dt>starting samba, <a class="indexterm" href="simple.html#id2543220">Implementation</a>, <a class="indexterm" href="simple.html#id2544190">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id2548369">Implementation</a>, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a>, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dd><dl><dt>nmbd, <a class="indexterm" href="appendix.html#id2615448">Starting Samba</a></dt><dt>smbd, <a class="indexterm" href="appendix.html#id2615448">Starting Samba</a></dt><dt>winbindd, <a class="indexterm" href="appendix.html#id2615448">Starting Samba</a></dt></dl></dd><dt>startingCUPS, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a></dt><dt>startup script, <a class="indexterm" href="appendix.html#id2615448">Starting Samba</a></dt><dt>sticky bit, <a class="indexterm" href="small.html#id2548369">Implementation</a></dt><dt>storage capacity, <a class="indexterm" href="secure.html#id2551990">Hardware Requirements</a></dt><dt>strategic, <a class="indexterm" href="ntmigration.html#id2594765">Technical Issues</a></dt><dt>strategy, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a></dt><dt>straw-man, <a class="indexterm" href="kerberos.html">Active Directory, Kerberos, and Security</a></dt><dt>strict sync, <a class="indexterm" href="HA.html#id2613096">Samba Configuration</a></dt><dt>stripped, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></dt><dt>strong cryptography, <a class="indexterm" href="kerberos.html#id2606064">Kerberos Exposed</a></dt><dt>subscription, <a class="indexterm" href="ch14.html#id2614102">Free Support</a></dt><dt>SUID, <a class="indexterm" href="simple.html#id2543979">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id2608636">Questions and Answers</a>, <a class="indexterm" href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></dt><dt>Sun ONE Identity Server, <a class="indexterm" href="happy.html#id2564531">Dissection and Discussion</a></dt><dt>super daemon, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a></dt><dt>support, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a>, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>survey, <a class="indexterm" href="unixclients.html">Adding Domain Member Servers and Clients</a></dt><dt>SUSE, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>SUSE Enterprise Linux Server, <a class="indexterm" href="simple.html#id2543849">Charity Administration Office</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="DomApps.html#id2609603">Implementation</a></dt><dt>SUSE Linux, <a class="indexterm" href="simple.html#id2543979">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#id2567062">Samba Server Implementation</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="2000users.html#id2578207">Implementation</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id2609603">Implementation</a>, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>SWAT, <a class="indexterm" href="appendix.html#id2615028">Samba System File Location</a></dt><dt>sync always, <a class="indexterm" href="HA.html#id2613096">Samba Configuration</a></dt><dt>synchronization, <a class="indexterm" href="DomApps.html#id2609852">Kerberos Configuration</a>, <a class="indexterm" href="HA.html#id2613521">For Scalability, Use SAN-Based Storage on Samba Servers</a></dt><dt>synchronize, <a class="indexterm" href="2000users.html#id2577284">User Needs</a>, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a></dt><dt>synchronized, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a></dt><dt>syslog, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>system level logins, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a></dt><dt>system security, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt></dl></div><div class="indexdiv"><h3>T</h3><dl><dt>tattooing, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a></dt><dt>TCP/IP, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a></dt><dt>tdbdump, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="ntmigration.html#id2595255">NT4 Migration Using LDAP Backend</a></dt><dt>tdbsam, <a class="indexterm" href="secure.html#id2551704">Technical Issues</a>, <a class="indexterm" href="secure.html#id2552197">Implementation</a>, <a class="indexterm" href="Big500users.html">The 500-User Office</a>, <a class="indexterm" href="happy.html#id2564394">Assignment Tasks</a>, <a class="indexterm" href="2000users.html#id2576972">Dissection and Discussion</a>, <a class="indexterm" href="2000users.html#id2578207">Implementation</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id2593024">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="upgrades.html#id2593683">Updating from Samba Versions between 3.0.6 and 3.0.10</a>, <a class="indexterm" href="ntmigration.html#id2594765">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a></dt><dt>testparm, <a class="indexterm" href="small.html#id2550069">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="HA.html#id2613096">Samba Configuration</a></dt><dt>ticket, <a class="indexterm" href="DomApps.html#id2610240">Samba Configuration</a></dt><dt>time server, <a class="indexterm" href="secure.html#id2552197">Implementation</a></dt><dt>Tivoli Directory Server, <a class="indexterm" href="happy.html#id2564531">Dissection and Discussion</a></dt><dt>TLS, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a></dt><dt>token, <a class="indexterm" href="DomApps.html#id2609429">Technical Issues</a></dt><dt>tool, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a></dt><dt>TOSHARG2, <a class="indexterm" href="simple.html#id2544190">Implementation</a></dt><dt>track record, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a></dt><dt>traffic collisions, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>transaction processing, <a class="indexterm" href="2000users.html#id2576972">Dissection and Discussion</a></dt><dt>transactional, <a class="indexterm" href="2000users.html#id2581512">Questions and Answers</a></dt><dt>transfer, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a></dt><dt>translate, <a class="indexterm" href="kerberos.html#id2607775">Managing Windows 200x ACLs</a></dt><dt>traverse, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt><dt>tree, <a class="indexterm" href="nw4migration.html#id2599364">Dissection and Discussion</a></dt><dt>Tree Connect, <a class="indexterm" href="primer.html#id2620118">Simple Windows Client Connection Characteristics</a></dt><dt>trust account, <a class="indexterm" href="happy.html#id2564154">Regarding LDAP Directories and Windows Computer Accounts</a></dt><dt>trusted computing, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a></dt><dt>Trusted Domains, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a></dt><dt>trusted domains, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a></dt><dt>trusted third-party, <a class="indexterm" href="kerberos.html#id2606064">Kerberos Exposed</a></dt><dt>trusting, <a class="indexterm" href="kerberos.html#id2606064">Kerberos Exposed</a></dt><dt>turn-around time, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt></dl></div><div class="indexdiv"><h3>U</h3><dl><dt>UDP</dt><dd><dl><dt>broadcast, <a class="indexterm" href="HA.html#id2612824">Routed Networks</a></dt></dl></dd><dt>UID, <a class="indexterm" href="simple.html#id2543979">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#id2564154">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="happy.html#id2564988">Technical Issues</a>, <a class="indexterm" href="2000users.html#id2578207">Implementation</a>, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a></dt><dt>un-join, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a></dt><dt>unauthorized activities, <a class="indexterm" href="kerberos.html#id2606064">Kerberos Exposed</a></dt><dt>UNC name, <a class="indexterm" href="2000users.html#id2581512">Questions and Answers</a></dt><dt>unencrypted, <a class="indexterm" href="appendix.html#id2616632">The LDAP Account Manager</a></dt><dt>Unicast, <a class="indexterm" href="2000users.html#id2577378">The Nature of Windows Networking Protocols</a></dt><dt>unicode, <a class="indexterm" href="upgrades.html#id2592490">International Language Support</a></dt><dt>Universal Naming Convention (see UNC name)</dt><dt>UNIX, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a></dt><dd><dl><dt>groups, <a class="indexterm" href="small.html#id2548136">Technical Issues</a>, <a class="indexterm" href="small.html#id2548369">Implementation</a></dt></dl></dd><dt>UNIX accounts, <a class="indexterm" href="happy.html#id2564988">Technical Issues</a></dt><dt>UNIX/Linux server, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>unix2dos, <a class="indexterm" href="secure.html#id2553134">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2560072">Configuration for Server: MASSIVE</a></dt><dt>unknown, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>unsupported software, <a class="indexterm" href="ch14.html#id2614320">Commercial Support</a></dt><dt>update, <a class="indexterm" href="upgrades.html#id2591231">Introduction</a>, <a class="indexterm" href="upgrades.html#id2591327">Cautions and Notes</a></dt><dt>updates, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a>, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>updating smbldap-tools, <a class="indexterm" href="ntmigration.html#id2595255">NT4 Migration Using LDAP Backend</a></dt><dt>upgrade, <a class="indexterm" href="upgrades.html#id2591231">Introduction</a>, <a class="indexterm" href="upgrades.html#id2591327">Cautions and Notes</a>, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a></dt><dt>uppercase, <a class="indexterm" href="ntmigration.html#id2595114">Implementation</a></dt><dt>user</dt><dd><dl><dt>management, <a class="indexterm" href="small.html#id2548369">Implementation</a>, <a class="indexterm" href="secure.html#id2553134">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2560072">Configuration for Server: MASSIVE</a></dt></dl></dd><dt>user account, <a class="indexterm" href="happy.html">Making Happy Users</a>, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>User and Group Controls, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>user credentials, <a class="indexterm" href="2000users.html#id2577725">Identity Management Needs</a>, <a class="indexterm" href="unixclients.html#id2589442">UNIX/Linux Client Domain Member</a></dt><dt>user errors, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a></dt><dt>user groups, <a class="indexterm" href="ch14.html#id2614102">Free Support</a></dt><dt>user identities, <a class="indexterm" href="unixclients.html#id2583237">Implementation</a></dt><dt>user logins, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a></dt><dt>user management, <a class="indexterm" href="secure.html#id2552197">Implementation</a></dt><dt>User Manager, <a class="indexterm" href="ntmigration.html#id2595255">NT4 Migration Using LDAP Backend</a></dt><dt>User Mode, <a class="indexterm" href="secure.html#id2552197">Implementation</a>, <a class="indexterm" href="primer.html#id2620118">Simple Windows Client Connection Characteristics</a>, <a class="indexterm" href="primer.html#id2620620">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>useradd, <a class="indexterm" href="simple.html#id2544190">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id2548369">Implementation</a>, <a class="indexterm" href="secure.html#id2553134">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2560072">Configuration for Server: MASSIVE</a>, <a class="indexterm" href="upgrades.html#id2593024">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>userdel, <a class="indexterm" href="upgrades.html#id2593024">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>usermod, <a class="indexterm" href="upgrades.html#id2593024">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id2595255">NT4 Migration Using LDAP Backend</a></dt><dt>username, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a></dt><dt>username map, <a class="indexterm" href="small.html#id2548369">Implementation</a>, <a class="indexterm" href="secure.html#id2553134">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2559494">Server Preparation: All Servers</a></dt><dt>UTF-8, <a class="indexterm" href="upgrades.html#id2592490">International Language Support</a></dt><dt>utilities, <a class="indexterm" href="DomApps.html#id2611515">Questions and Answers</a></dt></dl></div><div class="indexdiv"><h3>V</h3><dl><dt>valid users, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2606898">Checkpoint Controls</a>, <a class="indexterm" href="kerberos.html#id2608636">Questions and Answers</a></dt><dt>validate, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2606898">Checkpoint Controls</a></dt><dt>validated, <a class="indexterm" href="2000users.html#id2577725">Identity Management Needs</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a></dt><dt>validation, <a class="indexterm" href="simple.html#validate1">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="DomApps.html#id2611515">Questions and Answers</a></dt><dt>vampire, <a class="indexterm" href="ntmigration.html#id2598159">Questions and Answers</a></dt><dt>vendor, <a class="indexterm" href="kerberos.html#id2604384">Dissection and Discussion</a></dt><dt>vendors, <a class="indexterm" href="upgrades.html#id2593539">Updating a Samba-3 Installation</a></dt><dt>VFS modules, <a class="indexterm" href="appendix.html#id2615028">Samba System File Location</a></dt><dt>virus, <a class="indexterm" href="secure.html#id2552197">Implementation</a></dt><dt>VPN, <a class="indexterm" href="2000users.html#id2576904">Assignment Tasks</a></dt><dt>vulnerabilities, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a></dt></dl></div><div class="indexdiv"><h3>W</h3><dl><dt>wbinfo, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id2610240">Samba Configuration</a></dt><dt>weakness, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a></dt><dt>web</dt><dd><dl><dt>caching, <a class="indexterm" href="DomApps.html#id2609296">Assignment Tasks</a></dt><dt>proxying, <a class="indexterm" href="DomApps.html#id2609296">Assignment Tasks</a></dt></dl></dd><dt>Web</dt><dd><dl><dt>proxy, <a class="indexterm" href="DomApps.html#id2611515">Questions and Answers</a></dt><dd><dl><dt>access, <a class="indexterm" href="DomApps.html#id2611455">Key Points Learned</a></dt></dl></dd></dl></dd><dt>Web browsers, <a class="indexterm" href="DomApps.html#id2611455">Key Points Learned</a></dt><dt>WebClient, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>WHATSNEW.txt, <a class="indexterm" href="upgrades.html#id2593358">Samba-2.x with LDAP Support</a></dt><dt>white-pages, <a class="indexterm" href="nw4migration.html#id2599440">Technical Issues</a>, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a></dt><dt>wide-area, <a class="indexterm" href="2000users.html#id2577284">User Needs</a>, <a class="indexterm" href="2000users.html#id2577725">Identity Management Needs</a>, <a class="indexterm" href="2000users.html#id2581365">Key Points Learned</a>, <a class="indexterm" href="2000users.html#id2581512">Questions and Answers</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt><dt>wide-area network, <a class="indexterm" href="HA.html#id2613424">Use and Location of BDCs</a>, <a class="indexterm" href="HA.html#id2613625">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></dt><dt>winbind, <a class="indexterm" href="2000users.html#id2578207">Implementation</a>, <a class="indexterm" href="unixclients.html#id2582459">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a>, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id2609429">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id2610240">Samba Configuration</a>, <a class="indexterm" href="DomApps.html#id2610793">NSS Configuration</a></dt><dt>Winbind, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2604780">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2608502">Key Points Learned</a></dt><dt>winbind trusted domains only, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a></dt><dt>winbind use default domain, <a class="indexterm" href="kerberos.html#id2606898">Checkpoint Controls</a></dt><dt>winbindd, <a class="indexterm" href="small.html#id2550069">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="Big500users.html#id2558539">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="upgrades.html#id2593762">Updating from Samba Versions after 3.0.6 to a Current Release</a>, <a class="indexterm" href="upgrades.html#id2593865">Replacing a Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id2610240">Samba Configuration</a>, <a class="indexterm" href="DomApps.html#id2611515">Questions and Answers</a>, <a class="indexterm" href="appendix.html#id2615448">Starting Samba</a></dt><dt>winbindd_cache.tdb, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a></dt><dt>winbindd_idmap.tdb, <a class="indexterm" href="unixclients.html#id2582487">Technical Issues</a></dt><dt>Windows, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a></dt><dd><dl><dt>client, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a></dt><dt>NT, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a></dt></dl></dd><dt>Windows 2000 ACLs, <a class="indexterm" href="kerberos.html#id2607775">Managing Windows 200x ACLs</a></dt><dt>Windows 2003 Serve, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a></dt><dt>Windows 200x ACLs, <a class="indexterm" href="kerberos.html#id2608636">Questions and Answers</a></dt><dt>Windows accounts, <a class="indexterm" href="happy.html#id2564988">Technical Issues</a></dt><dt>Windows ACLs, <a class="indexterm" href="kerberos.html#id2608291">Setting Posix ACLs in UNIX/Linux</a></dt><dt>Windows Address Book, <a class="indexterm" href="nw4migration.html#id2599715">LDAP Server Configuration</a></dt><dt>Windows ADS Domain, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt><dt>Windows clients, <a class="indexterm" href="DomApps.html#id2611515">Questions and Answers</a></dt><dt>Windows Explorer, <a class="indexterm" href="simple.html#validate1">Validation</a></dt><dt>Windows explorer, <a class="indexterm" href="DomApps.html#id2611515">Questions and Answers</a></dt><dt>Windows security identifier (see SID)</dt><dt>Windows Servers, <a class="indexterm" href="kerberos.html#id2603717">Introduction</a></dt><dt>Windows Services for UNIX (see SUS)</dt><dt>Windows XP, <a class="indexterm" href="small.html#id2548021">Assignment Tasks</a></dt><dt>WINS, <a class="indexterm" href="simple.html#id2544190">Implementation</a>, <a class="indexterm" href="small.html#id2548136">Technical Issues</a>, <a class="indexterm" href="small.html#id2548369">Implementation</a>, <a class="indexterm" href="secure.html#ch4wincfg">Windows Client Configuration</a>, <a class="indexterm" href="Big500users.html#id2558539">Technical Issues</a>, <a class="indexterm" href="Big500users.html#ch5wincfg">Windows Client Configuration</a>, <a class="indexterm" href="2000users.html#id2577378">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="2000users.html#id2577725">Identity Management Needs</a>, <a class="indexterm" href="2000users.html#id2581512">Questions and Answers</a>, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dd><dl><dt>lookup, <a class="indexterm" href="unixclients.html#id2590071">Questions and Answers</a></dt><dt>name resolution, <a class="indexterm" href="HA.html#id2612824">Routed Networks</a></dt><dt>server, <a class="indexterm" href="happy.html">Making Happy Users</a>, <a class="indexterm" href="HA.html#id2612824">Routed Networks</a></dt></dl></dd><dt>WINS server, <a class="indexterm" href="Big500users.html">The 500-User Office</a>, <a class="indexterm" href="2000users.html#id2581512">Questions and Answers</a></dt><dt>WINS serving, <a class="indexterm" href="secure.html#id2552197">Implementation</a></dt><dt>wins support, <a class="indexterm" href="secure.html#id2552197">Implementation</a></dt><dt>wins.dat, <a class="indexterm" href="2000users.html#id2577725">Identity Management Needs</a>, <a class="indexterm" href="upgrades.html#id2593865">Replacing a Domain Member Server</a></dt><dt>Wireshark, <a class="indexterm" href="primer.html#id2618507">Requirements and Notes</a></dt><dt>wireshark, <a class="indexterm" href="primer.html#id2618846">Exercises</a></dt><dt>Word, <a class="indexterm" href="kerberos.html#id2607372">Share Point Directory and File Permissions</a></dt><dt>workgroup, <a class="indexterm" href="simple.html#id2543220">Implementation</a>, <a class="indexterm" href="upgrades.html#id2591431">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id2592224">Change of Workgroup (Domain) Name</a></dt><dt>Workgroup Announcement, <a class="indexterm" href="primer.html#id2619758">Findings</a></dt><dt>workstation, <a class="indexterm" href="unixclients.html#id2583237">Implementation</a></dt><dt>wrapper, <a class="indexterm" href="DomApps.html#id2611515">Questions and Answers</a></dt><dt>write lock, <a class="indexterm" href="appendix.html#id2618341">Opportunistic Locking Controls</a></dt></dl></div><div class="indexdiv"><h3>X</h3><dl><dt>xinetd, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a></dt><dt>XML, <a class="indexterm" href="2000users.html#id2576972">Dissection and Discussion</a></dt><dt>xmlsam, <a class="indexterm" href="2000users.html#id2578207">Implementation</a></dt></dl></div><div class="indexdiv"><h3>Y</h3><dl><dt>YaST, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dt>Yellow Pages, <a class="indexterm" href="2000users.html#id2577725">Identity Management Needs</a></dt><dt>yellow pages (see NIS)</dt></dl></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="go01.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> </td></tr><tr><td width="40%" align="left" valign="top">Glossary </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> </td></tr></table></div></body></html>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Index</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="go01.html" title="Glossary"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Index</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="go01.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> </td></tr></table><hr></div><div class="index"><div class="titlepage"><div><div><h2 class="title"><a name="id2623953"></a>Index</h2></div></div></div><div class="index"><div class="indexdiv"><h3>Symbols</h3><dl><dt>%LOGONSERVER%, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>%USERNAME%, <a class="indexterm" href="happy.html#id2565495">Roaming Profile Background</a>, <a class="indexterm" href="happy.html#id2565796">Profile Changes</a></dt><dt>%USERPROFILE%, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>/data/ldap, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>/etc/cups/mime.convs, <a class="indexterm" href="simple.html#id2544185">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a></dt><dt>/etc/cups/mime.types, <a class="indexterm" href="simple.html#id2544185">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a></dt><dt>/etc/dhcpd.conf, <a class="indexterm" href="small.html#id2548364">Implementation</a>, <a class="indexterm" href="small.html#id2550065">Validation</a>, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>/etc/exports, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></dt><dt>/etc/group, <a class="indexterm" href="happy.html#id2564983">Technical Issues</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="upgrades.html#id2593860">Replacing a Domain Member Server</a>, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a>, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>/etc/hosts, <a class="indexterm" href="simple.html#id2543216">Implementation</a>, <a class="indexterm" href="small.html#id2548364">Implementation</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="Big500users.html#id2559489">Server Preparation: All Servers</a>, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a>, <a class="indexterm" href="DomApps.html#id2609847">Kerberos Configuration</a>, <a class="indexterm" href="HA.html#id2612627">Bad Hostnames</a></dt><dt>/etc/krb5.conf, <a class="indexterm" href="unixclients.html#id2588507">IDMAP Storage in LDAP using Winbind</a>, <a class="indexterm" href="DomApps.html#id2609847">Kerberos Configuration</a></dt><dt>/etc/ldap.conf, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="unixclients.html#id2588507">IDMAP Storage in LDAP using Winbind</a>, <a class="indexterm" href="unixclients.html#id2589101">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a class="indexterm" href="ntmigration.html#id2595250">NT4 Migration Using LDAP Backend</a>, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a></dt><dt>/etc/mime.convs, <a class="indexterm" href="small.html#id2548364">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id2559489">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>/etc/mime.types, <a class="indexterm" href="small.html#id2548364">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id2559489">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>/etc/named.conf, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></dt><dt>/etc/nsswitch.conf, <a class="indexterm" href="small.html#id2548364">Implementation</a>, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="Big500users.html#id2560067">Configuration for Server: MASSIVE</a>, <a class="indexterm" href="Big500users.html#ch5-domsvrspec">Configuration Specific to Domain Member Servers: BLDG1, BLDG2</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#id2587903">IDMAP_RID with Winbind</a>, <a class="indexterm" href="unixclients.html#id2589101">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id2595250">NT4 Migration Using LDAP Backend</a></dt><dt>/etc/openldap/slapd.conf, <a class="indexterm" href="happy.html#id2566373">Debugging LDAP</a>, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a>, <a class="indexterm" href="2000users.html#id2578202">Implementation</a></dt><dt>/etc/passwd, <a class="indexterm" href="small.html#id2548364">Implementation</a>, <a class="indexterm" href="secure.html#id2553129">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2560067">Configuration for Server: MASSIVE</a>, <a class="indexterm" href="happy.html#id2569957">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id2593860">Replacing a Domain Member Server</a>, <a class="indexterm" href="ntmigration.html#id2594760">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id2599436">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2607367">Share Point Directory and File Permissions</a>, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a class="indexterm" href="primer.html#id2620350">Findings and Comments</a></dt><dt>/etc/rc.d/boot.local, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="Big500users.html#id2560067">Configuration for Server: MASSIVE</a></dt><dt>/etc/rc.d/rc.local, <a class="indexterm" href="small.html#id2548364">Implementation</a></dt><dt>/etc/resolv.conf, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a>, <a class="indexterm" href="Big500users.html#id2559489">Server Preparation: All Servers</a></dt><dt>/etc/samba, <a class="indexterm" href="appendix.html#id2615023">Samba System File Location</a></dt><dt>/etc/samba/secrets.tdb, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>/etc/samba/smbusers, <a class="indexterm" href="Big500users.html#id2559489">Server Preparation: All Servers</a></dt><dt>/etc/shadow, <a class="indexterm" href="upgrades.html#id2593860">Replacing a Domain Member Server</a>, <a class="indexterm" href="nw4migration.html#id2599436">Technical Issues</a></dt><dt>/etc/squid/squid.conf, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>/etc/syslog.conf, <a class="indexterm" href="happy.html#id2566373">Debugging LDAP</a></dt><dt>/etc/xinetd.d, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a>, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dt>/lib/libnss_ldap.so.2, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dt>/opt/IDEALX/sbin, <a class="indexterm" href="ntmigration.html#id2595250">NT4 Migration Using LDAP Backend</a></dt><dt>/proc/sys/net/ipv4/ip_forward, <a class="indexterm" href="small.html#id2548364">Implementation</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a></dt><dt>/usr/bin, <a class="indexterm" href="appendix.html#id2615023">Samba System File Location</a></dt><dt>/usr/lib/samba, <a class="indexterm" href="appendix.html#id2615023">Samba System File Location</a></dt><dt>/usr/local, <a class="indexterm" href="appendix.html#id2615023">Samba System File Location</a></dt><dt>/usr/local/samba, <a class="indexterm" href="appendix.html#id2615023">Samba System File Location</a></dt><dt>/usr/local/samba/var/locks, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></dt><dt>/usr/sbin, <a class="indexterm" href="appendix.html#id2615023">Samba System File Location</a></dt><dt>/usr/share, <a class="indexterm" href="appendix.html#id2615023">Samba System File Location</a></dt><dt>/usr/share/samba/swat, <a class="indexterm" href="appendix.html#id2615023">Samba System File Location</a></dt><dt>/usr/share/swat, <a class="indexterm" href="appendix.html#id2615023">Samba System File Location</a></dt><dt>/var/cache/samba, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></dt><dt>/var/lib/samba, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="appendix.html#id2615023">Samba System File Location</a></dt><dt>/var/log/ldaplogs, <a class="indexterm" href="happy.html#id2566373">Debugging LDAP</a></dt><dt>/var/log/samba, <a class="indexterm" href="appendix.html#id2615023">Samba System File Location</a></dt><dt>8-bit, <a class="indexterm" href="upgrades.html#id2592486">International Language Support</a></dt></dl></div><div class="indexdiv"><h3></h3><dl><dt>, <a class="indexterm" href="simple.html#id2543216">Implementation</a>, <a class="indexterm" href="simple.html#id2544185">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id2548364">Implementation</a>, <a class="indexterm" href="secure.html#id2553129">Samba Configuration</a>, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a>, <a class="indexterm" href="Big500users.html#id2558760">Implementation</a>, <a class="indexterm" href="happy.html#sbehap-ppc">Addition of Machines to the Domain</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a class="indexterm" href="2000users.html#id2578202">Implementation</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id2587903">IDMAP_RID with Winbind</a>, <a class="indexterm" href="unixclients.html#id2588507">IDMAP Storage in LDAP using Winbind</a>, <a class="indexterm" href="unixclients.html#id2589101">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a class="indexterm" href="upgrades.html#sbeug1">Location of config files</a>, <a class="indexterm" href="ntmigration.html#id2595250">NT4 Migration Using LDAP Backend</a>, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a>, <a class="indexterm" href="DomApps.html#id2610788">NSS Configuration</a></dt><dd><dl><dt>Domain account, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>liability, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a></dt><dt>logon, <a class="indexterm" href="simple.html#id2544185">Implementation</a></dt><dt>problem, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a></dt><dt>transparent inter-operability, <a class="indexterm" href="DomApps.html#id2611510">Questions and Answers</a></dt></dl></dd></dl></div><div class="indexdiv"><h3>A</h3><dl><dt>abmas-netfw.sh, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a></dt><dt>accept, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a></dt><dt>accepts liability, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a></dt><dt>access, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2606894">Checkpoint Controls</a></dt><dt>access control, <a class="indexterm" href="kerberos.html#id2606060">Kerberos Exposed</a>, <a class="indexterm" href="kerberos.html#id2607825">Using the MMC Computer Management Interface</a></dt><dt>Access Control Lists (see ACLs)</dt><dt>access control settings, <a class="indexterm" href="kerberos.html#id2606406">Share Access Controls</a></dt><dt>access controls, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2606754">Share Definition Controls</a></dt><dt>accessible, <a class="indexterm" href="kerberos.html#id2607367">Share Point Directory and File Permissions</a></dt><dt>account, <a class="indexterm" href="happy.html#id2564150">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="kerberos.html#id2606406">Share Access Controls</a></dt><dd><dl><dt>ADS Domain, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt></dl></dd><dt>account credentials, <a class="indexterm" href="primer.html#id2620350">Findings and Comments</a></dt><dt>account information, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a></dt><dt>account names, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a></dt><dt>account policies, <a class="indexterm" href="appendix.html#id2616627">The LDAP Account Manager</a></dt><dt>accountable, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a>, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a></dt><dt>accounts</dt><dd><dl><dt>authoritative, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a></dt><dt>Domain, <a class="indexterm" href="ntmigration.html#id2594435">Introduction</a>, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a></dt><dt>group, <a class="indexterm" href="ntmigration.html#id2594435">Introduction</a>, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a></dt><dt>machine, <a class="indexterm" href="ntmigration.html#id2594435">Introduction</a>, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a></dt><dt>manage, <a class="indexterm" href="appendix.html#id2616627">The LDAP Account Manager</a></dt><dt>user, <a class="indexterm" href="ntmigration.html#id2594435">Introduction</a>, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a></dt></dl></dd><dt>ACL, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a>, <a class="indexterm" href="kerberos.html#id2606894">Checkpoint Controls</a></dt><dt>ACLs, <a class="indexterm" href="happy.html#id2576332">Key Points Learned</a>, <a class="indexterm" href="kerberos.html#id2606406">Share Access Controls</a>, <a class="indexterm" href="kerberos.html#id2606754">Share Definition Controls</a></dt><dt>acquisitions, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a></dt><dt>Act!, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>ACT! database, <a class="indexterm" href="appendix.html#id2618252">Act! Database Sharing</a></dt><dt>Act!Diag, <a class="indexterm" href="appendix.html#id2618252">Act! Database Sharing</a></dt><dt>Active Directory, <a class="indexterm" href="happy.html#id2564526">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#sbehap-locgrppol">The Local Group Policy</a>, <a class="indexterm" href="2000users.html#id2576967">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#id2582419">Assignment Tasks</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id2587903">IDMAP_RID with Winbind</a>, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a>, <a class="indexterm" href="kerberos.html#id2608497">Key Points Learned</a>, <a class="indexterm" href="kerberos.html#id2608631">Questions and Answers</a>, <a class="indexterm" href="DomApps.html">Integrating Additional Services</a>, <a class="indexterm" href="DomApps.html#id2609291">Assignment Tasks</a>, <a class="indexterm" href="DomApps.html#id2609425">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id2610236">Samba Configuration</a>, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dd><dl><dt>authentication, <a class="indexterm" href="DomApps.html#id2611054">Squid Configuration</a></dt><dt>domain, <a class="indexterm" href="DomApps.html#id2610236">Samba Configuration</a></dt><dt>join, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>management tools, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>realm, <a class="indexterm" href="HA.html#id2612627">Bad Hostnames</a></dt><dt>Replacement, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>server, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id2609847">Kerberos Configuration</a></dt><dt>Server, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>tree, <a class="indexterm" href="DomApps.html#id2610236">Samba Configuration</a></dt></dl></dd><dt>active directory, <a class="indexterm" href="ntmigration.html#id2594760">Technical Issues</a></dt><dt>AD printer publishing, <a class="indexterm" href="happy.html#id2575759">Uploading Printer Drivers to Samba Servers</a></dt><dt>ADAM, <a class="indexterm" href="happy.html#id2564526">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#id2588507">IDMAP Storage in LDAP using Winbind</a></dt><dt>add group script, <a class="indexterm" href="upgrades.html#id2593019">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>add machine script, <a class="indexterm" href="upgrades.html#id2593019">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>Add Printer Wizard</dt><dd><dl><dt>APW, <a class="indexterm" href="happy.html#id2575759">Uploading Printer Drivers to Samba Servers</a></dt></dl></dd><dt>add user script, <a class="indexterm" href="upgrades.html#id2593019">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>add user to group script, <a class="indexterm" href="upgrades.html#id2593019">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>adduser, <a class="indexterm" href="small.html#id2548364">Implementation</a>, <a class="indexterm" href="secure.html#id2553129">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2560067">Configuration for Server: MASSIVE</a></dt><dt>adequate precautions, <a class="indexterm" href="upgrades.html#id2591226">Introduction</a></dt><dt>administrative installation, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a></dt><dt>administrative rights, <a class="indexterm" href="kerberos.html#id2606894">Checkpoint Controls</a></dt><dt>administrator, <a class="indexterm" href="small.html#id2548364">Implementation</a>, <a class="indexterm" href="secure.html#id2553129">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2559489">Server Preparation: All Servers</a></dt><dt>ADMT, <a class="indexterm" href="upgrades.html#id2594263">Migration of Samba Accounts to Active Directory</a></dt><dt>ADS, <a class="indexterm" href="unixclients.html#id2588507">IDMAP Storage in LDAP using Winbind</a>, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id2609847">Kerberos Configuration</a>, <a class="indexterm" href="HA.html#id2612627">Bad Hostnames</a></dt><dd><dl><dt>server, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt></dl></dd><dt>ADS Domain, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>affordability, <a class="indexterm" href="2000users.html#id2577373">The Nature of Windows Networking Protocols</a></dt><dt>alarm, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a></dt><dt>algorithm, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>allow trusted domains, <a class="indexterm" href="unixclients.html#id2587903">IDMAP_RID with Winbind</a></dt><dt>alternative, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a></dt><dt>analysis, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>anonymous connection, <a class="indexterm" href="small.html#id2550065">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>Apache Web server, <a class="indexterm" href="DomApps.html#id2611510">Questions and Answers</a></dt><dt>appliance mode, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a></dt><dt>application server, <a class="indexterm" href="secure.html#id2551699">Technical Issues</a>, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a></dt><dt>application servers, <a class="indexterm" href="2000users.html#id2577373">The Nature of Windows Networking Protocols</a></dt><dt>application/octet-stream, <a class="indexterm" href="simple.html#id2544185">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id2548364">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id2559489">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>APW, <a class="indexterm" href="happy.html#id2575759">Uploading Printer Drivers to Samba Servers</a></dt><dt>arp, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>assessment, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a></dt><dt>assistance, <a class="indexterm" href="ch14.html#id2614097">Free Support</a></dt><dt>assumptions, <a class="indexterm" href="HA.html#id2613927">Key Points Learned</a></dt><dt>authconfig, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dt>authenticate, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a>, <a class="indexterm" href="DomApps.html#id2610236">Samba Configuration</a></dt><dt>authenticated, <a class="indexterm" href="DomApps.html#id2609291">Assignment Tasks</a></dt><dt>authenticated connection, <a class="indexterm" href="small.html#id2550065">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>authentication, <a class="indexterm" href="2000users.html#id2577373">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id2599359">Dissection and Discussion</a>, <a class="indexterm" href="DomApps.html">Integrating Additional Services</a>, <a class="indexterm" href="DomApps.html#id2609425">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id2610788">NSS Configuration</a>, <a class="indexterm" href="DomApps.html#id2611510">Questions and Answers</a></dt><dd><dl><dt>plain-text, <a class="indexterm" href="DomApps.html#id2611510">Questions and Answers</a></dt></dl></dd><dt>authentication process, <a class="indexterm" href="unixclients.html#id2583232">Implementation</a></dt><dt>authentication protocols, <a class="indexterm" href="DomApps.html#id2611450">Key Points Learned</a></dt><dt>authoritative, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a></dt><dt>authorized location, <a class="indexterm" href="kerberos.html#id2606060">Kerberos Exposed</a></dt><dt>auto-generated SID, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a></dt><dt>automatically allocate, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a></dt><dt>availability, <a class="indexterm" href="HA.html">Performance, Reliability, and Availability</a></dt></dl></div><div class="indexdiv"><h3>B</h3><dl><dt>backends, <a class="indexterm" href="DomApps.html">Integrating Additional Services</a></dt><dt>background communication, <a class="indexterm" href="2000users.html#id2581507">Questions and Answers</a></dt><dt>Backup, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a></dt><dt>Backup Domain Controller (see BDC)</dt><dt>bandwidth, <a class="indexterm" href="DomApps.html#id2609291">Assignment Tasks</a></dt><dd><dl><dt>requirements, <a class="indexterm" href="2000users.html#id2577280">User Needs</a></dt></dl></dd><dt>bandwidth calculations, <a class="indexterm" href="secure.html#id2551986">Hardware Requirements</a></dt><dt>BDC, <a class="indexterm" href="Big500users.html#id2558534">Technical Issues</a>, <a class="indexterm" href="happy.html">Making Happy Users</a>, <a class="indexterm" href="happy.html#id2564389">Assignment Tasks</a>, <a class="indexterm" href="happy.html#id2564526">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#id2567058">Samba Server Implementation</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="2000users.html#id2577373">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="2000users.html#id2581360">Key Points Learned</a>, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a>, <a class="indexterm" href="ntmigration.html#id2597709">NT4 Migration Using tdbsam Backend</a>, <a class="indexterm" href="HA.html#id2613419">Use and Location of BDCs</a></dt><dt>benefit, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a></dt><dt>best practices, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a></dt><dt>bias, <a class="indexterm" href="kerberos.html#id2608631">Questions and Answers</a></dt><dt>binary database, <a class="indexterm" href="secure.html#id2552192">Implementation</a></dt><dt>binary files, <a class="indexterm" href="upgrades.html#id2593535">Updating a Samba-3 Installation</a></dt><dt>binary package, <a class="indexterm" href="upgrades.html#id2593535">Updating a Samba-3 Installation</a></dt><dt>bind interfaces only, <a class="indexterm" href="secure.html#id2552192">Implementation</a></dt><dt>broadcast, <a class="indexterm" href="HA.html#id2612819">Routed Networks</a>, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dd><dl><dt>directed, <a class="indexterm" href="2000users.html#id2577373">The Nature of Windows Networking Protocols</a></dt><dt>mailslot, <a class="indexterm" href="2000users.html#id2577373">The Nature of Windows Networking Protocols</a></dt></dl></dd><dt>broadcast messages, <a class="indexterm" href="secure.html#id2552192">Implementation</a></dt><dt>broadcast storms, <a class="indexterm" href="HA.html#id2612992">Network Collisions</a></dt><dt>broken, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a></dt><dt>broken behavior, <a class="indexterm" href="HA.html#id2612117">Dissection and Discussion</a></dt><dt>browse, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>browse master, <a class="indexterm" href="primer.html#id2619102">Findings</a></dt><dt>Browse Master, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dt>browse.dat, <a class="indexterm" href="upgrades.html#id2593860">Replacing a Domain Member Server</a></dt><dt>Browser Election Service, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dt>browsing, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id2609425">Technical Issues</a>, <a class="indexterm" href="primer.html#id2618724">Assignment Tasks</a></dt><dt>budgetted, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a></dt><dt>bug fixes, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a></dt><dt>bug report, <a class="indexterm" href="ch14.html#id2614097">Free Support</a></dt></dl></div><div class="indexdiv"><h3>C</h3><dl><dt>cache, <a class="indexterm" href="appendix.html#id2618336">Opportunistic Locking Controls</a></dt><dt>cache directories, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>caching, <a class="indexterm" href="HA.html#id2613092">Samba Configuration</a></dt><dt>case-sensitive, <a class="indexterm" href="DomApps.html#id2609847">Kerberos Configuration</a></dt><dt>centralized storage, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a></dt><dt>character set, <a class="indexterm" href="upgrades.html#id2592486">International Language Support</a></dt><dt>check samba daemons, <a class="indexterm" href="small.html#id2550065">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>check-point, <a class="indexterm" href="kerberos.html#id2606754">Share Definition Controls</a></dt><dt>check-point controls, <a class="indexterm" href="kerberos.html#id2606894">Checkpoint Controls</a></dt><dt>Checkpoint Controls, <a class="indexterm" href="kerberos.html#id2606894">Checkpoint Controls</a></dt><dt>chgrp, <a class="indexterm" href="DomApps.html#id2610236">Samba Configuration</a></dt><dt>chkconfig, <a class="indexterm" href="simple.html#id2543216">Implementation</a>, <a class="indexterm" href="simple.html#id2544185">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id2548364">Implementation</a>, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a>, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a>, <a class="indexterm" href="2000users.html#id2578202">Implementation</a></dt><dt>chmod, <a class="indexterm" href="DomApps.html#id2610236">Samba Configuration</a></dt><dt>choice, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>chown, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>CIFS, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a>, <a class="indexterm" href="primer.html#id2619102">Findings</a></dt><dt>cifsfs, <a class="indexterm" href="HA.html#id2612117">Dissection and Discussion</a></dt><dt>clean database, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a></dt><dt>clients per DC, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>Clock skew, <a class="indexterm" href="DomApps.html#id2609847">Kerberos Configuration</a></dt><dt>cluster, <a class="indexterm" href="HA.html#id2612030">Introduction</a></dt><dt>clustering, <a class="indexterm" href="HA.html#id2612030">Introduction</a>, <a class="indexterm" href="HA.html#id2613516">For Scalability, Use SAN-Based Storage on Samba Servers</a></dt><dt>code maintainer, <a class="indexterm" href="ch14.html#id2614097">Free Support</a></dt><dt>codepage, <a class="indexterm" href="upgrades.html#id2592486">International Language Support</a></dt><dt>collision rates, <a class="indexterm" href="HA.html#id2612992">Network Collisions</a></dt><dt>commercial, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a></dt><dt>commercial software, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a></dt><dt>commercial support, <a class="indexterm" href="ch14.html">Samba Support</a>, <a class="indexterm" href="ch14.html#id2614316">Commercial Support</a></dt><dt>Common Internet File System (see CIFS)</dt><dt>comparison</dt><dd><dl><dt>Active Directory & OpenLDAP, <a class="indexterm" href="happy.html#id2564526">Dissection and Discussion</a></dt></dl></dd><dt>compat, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>compatible, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>compile-time, <a class="indexterm" href="upgrades.html#sbeug1">Location of config files</a></dt><dt>complexities, <a class="indexterm" href="HA.html#id2612117">Dissection and Discussion</a></dt><dt>compromise, <a class="indexterm" href="happy.html#id2564292">Introduction</a>, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a>, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>computer account, <a class="indexterm" href="DomApps.html#id2610236">Samba Configuration</a></dt><dt>Computer Management, <a class="indexterm" href="kerberos.html#id2606406">Share Access Controls</a>, <a class="indexterm" href="kerberos.html#id2608631">Questions and Answers</a></dt><dt>computer name, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a></dt><dt>condemns, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>conferences, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>configuration files, <a class="indexterm" href="upgrades.html#id2591226">Introduction</a></dt><dt>configure.pl, <a class="indexterm" href="ntmigration.html#id2595250">NT4 Migration Using LDAP Backend</a></dt><dt>connection, <a class="indexterm" href="kerberos.html#id2606406">Share Access Controls</a></dt><dt>connectivity, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a></dt><dt>consequential risk, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>consultant, <a class="indexterm" href="simple.html#id2543074">Drafting Office</a>, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a>, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a></dt><dt>consumer, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>consumer expects, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>contiguous directory, <a class="indexterm" href="2000users.html#id2578202">Implementation</a></dt><dt>contributions, <a class="indexterm" href="upgrades.html">Updating Samba-3</a></dt><dt>control files, <a class="indexterm" href="upgrades.html#id2593535">Updating a Samba-3 Installation</a></dt><dt>convmv, <a class="indexterm" href="upgrades.html#id2592486">International Language Support</a></dt><dt>copy, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a></dt><dt>corrective action, <a class="indexterm" href="HA.html#id2613666">Hardware Problems</a></dt><dt>cost, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a></dt><dt>cost-benefit, <a class="indexterm" href="nw4migration.html#id2599246">Assignment Tasks</a></dt><dt>country of origin, <a class="indexterm" href="ch14.html#id2614316">Commercial Support</a></dt><dt>Courier-IMAP, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a></dt><dt>credential, <a class="indexterm" href="kerberos.html#id2606754">Share Definition Controls</a></dt><dt>credentials, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>crippled, <a class="indexterm" href="ntmigration.html#id2594574">Dissection and Discussion</a></dt><dt>criticism, <a class="indexterm" href="kerberos.html">Active Directory, Kerberos, and Security</a>, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a></dt><dt>Critics, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>Cryptographic, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>CUPS, <a class="indexterm" href="simple.html#id2543975">Dissection and Discussion</a>, <a class="indexterm" href="small.html#id2548131">Technical Issues</a>, <a class="indexterm" href="small.html#id2548364">Implementation</a>, <a class="indexterm" href="small.html#id2550795">Key Points Learned</a>, <a class="indexterm" href="secure.html#id2552192">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id2559489">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#id2564389">Assignment Tasks</a>, <a class="indexterm" href="happy.html#id2565949">Installation of Printer Driver Auto-Download</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dd><dl><dt>queue, <a class="indexterm" href="small.html#id2548364">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id2559489">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt></dl></dd><dt>cupsd, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a></dt><dt>customer expected, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>customers, <a class="indexterm" href="ch14.html">Samba Support</a></dt></dl></div><div class="indexdiv"><h3>D</h3><dl><dt>daemon, <a class="indexterm" href="simple.html#validate1">Validation</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a>, <a class="indexterm" href="DomApps.html#id2609425">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id2611510">Questions and Answers</a>, <a class="indexterm" href="appendix.html#id2615443">Starting Samba</a></dt><dt>daemon control, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dt>data</dt><dd><dl><dt>corruption, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>integrity, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a></dt></dl></dd><dt>data corruption, <a class="indexterm" href="HA.html#id2613666">Hardware Problems</a>, <a class="indexterm" href="appendix.html#id2618252">Act! Database Sharing</a></dt><dt>data integrity, <a class="indexterm" href="HA.html#id2613666">Hardware Problems</a>, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>data storage, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a></dt><dt>database, <a class="indexterm" href="2000users.html#id2576967">Dissection and Discussion</a>, <a class="indexterm" href="2000users.html#id2581507">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id2599359">Dissection and Discussion</a></dt><dt>database applications, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>DB_CONFIG, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>DCE, <a class="indexterm" href="kerberos.html#id2606060">Kerberos Exposed</a></dt><dt>DDNS (see dynamic DNS)</dt><dt>Debian, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>default installation, <a class="indexterm" href="appendix.html#id2615023">Samba System File Location</a></dt><dt>default password, <a class="indexterm" href="appendix.html#id2616627">The LDAP Account Manager</a></dt><dt>default profile, <a class="indexterm" href="happy.html#id2564389">Assignment Tasks</a>, <a class="indexterm" href="happy.html#id2564983">Technical Issues</a></dt><dt>Default User, <a class="indexterm" href="happy.html#id2565796">Profile Changes</a>, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>defective</dt><dd><dl><dt>cables, <a class="indexterm" href="HA.html#id2613666">Hardware Problems</a></dt><dt>HUBs, <a class="indexterm" href="HA.html#id2613666">Hardware Problems</a></dt><dt>switches, <a class="indexterm" href="HA.html#id2613666">Hardware Problems</a></dt></dl></dd><dt>defects, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>defensible standards, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>defragmentation, <a class="indexterm" href="secure.html#ch4wincfg">Windows Client Configuration</a></dt><dt>delete group script, <a class="indexterm" href="upgrades.html#id2593019">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>delete user from group script, <a class="indexterm" href="upgrades.html#id2593019">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>delimiter, <a class="indexterm" href="kerberos.html#id2606894">Checkpoint Controls</a></dt><dt>dependability, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>deployment, <a class="indexterm" href="ch14.html#id2614097">Free Support</a></dt><dt>desired security setting, <a class="indexterm" href="kerberos.html#id2608287">Setting Posix ACLs in UNIX/Linux</a></dt><dt>development, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>DHCP, <a class="indexterm" href="small.html#id2548131">Technical Issues</a>, <a class="indexterm" href="small.html#id2548364">Implementation</a>, <a class="indexterm" href="small.html#id2550795">Key Points Learned</a>, <a class="indexterm" href="secure.html#ch4wincfg">Windows Client Configuration</a>, <a class="indexterm" href="Big500users.html#ch5wincfg">Windows Client Configuration</a>, <a class="indexterm" href="2000users.html#id2577373">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="2000users.html#id2581507">Questions and Answers</a></dt><dd><dl><dt>client, <a class="indexterm" href="HA.html#id2612627">Bad Hostnames</a></dt><dt>relay, <a class="indexterm" href="Big500users.html#id2558534">Technical Issues</a></dt><dt>Relay Agent, <a class="indexterm" href="2000users.html#id2581507">Questions and Answers</a></dt><dt>request, <a class="indexterm" href="2000users.html#id2581507">Questions and Answers</a></dt><dt>requests, <a class="indexterm" href="Big500users.html#id2558534">Technical Issues</a></dt><dt>servers, <a class="indexterm" href="2000users.html#id2581507">Questions and Answers</a></dt><dt>traffic, <a class="indexterm" href="2000users.html#id2581507">Questions and Answers</a></dt></dl></dd><dt>dhcp client validation, <a class="indexterm" href="small.html#id2550065">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>DHCP Server, <a class="indexterm" href="small.html#id2548364">Implementation</a></dt><dt>DHCP server, <a class="indexterm" href="secure.html#id2551699">Technical Issues</a></dt><dt>diagnostic, <a class="indexterm" href="unixclients.html#id2588507">IDMAP Storage in LDAP using Winbind</a></dt><dt>diffusion, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>digital rights, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>digital sign'n'seal, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>digits, <a class="indexterm" href="HA.html#id2612627">Bad Hostnames</a></dt><dt>diligence, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>directory, <a class="indexterm" href="2000users.html#id2576967">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#id2583132">Political Issues</a>, <a class="indexterm" href="upgrades.html#sbeug1">Location of config files</a></dt><dd><dl><dt>Computers container, <a class="indexterm" href="happy.html#id2569957">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>management, <a class="indexterm" href="happy.html#id2564526">Dissection and Discussion</a></dt><dt>People container, <a class="indexterm" href="happy.html#id2569957">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>replication, <a class="indexterm" href="happy.html#id2564526">Dissection and Discussion</a></dt><dt>schema, <a class="indexterm" href="happy.html#id2564526">Dissection and Discussion</a></dt><dt>server, <a class="indexterm" href="happy.html#id2564983">Technical Issues</a></dt><dt>synchronization, <a class="indexterm" href="happy.html#id2564526">Dissection and Discussion</a></dt></dl></dd><dt>directory tree, <a class="indexterm" href="kerberos.html#id2608287">Setting Posix ACLs in UNIX/Linux</a></dt><dt>disable, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a></dt><dt>disaster recovery, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a></dt><dt>disk image, <a class="indexterm" href="happy.html#id2564389">Assignment Tasks</a></dt><dt>disruptive, <a class="indexterm" href="ntmigration.html#id2594574">Dissection and Discussion</a></dt><dt>distributed, <a class="indexterm" href="2000users.html#id2577720">Identity Management Needs</a>, <a class="indexterm" href="2000users.html#id2578202">Implementation</a>, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a>, <a class="indexterm" href="HA.html#id2613566">Distribute Network Load with MSDFS</a></dt><dt>distributed domain, <a class="indexterm" href="2000users.html#id2577720">Identity Management Needs</a></dt><dt>DMB, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dt>DMS, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id2593860">Replacing a Domain Member Server</a></dt><dt>DNS, <a class="indexterm" href="small.html#id2548131">Technical Issues</a>, <a class="indexterm" href="small.html#id2548364">Implementation</a>, <a class="indexterm" href="secure.html#id2551699">Technical Issues</a>, <a class="indexterm" href="2000users.html#id2577373">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a>, <a class="indexterm" href="HA.html#id2612627">Bad Hostnames</a>, <a class="indexterm" href="HA.html#id2612819">Routed Networks</a>, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dd><dl><dt>configuration, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a></dt><dt>Dynamic, <a class="indexterm" href="2000users.html#id2581507">Questions and Answers</a></dt><dt>dynamic, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dt>lookup, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a>, <a class="indexterm" href="DomApps.html#id2609847">Kerberos Configuration</a></dt><dt>name lookup, <a class="indexterm" href="HA.html#id2612627">Bad Hostnames</a></dt><dt>SRV records, <a class="indexterm" href="DomApps.html#id2609847">Kerberos Configuration</a></dt><dt>suffix, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt></dl></dd><dt>DNS server, <a class="indexterm" href="small.html#id2548364">Implementation</a>, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></dt><dt>document the settings, <a class="indexterm" href="HA.html#id2613092">Samba Configuration</a></dt><dt>documentation, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>documented, <a class="indexterm" href="HA.html#id2613092">Samba Configuration</a></dt><dt>Domain, <a class="indexterm" href="small.html#id2548131">Technical Issues</a></dt><dd><dl><dt>groups, <a class="indexterm" href="small.html#id2548131">Technical Issues</a></dt></dl></dd><dt>domain</dt><dd><dl><dt>Active Directory, <a class="indexterm" href="DomApps.html#id2609425">Technical Issues</a></dt><dt>controller, <a class="indexterm" href="upgrades.html#id2594062">Replacing a Domain Controller</a></dt><dt>joining, <a class="indexterm" href="appendix.html">A Collection of Useful Tidbits</a></dt><dt>trusted, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a></dt></dl></dd><dt>Domain accounts, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a></dt><dt>Domain Administrator, <a class="indexterm" href="kerberos.html#id2606406">Share Access Controls</a></dt><dt>Domain Controller, <a class="indexterm" href="small.html#id2550795">Key Points Learned</a>, <a class="indexterm" href="2000users.html#id2577373">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2583232">Implementation</a>, <a class="indexterm" href="HA.html#id2613419">Use and Location of BDCs</a></dt><dd><dl><dt>closest, <a class="indexterm" href="2000users.html#id2577373">The Nature of Windows Networking Protocols</a></dt></dl></dd><dt>domain controller, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id2593019">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>domain controllers, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a></dt><dt>Domain Controllers, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a></dt><dt>Domain Groups</dt><dd><dl><dt>well-known, <a class="indexterm" href="appendix.html#id2616048">Initialization of the LDAP Database</a></dt></dl></dd><dt>Domain join, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>domain master, <a class="indexterm" href="ntmigration.html#id2595250">NT4 Migration Using LDAP Backend</a>, <a class="indexterm" href="ntmigration.html#id2597709">NT4 Migration Using tdbsam Backend</a></dt><dt>Domain Master Browser (see DMB)</dt><dt>Domain Member, <a class="indexterm" href="HA.html#id2613419">Use and Location of BDCs</a></dt><dd><dl><dt>authoritative</dt><dd><dl><dt>local accounts, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a></dt></dl></dd><dt>client, <a class="indexterm" href="unixclients.html#id2583232">Implementation</a></dt><dt>desktop, <a class="indexterm" href="unixclients.html#id2582366">Introduction</a></dt><dt>server, <a class="indexterm" href="unixclients.html#id2582366">Introduction</a>, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2583232">Implementation</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>servers, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2606894">Checkpoint Controls</a></dt><dt>workstations, <a class="indexterm" href="unixclients.html#id2583232">Implementation</a></dt></dl></dd><dt>domain member</dt><dd><dl><dt>servers, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a></dt></dl></dd><dt>Domain Member server, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2608631">Questions and Answers</a></dt><dt>Domain Member servers, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a></dt><dt>domain members, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a></dt><dt>domain name space, <a class="indexterm" href="2000users.html#id2577720">Identity Management Needs</a></dt><dt>domain replication, <a class="indexterm" href="2000users.html#id2581507">Questions and Answers</a></dt><dt>domain SID, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a></dt><dt>Domain SID, <a class="indexterm" href="ntmigration.html#id2594760">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a></dt><dt>domain tree, <a class="indexterm" href="2000users.html#id2577720">Identity Management Needs</a></dt><dt>Domain User Manager, <a class="indexterm" href="happy.html#id2574022">Configuring Profile Directories</a></dt><dt>Domain users, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>DOS, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a></dt><dt>dos2unix, <a class="indexterm" href="secure.html#id2553129">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2560067">Configuration for Server: MASSIVE</a></dt><dt>down-grade, <a class="indexterm" href="upgrades.html#id2591226">Introduction</a></dt><dt>drive letters, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a></dt><dt>drive mapping, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>dumb printing, <a class="indexterm" href="happy.html#id2565949">Installation of Printer Driver Auto-Download</a></dt><dt>dump, <a class="indexterm" href="ntmigration.html#id2594760">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a></dt><dt>duplicate accounts, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt><dt>dynamic DNS, <a class="indexterm" href="secure.html#id2551699">Technical Issues</a></dt></dl></div><div class="indexdiv"><h3>E</h3><dl><dt>e-Directory, <a class="indexterm" href="nw4migration.html#id2599359">Dissection and Discussion</a></dt><dt>Easy Software Products, <a class="indexterm" href="happy.html#id2565949">Installation of Printer Driver Auto-Download</a></dt><dt>economically sustainable, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a></dt><dt>eDirectory, <a class="indexterm" href="happy.html#id2564526">Dissection and Discussion</a></dt><dt>education, <a class="indexterm" href="2000users.html#id2577720">Identity Management Needs</a></dt><dt>election, <a class="indexterm" href="primer.html#id2619102">Findings</a></dt><dt>employment, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a>, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a></dt><dt>enable, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a></dt><dt>encrypted, <a class="indexterm" href="primer.html#id2620350">Findings and Comments</a></dt><dt>encrypted password, <a class="indexterm" href="primer.html#id2620615">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>encrypted passwords, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a></dt><dt>End User License Agreement (see EULA)</dt><dt>enumerating, <a class="indexterm" href="DomApps.html#id2610236">Samba Configuration</a></dt><dt>essential, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a></dt><dt>ethereal, <a class="indexterm" href="primer.html#id2618841">Exercises</a></dt><dt>Ethernet switch, <a class="indexterm" href="small.html#id2548131">Technical Issues</a></dt><dt>ethernet switch, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>EULA, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a></dt><dt>Everyone, <a class="indexterm" href="kerberos.html#id2606406">Share Access Controls</a></dt><dt>Excel, <a class="indexterm" href="kerberos.html#id2607367">Share Point Directory and File Permissions</a></dt><dt>exclusive open, <a class="indexterm" href="appendix.html#id2618104">Microsoft Access</a></dt><dt>experiment, <a class="indexterm" href="kerberos.html">Active Directory, Kerberos, and Security</a></dt><dt>export, <a class="indexterm" href="ntmigration.html#id2594760">Technical Issues</a></dt><dt>extent, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a></dt><dt>External Domains, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a></dt><dt>extreme demand, <a class="indexterm" href="HA.html#id2612588">Guidelines for Reliable Samba Operation</a></dt></dl></div><div class="indexdiv"><h3>F</h3><dl><dt>fail, <a class="indexterm" href="2000users.html#id2577373">The Nature of Windows Networking Protocols</a></dt><dt>fail-over, <a class="indexterm" href="2000users.html#id2577720">Identity Management Needs</a>, <a class="indexterm" href="2000users.html#id2578202">Implementation</a></dt><dt>failed, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>failed join, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id2587903">IDMAP_RID with Winbind</a></dt><dt>failure, <a class="indexterm" href="DomApps.html#id2610236">Samba Configuration</a></dt><dt>familiar, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>fatal problem, <a class="indexterm" href="HA.html#id2613092">Samba Configuration</a></dt><dt>fear, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>fears, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>Fedora, <a class="indexterm" href="simple.html#id2543074">Drafting Office</a></dt><dt>FHS, <a class="indexterm" href="appendix.html#id2615023">Samba System File Location</a></dt><dt>file and print server, <a class="indexterm" href="DomApps.html#id2611510">Questions and Answers</a></dt><dt>file and print service, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a></dt><dt>file caching, <a class="indexterm" href="HA.html#id2613092">Samba Configuration</a>, <a class="indexterm" href="appendix.html#id2618336">Opportunistic Locking Controls</a></dt><dt>File Hierarchy System (see FHS)</dt><dt>file locations, <a class="indexterm" href="appendix.html#id2615023">Samba System File Location</a></dt><dt>file permissions, <a class="indexterm" href="appendix.html#id2616627">The LDAP Account Manager</a></dt><dt>file server</dt><dd><dl><dt>read-only, <a class="indexterm" href="simple.html#id2543158">Dissection and Discussion</a></dt></dl></dd><dt>file servers, <a class="indexterm" href="happy.html#id2567058">Samba Server Implementation</a></dt><dt>file system, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dd><dl><dt>access control, <a class="indexterm" href="secure.html#id2553129">Samba Configuration</a></dt><dt>Ext3, <a class="indexterm" href="simple.html#id2543216">Implementation</a></dt><dt>permissions, <a class="indexterm" href="secure.html#id2553129">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2560067">Configuration for Server: MASSIVE</a></dt></dl></dd><dt>file system security, <a class="indexterm" href="kerberos.html#id2608631">Questions and Answers</a></dt><dt>filter, <a class="indexterm" href="kerberos.html#id2606406">Share Access Controls</a></dt><dt>financial responsibility, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a></dt><dt>firewall, <a class="indexterm" href="secure.html#id2551699">Technical Issues</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a></dt><dt>fix, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a></dt><dt>flaws, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a></dt><dt>flexibility, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>flush</dt><dd><dl><dt>cache memory, <a class="indexterm" href="appendix.html#id2618336">Opportunistic Locking Controls</a></dt></dl></dd><dt>folder redirection, <a class="indexterm" href="happy.html#id2564983">Technical Issues</a>, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a>, <a class="indexterm" href="2000users.html#id2581507">Questions and Answers</a></dt><dt>force group, <a class="indexterm" href="kerberos.html#id2607206">Override Controls</a>, <a class="indexterm" href="kerberos.html#id2608631">Questions and Answers</a></dt><dt>force user, <a class="indexterm" href="simple.html#id2543975">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id2607206">Override Controls</a>, <a class="indexterm" href="kerberos.html#id2608631">Questions and Answers</a></dt><dt>forced settings, <a class="indexterm" href="kerberos.html#id2607206">Override Controls</a></dt><dt>foreign, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>foreign SID, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>forwarded, <a class="indexterm" href="HA.html#id2612819">Routed Networks</a></dt><dt>foundation members, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>Free Standards Group (see FSG)</dt><dt>free support, <a class="indexterm" href="ch14.html">Samba Support</a>, <a class="indexterm" href="ch14.html#id2614097">Free Support</a></dt><dt>front-end, <a class="indexterm" href="HA.html#id2612117">Dissection and Discussion</a></dt><dd><dl><dt>server, <a class="indexterm" href="HA.html#id2613566">Distribute Network Load with MSDFS</a></dt></dl></dd><dt>frustration, <a class="indexterm" href="upgrades.html#id2591226">Introduction</a></dt><dt>FSG, <a class="indexterm" href="appendix.html#id2615023">Samba System File Location</a></dt><dt>FTP</dt><dd><dl><dt>proxy, <a class="indexterm" href="DomApps.html#id2611510">Questions and Answers</a></dt></dl></dd><dt>full control, <a class="indexterm" href="kerberos.html#id2606406">Share Access Controls</a>, <a class="indexterm" href="kerberos.html#id2608116">Using MS Windows Explorer (File Manager)</a></dt><dt>fully qualified, <a class="indexterm" href="kerberos.html#id2606894">Checkpoint Controls</a></dt><dt>functional differences, <a class="indexterm" href="upgrades.html#id2591322">Cautions and Notes</a></dt></dl></div><div class="indexdiv"><h3>G</h3><dl><dt>generation, <a class="indexterm" href="upgrades.html#id2591322">Cautions and Notes</a></dt><dt>Gentoo, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>getent, <a class="indexterm" href="happy.html#id2569957">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id2587903">IDMAP_RID with Winbind</a></dt><dt>getfacl, <a class="indexterm" href="kerberos.html#id2608287">Setting Posix ACLs in UNIX/Linux</a></dt><dt>getgrnam, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a></dt><dt>getpwnam, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>getpwnam(), <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a></dt><dt>GID, <a class="indexterm" href="2000users.html#id2578202">Implementation</a>, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a></dt><dt>Goettingen, <a class="indexterm" href="DomApps.html#id2611510">Questions and Answers</a></dt><dt>government, <a class="indexterm" href="2000users.html#id2577720">Identity Management Needs</a></dt><dt>GPL, <a class="indexterm" href="secure.html#id2557213">Comments Regarding Software Terms of Use</a></dt><dt>group account, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>group management, <a class="indexterm" href="secure.html#id2552192">Implementation</a></dt><dt>group mapping, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a></dt><dt>group membership, <a class="indexterm" href="small.html#id2548364">Implementation</a>, <a class="indexterm" href="secure.html#id2553129">Samba Configuration</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="kerberos.html#id2607367">Share Point Directory and File Permissions</a></dt><dt>group names, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a></dt><dt>group policies, <a class="indexterm" href="ntmigration.html#id2594435">Introduction</a></dt><dt>Group Policy, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dt>Group Policy editor, <a class="indexterm" href="happy.html#sbehap-locgrppol">The Local Group Policy</a></dt><dt>Group Policy Objects, <a class="indexterm" href="happy.html#sbehap-locgrppol">The Local Group Policy</a></dt><dt>groupadd, <a class="indexterm" href="simple.html#id2544185">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="upgrades.html#id2593019">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a></dt><dt>groupdel, <a class="indexterm" href="upgrades.html#id2593019">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a></dt><dt>groupmem, <a class="indexterm" href="ntmigration.html#id2595250">NT4 Migration Using LDAP Backend</a></dt><dt>groupmod, <a class="indexterm" href="upgrades.html#id2593019">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a></dt><dt>GSS-API, <a class="indexterm" href="primer.html#id2620615">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>guest account, <a class="indexterm" href="primer.html#id2620350">Findings and Comments</a>, <a class="indexterm" href="primer.html#chap01conc">Dissection and Discussion</a>, <a class="indexterm" href="primer.html#id2621297">Technical Issues</a>, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt></dl></div><div class="indexdiv"><h3>H</h3><dl><dt>hackers, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a></dt><dt>hardware prices, <a class="indexterm" href="HA.html#id2613666">Hardware Problems</a></dt><dt>hardware problems, <a class="indexterm" href="HA.html#id2613666">Hardware Problems</a></dt><dt>Heimdal, <a class="indexterm" href="DomApps.html#id2609598">Implementation</a>, <a class="indexterm" href="DomApps.html#id2609847">Kerberos Configuration</a></dt><dt>Heimdal Kerberos, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="kerberos.html#id2606060">Kerberos Exposed</a></dt><dt>Heimdal kerberos, <a class="indexterm" href="unixclients.html#id2588507">IDMAP Storage in LDAP using Winbind</a></dt><dt>help, <a class="indexterm" href="ch14.html#id2614097">Free Support</a></dt><dt>helper agent, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>hesiod, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>hierarchy of control, <a class="indexterm" href="kerberos.html#id2606754">Share Definition Controls</a></dt><dt>high availability, <a class="indexterm" href="happy.html#id2564526">Dissection and Discussion</a></dt><dt>hire, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a></dt><dt>HKEY_CURRENT_USER, <a class="indexterm" href="happy.html#id2565495">Roaming Profile Background</a></dt><dt>HKEY_LOCAL_MACHINE, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>HKEY_LOCAL_USER, <a class="indexterm" href="2000users.html#id2581507">Questions and Answers</a></dt><dt>host announcement, <a class="indexterm" href="primer.html#id2618724">Assignment Tasks</a>, <a class="indexterm" href="primer.html#id2619753">Findings</a></dt><dt>hostname, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a></dt><dt>hosts, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a></dt><dt>HUB, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>Hybrid, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dt>hypothetical, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a></dt></dl></div><div class="indexdiv"><h3>I</h3><dl><dt>Idealx, <a class="indexterm" href="upgrades.html#id2593019">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id2595250">NT4 Migration Using LDAP Backend</a></dt><dd><dl><dt>smbldap-tools, <a class="indexterm" href="happy.html#sbeidealx">Install and Configure Idealx smbldap-tools Scripts</a>, <a class="indexterm" href="happy.html#id2569957">LDAP Initialization and Creation of User and Group Accounts</a></dt></dl></dd><dt>identifiers, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a></dt><dt>identity, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2606060">Kerberos Exposed</a></dt><dd><dl><dt>management, <a class="indexterm" href="happy.html#id2564983">Technical Issues</a></dt></dl></dd><dt>identity management, <a class="indexterm" href="Big500users.html#id2558534">Technical Issues</a>, <a class="indexterm" href="2000users.html#id2576967">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#id2583132">Political Issues</a>, <a class="indexterm" href="nw4migration.html#id2599359">Dissection and Discussion</a></dt><dt>Identity Management, <a class="indexterm" href="happy.html#id2564526">Dissection and Discussion</a>, <a class="indexterm" href="2000users.html#id2577373">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="2000users.html#id2577720">Identity Management Needs</a></dt><dt>Identity management, <a class="indexterm" href="unixclients.html#id2589438">UNIX/Linux Client Domain Member</a></dt><dt>Identity resolution, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id2589438">UNIX/Linux Client Domain Member</a>, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a></dt><dt>Identity resolver, <a class="indexterm" href="DomApps.html#id2611510">Questions and Answers</a></dt><dt>IDMAP, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#id2587903">IDMAP_RID with Winbind</a></dt><dt>idmap backend, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a></dt><dt>IDMAP backend, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a></dt><dt>idmap gid, <a class="indexterm" href="unixclients.html#id2587903">IDMAP_RID with Winbind</a></dt><dt>idmap uid, <a class="indexterm" href="unixclients.html#id2587903">IDMAP_RID with Winbind</a></dt><dt>idmap_rid, <a class="indexterm" href="unixclients.html#id2587903">IDMAP_RID with Winbind</a></dt><dt>IMAP, <a class="indexterm" href="nw4migration.html#id2599436">Technical Issues</a></dt><dt>import, <a class="indexterm" href="ntmigration.html#id2594760">Technical Issues</a></dt><dt>income, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a></dt><dt>independent expert, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a></dt><dt>inetd, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a></dt><dt>inetOrgPerson, <a class="indexterm" href="nw4migration.html#id2599436">Technical Issues</a></dt><dt>inheritance, <a class="indexterm" href="kerberos.html#id2608287">Setting Posix ACLs in UNIX/Linux</a></dt><dt>initGrps.sh, <a class="indexterm" href="small.html#id2548364">Implementation</a>, <a class="indexterm" href="secure.html#id2553129">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2560067">Configuration for Server: MASSIVE</a></dt><dt>initial credentials, <a class="indexterm" href="DomApps.html#id2609847">Kerberos Configuration</a></dt><dt>inoperative, <a class="indexterm" href="ntmigration.html#id2594574">Dissection and Discussion</a></dt><dt>install, <a class="indexterm" href="upgrades.html">Updating Samba-3</a></dt><dt>installation, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a></dt><dt>integrate, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a></dt><dt>integrity, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a>, <a class="indexterm" href="kerberos.html#id2606060">Kerberos Exposed</a></dt><dt>inter-domain, <a class="indexterm" href="upgrades.html#id2593019">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>inter-operability, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2608497">Key Points Learned</a>, <a class="indexterm" href="DomApps.html#id2611510">Questions and Answers</a></dt><dt>interactive help, <a class="indexterm" href="ch14.html#id2614097">Free Support</a></dt><dt>interdomain trusts, <a class="indexterm" href="2000users.html#id2577720">Identity Management Needs</a></dt><dt>interfaces, <a class="indexterm" href="secure.html#id2552192">Implementation</a></dt><dt>intermittent, <a class="indexterm" href="HA.html#id2613666">Hardware Problems</a></dt><dt>internationalization, <a class="indexterm" href="upgrades.html#id2592486">International Language Support</a></dt><dt>Internet Explorer, <a class="indexterm" href="DomApps.html#id2609425">Technical Issues</a></dt><dt>Internet Information Server, <a class="indexterm" href="DomApps.html#id2611510">Questions and Answers</a></dt><dt>interoperability, <a class="indexterm" href="happy.html#id2564526">Dissection and Discussion</a></dt><dt>IP forwarding, <a class="indexterm" href="small.html#id2548364">Implementation</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="Big500users.html#id2560067">Configuration for Server: MASSIVE</a></dt><dt>IPC$, <a class="indexterm" href="primer.html#id2620350">Findings and Comments</a></dt><dt>iptables, <a class="indexterm" href="secure.html#id2551699">Technical Issues</a></dt><dt>IRC, <a class="indexterm" href="ch14.html#id2614097">Free Support</a></dt><dt>isolated, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a></dt><dt>Italian, <a class="indexterm" href="DomApps.html#id2611510">Questions and Answers</a></dt></dl></div><div class="indexdiv"><h3>J</h3><dl><dt>jobs, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a></dt><dt>joining a domain, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt></dl></div><div class="indexdiv"><h3>K</h3><dl><dt>KDC, <a class="indexterm" href="DomApps.html#id2609847">Kerberos Configuration</a></dt><dt>Kerberos, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a>, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2608497">Key Points Learned</a>, <a class="indexterm" href="DomApps.html#id2609425">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id2609598">Implementation</a>, <a class="indexterm" href="DomApps.html#id2609847">Kerberos Configuration</a></dt><dd><dl><dt>Heimdal, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>interoperability, <a class="indexterm" href="kerberos.html#id2606060">Kerberos Exposed</a></dt><dt>libraries, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>MIT, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>unspecified fields, <a class="indexterm" href="kerberos.html#id2606060">Kerberos Exposed</a></dt></dl></dd><dt>kerberos, <a class="indexterm" href="kerberos.html#id2606060">Kerberos Exposed</a></dt><dd><dl><dt>server, <a class="indexterm" href="kerberos.html#id2606060">Kerberos Exposed</a></dt></dl></dd><dt>Kerberos ticket, <a class="indexterm" href="DomApps.html#id2610236">Samba Configuration</a></dt><dt>kinit, <a class="indexterm" href="DomApps.html#id2609847">Kerberos Configuration</a></dt><dt>Kixtart, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a></dt><dt>klist, <a class="indexterm" href="DomApps.html#id2609847">Kerberos Configuration</a></dt><dt>krb5, <a class="indexterm" href="DomApps.html#id2609598">Implementation</a></dt><dt>krb5.conf, <a class="indexterm" href="DomApps.html#id2609847">Kerberos Configuration</a></dt></dl></div><div class="indexdiv"><h3>L</h3><dl><dt>LAM, <a class="indexterm" href="appendix.html#id2616627">The LDAP Account Manager</a></dt><dd><dl><dt>configuration editor, <a class="indexterm" href="appendix.html#id2616627">The LDAP Account Manager</a></dt><dt>configuration file, <a class="indexterm" href="appendix.html#id2616627">The LDAP Account Manager</a></dt><dt>login screen, <a class="indexterm" href="appendix.html#id2616627">The LDAP Account Manager</a></dt><dt>opening screen, <a class="indexterm" href="appendix.html#id2616627">The LDAP Account Manager</a></dt><dt>profile, <a class="indexterm" href="appendix.html#id2616627">The LDAP Account Manager</a></dt><dt>wizard, <a class="indexterm" href="appendix.html#id2616627">The LDAP Account Manager</a></dt></dl></dd><dt>large domain, <a class="indexterm" href="unixclients.html#id2587903">IDMAP_RID with Winbind</a></dt><dt>LDAP, <a class="indexterm" href="Big500users.html#id2558534">Technical Issues</a>, <a class="indexterm" href="happy.html#id2564389">Assignment Tasks</a>, <a class="indexterm" href="happy.html#id2564526">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#id2564983">Technical Issues</a>, <a class="indexterm" href="happy.html#id2566139">Preliminary Advice: Dangers Can Be Avoided</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="2000users.html#id2576869">Introduction</a>, <a class="indexterm" href="2000users.html#id2576967">Dissection and Discussion</a>, <a class="indexterm" href="2000users.html#id2577720">Identity Management Needs</a>, <a class="indexterm" href="2000users.html#id2578202">Implementation</a>, <a class="indexterm" href="2000users.html#id2581360">Key Points Learned</a>, <a class="indexterm" href="2000users.html#id2581507">Questions and Answers</a>, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id2593019">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id2594520">Assignment Tasks</a>, <a class="indexterm" href="ntmigration.html#id2594760">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id2599359">Dissection and Discussion</a>, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a>, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dd><dl><dt>backend, <a class="indexterm" href="2000users.html#id2577720">Identity Management Needs</a></dt><dt>database, <a class="indexterm" href="happy.html#id2569957">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="2000users.html#id2577720">Identity Management Needs</a>, <a class="indexterm" href="2000users.html#id2581507">Questions and Answers</a>, <a class="indexterm" href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></dt><dt>directory, <a class="indexterm" href="happy.html#id2564150">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="2000users.html#id2577720">Identity Management Needs</a></dt><dt>fail-over, <a class="indexterm" href="2000users.html#id2578202">Implementation</a></dt><dt>initial configuration, <a class="indexterm" href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></dt><dt>master, <a class="indexterm" href="2000users.html#id2577720">Identity Management Needs</a></dt><dt>master/slave</dt><dd><dl><dt>background communication, <a class="indexterm" href="2000users.html#id2581507">Questions and Answers</a></dt></dl></dd><dt>preload, <a class="indexterm" href="2000users.html#id2578202">Implementation</a></dt><dt>schema, <a class="indexterm" href="upgrades.html#id2593679">Updating from Samba Versions between 3.0.6 and 3.0.10</a></dt><dt>secure, <a class="indexterm" href="happy.html#id2564983">Technical Issues</a></dt><dt>server, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a></dt><dt>slave, <a class="indexterm" href="2000users.html#id2577720">Identity Management Needs</a></dt><dt>updates, <a class="indexterm" href="2000users.html#id2577720">Identity Management Needs</a></dt></dl></dd><dt>ldap, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>LDAP Account Manager (see LAM)</dt><dt>LDAP backend, <a class="indexterm" href="ntmigration.html#id2594760">Technical Issues</a></dt><dt>LDAP database, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a></dt><dt>LDAP Interchange Format (see LDIF)</dt><dt>LDAP server, <a class="indexterm" href="2000users.html#id2577720">Identity Management Needs</a></dt><dt>LDAP-transfer-LDIF.txt, <a class="indexterm" href="2000users.html#id2578202">Implementation</a></dt><dt>ldap.conf, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>ldapadd, <a class="indexterm" href="happy.html#id2569957">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>ldapsam, <a class="indexterm" href="happy.html#id2569957">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="2000users.html#id2576967">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="upgrades.html#id2593679">Updating from Samba Versions between 3.0.6 and 3.0.10</a>, <a class="indexterm" href="ntmigration.html#id2594520">Assignment Tasks</a>, <a class="indexterm" href="DomApps.html">Integrating Additional Services</a></dt><dt>ldapsam backend, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>ldapsearch, <a class="indexterm" href="happy.html#id2569957">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>LDIF, <a class="indexterm" href="happy.html#id2564983">Technical Issues</a>, <a class="indexterm" href="2000users.html#id2578202">Implementation</a>, <a class="indexterm" href="nw4migration.html#id2599436">Technical Issues</a>, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a>, <a class="indexterm" href="appendix.html#id2616048">Initialization of the LDAP Database</a></dt><dt>leadership, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>Lightweight Directory Access Protocol (see LDAP)</dt><dt>limit, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a></dt><dt>Linux desktop, <a class="indexterm" href="unixclients.html#id2582366">Introduction</a></dt><dt>Linux Standards Base (see LSB)</dt><dt>LMB, <a class="indexterm" href="primer.html#id2619102">Findings</a>, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dt>LMHOSTS, <a class="indexterm" href="HA.html#id2612819">Routed Networks</a></dt><dt>load distribution, <a class="indexterm" href="HA.html#id2613516">For Scalability, Use SAN-Based Storage on Samba Servers</a></dt><dt>local accounts, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a></dt><dt>Local Group Policy, <a class="indexterm" href="happy.html#id2565495">Roaming Profile Background</a></dt><dt>Local Master Announcement, <a class="indexterm" href="primer.html#id2619753">Findings</a></dt><dt>Local Master Browser (see LMB)</dt><dt>localhost, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="HA.html#id2612627">Bad Hostnames</a></dt><dt>lock directory, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></dt><dt>locking</dt><dd><dl><dt>Application level, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>Client side, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>Server side, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt></dl></dd><dt>logging, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>login, <a class="indexterm" href="secure.html#id2551699">Technical Issues</a></dt><dt>loglevel, <a class="indexterm" href="happy.html#id2566373">Debugging LDAP</a></dt><dt>logon credentials, <a class="indexterm" href="DomApps.html#id2611510">Questions and Answers</a></dt><dt>logon hours, <a class="indexterm" href="ntmigration.html#id2594760">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2608497">Key Points Learned</a></dt><dt>logon machines, <a class="indexterm" href="ntmigration.html#id2594760">Technical Issues</a></dt><dt>logon path, <a class="indexterm" href="secure.html#id2552192">Implementation</a></dt><dt>logon process, <a class="indexterm" href="unixclients.html#id2583232">Implementation</a></dt><dt>logon scrip, <a class="indexterm" href="secure.html#id2553129">Samba Configuration</a></dt><dt>logon script, <a class="indexterm" href="secure.html#id2552192">Implementation</a>, <a class="indexterm" href="happy.html#id2564983">Technical Issues</a>, <a class="indexterm" href="happy.html#id2574266">Preparation of Logon Scripts</a>, <a class="indexterm" href="ntmigration.html#id2594760">Technical Issues</a></dt><dt>logon server, <a class="indexterm" href="2000users.html#id2577373">The Nature of Windows Networking Protocols</a></dt><dt>logon services, <a class="indexterm" href="secure.html#id2552192">Implementation</a></dt><dt>logon time, <a class="indexterm" href="happy.html#id2564389">Assignment Tasks</a></dt><dt>logon traffic, <a class="indexterm" href="2000users.html#id2577373">The Nature of Windows Networking Protocols</a></dt><dt>logon.kix, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a></dt><dt>loopback, <a class="indexterm" href="simple.html#validate1">Validation</a></dt><dt>low performance, <a class="indexterm" href="HA.html#id2613666">Hardware Problems</a></dt><dt>lower-case, <a class="indexterm" href="ntmigration.html#id2595109">Implementation</a></dt><dt>lpadmin, <a class="indexterm" href="simple.html#id2544185">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id2548364">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>LSB, <a class="indexterm" href="appendix.html#id2615023">Samba System File Location</a></dt></dl></div><div class="indexdiv"><h3>M</h3><dl><dt>machine, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a></dt><dt>machine account, <a class="indexterm" href="happy.html#id2564150">Regarding LDAP Directories and Windows Computer Accounts</a></dt><dt>machine accounts, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a></dt><dt>machine secret password, <a class="indexterm" href="Big500users.html#id2558534">Technical Issues</a></dt><dt>MACHINE.SID, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a></dt><dt>mailing list, <a class="indexterm" href="ch14.html#id2614097">Free Support</a></dt><dt>mailing lists, <a class="indexterm" href="ch14.html#id2614097">Free Support</a></dt><dt>managed, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>management, <a class="indexterm" href="unixclients.html#id2583132">Political Issues</a>, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a></dt><dd><dl><dt>group, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>User, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt></dl></dd><dt>mandatory profile, <a class="indexterm" href="happy.html#id2564983">Technical Issues</a>, <a class="indexterm" href="happy.html#id2574022">Configuring Profile Directories</a></dt><dt>Mandrake, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>mapped drives, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a></dt><dt>mapping, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id2609847">Kerberos Configuration</a></dt><dd><dl><dt>consistent, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt></dl></dd><dt>Mars_NWE, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>master, <a class="indexterm" href="2000users.html#id2576967">Dissection and Discussion</a></dt><dt>material, <a class="indexterm" href="appendix.html">A Collection of Useful Tidbits</a></dt><dt>memberUID, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a></dt><dt>memory requirements, <a class="indexterm" href="secure.html#id2551986">Hardware Requirements</a></dt><dt>merge, <a class="indexterm" href="ntmigration.html#id2594760">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a></dt><dt>merged, <a class="indexterm" href="ntmigration.html#id2594760">Technical Issues</a></dt><dt>meta-directory, <a class="indexterm" href="2000users.html#id2581507">Questions and Answers</a></dt><dt>meta-service, <a class="indexterm" href="kerberos.html#id2608631">Questions and Answers</a></dt><dt>Microsoft Access, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>Microsoft Excel, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>Microsoft ISA, <a class="indexterm" href="DomApps.html#id2609291">Assignment Tasks</a></dt><dt>Microsoft Management Console (see MMC)</dt><dt>Microsoft Office, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a>, <a class="indexterm" href="kerberos.html#id2607367">Share Point Directory and File Permissions</a></dt><dt>Microsoft Outlook</dt><dd><dl><dt>PST files, <a class="indexterm" href="2000users.html#id2581507">Questions and Answers</a></dt></dl></dd><dt>migrate, <a class="indexterm" href="upgrades.html">Updating Samba-3</a>, <a class="indexterm" href="ntmigration.html#id2594760">Technical Issues</a></dt><dt>migration, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id2548364">Implementation</a>, <a class="indexterm" href="happy.html#id2564389">Assignment Tasks</a>, <a class="indexterm" href="ntmigration.html#id2594435">Introduction</a>, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dd><dl><dt>objectives, <a class="indexterm" href="ntmigration.html#id2594574">Dissection and Discussion</a></dt></dl></dd><dt>Migration speed, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a></dt><dt>mime type, <a class="indexterm" href="simple.html#id2544185">Implementation</a>, <a class="indexterm" href="small.html#id2548364">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id2559489">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>mime types, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a></dt><dt>missing RPC's, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>MIT, <a class="indexterm" href="DomApps.html#id2609598">Implementation</a>, <a class="indexterm" href="DomApps.html#id2609847">Kerberos Configuration</a></dt><dt>MIT Kerberos, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="kerberos.html#id2606060">Kerberos Exposed</a></dt><dt>MIT kerberos, <a class="indexterm" href="unixclients.html#id2588507">IDMAP Storage in LDAP using Winbind</a></dt><dt>MIT KRB5, <a class="indexterm" href="DomApps.html#id2610236">Samba Configuration</a></dt><dt>mixed mode, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>mixed-mode, <a class="indexterm" href="kerberos.html#id2608631">Questions and Answers</a></dt><dt>MMC, <a class="indexterm" href="happy.html#id2575580">Configure Delete Cached Profiles on Logout</a>, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2608631">Questions and Answers</a></dt><dt>mobile computing, <a class="indexterm" href="small.html#id2548078">Dissection and Discussion</a></dt><dt>mobility, <a class="indexterm" href="2000users.html#id2577240">Technical Issues</a></dt><dt>modularization, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>modules, <a class="indexterm" href="DomApps.html#id2611510">Questions and Answers</a></dt><dt>MS Access</dt><dd><dl><dt>validate, <a class="indexterm" href="appendix.html#id2618104">Microsoft Access</a></dt></dl></dd><dt>MS Outlook, <a class="indexterm" href="happy.html#id2575264">Configuration of MS Outlook to Relocate PST File</a></dt><dd><dl><dt>PST, <a class="indexterm" href="happy.html#id2575264">Configuration of MS Outlook to Relocate PST File</a></dt><dt>PST file, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>MS Windows Server 2003, <a class="indexterm" href="DomApps.html#id2609598">Implementation</a></dt><dt>MS Word, <a class="indexterm" href="kerberos.html#id2607367">Share Point Directory and File Permissions</a></dt><dt>MSDFS, <a class="indexterm" href="HA.html#id2613566">Distribute Network Load with MSDFS</a></dt><dt>multi-subnet, <a class="indexterm" href="HA.html#id2612819">Routed Networks</a></dt><dt>multi-user</dt><dd><dl><dt>access, <a class="indexterm" href="appendix.html#id2618104">Microsoft Access</a></dt><dt>data access, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt></dl></dd><dt>multiple directories, <a class="indexterm" href="2000users.html#id2577720">Identity Management Needs</a></dt><dt>multiple domain controllers, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>multiple group mappings, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a></dt><dt>mutual assistance, <a class="indexterm" href="ch14.html#id2614097">Free Support</a></dt><dt>My Documents, <a class="indexterm" href="happy.html#id2565495">Roaming Profile Background</a></dt><dt>My Network Places, <a class="indexterm" href="simple.html#id2544185">Implementation</a></dt><dt>mysqlsam, <a class="indexterm" href="2000users.html#id2578202">Implementation</a></dt></dl></div><div class="indexdiv"><h3>N</h3><dl><dt>name resolution, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a>, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a>, <a class="indexterm" href="primer.html#id2618724">Assignment Tasks</a></dt><dd><dl><dt>Defective, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt></dl></dd><dt>name resolve order, <a class="indexterm" href="secure.html#id2552192">Implementation</a></dt><dt>name service switch, <a class="indexterm" href="small.html#id2548364">Implementation</a> (see NSS)</dt><dt>named, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="Big500users.html#id2559489">Server Preparation: All Servers</a></dt><dt>NAT, <a class="indexterm" href="secure.html#id2551699">Technical Issues</a></dt><dt>native, <a class="indexterm" href="kerberos.html#id2608631">Questions and Answers</a></dt><dt>net</dt><dd><dl><dt>ads</dt><dd><dl><dt>info, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>join, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a>, <a class="indexterm" href="DomApps.html#id2610236">Samba Configuration</a></dt><dt>status, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt></dl></dd><dt>getlocalsid, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a></dt><dt>group, <a class="indexterm" href="ntmigration.html#id2597709">NT4 Migration Using tdbsam Backend</a></dt><dt>groupmap</dt><dd><dl><dt>add, <a class="indexterm" href="secure.html#id2553129">Samba Configuration</a></dt><dt>list, <a class="indexterm" href="secure.html#id2553129">Samba Configuration</a>, <a class="indexterm" href="happy.html#id2569957">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>modify, <a class="indexterm" href="secure.html#id2553129">Samba Configuration</a></dt></dl></dd><dt>rpc</dt><dd><dl><dt>info, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a></dt><dt>join, <a class="indexterm" href="Big500users.html#ch5-domsvrspec">Configuration Specific to Domain Member Servers: BLDG1, BLDG2</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id2597709">NT4 Migration Using tdbsam Backend</a></dt><dt>vampire, <a class="indexterm" href="upgrades.html">Updating Samba-3</a>, <a class="indexterm" href="ntmigration.html#id2597709">NT4 Migration Using tdbsam Backend</a></dt></dl></dd><dt>setlocalsid, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a></dt></dl></dd><dt>NetBIOS, <a class="indexterm" href="2000users.html#id2577373">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a>, <a class="indexterm" href="HA.html#id2612627">Bad Hostnames</a>, <a class="indexterm" href="HA.html#id2612819">Routed Networks</a>, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dd><dl><dt>name cache, <a class="indexterm" href="2000users.html#id2581507">Questions and Answers</a></dt><dt>name resolution</dt><dd><dl><dt>delays, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>Node Type, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt></dl></dd><dt>netbios</dt><dd><dl><dt>machine name, <a class="indexterm" href="upgrades.html#id2592154">Change of hostname</a></dt></dl></dd><dt>netbios forwarding, <a class="indexterm" href="HA.html#id2612992">Network Collisions</a></dt><dt>NetBIOS name, <a class="indexterm" href="DomApps.html#id2609847">Kerberos Configuration</a></dt><dd><dl><dt>aliases, <a class="indexterm" href="2000users.html#id2577720">Identity Management Needs</a></dt></dl></dd><dt>netbios name, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id2592154">Change of hostname</a>, <a class="indexterm" href="HA.html#id2612627">Bad Hostnames</a></dt><dt>NETLOGON, <a class="indexterm" href="happy.html#id2565890">Using a Network Default User Profile</a>, <a class="indexterm" href="happy.html#id2574511">Windows Client Configuration</a></dt><dt>netlogon, <a class="indexterm" href="2000users.html#id2577373">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a></dt><dt>Netlogon, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dt>netmask, <a class="indexterm" href="simple.html#id2543216">Implementation</a></dt><dt>Netware, <a class="indexterm" href="small.html">Small Office Networking</a></dt><dt>NetWare, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a>, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a></dt><dt>network</dt><dd><dl><dt>administrators, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>analyzer, <a class="indexterm" href="primer.html#id2618724">Assignment Tasks</a></dt><dt>bandwidth, <a class="indexterm" href="2000users.html#id2577720">Identity Management Needs</a>, <a class="indexterm" href="2000users.html#id2581507">Questions and Answers</a></dt><dt>broadcast, <a class="indexterm" href="primer.html#id2618664">Introduction</a></dt><dt>captures, <a class="indexterm" href="primer.html#id2618502">Requirements and Notes</a></dt><dt>collisions, <a class="indexterm" href="HA.html#id2612992">Network Collisions</a></dt><dt>load, <a class="indexterm" href="HA.html#id2612992">Network Collisions</a></dt><dt>logon, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>logon scripts, <a class="indexterm" href="ntmigration.html#id2594574">Dissection and Discussion</a></dt><dt>management, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a></dt><dt>multi-segment, <a class="indexterm" href="happy.html#id2564292">Introduction</a></dt><dt>overload, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>performance, <a class="indexterm" href="HA.html#id2613092">Samba Configuration</a></dt><dt>routed, <a class="indexterm" href="2000users.html#id2576967">Dissection and Discussion</a></dt><dt>secure, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a></dt><dt>segment, <a class="indexterm" href="happy.html#id2564526">Dissection and Discussion</a></dt><dt>services, <a class="indexterm" href="DomApps.html#id2611510">Questions and Answers</a></dt><dt>sniffer, <a class="indexterm" href="primer.html#id2618502">Requirements and Notes</a></dt><dt>timeout, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>timeouts, <a class="indexterm" href="HA.html#id2612992">Network Collisions</a></dt><dt>trace, <a class="indexterm" href="primer.html#id2618724">Assignment Tasks</a></dt><dt>traffic</dt><dd><dl><dt>observation, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt></dl></dd><dt>wide-area, <a class="indexterm" href="happy.html#id2564526">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt></dl></dd><dt>Network Address Translation (see NAT)</dt><dt>network administrators, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>network attached storage (see NAS)</dt><dt>network bandwidth</dt><dd><dl><dt>utilization, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>Network Default Profile, <a class="indexterm" href="happy.html#id2565495">Roaming Profile Background</a></dt><dt>network hardware</dt><dd><dl><dt>defective, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>network hygiene, <a class="indexterm" href="HA.html#id2612117">Dissection and Discussion</a></dt><dt>network Identities, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a></dt><dt>network load factors, <a class="indexterm" href="Big500users.html#id2558499">Dissection and Discussion</a></dt><dt>Network Neighborhood, <a class="indexterm" href="simple.html#validate1">Validation</a>, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>network segment, <a class="indexterm" href="HA.html#id2613419">Use and Location of BDCs</a></dt><dt>network segments, <a class="indexterm" href="secure.html#id2551986">Hardware Requirements</a></dt><dt>network share, <a class="indexterm" href="happy.html#id2564389">Assignment Tasks</a></dt><dt>networking</dt><dd><dl><dt>client, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a></dt></dl></dd><dt>networking hardware</dt><dd><dl><dt>defective, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>networking protocols, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>next generation, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>NextFreeUnixId, <a class="indexterm" href="ntmigration.html#id2595250">NT4 Migration Using LDAP Backend</a></dt><dt>NFS server, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></dt><dt>NICs, <a class="indexterm" href="HA.html#id2613666">Hardware Problems</a></dt><dt>NIS, <a class="indexterm" href="happy.html#id2569957">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="2000users.html#id2577720">Identity Management Needs</a>, <a class="indexterm" href="2000users.html#id2581507">Questions and Answers</a>, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2583132">Political Issues</a>, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a></dt><dt>nis, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>NIS schema, <a class="indexterm" href="2000users.html#id2581507">Questions and Answers</a></dt><dt>NIS server, <a class="indexterm" href="2000users.html#id2581507">Questions and Answers</a></dt><dt>NIS+, <a class="indexterm" href="2000users.html#id2577720">Identity Management Needs</a></dt><dt>nisplus, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>NLM, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>nmap, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>nmbd, <a class="indexterm" href="small.html#id2550065">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="upgrades.html#id2593860">Replacing a Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id2610236">Samba Configuration</a>, <a class="indexterm" href="appendix.html#id2615443">Starting Samba</a></dt><dt>nobody, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a class="indexterm" href="primer.html#id2620350">Findings and Comments</a></dt><dt>Novell, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a>, <a class="indexterm" href="nw4migration.html#id2599130">Introduction</a></dt><dt>Novell SUSE SLES 9, <a class="indexterm" href="ntmigration.html#id2595250">NT4 Migration Using LDAP Backend</a></dt><dt>NSS, <a class="indexterm" href="happy.html#id2564150">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="happy.html#id2564983">Technical Issues</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#id2587903">IDMAP_RID with Winbind</a>, <a class="indexterm" href="unixclients.html#id2589438">UNIX/Linux Client Domain Member</a>, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a>, <a class="indexterm" href="DomApps.html#id2610788">NSS Configuration</a> (see same service switch)</dt><dt>nss_ldap, <a class="indexterm" href="happy.html#id2564150">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="happy.html#id2564983">Technical Issues</a>, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="happy.html#id2569957">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#id2589101">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a class="indexterm" href="upgrades.html#id2593860">Replacing a Domain Member Server</a>, <a class="indexterm" href="ntmigration.html#id2595250">NT4 Migration Using LDAP Backend</a></dt><dt>nt acl support, <a class="indexterm" href="simple.html#id2543975">Dissection and Discussion</a></dt><dt>NT4 registry, <a class="indexterm" href="ntmigration.html#id2594574">Dissection and Discussion</a></dt><dt>NTLM, <a class="indexterm" href="DomApps.html#id2609425">Technical Issues</a></dt><dt>NTLM authentication daemon, <a class="indexterm" href="DomApps.html#id2609425">Technical Issues</a></dt><dt>NTLMSSP, <a class="indexterm" href="DomApps.html#id2611450">Key Points Learned</a>, <a class="indexterm" href="DomApps.html#id2611510">Questions and Answers</a>, <a class="indexterm" href="primer.html#id2620615">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>NTLMSSP_AUTH, <a class="indexterm" href="primer.html#id2620615">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>ntlm_auth, <a class="indexterm" href="DomApps.html#id2610236">Samba Configuration</a>, <a class="indexterm" href="DomApps.html#id2611510">Questions and Answers</a></dt><dt>NTP, <a class="indexterm" href="DomApps.html#id2609847">Kerberos Configuration</a></dt><dt>NTUSER.DAT, <a class="indexterm" href="happy.html#id2565495">Roaming Profile Background</a>, <a class="indexterm" href="happy.html#id2565796">Profile Changes</a>, <a class="indexterm" href="happy.html#id2565890">Using a Network Default User Profile</a>, <a class="indexterm" href="2000users.html#id2581507">Questions and Answers</a></dt><dt>NULL connection, <a class="indexterm" href="simple.html#validate1">Validation</a></dt><dt>NULL session, <a class="indexterm" href="primer.html#id2620350">Findings and Comments</a></dt><dt>NULL-Session, <a class="indexterm" href="primer.html#id2621152">Discussion</a></dt></dl></div><div class="indexdiv"><h3>O</h3><dl><dt>objectClass, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a></dt><dt>off-site storage, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a></dt><dt>Open Magazine, <a class="indexterm" href="unixclients.html">Adding Domain Member Servers and Clients</a></dt><dt>Open Source, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a></dt><dt>OpenLDAP, <a class="indexterm" href="happy.html#id2564526">Dissection and Discussion</a>, <a class="indexterm" href="2000users.html#id2576967">Dissection and Discussion</a>, <a class="indexterm" href="2000users.html#id2581507">Questions and Answers</a>, <a class="indexterm" href="unixclients.html#id2583132">Political Issues</a>, <a class="indexterm" href="nw4migration.html#id2599436">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a>, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2608497">Key Points Learned</a>, <a class="indexterm" href="appendix.html#id2616627">The LDAP Account Manager</a></dt><dt>openldap, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>OpenOffice, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a></dt><dt>operating profiles, <a class="indexterm" href="appendix.html#id2616627">The LDAP Account Manager</a></dt><dt>oplock break, <a class="indexterm" href="kerberos.html#id2607206">Override Controls</a></dt><dt>oplocks, <a class="indexterm" href="HA.html#id2613092">Samba Configuration</a></dt><dt>Oplocks</dt><dd><dl><dt>disabled, <a class="indexterm" href="appendix.html#id2618336">Opportunistic Locking Controls</a></dt></dl></dd><dt>opportunistic</dt><dd><dl><dt>locking, <a class="indexterm" href="kerberos.html#id2607206">Override Controls</a></dt></dl></dd><dt>opportunistic locking, <a class="indexterm" href="secure.html#id2552192">Implementation</a>, <a class="indexterm" href="HA.html#id2613092">Samba Configuration</a>, <a class="indexterm" href="appendix.html#id2618252">Act! Database Sharing</a></dt><dt>optimized, <a class="indexterm" href="HA.html#id2613092">Samba Configuration</a></dt><dt>organizational units, <a class="indexterm" href="appendix.html#id2616627">The LDAP Account Manager</a></dt><dt>OS/2, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a></dt><dt>Outlook</dt><dd><dl><dt>PST, <a class="indexterm" href="happy.html#id2575264">Configuration of MS Outlook to Relocate PST File</a></dt></dl></dd><dt>Outlook Address Book, <a class="indexterm" href="happy.html#id2575264">Configuration of MS Outlook to Relocate PST File</a></dt><dt>Outlook Express, <a class="indexterm" href="secure.html#id2552152">Political Issues</a>, <a class="indexterm" href="happy.html#id2575264">Configuration of MS Outlook to Relocate PST File</a></dt><dt>over-ride, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>over-ride controls, <a class="indexterm" href="kerberos.html#id2607206">Override Controls</a></dt><dt>over-rule, <a class="indexterm" href="kerberos.html#id2606406">Share Access Controls</a>, <a class="indexterm" href="kerberos.html#id2608116">Using MS Windows Explorer (File Manager)</a></dt><dt>overheads, <a class="indexterm" href="kerberos.html#id2607206">Override Controls</a></dt><dt>ownership, <a class="indexterm" href="kerberos.html#id2607367">Share Point Directory and File Permissions</a></dt></dl></div><div class="indexdiv"><h3>P</h3><dl><dt>package, <a class="indexterm" href="simple.html#id2543216">Implementation</a></dt><dt>package names, <a class="indexterm" href="appendix.html#id2615023">Samba System File Location</a></dt><dt>packages, <a class="indexterm" href="upgrades.html#id2593535">Updating a Samba-3 Installation</a></dt><dt>PADL, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2588507">IDMAP Storage in LDAP using Winbind</a></dt><dt>PADL LDAP tools, <a class="indexterm" href="happy.html#id2564983">Technical Issues</a></dt><dt>PADL Software, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>paid-for support, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>PAM, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="unixclients.html#id2589438">UNIX/Linux Client Domain Member</a>, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a></dt><dt>pam_ldap, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>pam_ldap.so, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dt>pam_unix2.so, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dd><dl><dt>use_ldap, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt></dl></dd><dt>parameters, <a class="indexterm" href="upgrades.html#id2593019">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>passdb backend, <a class="indexterm" href="secure.html#id2552192">Implementation</a>, <a class="indexterm" href="Big500users.html">The 500-User Office</a>, <a class="indexterm" href="happy.html#id2564526">Dissection and Discussion</a>, <a class="indexterm" href="2000users.html#id2576967">Dissection and Discussion</a>, <a class="indexterm" href="2000users.html#id2578202">Implementation</a>, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a>, <a class="indexterm" href="upgrades.html">Updating Samba-3</a>, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id2593019">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="upgrades.html#id2593679">Updating from Samba Versions between 3.0.6 and 3.0.10</a>, <a class="indexterm" href="ntmigration.html#id2594520">Assignment Tasks</a>, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a></dt><dt>passdb.tdb, <a class="indexterm" href="ntmigration.html#id2594760">Technical Issues</a></dt><dt>passwd, <a class="indexterm" href="simple.html#id2544185">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="secure.html#id2553129">Samba Configuration</a></dt><dt>password</dt><dd><dl><dt>backend, <a class="indexterm" href="small.html#id2548364">Implementation</a>, <a class="indexterm" href="secure.html#id2553129">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2560067">Configuration for Server: MASSIVE</a></dt></dl></dd><dt>password caching, <a class="indexterm" href="simple.html#id2544185">Implementation</a></dt><dt>password change, <a class="indexterm" href="kerberos.html#id2608497">Key Points Learned</a></dt><dt>password length, <a class="indexterm" href="primer.html#id2620113">Simple Windows Client Connection Characteristics</a>, <a class="indexterm" href="primer.html#id2620615">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>payroll, <a class="indexterm" href="nw4migration.html#id2599130">Introduction</a></dt><dt>pdbedit, <a class="indexterm" href="happy.html#id2569957">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a class="indexterm" href="ntmigration.html#id2597709">NT4 Migration Using tdbsam Backend</a>, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a></dt><dt>PDC, <a class="indexterm" href="Big500users.html#id2558393">Assignment Tasks</a>, <a class="indexterm" href="Big500users.html#id2558534">Technical Issues</a>, <a class="indexterm" href="happy.html">Making Happy Users</a>, <a class="indexterm" href="happy.html#id2564983">Technical Issues</a>, <a class="indexterm" href="happy.html#sbehap-locgrppol">The Local Group Policy</a>, <a class="indexterm" href="2000users.html#id2577373">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id2593019">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id2595109">Implementation</a>, <a class="indexterm" href="ntmigration.html#id2595250">NT4 Migration Using LDAP Backend</a>, <a class="indexterm" href="ntmigration.html#id2597709">NT4 Migration Using tdbsam Backend</a>, <a class="indexterm" href="HA.html#id2613419">Use and Location of BDCs</a></dt><dt>PDC/BDC ratio, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>PDF, <a class="indexterm" href="appendix.html#id2616627">The LDAP Account Manager</a></dt><dt>performance, <a class="indexterm" href="happy.html#id2564526">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id2608631">Questions and Answers</a>, <a class="indexterm" href="HA.html">Performance, Reliability, and Availability</a>, <a class="indexterm" href="HA.html#id2612030">Introduction</a>, <a class="indexterm" href="HA.html#id2612992">Network Collisions</a></dt><dt>performance degradation, <a class="indexterm" href="kerberos.html#id2607206">Override Controls</a>, <a class="indexterm" href="HA.html#id2613092">Samba Configuration</a></dt><dt>Perl, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a>, <a class="indexterm" href="appendix.html#id2616627">The LDAP Account Manager</a></dt><dt>permission, <a class="indexterm" href="kerberos.html#id2607367">Share Point Directory and File Permissions</a></dt><dt>permissions, <a class="indexterm" href="simple.html#id2544185">Implementation</a>, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2606406">Share Access Controls</a>, <a class="indexterm" href="kerberos.html#id2606894">Checkpoint Controls</a>, <a class="indexterm" href="kerberos.html#id2607367">Share Point Directory and File Permissions</a>, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dd><dl><dt>excessive, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>group, <a class="indexterm" href="kerberos.html#id2607367">Share Point Directory and File Permissions</a></dt><dt>user, <a class="indexterm" href="kerberos.html#id2607367">Share Point Directory and File Permissions</a></dt></dl></dd><dt>Permissions, <a class="indexterm" href="kerberos.html#id2607825">Using the MMC Computer Management Interface</a></dt><dt>permits, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>permitted group, <a class="indexterm" href="kerberos.html#id2607825">Using the MMC Computer Management Interface</a></dt><dt>PHP, <a class="indexterm" href="appendix.html#id2616627">The LDAP Account Manager</a></dt><dt>PHP4, <a class="indexterm" href="appendix.html#id2616627">The LDAP Account Manager</a></dt><dt>pile-driver, <a class="indexterm" href="kerberos.html#id2606754">Share Definition Controls</a></dt><dt>ping, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>pitfalls, <a class="indexterm" href="appendix.html#id2616627">The LDAP Account Manager</a></dt><dt>plain-text, <a class="indexterm" href="DomApps.html#id2611510">Questions and Answers</a></dt><dt>Pluggable Authentication Modules (see PAM)</dt><dt>policy, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a></dt><dt>poor performance, <a class="indexterm" href="HA.html#id2612117">Dissection and Discussion</a></dt><dt>POP3, <a class="indexterm" href="nw4migration.html#id2599436">Technical Issues</a></dt><dt>Posix, <a class="indexterm" href="simple.html#id2543975">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#id2564983">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id2595109">Implementation</a>, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a>, <a class="indexterm" href="appendix.html#id2616627">The LDAP Account Manager</a></dt><dt>POSIX, <a class="indexterm" href="happy.html#id2564150">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a></dt><dt>Posix accounts, <a class="indexterm" href="happy.html#id2569957">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a></dt><dt>Posix ACLs, <a class="indexterm" href="kerberos.html#id2607770">Managing Windows 200x ACLs</a></dt><dt>PosixAccount, <a class="indexterm" href="happy.html#id2569957">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>posixAccount, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a></dt><dt>Postfix, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a></dt><dt>Postscript, <a class="indexterm" href="happy.html#id2565949">Installation of Printer Driver Auto-Download</a></dt><dt>powers, <a class="indexterm" href="kerberos.html#id2606754">Share Definition Controls</a></dt><dt>practices, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a></dt><dt>precaution, <a class="indexterm" href="upgrades.html#id2591226">Introduction</a></dt><dt>presence and leadership, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>price paid, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a></dt><dt>primary group, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="kerberos.html#id2607367">Share Point Directory and File Permissions</a></dt><dt>principals, <a class="indexterm" href="kerberos.html#id2606060">Kerberos Exposed</a></dt><dt>print filter, <a class="indexterm" href="small.html#id2548364">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id2559489">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>print queue, <a class="indexterm" href="simple.html#id2543845">Charity Administration Office</a>, <a class="indexterm" href="simple.html#id2543975">Dissection and Discussion</a></dt><dt>print spooler, <a class="indexterm" href="simple.html#id2543845">Charity Administration Office</a></dt><dt>Print Test Page, <a class="indexterm" href="happy.html#id2575759">Uploading Printer Drivers to Samba Servers</a></dt><dt>printcap name, <a class="indexterm" href="secure.html#id2552192">Implementation</a></dt><dt>printer validation, <a class="indexterm" href="small.html#id2550065">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>printers</dt><dd><dl><dt>Advanced, <a class="indexterm" href="happy.html#id2575759">Uploading Printer Drivers to Samba Servers</a></dt><dt>Default Settings, <a class="indexterm" href="happy.html#id2575759">Uploading Printer Drivers to Samba Servers</a></dt><dt>General, <a class="indexterm" href="happy.html#id2575759">Uploading Printer Drivers to Samba Servers</a></dt><dt>Properties, <a class="indexterm" href="happy.html#id2575759">Uploading Printer Drivers to Samba Servers</a></dt><dt>Security, <a class="indexterm" href="happy.html#id2575759">Uploading Printer Drivers to Samba Servers</a></dt><dt>Sharing, <a class="indexterm" href="happy.html#id2575759">Uploading Printer Drivers to Samba Servers</a></dt></dl></dd><dt>printing, <a class="indexterm" href="secure.html#id2552192">Implementation</a></dt><dd><dl><dt>drag-and-drop, <a class="indexterm" href="happy.html#id2565949">Installation of Printer Driver Auto-Download</a>, <a class="indexterm" href="happy.html#id2575759">Uploading Printer Drivers to Samba Servers</a></dt><dt>dumb, <a class="indexterm" href="happy.html#id2565949">Installation of Printer Driver Auto-Download</a></dt><dt>point-n-click, <a class="indexterm" href="happy.html#id2565949">Installation of Printer Driver Auto-Download</a></dt><dt>raw, <a class="indexterm" href="simple.html#id2543975">Dissection and Discussion</a></dt></dl></dd><dt>privacy, <a class="indexterm" href="2000users.html#id2577720">Identity Management Needs</a></dt><dt>Privilege Attribute Certificates (see PAC)</dt><dt>privilege controls, <a class="indexterm" href="kerberos.html#id2607367">Share Point Directory and File Permissions</a></dt><dt>privileged pipe, <a class="indexterm" href="DomApps.html#id2610236">Samba Configuration</a></dt><dt>privileges, <a class="indexterm" href="2000users.html#id2577720">Identity Management Needs</a>, <a class="indexterm" href="upgrades.html#id2593757">Updating from Samba Versions after 3.0.6 to a Current Release</a>, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2606754">Share Definition Controls</a></dt><dt>problem report, <a class="indexterm" href="ch14.html#id2614097">Free Support</a></dt><dt>problem resolution, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>product defects, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a></dt><dt>professional support, <a class="indexterm" href="ch14.html#id2614097">Free Support</a></dt><dt>profile</dt><dd><dl><dt>default, <a class="indexterm" href="happy.html#id2564389">Assignment Tasks</a></dt><dt>mandatory, <a class="indexterm" href="2000users.html#id2577373">The Nature of Windows Networking Protocols</a></dt><dt>roaming, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>profile path, <a class="indexterm" href="ntmigration.html#id2594760">Technical Issues</a></dt><dt>profile share, <a class="indexterm" href="secure.html#id2552192">Implementation</a></dt><dt>profiles, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a></dt><dt>profiles share, <a class="indexterm" href="ntmigration.html#id2594574">Dissection and Discussion</a></dt><dt>programmer, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a></dt><dt>project, <a class="indexterm" href="ch14.html#id2614097">Free Support</a></dt><dt>project maintainers, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>Properties, <a class="indexterm" href="kerberos.html#id2607825">Using the MMC Computer Management Interface</a></dt><dt>proprietary, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>protected, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>protection, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>protocol</dt><dd><dl><dt>negotiation, <a class="indexterm" href="2000users.html#id2577373">The Nature of Windows Networking Protocols</a></dt></dl></dd><dt>protocol analysis, <a class="indexterm" href="primer.html#id2618502">Requirements and Notes</a></dt><dt>protocols, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>provided services, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>proxy, <a class="indexterm" href="DomApps.html#id2609291">Assignment Tasks</a>, <a class="indexterm" href="DomApps.html#id2609425">Technical Issues</a></dt><dt>PST file, <a class="indexterm" href="happy.html#id2575264">Configuration of MS Outlook to Relocate PST File</a></dt><dt>public specifications, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>purchase support, <a class="indexterm" href="ch14.html#id2614097">Free Support</a></dt></dl></div><div class="indexdiv"><h3>Q</h3><dl><dt>Qbasic, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a></dt><dt>qualified problem, <a class="indexterm" href="ch14.html#id2614097">Free Support</a></dt></dl></div><div class="indexdiv"><h3>R</h3><dl><dt>RAID, <a class="indexterm" href="secure.html#id2551986">Hardware Requirements</a></dt><dt>RAID controllers, <a class="indexterm" href="HA.html#id2613666">Hardware Problems</a></dt><dt>Raw Print Through, <a class="indexterm" href="happy.html#id2565949">Installation of Printer Driver Auto-Download</a></dt><dt>raw printing, <a class="indexterm" href="small.html#id2548364">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id2559489">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>Rbase, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a></dt><dt>rcldap, <a class="indexterm" href="2000users.html#id2578202">Implementation</a></dt><dt>realm, <a class="indexterm" href="unixclients.html#id2587903">IDMAP_RID with Winbind</a>, <a class="indexterm" href="unixclients.html#id2588507">IDMAP Storage in LDAP using Winbind</a>, <a class="indexterm" href="DomApps.html#id2609847">Kerberos Configuration</a></dt><dt>recognize, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>record locking, <a class="indexterm" href="appendix.html#id2618104">Microsoft Access</a></dt><dt>recursively, <a class="indexterm" href="kerberos.html#id2608287">Setting Posix ACLs in UNIX/Linux</a></dt><dt>Red Hat, <a class="indexterm" href="simple.html#id2543074">Drafting Office</a>, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>Red Hat Fedora Linux, <a class="indexterm" href="DomApps.html#id2610236">Samba Configuration</a></dt><dt>Red Hat Linux, <a class="indexterm" href="simple.html#id2543975">Dissection and Discussion</a>, <a class="indexterm" href="simple.html#AccountingOffice">Accounting Office</a>, <a class="indexterm" href="happy.html#id2567058">Samba Server Implementation</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="2000users.html#id2578202">Implementation</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id2609598">Implementation</a>, <a class="indexterm" href="DomApps.html#id2610236">Samba Configuration</a></dt><dt>redirected folders, <a class="indexterm" href="happy.html#id2565495">Roaming Profile Background</a>, <a class="indexterm" href="2000users.html#id2577373">The Nature of Windows Networking Protocols</a></dt><dt>refereed standards, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>regedit, <a class="indexterm" href="simple.html#id2544185">Implementation</a></dt><dt>regedt32, <a class="indexterm" href="happy.html#id2565796">Profile Changes</a>, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>registry, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a></dt><dd><dl><dt>keys</dt><dd><dl><dt>SAM, <a class="indexterm" href="ntmigration.html#id2594574">Dissection and Discussion</a></dt><dt>SECURITY, <a class="indexterm" href="ntmigration.html#id2594574">Dissection and Discussion</a></dt></dl></dd></dl></dd><dt>registry change, <a class="indexterm" href="kerberos.html#id2608631">Questions and Answers</a></dt><dt>Registry Editor, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>registry hacks, <a class="indexterm" href="kerberos.html#id2608631">Questions and Answers</a></dt><dt>registry keys, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>reimburse, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a></dt><dt>rejected, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="kerberos.html#id2606406">Share Access Controls</a></dt><dt>rejoin, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a></dt><dt>reliability, <a class="indexterm" href="HA.html">Performance, Reliability, and Availability</a></dt><dt>remote announce, <a class="indexterm" href="HA.html#id2612819">Routed Networks</a></dt><dt>remote browse sync, <a class="indexterm" href="HA.html#id2612819">Routed Networks</a></dt><dt>remote procedure call (see RPC)</dt><dt>replicate, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a>, <a class="indexterm" href="HA.html#id2613620">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></dt><dt>replicated, <a class="indexterm" href="2000users.html#id2576967">Dissection and Discussion</a></dt><dt>requesting payment, <a class="indexterm" href="ch14.html#id2614097">Free Support</a></dt><dt>resilient, <a class="indexterm" href="HA.html#id2612588">Guidelines for Reliable Samba Operation</a></dt><dt>resolution, <a class="indexterm" href="upgrades.html#id2593860">Replacing a Domain Member Server</a></dt><dt>resolve, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a>, <a class="indexterm" href="HA.html#id2612627">Bad Hostnames</a></dt><dt>response, <a class="indexterm" href="unixclients.html#id2587903">IDMAP_RID with Winbind</a></dt><dt>responsibility, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a></dt><dt>responsible, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>restrict anonymous, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>restricted export, <a class="indexterm" href="kerberos.html#id2606060">Kerberos Exposed</a></dt><dt>Restrictive security, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>reverse DNS, <a class="indexterm" href="DomApps.html#id2609847">Kerberos Configuration</a></dt><dt>rfc2307bis, <a class="indexterm" href="unixclients.html#id2589101">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a></dt><dt>RID, <a class="indexterm" href="unixclients.html#id2587903">IDMAP_RID with Winbind</a>, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a></dt><dt>risk, <a class="indexterm" href="secure.html#id2551699">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a></dt><dt>road-map, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dd><dl><dt>published, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt></dl></dd><dt>roaming profile, <a class="indexterm" href="happy.html#id2564983">Technical Issues</a>, <a class="indexterm" href="happy.html#id2565495">Roaming Profile Background</a>, <a class="indexterm" href="happy.html#id2574022">Configuring Profile Directories</a>, <a class="indexterm" href="2000users.html#id2577280">User Needs</a>, <a class="indexterm" href="2000users.html#id2581507">Questions and Answers</a></dt><dt>roaming profiles, <a class="indexterm" href="secure.html#id2551699">Technical Issues</a>, <a class="indexterm" href="secure.html#id2552192">Implementation</a>, <a class="indexterm" href="happy.html#id2565495">Roaming Profile Background</a></dt><dt>routed network, <a class="indexterm" href="HA.html#id2613419">Use and Location of BDCs</a></dt><dt>router, <a class="indexterm" href="small.html#id2548364">Implementation</a></dt><dt>routers, <a class="indexterm" href="2000users.html#id2581507">Questions and Answers</a>, <a class="indexterm" href="HA.html#id2612819">Routed Networks</a></dt><dt>RPC, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="kerberos.html#id2606060">Kerberos Exposed</a></dt><dt>rpc, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a></dt><dt>rpcclient, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a></dt><dt>RPM, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="nw4migration.html#id2599359">Dissection and Discussion</a></dt><dd><dl><dt>install, <a class="indexterm" href="simple.html#id2543216">Implementation</a></dt></dl></dd><dt>rpm, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a class="indexterm" href="appendix.html#id2615023">Samba System File Location</a></dt><dt>RPMs, <a class="indexterm" href="DomApps.html#id2610236">Samba Configuration</a></dt><dt>rpms, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>rsync, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a>, <a class="indexterm" href="HA.html#id2613620">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></dt><dt>rsyncd.conf, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a></dt><dt>run-time control files, <a class="indexterm" href="appendix.html#id2615023">Samba System File Location</a></dt></dl></div><div class="indexdiv"><h3>S</h3><dl><dt>safe-guards, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>SAM, <a class="indexterm" href="ntmigration.html#id2594574">Dissection and Discussion</a></dt><dt>samba, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dd><dl><dt>starting samba, <a class="indexterm" href="simple.html#id2543216">Implementation</a></dt></dl></dd><dt>Samba, <a class="indexterm" href="DomApps.html#id2610236">Samba Configuration</a></dt><dt>Samba accounts, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a></dt><dt>samba cluster, <a class="indexterm" href="HA.html#id2612030">Introduction</a></dt><dt>samba control script, <a class="indexterm" href="appendix.html#id2615443">Starting Samba</a></dt><dt>Samba Domain, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a></dt><dt>Samba Domain server, <a class="indexterm" href="kerberos.html#id2607825">Using the MMC Computer Management Interface</a></dt><dt>Samba RPM Packages, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></dt><dt>Samba Tea, <a class="indexterm" href="DomApps.html#id2610236">Samba Configuration</a></dt><dt>sambaDomainName, <a class="indexterm" href="ntmigration.html#id2595250">NT4 Migration Using LDAP Backend</a></dt><dt>sambaGroupMapping, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a></dt><dt>SambaSAMAccount, <a class="indexterm" href="happy.html#id2564150">Regarding LDAP Directories and Windows Computer Accounts</a></dt><dt>SambaSamAccount, <a class="indexterm" href="happy.html#id2569957">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>sambaSamAccount, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a></dt><dt>SambaXP conference, <a class="indexterm" href="DomApps.html#id2611510">Questions and Answers</a></dt><dt>SAN, <a class="indexterm" href="HA.html#id2613516">For Scalability, Use SAN-Based Storage on Samba Servers</a></dt><dt>SAS, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a></dt><dt>scalability, <a class="indexterm" href="HA.html#id2612030">Introduction</a></dt><dt>scalable, <a class="indexterm" href="2000users.html#id2577720">Identity Management Needs</a></dt><dt>schannel, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2608497">Key Points Learned</a>, <a class="indexterm" href="kerberos.html#id2608631">Questions and Answers</a></dt><dt>schema, <a class="indexterm" href="unixclients.html#id2589101">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id2593353">Samba-2.x with LDAP Support</a>, <a class="indexterm" href="upgrades.html#id2593679">Updating from Samba Versions between 3.0.6 and 3.0.10</a></dt><dt>scripts, <a class="indexterm" href="appendix.html#id2616627">The LDAP Account Manager</a></dt><dt>secondary group, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>secret, <a class="indexterm" href="kerberos.html#id2606060">Kerberos Exposed</a></dt><dt>secrets.tdb, <a class="indexterm" href="happy.html#id2564983">Technical Issues</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#sbeug1">Location of config files</a></dt><dt>secure, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a></dt><dt>secure account password, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a></dt><dt>secure connections, <a class="indexterm" href="appendix.html#id2616627">The LDAP Account Manager</a></dt><dt>secure networking, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>secure networking protocols, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>security, <a class="indexterm" href="happy.html#id2564983">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a>, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a>, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2607367">Share Point Directory and File Permissions</a>, <a class="indexterm" href="kerberos.html#id2608631">Questions and Answers</a></dt><dd><dl><dt>identifier, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a></dt><dt>share mode, <a class="indexterm" href="simple.html#id2543975">Dissection and Discussion</a></dt><dt>user mode, <a class="indexterm" href="simple.html#id2546228">Dissection and Discussion</a></dt></dl></dd><dt>Security, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2607825">Using the MMC Computer Management Interface</a></dt><dt>Security Account Manager (see SAM)</dt><dt>security controls, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>security descriptors, <a class="indexterm" href="ntmigration.html#id2594574">Dissection and Discussion</a></dt><dt>security fixes, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>security updates, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>SerNet, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id2610236">Samba Configuration</a></dt><dt>server</dt><dd><dl><dt>domain member, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a></dt><dt>stand-alone, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a></dt></dl></dd><dt>service, <a class="indexterm" href="2000users.html#id2578202">Implementation</a></dt><dd><dl><dt>smb</dt><dd><dl><dt>start, <a class="indexterm" href="Big500users.html#ch5-domsvrspec">Configuration Specific to Domain Member Servers: BLDG1, BLDG2</a></dt></dl></dd></dl></dd><dt>Service Packs, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a></dt><dt>services, <a class="indexterm" href="DomApps.html#id2611450">Key Points Learned</a></dt><dt>services provided, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>session setup, <a class="indexterm" href="primer.html#id2620113">Simple Windows Client Connection Characteristics</a>, <a class="indexterm" href="primer.html#id2620615">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>Session Setup, <a class="indexterm" href="primer.html#id2620113">Simple Windows Client Connection Characteristics</a></dt><dt>SessionSetUpAndX, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a></dt><dt>set primary group script, <a class="indexterm" href="upgrades.html#id2593019">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>setfacl, <a class="indexterm" href="kerberos.html#id2608287">Setting Posix ACLs in UNIX/Linux</a></dt><dt>severely degrade, <a class="indexterm" href="HA.html#id2613092">Samba Configuration</a></dt><dt>SFU, <a class="indexterm" href="unixclients.html#id2589387">IDMAP, Active Directory, and MS Services for UNIX 3.5</a></dt><dt>SGID, <a class="indexterm" href="simple.html#id2543975">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id2607367">Share Point Directory and File Permissions</a>, <a class="indexterm" href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></dt><dt>shadow-utils, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a></dt><dt>Share Access Controls, <a class="indexterm" href="kerberos.html#id2606406">Share Access Controls</a></dt><dt>share ACLs, <a class="indexterm" href="kerberos.html#id2608631">Questions and Answers</a></dt><dt>share definition, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>Share Definition</dt><dd><dl><dt>Controls, <a class="indexterm" href="kerberos.html#id2606754">Share Definition Controls</a></dt></dl></dd><dt>share definition controls, <a class="indexterm" href="kerberos.html#id2606754">Share Definition Controls</a>, <a class="indexterm" href="kerberos.html#id2606894">Checkpoint Controls</a>, <a class="indexterm" href="kerberos.html#id2607367">Share Point Directory and File Permissions</a>, <a class="indexterm" href="kerberos.html#id2608631">Questions and Answers</a></dt><dt>share level access controls, <a class="indexterm" href="kerberos.html#id2608631">Questions and Answers</a></dt><dt>share level ACL, <a class="indexterm" href="kerberos.html#id2608631">Questions and Answers</a></dt><dt>Share Permissions, <a class="indexterm" href="kerberos.html#id2606406">Share Access Controls</a></dt><dt>shared resource, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2608287">Setting Posix ACLs in UNIX/Linux</a></dt><dt>shares, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>SID, <a class="indexterm" href="secure.html#ch4wincfg">Windows Client Configuration</a>, <a class="indexterm" href="happy.html#id2564150">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="2000users.html#id2577720">Identity Management Needs</a>, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2587903">IDMAP_RID with Winbind</a>, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id2592219">Change of Workgroup (Domain) Name</a>, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a>, <a class="indexterm" href="appendix.html#id2616048">Initialization of the LDAP Database</a></dt><dt>side effects, <a class="indexterm" href="kerberos.html#id2607770">Managing Windows 200x ACLs</a></dt><dt>Sign'n'seal, <a class="indexterm" href="kerberos.html#id2608497">Key Points Learned</a>, <a class="indexterm" href="kerberos.html#id2608631">Questions and Answers</a></dt><dt>silent return, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>simple, <a class="indexterm" href="HA.html#id2612117">Dissection and Discussion</a></dt><dt>Single Sign-On (see SSO)</dt><dt>slapcat, <a class="indexterm" href="happy.html#id2569957">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a></dt><dt>slapd, <a class="indexterm" href="happy.html#id2566373">Debugging LDAP</a></dt><dt>slapd.conf, <a class="indexterm" href="ntmigration.html#id2595250">NT4 Migration Using LDAP Backend</a></dt><dt>slave, <a class="indexterm" href="2000users.html#id2576967">Dissection and Discussion</a></dt><dt>slow logon, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>slow network, <a class="indexterm" href="HA.html#id2613666">Hardware Problems</a></dt><dt>slurpd, <a class="indexterm" href="2000users.html#id2578202">Implementation</a>, <a class="indexterm" href="2000users.html#id2581507">Questions and Answers</a></dt><dt>smart printing, <a class="indexterm" href="happy.html#id2564526">Dissection and Discussion</a></dt><dt>SMB, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a></dt><dt>SMB passwords, <a class="indexterm" href="2000users.html#id2578202">Implementation</a></dt><dt>SMB/CIFS, <a class="indexterm" href="DomApps.html#id2611510">Questions and Answers</a></dt><dt>smbclient, <a class="indexterm" href="simple.html#validate1">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="happy.html#id2569957">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="DomApps.html#id2611510">Questions and Answers</a></dt><dt>smbd, <a class="indexterm" href="simple.html#validate1">Validation</a>, <a class="indexterm" href="simple.html#id2544185">Implementation</a>, <a class="indexterm" href="small.html#id2550065">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#sbeug1">Location of config files</a>, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="upgrades.html#id2593860">Replacing a Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id2610236">Samba Configuration</a>, <a class="indexterm" href="DomApps.html#id2611510">Questions and Answers</a>, <a class="indexterm" href="appendix.html#id2615443">Starting Samba</a></dt><dd><dl><dt>location of files, <a class="indexterm" href="appendix.html#id2615023">Samba System File Location</a></dt></dl></dd><dt>smbfs, <a class="indexterm" href="HA.html#id2612117">Dissection and Discussion</a></dt><dt>smbldap-groupadd, <a class="indexterm" href="happy.html#id2569957">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a></dt><dt>smbldap-groupmod, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a></dt><dt>smbldap-passwd, <a class="indexterm" href="happy.html#id2569957">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>smbldap-populate, <a class="indexterm" href="happy.html#id2569957">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>smbldap-tools, <a class="indexterm" href="ntmigration.html#id2595250">NT4 Migration Using LDAP Backend</a>, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a>, <a class="indexterm" href="appendix.html#id2616627">The LDAP Account Manager</a></dt><dt>smbldap-tools updating, <a class="indexterm" href="ntmigration.html#id2595250">NT4 Migration Using LDAP Backend</a></dt><dt>smbldap-useradd, <a class="indexterm" href="happy.html#id2569957">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="2000users.html#id2578202">Implementation</a></dt><dt>smbldap-usermod, <a class="indexterm" href="happy.html#id2569957">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a></dt><dt>smbmnt, <a class="indexterm" href="HA.html#id2612117">Dissection and Discussion</a></dt><dt>smbmount, <a class="indexterm" href="HA.html#id2612117">Dissection and Discussion</a></dt><dt>smbpasswd, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id2548131">Technical Issues</a>, <a class="indexterm" href="small.html#id2548364">Implementation</a>, <a class="indexterm" href="secure.html#id2551699">Technical Issues</a>, <a class="indexterm" href="secure.html#id2553129">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2559489">Server Preparation: All Servers</a>, <a class="indexterm" href="Big500users.html#id2560067">Configuration for Server: MASSIVE</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="happy.html#id2569957">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a class="indexterm" href="2000users.html#id2576967">Dissection and Discussion</a>, <a class="indexterm" href="2000users.html#id2578202">Implementation</a>, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a>, <a class="indexterm" href="upgrades.html">Updating Samba-3</a>, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id2593019">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id2594760">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a>, <a class="indexterm" href="DomApps.html">Integrating Additional Services</a></dt><dt>smbumnt, <a class="indexterm" href="HA.html#id2612117">Dissection and Discussion</a></dt><dt>smbumount, <a class="indexterm" href="HA.html#id2612117">Dissection and Discussion</a></dt><dt>SMTP, <a class="indexterm" href="nw4migration.html#id2599436">Technical Issues</a></dt><dt>snap-shot, <a class="indexterm" href="ntmigration.html#id2594574">Dissection and Discussion</a></dt><dt>socket address, <a class="indexterm" href="HA.html#id2613092">Samba Configuration</a></dt><dt>socket options, <a class="indexterm" href="HA.html#id2613092">Samba Configuration</a></dt><dt>software, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a></dt><dt>solve, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a></dt><dt>source code, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a></dt><dt>SPNEGO, <a class="indexterm" href="primer.html#id2620615">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>SQL, <a class="indexterm" href="2000users.html#id2576967">Dissection and Discussion</a>, <a class="indexterm" href="2000users.html#id2581507">Questions and Answers</a></dt><dt>Squid, <a class="indexterm" href="DomApps.html#id2609598">Implementation</a>, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a class="indexterm" href="DomApps.html#id2610236">Samba Configuration</a>, <a class="indexterm" href="DomApps.html#id2611054">Squid Configuration</a></dt><dt>squid, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a class="indexterm" href="DomApps.html#id2610236">Samba Configuration</a></dt><dt>Squid proxy, <a class="indexterm" href="DomApps.html#id2609425">Technical Issues</a></dt><dt>SRVTOOLS.EXE, <a class="indexterm" href="secure.html#id2552192">Implementation</a>, <a class="indexterm" href="happy.html#id2574022">Configuring Profile Directories</a>, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2608631">Questions and Answers</a></dt><dt>SSL, <a class="indexterm" href="appendix.html#id2616627">The LDAP Account Manager</a></dt><dt>stand-alone server, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a></dt><dt>starting CUPS, <a class="indexterm" href="simple.html#id2544185">Implementation</a>, <a class="indexterm" href="small.html#id2548364">Implementation</a>, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a>, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dt>starting dhcpd, <a class="indexterm" href="small.html#id2548364">Implementation</a>, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a>, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dt>starting samba, <a class="indexterm" href="simple.html#id2543216">Implementation</a>, <a class="indexterm" href="simple.html#id2544185">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id2548364">Implementation</a>, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a>, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dd><dl><dt>nmbd, <a class="indexterm" href="appendix.html#id2615443">Starting Samba</a></dt><dt>smbd, <a class="indexterm" href="appendix.html#id2615443">Starting Samba</a></dt><dt>winbindd, <a class="indexterm" href="appendix.html#id2615443">Starting Samba</a></dt></dl></dd><dt>startingCUPS, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a></dt><dt>startup script, <a class="indexterm" href="appendix.html#id2615443">Starting Samba</a></dt><dt>sticky bit, <a class="indexterm" href="small.html#id2548364">Implementation</a></dt><dt>storage capacity, <a class="indexterm" href="secure.html#id2551986">Hardware Requirements</a></dt><dt>strategic, <a class="indexterm" href="ntmigration.html#id2594760">Technical Issues</a></dt><dt>strategy, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a></dt><dt>straw-man, <a class="indexterm" href="kerberos.html">Active Directory, Kerberos, and Security</a></dt><dt>strict sync, <a class="indexterm" href="HA.html#id2613092">Samba Configuration</a></dt><dt>stripped, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></dt><dt>strong cryptography, <a class="indexterm" href="kerberos.html#id2606060">Kerberos Exposed</a></dt><dt>subscription, <a class="indexterm" href="ch14.html#id2614097">Free Support</a></dt><dt>SUID, <a class="indexterm" href="simple.html#id2543975">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id2608631">Questions and Answers</a>, <a class="indexterm" href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></dt><dt>Sun ONE Identity Server, <a class="indexterm" href="happy.html#id2564526">Dissection and Discussion</a></dt><dt>super daemon, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a></dt><dt>support, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a>, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>survey, <a class="indexterm" href="unixclients.html">Adding Domain Member Servers and Clients</a></dt><dt>SUSE, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>SUSE Enterprise Linux Server, <a class="indexterm" href="simple.html#id2543845">Charity Administration Office</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="DomApps.html#id2609598">Implementation</a></dt><dt>SUSE Linux, <a class="indexterm" href="simple.html#id2543975">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#id2567058">Samba Server Implementation</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="2000users.html#id2578202">Implementation</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id2609598">Implementation</a>, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>SWAT, <a class="indexterm" href="appendix.html#id2615023">Samba System File Location</a></dt><dt>sync always, <a class="indexterm" href="HA.html#id2613092">Samba Configuration</a></dt><dt>synchronization, <a class="indexterm" href="DomApps.html#id2609847">Kerberos Configuration</a>, <a class="indexterm" href="HA.html#id2613516">For Scalability, Use SAN-Based Storage on Samba Servers</a></dt><dt>synchronize, <a class="indexterm" href="2000users.html#id2577280">User Needs</a>, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a></dt><dt>synchronized, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a></dt><dt>syslog, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>system level logins, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a></dt><dt>system security, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt></dl></div><div class="indexdiv"><h3>T</h3><dl><dt>tattooing, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a></dt><dt>TCP/IP, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a></dt><dt>tdbdump, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="ntmigration.html#id2595250">NT4 Migration Using LDAP Backend</a></dt><dt>tdbsam, <a class="indexterm" href="secure.html#id2551699">Technical Issues</a>, <a class="indexterm" href="secure.html#id2552192">Implementation</a>, <a class="indexterm" href="Big500users.html">The 500-User Office</a>, <a class="indexterm" href="happy.html#id2564389">Assignment Tasks</a>, <a class="indexterm" href="2000users.html#id2576967">Dissection and Discussion</a>, <a class="indexterm" href="2000users.html#id2578202">Implementation</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id2593019">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="upgrades.html#id2593679">Updating from Samba Versions between 3.0.6 and 3.0.10</a>, <a class="indexterm" href="ntmigration.html#id2594760">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a></dt><dt>testparm, <a class="indexterm" href="small.html#id2550065">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="HA.html#id2613092">Samba Configuration</a></dt><dt>ticket, <a class="indexterm" href="DomApps.html#id2610236">Samba Configuration</a></dt><dt>time server, <a class="indexterm" href="secure.html#id2552192">Implementation</a></dt><dt>Tivoli Directory Server, <a class="indexterm" href="happy.html#id2564526">Dissection and Discussion</a></dt><dt>TLS, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a></dt><dt>token, <a class="indexterm" href="DomApps.html#id2609425">Technical Issues</a></dt><dt>tool, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a></dt><dt>TOSHARG2, <a class="indexterm" href="simple.html#id2544185">Implementation</a></dt><dt>track record, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a></dt><dt>traffic collisions, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>transaction processing, <a class="indexterm" href="2000users.html#id2576967">Dissection and Discussion</a></dt><dt>transactional, <a class="indexterm" href="2000users.html#id2581507">Questions and Answers</a></dt><dt>transfer, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a></dt><dt>translate, <a class="indexterm" href="kerberos.html#id2607770">Managing Windows 200x ACLs</a></dt><dt>traverse, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt><dt>tree, <a class="indexterm" href="nw4migration.html#id2599359">Dissection and Discussion</a></dt><dt>Tree Connect, <a class="indexterm" href="primer.html#id2620113">Simple Windows Client Connection Characteristics</a></dt><dt>trust account, <a class="indexterm" href="happy.html#id2564150">Regarding LDAP Directories and Windows Computer Accounts</a></dt><dt>trusted computing, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a></dt><dt>Trusted Domains, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a></dt><dt>trusted domains, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a></dt><dt>trusted third-party, <a class="indexterm" href="kerberos.html#id2606060">Kerberos Exposed</a></dt><dt>trusting, <a class="indexterm" href="kerberos.html#id2606060">Kerberos Exposed</a></dt><dt>turn-around time, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt></dl></div><div class="indexdiv"><h3>U</h3><dl><dt>UDP</dt><dd><dl><dt>broadcast, <a class="indexterm" href="HA.html#id2612819">Routed Networks</a></dt></dl></dd><dt>UID, <a class="indexterm" href="simple.html#id2543975">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#id2564150">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="happy.html#id2564983">Technical Issues</a>, <a class="indexterm" href="2000users.html#id2578202">Implementation</a>, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a></dt><dt>un-join, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a></dt><dt>unauthorized activities, <a class="indexterm" href="kerberos.html#id2606060">Kerberos Exposed</a></dt><dt>UNC name, <a class="indexterm" href="2000users.html#id2581507">Questions and Answers</a></dt><dt>unencrypted, <a class="indexterm" href="appendix.html#id2616627">The LDAP Account Manager</a></dt><dt>Unicast, <a class="indexterm" href="2000users.html#id2577373">The Nature of Windows Networking Protocols</a></dt><dt>unicode, <a class="indexterm" href="upgrades.html#id2592486">International Language Support</a></dt><dt>Universal Naming Convention (see UNC name)</dt><dt>UNIX, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a></dt><dd><dl><dt>groups, <a class="indexterm" href="small.html#id2548131">Technical Issues</a>, <a class="indexterm" href="small.html#id2548364">Implementation</a></dt></dl></dd><dt>UNIX accounts, <a class="indexterm" href="happy.html#id2564983">Technical Issues</a></dt><dt>UNIX/Linux server, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>unix2dos, <a class="indexterm" href="secure.html#id2553129">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2560067">Configuration for Server: MASSIVE</a></dt><dt>unknown, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>unsupported software, <a class="indexterm" href="ch14.html#id2614316">Commercial Support</a></dt><dt>update, <a class="indexterm" href="upgrades.html#id2591226">Introduction</a>, <a class="indexterm" href="upgrades.html#id2591322">Cautions and Notes</a></dt><dt>updates, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a>, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>updating smbldap-tools, <a class="indexterm" href="ntmigration.html#id2595250">NT4 Migration Using LDAP Backend</a></dt><dt>upgrade, <a class="indexterm" href="upgrades.html#id2591226">Introduction</a>, <a class="indexterm" href="upgrades.html#id2591322">Cautions and Notes</a>, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a></dt><dt>uppercase, <a class="indexterm" href="ntmigration.html#id2595109">Implementation</a></dt><dt>user</dt><dd><dl><dt>management, <a class="indexterm" href="small.html#id2548364">Implementation</a>, <a class="indexterm" href="secure.html#id2553129">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2560067">Configuration for Server: MASSIVE</a></dt></dl></dd><dt>user account, <a class="indexterm" href="happy.html">Making Happy Users</a>, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>User and Group Controls, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>user credentials, <a class="indexterm" href="2000users.html#id2577720">Identity Management Needs</a>, <a class="indexterm" href="unixclients.html#id2589438">UNIX/Linux Client Domain Member</a></dt><dt>user errors, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a></dt><dt>user groups, <a class="indexterm" href="ch14.html#id2614097">Free Support</a></dt><dt>user identities, <a class="indexterm" href="unixclients.html#id2583232">Implementation</a></dt><dt>user logins, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a></dt><dt>user management, <a class="indexterm" href="secure.html#id2552192">Implementation</a></dt><dt>User Manager, <a class="indexterm" href="ntmigration.html#id2595250">NT4 Migration Using LDAP Backend</a></dt><dt>User Mode, <a class="indexterm" href="secure.html#id2552192">Implementation</a>, <a class="indexterm" href="primer.html#id2620113">Simple Windows Client Connection Characteristics</a>, <a class="indexterm" href="primer.html#id2620615">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>useradd, <a class="indexterm" href="simple.html#id2544185">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id2548364">Implementation</a>, <a class="indexterm" href="secure.html#id2553129">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2560067">Configuration for Server: MASSIVE</a>, <a class="indexterm" href="upgrades.html#id2593019">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>userdel, <a class="indexterm" href="upgrades.html#id2593019">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>usermod, <a class="indexterm" href="upgrades.html#id2593019">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id2595250">NT4 Migration Using LDAP Backend</a></dt><dt>username, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a></dt><dt>username map, <a class="indexterm" href="small.html#id2548364">Implementation</a>, <a class="indexterm" href="secure.html#id2553129">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2559489">Server Preparation: All Servers</a></dt><dt>UTF-8, <a class="indexterm" href="upgrades.html#id2592486">International Language Support</a></dt><dt>utilities, <a class="indexterm" href="DomApps.html#id2611510">Questions and Answers</a></dt></dl></div><div class="indexdiv"><h3>V</h3><dl><dt>valid users, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2606894">Checkpoint Controls</a>, <a class="indexterm" href="kerberos.html#id2608631">Questions and Answers</a></dt><dt>validate, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2606894">Checkpoint Controls</a></dt><dt>validated, <a class="indexterm" href="2000users.html#id2577720">Identity Management Needs</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a></dt><dt>validation, <a class="indexterm" href="simple.html#validate1">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="DomApps.html#id2611510">Questions and Answers</a></dt><dt>vampire, <a class="indexterm" href="ntmigration.html#id2598154">Questions and Answers</a></dt><dt>vendor, <a class="indexterm" href="kerberos.html#id2604379">Dissection and Discussion</a></dt><dt>vendors, <a class="indexterm" href="upgrades.html#id2593535">Updating a Samba-3 Installation</a></dt><dt>VFS modules, <a class="indexterm" href="appendix.html#id2615023">Samba System File Location</a></dt><dt>virus, <a class="indexterm" href="secure.html#id2552192">Implementation</a></dt><dt>VPN, <a class="indexterm" href="2000users.html#id2576899">Assignment Tasks</a></dt><dt>vulnerabilities, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a></dt></dl></div><div class="indexdiv"><h3>W</h3><dl><dt>wbinfo, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id2610236">Samba Configuration</a></dt><dt>weakness, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a></dt><dt>web</dt><dd><dl><dt>caching, <a class="indexterm" href="DomApps.html#id2609291">Assignment Tasks</a></dt><dt>proxying, <a class="indexterm" href="DomApps.html#id2609291">Assignment Tasks</a></dt></dl></dd><dt>Web</dt><dd><dl><dt>proxy, <a class="indexterm" href="DomApps.html#id2611510">Questions and Answers</a></dt><dd><dl><dt>access, <a class="indexterm" href="DomApps.html#id2611450">Key Points Learned</a></dt></dl></dd></dl></dd><dt>Web browsers, <a class="indexterm" href="DomApps.html#id2611450">Key Points Learned</a></dt><dt>WebClient, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>WHATSNEW.txt, <a class="indexterm" href="upgrades.html#id2593353">Samba-2.x with LDAP Support</a></dt><dt>white-pages, <a class="indexterm" href="nw4migration.html#id2599436">Technical Issues</a>, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a></dt><dt>wide-area, <a class="indexterm" href="2000users.html#id2577280">User Needs</a>, <a class="indexterm" href="2000users.html#id2577720">Identity Management Needs</a>, <a class="indexterm" href="2000users.html#id2581360">Key Points Learned</a>, <a class="indexterm" href="2000users.html#id2581507">Questions and Answers</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt><dt>wide-area network, <a class="indexterm" href="HA.html#id2613419">Use and Location of BDCs</a>, <a class="indexterm" href="HA.html#id2613620">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></dt><dt>winbind, <a class="indexterm" href="2000users.html#id2578202">Implementation</a>, <a class="indexterm" href="unixclients.html#id2582454">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a>, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id2609425">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id2610236">Samba Configuration</a>, <a class="indexterm" href="DomApps.html#id2610788">NSS Configuration</a></dt><dt>Winbind, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2604776">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2608497">Key Points Learned</a></dt><dt>winbind trusted domains only, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a></dt><dt>winbind use default domain, <a class="indexterm" href="kerberos.html#id2606894">Checkpoint Controls</a></dt><dt>winbindd, <a class="indexterm" href="small.html#id2550065">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="Big500users.html#id2558534">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="upgrades.html#id2593757">Updating from Samba Versions after 3.0.6 to a Current Release</a>, <a class="indexterm" href="upgrades.html#id2593860">Replacing a Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id2610236">Samba Configuration</a>, <a class="indexterm" href="DomApps.html#id2611510">Questions and Answers</a>, <a class="indexterm" href="appendix.html#id2615443">Starting Samba</a></dt><dt>winbindd_cache.tdb, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a></dt><dt>winbindd_idmap.tdb, <a class="indexterm" href="unixclients.html#id2582483">Technical Issues</a></dt><dt>Windows, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a></dt><dd><dl><dt>client, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a></dt><dt>NT, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a></dt></dl></dd><dt>Windows 2000 ACLs, <a class="indexterm" href="kerberos.html#id2607770">Managing Windows 200x ACLs</a></dt><dt>Windows 2003 Serve, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a></dt><dt>Windows 200x ACLs, <a class="indexterm" href="kerberos.html#id2608631">Questions and Answers</a></dt><dt>Windows accounts, <a class="indexterm" href="happy.html#id2564983">Technical Issues</a></dt><dt>Windows ACLs, <a class="indexterm" href="kerberos.html#id2608287">Setting Posix ACLs in UNIX/Linux</a></dt><dt>Windows Address Book, <a class="indexterm" href="nw4migration.html#id2599710">LDAP Server Configuration</a></dt><dt>Windows ADS Domain, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt><dt>Windows clients, <a class="indexterm" href="DomApps.html#id2611510">Questions and Answers</a></dt><dt>Windows Explorer, <a class="indexterm" href="simple.html#validate1">Validation</a></dt><dt>Windows explorer, <a class="indexterm" href="DomApps.html#id2611510">Questions and Answers</a></dt><dt>Windows security identifier (see SID)</dt><dt>Windows Servers, <a class="indexterm" href="kerberos.html#id2603712">Introduction</a></dt><dt>Windows Services for UNIX (see SUS)</dt><dt>Windows XP, <a class="indexterm" href="small.html#id2548016">Assignment Tasks</a></dt><dt>WINS, <a class="indexterm" href="simple.html#id2544185">Implementation</a>, <a class="indexterm" href="small.html#id2548131">Technical Issues</a>, <a class="indexterm" href="small.html#id2548364">Implementation</a>, <a class="indexterm" href="secure.html#ch4wincfg">Windows Client Configuration</a>, <a class="indexterm" href="Big500users.html#id2558534">Technical Issues</a>, <a class="indexterm" href="Big500users.html#ch5wincfg">Windows Client Configuration</a>, <a class="indexterm" href="2000users.html#id2577373">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="2000users.html#id2577720">Identity Management Needs</a>, <a class="indexterm" href="2000users.html#id2581507">Questions and Answers</a>, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dd><dl><dt>lookup, <a class="indexterm" href="unixclients.html#id2590066">Questions and Answers</a></dt><dt>name resolution, <a class="indexterm" href="HA.html#id2612819">Routed Networks</a></dt><dt>server, <a class="indexterm" href="happy.html">Making Happy Users</a>, <a class="indexterm" href="HA.html#id2612819">Routed Networks</a></dt></dl></dd><dt>WINS server, <a class="indexterm" href="Big500users.html">The 500-User Office</a>, <a class="indexterm" href="2000users.html#id2581507">Questions and Answers</a></dt><dt>WINS serving, <a class="indexterm" href="secure.html#id2552192">Implementation</a></dt><dt>wins support, <a class="indexterm" href="secure.html#id2552192">Implementation</a></dt><dt>wins.dat, <a class="indexterm" href="2000users.html#id2577720">Identity Management Needs</a>, <a class="indexterm" href="upgrades.html#id2593860">Replacing a Domain Member Server</a></dt><dt>Wireshark, <a class="indexterm" href="primer.html#id2618502">Requirements and Notes</a></dt><dt>wireshark, <a class="indexterm" href="primer.html#id2618841">Exercises</a></dt><dt>Word, <a class="indexterm" href="kerberos.html#id2607367">Share Point Directory and File Permissions</a></dt><dt>workgroup, <a class="indexterm" href="simple.html#id2543216">Implementation</a>, <a class="indexterm" href="upgrades.html#id2591426">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id2592219">Change of Workgroup (Domain) Name</a></dt><dt>Workgroup Announcement, <a class="indexterm" href="primer.html#id2619753">Findings</a></dt><dt>workstation, <a class="indexterm" href="unixclients.html#id2583232">Implementation</a></dt><dt>wrapper, <a class="indexterm" href="DomApps.html#id2611510">Questions and Answers</a></dt><dt>write lock, <a class="indexterm" href="appendix.html#id2618336">Opportunistic Locking Controls</a></dt></dl></div><div class="indexdiv"><h3>X</h3><dl><dt>xinetd, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a></dt><dt>XML, <a class="indexterm" href="2000users.html#id2576967">Dissection and Discussion</a></dt><dt>xmlsam, <a class="indexterm" href="2000users.html#id2578202">Implementation</a></dt></dl></div><div class="indexdiv"><h3>Y</h3><dl><dt>YaST, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dt>Yellow Pages, <a class="indexterm" href="2000users.html#id2577720">Identity Management Needs</a></dt><dt>yellow pages (see NIS)</dt></dl></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="go01.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> </td></tr><tr><td width="40%" align="left" valign="top">Glossary </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> </td></tr></table></div></body></html> -
branches/samba-3.2.x/docs/htmldocs/Samba3-ByExample/kerberos.html
r204 r226 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 11. Active Directory, Kerberos, and Security</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="RefSection.html" title="Part III. Reference Section"><link rel="next" href="DomApps.html" title="Chapter 12. Integrating Additional Services"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 11. Active Directory, Kerberos, and Security</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="RefSection.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="DomApps.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="kerberos"></a>Chapter 11. Active Directory, Kerberos, and Security</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="kerberos.html#id260371 7">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2604367">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id2604384">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2604780">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#ch10expl">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2606410">Share Access Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2606759">Share Definition Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2607372">Share Point Directory and File Permissions</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2607775">Managing Windows 200x ACLs</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2608502">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id2608636">Questions and Answers</a></span></dt></dl></div><p><a class="indexterm" name="id2603652"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 11. Active Directory, Kerberos, and Security</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="RefSection.html" title="Part III. Reference Section"><link rel="next" href="DomApps.html" title="Chapter 12. Integrating Additional Services"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 11. Active Directory, Kerberos, and Security</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="RefSection.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="DomApps.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="kerberos"></a>Chapter 11. Active Directory, Kerberos, and Security</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="kerberos.html#id2603712">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2604363">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id2604379">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2604776">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#ch10expl">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2606406">Share Access Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2606754">Share Definition Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2607367">Share Point Directory and File Permissions</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2607770">Managing Windows 200x ACLs</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2608497">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id2608631">Questions and Answers</a></span></dt></dl></div><p><a class="indexterm" name="id2603648"></a> 2 2 By this point in the book, you have been exposed to many Samba-3 features and capabilities. 3 3 More importantly, if you have implemented the examples given, you are well on your way to becoming … … 5 5 practice, you likely have thought of improvements and scenarios with which you can experiment. You 6 6 are rather well plugged in to the many flexible ways Samba can be used. 7 </p><p><a class="indexterm" name="id26036 72"></a>7 </p><p><a class="indexterm" name="id2603667"></a> 8 8 This is a book about Samba-3. Understandably, its intent is to present it in a positive light. 9 9 The casual observer might conclude that this book is one-eyed about Samba. It is what … … 14 14 decision. Criticism can be expected from the outside. Let's see how the interesting dynamic of 15 15 criticism develops with respect to Abmas. 16 </p><p><a class="indexterm" name="id2603 700"></a>16 </p><p><a class="indexterm" name="id2603695"></a> 17 17 This chapter provides a shameless self-promotion of Samba-3. The objections raised were not pulled 18 18 out of thin air. They were drawn from comments made by Samba users and from criticism during … … 20 20 as possible that of the original. The case presented is a straw-man example that is designed to 21 21 permit each objection to be answered as it might occur in real life. 22 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id260371 7"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id2603723"></a><a class="indexterm" name="id2603731"></a><a class="indexterm" name="id2603739"></a><a class="indexterm" name="id2603747"></a><a class="indexterm" name="id2603755"></a>22 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2603712"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id2603719"></a><a class="indexterm" name="id2603727"></a><a class="indexterm" name="id2603734"></a><a class="indexterm" name="id2603742"></a><a class="indexterm" name="id2603750"></a> 23 23 Abmas is continuing its meteoric growth with yet further acquisitions. The investment community took 24 24 note of the spectacular projection of Abmas onto the global business stage. Abmas is building an … … 29 29 During the time that the acquisition was closing, the Video Rentals business upgraded its Windows 30 30 NT4-based network to Windows 2003 Server and Active Directory. 31 </p><p><a class="indexterm" name="id260377 9"></a>31 </p><p><a class="indexterm" name="id2603774"></a> 32 32 You have accepted the fact that Abmas Video Rentals will use Microsoft Active Directory. 33 33 The IT team, led by Stan Soroka, is committed to Samba-3 and to maintaining a uniform technology platform. … … 36 36 technologies.</span>” This comment was made by one of Christine's staff as they were installing a new 37 37 Samba-3 server at the new business. 38 </p><p><a class="indexterm" name="id2603 803"></a><a class="indexterm" name="id2603810"></a>38 </p><p><a class="indexterm" name="id2603798"></a><a class="indexterm" name="id2603806"></a> 39 39 Abmas Video Rentals' head of IT heard of this criticism. He was offended that a junior engineer 40 40 should make such a comment. He felt that he had to prepare in case he might be criticized for his 41 41 decision to use Active Directory. He decided he would defend his decision by hiring the services 42 of an outside security systems consultant to report<sup>[<a name="id260382 6" href="#ftn.id2603826" class="footnote">12</a>]</sup> on his unit's operations42 of an outside security systems consultant to report<sup>[<a name="id2603821" href="#ftn.id2603821" class="footnote">12</a>]</sup> on his unit's operations 43 43 and to investigate the role of Samba at his site. Here are key extracts from this hypothetical 44 44 report: 45 </p><div class="blockquote"><blockquote class="blockquote"><p><a class="indexterm" name="id260383 6"></a><a class="indexterm" name="id2603844"></a><a class="indexterm" name="id2603852"></a><a class="indexterm" name="id2603860"></a>45 </p><div class="blockquote"><blockquote class="blockquote"><p><a class="indexterm" name="id2603831"></a><a class="indexterm" name="id2603839"></a><a class="indexterm" name="id2603847"></a><a class="indexterm" name="id2603855"></a> 46 46 ... the implementation of Microsoft Active Directory at the Abmas Video Rentals, Bamingsham site, 47 47 has been examined. We find no evidence to support a notion that vulnerabilities exist at your site. … … 50 50 </p><p> 51 51 ... 52 </p><p><a class="indexterm" name="id26038 81"></a><a class="indexterm" name="id2603892"></a><a class="indexterm" name="id2603904"></a><a class="indexterm" name="id2603912"></a><a class="indexterm" name="id2603920"></a><a class="indexterm" name="id2603927"></a>52 </p><p><a class="indexterm" name="id2603876"></a><a class="indexterm" name="id2603888"></a><a class="indexterm" name="id2603899"></a><a class="indexterm" name="id2603907"></a><a class="indexterm" name="id2603915"></a><a class="indexterm" name="id2603923"></a> 53 53 User and group accounts, and respective privileges, have been well thought out. File system shares are 54 54 appropriately secured. Backup and disaster recovery plans are well managed and validated regularly, and 55 55 effective off-site storage practices are considered to exceed industry norms. 56 </p><p><a class="indexterm" name="id26039 44"></a><a class="indexterm" name="id2603951"></a><a class="indexterm" name="id2603959"></a>56 </p><p><a class="indexterm" name="id2603939"></a><a class="indexterm" name="id2603947"></a><a class="indexterm" name="id2603955"></a> 57 57 Your staff are justifiably concerned that the use of Samba may compromise their good efforts to maintain 58 58 a secure network. 59 </p><p><a class="indexterm" name="id260397 6"></a><a class="indexterm" name="id2603984"></a><a class="indexterm" name="id2603992"></a><a class="indexterm" name="id2604000"></a>59 </p><p><a class="indexterm" name="id2603971"></a><a class="indexterm" name="id2603979"></a><a class="indexterm" name="id2603987"></a><a class="indexterm" name="id2603995"></a> 60 60 The recently installed Linux file and application server uses a tool called <code class="literal">winbind</code> 61 61 that is indiscriminate about security. All user accounts in Active Directory can be used to access data … … 64 64 to great lengths to set fine-grained controls that limit information access to those who need access. 65 65 It seems incongruous to us that Samba winbind should be permitted to be used considering that it voids this fine work. 66 </p><p><a class="indexterm" name="id26040 40"></a><a class="indexterm" name="id2604047"></a><a class="indexterm" name="id2604055"></a>66 </p><p><a class="indexterm" name="id2604035"></a><a class="indexterm" name="id2604043"></a><a class="indexterm" name="id2604051"></a> 67 67 Graham Judd [head of network administration] has locked down the security of all systems and is following 68 68 the latest Microsoft guidelines. ... null session connections have been disabled ... the internal network … … 73 73 </p><p> 74 74 ... 75 </p><p><a class="indexterm" name="id26040 80"></a><a class="indexterm" name="id2604088"></a><a class="indexterm" name="id2604096"></a><a class="indexterm" name="id2604104"></a>75 </p><p><a class="indexterm" name="id2604075"></a><a class="indexterm" name="id2604083"></a><a class="indexterm" name="id2604091"></a><a class="indexterm" name="id2604099"></a> 76 76 Regarding the use of Samba, we offer the following comments: Samba is in use in nearly half of 77 77 all sites we have surveyed. ... It is our opinion that Samba offers no better security than Microsoft … … 81 81 Samba is not at the full capabilities of Microsoft Windows NT4 server. Microsoft has moved well beyond that 82 82 with trusted computing initiatives that the Samba developers do not participate in. 83 </p><p><a class="indexterm" name="id260412 7"></a><a class="indexterm" name="id2604135"></a><a class="indexterm" name="id2604143"></a><a class="indexterm" name="id2604150"></a><a class="indexterm" name="id2604158"></a><a class="indexterm" name="id2604166"></a><a class="indexterm" name="id2604174"></a>83 </p><p><a class="indexterm" name="id2604122"></a><a class="indexterm" name="id2604130"></a><a class="indexterm" name="id2604138"></a><a class="indexterm" name="id2604146"></a><a class="indexterm" name="id2604154"></a><a class="indexterm" name="id2604162"></a><a class="indexterm" name="id2604169"></a> 84 84 One wonders about the integrity of an open source program that is developed by a team of hackers 85 85 who cannot be held accountable for the flaws in their code. The sheer number of updates and bug 86 86 fixes they have released should ring alarm bells in any business. 87 </p><p><a class="indexterm" name="id26041 90"></a><a class="indexterm" name="id2604198"></a><a class="indexterm" name="id2604205"></a>87 </p><p><a class="indexterm" name="id2604185"></a><a class="indexterm" name="id2604193"></a><a class="indexterm" name="id2604201"></a> 88 88 Another factor that should be considered is that buying Microsoft products and services helps to 89 89 provide employment in the IT industry. Samba and Open Source software place those jobs at risk. 90 </p></blockquote></div><p><a class="indexterm" name="id26042 20"></a><a class="indexterm" name="id2604228"></a>90 </p></blockquote></div><p><a class="indexterm" name="id2604215"></a><a class="indexterm" name="id2604223"></a> 91 91 This is also a challenge to rise above the trouble spot. You call Stan's team together for a simple 92 92 discussion, but it gets further out of hand. When you return to your office, you find the following … … 101 101 across all systems. I concur with the desire to improve security. One of the new guys who is championing 102 102 the move to Kerberos was responsible for the comment that caused the embarrassment. 103 </p><p><a class="indexterm" name="id260426 5"></a><a class="indexterm" name="id2604273"></a><a class="indexterm" name="id2604280"></a><a class="indexterm" name="id2604288"></a>103 </p><p><a class="indexterm" name="id2604260"></a><a class="indexterm" name="id2604268"></a><a class="indexterm" name="id2604276"></a><a class="indexterm" name="id2604284"></a> 104 104 I am experiencing difficulty in handling the sharp push for Kerberos. He claims that Kerberos, OpenLDAP, 105 105 plus Samba-3 will seamlessly replace Microsoft Active Directory. I am a little out of my depth with respect 106 106 to the feasibility of such a move, but have taken steps to pull both of them into line. With your consent, 107 107 I would like to hire the services of a well-known Samba consultant to set the record straight. 108 </p><p><a class="indexterm" name="id260430 7"></a><a class="indexterm" name="id2604315"></a><a class="indexterm" name="id2604322"></a><a class="indexterm" name="id2604330"></a><a class="indexterm" name="id2604338"></a><a class="indexterm" name="id2604346"></a>108 </p><p><a class="indexterm" name="id2604302"></a><a class="indexterm" name="id2604310"></a><a class="indexterm" name="id2604318"></a><a class="indexterm" name="id2604326"></a><a class="indexterm" name="id2604334"></a><a class="indexterm" name="id2604342"></a> 109 109 I intend to use this report to answer the criticism raised and would like to establish a policy that we 110 110 will approve the use of Microsoft Windows Servers (and Active Directory) subject to all costs being covered … … 113 113 use of any centrally proposed standards, but make all noncompliance the financial responsibility of the 114 114 out-of-step division. Hopefully, this will encourage all divisions to walk with us and not alone. 115 </p></td><td width="10%" valign="top"> </td></tr><tr><td width="10%" valign="top"> </td><td colspan="2" align="right" valign="top">--<span class="attribution">Stan</span></td></tr></table></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id260436 7"></a>Assignment Tasks</h3></div></div></div><p>115 </p></td><td width="10%" valign="top"> </td></tr><tr><td width="10%" valign="top"> </td><td colspan="2" align="right" valign="top">--<span class="attribution">Stan</span></td></tr></table></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2604363"></a>Assignment Tasks</h3></div></div></div><p> 116 116 You agreed with Stan's recommendations and hired a consultant to help defuse the powder 117 117 keg. The consultant's task is to provide a tractable answer to each of the issues raised. The consultant must be able 118 118 to support his or her claims, keep emotions to the side, and answer technically. 119 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id26043 84"></a>Dissection and Discussion</h2></div></div></div><p><a class="indexterm" name="id2604390"></a><a class="indexterm" name="id2604398"></a><a class="indexterm" name="id2604406"></a><a class="indexterm" name="id2604414"></a><a class="indexterm" name="id2604422"></a><a class="indexterm" name="id2604430"></a><a class="indexterm" name="id2604438"></a>119 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2604379"></a>Dissection and Discussion</h2></div></div></div><p><a class="indexterm" name="id2604386"></a><a class="indexterm" name="id2604394"></a><a class="indexterm" name="id2604402"></a><a class="indexterm" name="id2604409"></a><a class="indexterm" name="id2604417"></a><a class="indexterm" name="id2604425"></a><a class="indexterm" name="id2604433"></a> 120 120 Samba-3 is a tool. No one is pounding your door to make you use Samba. That is a choice that you are free to 121 121 make or reject. It is likely that your decision to use Samba can greatly benefit your company. … … 125 125 money saved by not spending in the IT area can be spent elsewhere in the business. All money saved 126 126 or spent creates employment. 127 </p><p><a class="indexterm" name="id260445 9"></a><a class="indexterm" name="id2604468"></a><a class="indexterm" name="id2604476"></a><a class="indexterm" name="id2604484"></a><a class="indexterm" name="id2604492"></a>127 </p><p><a class="indexterm" name="id2604455"></a><a class="indexterm" name="id2604463"></a><a class="indexterm" name="id2604471"></a><a class="indexterm" name="id2604479"></a><a class="indexterm" name="id2604487"></a> 128 128 In the long term, the use of Samba must be economically sustainable. In some situations, Samba is adopted 129 129 purely to provide file and print service interoperability on platforms that otherwise cannot provide … … 131 131 effect a reduction in the cost of providing IT services. Obviously, it is also used by some as an 132 132 alternative to the use of a Microsoft file and print serving platforms with no consideration of costs. 133 </p><p><a class="indexterm" name="id26045 11"></a><a class="indexterm" name="id2604519"></a><a class="indexterm" name="id2604527"></a><a class="indexterm" name="id2604535"></a>133 </p><p><a class="indexterm" name="id2604507"></a><a class="indexterm" name="id2604515"></a><a class="indexterm" name="id2604523"></a><a class="indexterm" name="id2604530"></a> 134 134 It would be foolish to adopt a technology that might put any data or users at risk. Security affects 135 135 everyone. The Samba-Team is fully cognizant of the responsibility they have to their users. 136 136 The Samba documentation clearly reveals that full responsibility is accepted to fix anything 137 137 that is broken. 138 </p><p><a class="indexterm" name="id26045 51"></a><a class="indexterm" name="id2604559"></a><a class="indexterm" name="id2604567"></a><a class="indexterm" name="id2604575"></a><a class="indexterm" name="id2604587"></a><a class="indexterm" name="id2604594"></a><a class="indexterm" name="id2604602"></a><a class="indexterm" name="id2604610"></a><a class="indexterm" name="id2604618"></a><a class="indexterm" name="id2604626"></a><a class="indexterm" name="id2604634"></a>138 </p><p><a class="indexterm" name="id2604547"></a><a class="indexterm" name="id2604554"></a><a class="indexterm" name="id2604562"></a><a class="indexterm" name="id2604570"></a><a class="indexterm" name="id2604582"></a><a class="indexterm" name="id2604590"></a><a class="indexterm" name="id2604598"></a><a class="indexterm" name="id2604606"></a><a class="indexterm" name="id2604614"></a><a class="indexterm" name="id2604622"></a><a class="indexterm" name="id2604629"></a> 139 139 There is a mistaken perception in the IT industry that commercial software providers are fully 140 140 accountable for the defects in products. Open Source software comes with no warranty, so it is … … 144 144 commercial software vendors are willingly accountable for product defects. In many cases, the 145 145 commercial vendor accepts liability only to reimburse the price paid for the software. 146 </p><p><a class="indexterm" name="id260465 6"></a><a class="indexterm" name="id2604664"></a><a class="indexterm" name="id2604672"></a><a class="indexterm" name="id2604680"></a><a class="indexterm" name="id2604688"></a><a class="indexterm" name="id2604696"></a>146 </p><p><a class="indexterm" name="id2604652"></a><a class="indexterm" name="id2604660"></a><a class="indexterm" name="id2604667"></a><a class="indexterm" name="id2604675"></a><a class="indexterm" name="id2604683"></a><a class="indexterm" name="id2604691"></a> 147 147 The real issues that a consumer (like you) needs answered are What is the way of escape from technical 148 148 problems, and how long will it take? The average problem turnaround time in the Open Source community is 149 149 approximately 48 hours. What does the EULA offer? What is the track record in the commercial software 150 150 industry? What happens when your commercial vendor decides to cease providing support? 151 </p><p><a class="indexterm" name="id26047 21"></a><a class="indexterm" name="id2604729"></a><a class="indexterm" name="id2604736"></a><a class="indexterm" name="id2604744"></a><a class="indexterm" name="id2604752"></a><a class="indexterm" name="id2604760"></a><a class="indexterm" name="id2604768"></a>151 </p><p><a class="indexterm" name="id2604716"></a><a class="indexterm" name="id2604724"></a><a class="indexterm" name="id2604732"></a><a class="indexterm" name="id2604740"></a><a class="indexterm" name="id2604748"></a><a class="indexterm" name="id2604755"></a><a class="indexterm" name="id2604763"></a> 152 152 Open Source software at least puts you in possession of the source code. This means that when 153 153 all else fails, you can hire a programmer to solve the problem. 154 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id26047 80"></a>Technical Issues</h3></div></div></div><p>154 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2604776"></a>Technical Issues</h3></div></div></div><p> 155 155 Each issue is now discussed and, where appropriate, example implementation steps are 156 156 provided. 157 </p><div class="variablelist"><dl><dt><span class="term">Winbind and Security</span></dt><dd><p><a class="indexterm" name="id2604 801"></a><a class="indexterm" name="id2604809"></a><a class="indexterm" name="id2604817"></a><a class="indexterm" name="id2604829"></a><a class="indexterm" name="id2604837"></a><a class="indexterm" name="id2604845"></a><a class="indexterm" name="id2604852"></a><a class="indexterm" name="id2604861"></a><a class="indexterm" name="id2604869"></a><a class="indexterm" name="id2604876"></a>157 </p><div class="variablelist"><dl><dt><span class="term">Winbind and Security</span></dt><dd><p><a class="indexterm" name="id2604797"></a><a class="indexterm" name="id2604805"></a><a class="indexterm" name="id2604812"></a><a class="indexterm" name="id2604824"></a><a class="indexterm" name="id2604832"></a><a class="indexterm" name="id2604840"></a><a class="indexterm" name="id2604848"></a><a class="indexterm" name="id2604856"></a><a class="indexterm" name="id2604864"></a><a class="indexterm" name="id2604872"></a> 158 158 Windows network administrators may be dismayed to find that <code class="literal">winbind</code> 159 159 exposes all domain users so that they may use their domain account credentials to … … 161 161 UNIX/Linux server in their Network Neighborhood and can browse the shares on the 162 162 server seems to excite them further. 163 </p><p><a class="indexterm" name="id2604 900"></a><a class="indexterm" name="id2604908"></a><a class="indexterm" name="id2604916"></a><a class="indexterm" name="id2604924"></a>163 </p><p><a class="indexterm" name="id2604895"></a><a class="indexterm" name="id2604903"></a><a class="indexterm" name="id2604911"></a><a class="indexterm" name="id2604919"></a> 164 164 <code class="literal">winbind</code> provides for the UNIX/Linux domain member server or 165 165 client, the same as one would obtain by adding a Microsoft Windows server or … … 167 167 and therefore requires handling a little differently from the familiar Windows systems. 168 168 One must recognize fear of the unknown. 169 </p><p><a class="indexterm" name="id260494 6"></a><a class="indexterm" name="id2604955"></a><a class="indexterm" name="id2604962"></a><a class="indexterm" name="id2604970"></a><a class="indexterm" name="id2604978"></a><a class="indexterm" name="id2604990"></a>169 </p><p><a class="indexterm" name="id2604942"></a><a class="indexterm" name="id2604950"></a><a class="indexterm" name="id2604958"></a><a class="indexterm" name="id2604966"></a><a class="indexterm" name="id2604974"></a><a class="indexterm" name="id2604985"></a> 170 170 Windows network administrators need to recognize that <code class="literal">winbind</code> does 171 171 not, and cannot, override account controls set using the Active Directory management 172 172 tools. The control is the same. Have no fear. 173 </p><p><a class="indexterm" name="id26050 10"></a><a class="indexterm" name="id2605018"></a><a class="indexterm" name="id2605030"></a><a class="indexterm" name="id2605037"></a><a class="indexterm" name="id2605045"></a><a class="indexterm" name="id2605053"></a><a class="indexterm" name="id2605061"></a><a class="indexterm" name="id2605069"></a><a class="indexterm" name="id2605077"></a><a class="indexterm" name="id2605085"></a>173 </p><p><a class="indexterm" name="id2605006"></a><a class="indexterm" name="id2605014"></a><a class="indexterm" name="id2605025"></a><a class="indexterm" name="id2605033"></a><a class="indexterm" name="id2605041"></a><a class="indexterm" name="id2605048"></a><a class="indexterm" name="id2605056"></a><a class="indexterm" name="id2605064"></a><a class="indexterm" name="id2605072"></a><a class="indexterm" name="id2605080"></a> 174 174 Where Samba and the ADS domain account information obtained through the use of 175 175 <code class="literal">winbind</code> permits access, by browsing or by the drive mapping to … … 179 179 </p><div class="itemizedlist"><ul type="disc"><li><p>Shares themselves (i.e., the logical share itself)</p></li><li><p>The share definition in <code class="filename">smb.conf</code></p></li><li><p>The shared directories and files using UNIX permissions</p></li><li><p>Using Windows 2000 ACLs if the file system is POSIX enabled</p></li></ul></div><p> 180 180 Examples of each are given in <a class="link" href="kerberos.html#ch10expl" title="Implementation">“Implementation”</a>. 181 </p></dd><dt><span class="term">User and Group Controls</span></dt><dd><p><a class="indexterm" name="id260515 9"></a><a class="indexterm" name="id2605167"></a><a class="indexterm" name="id2605179"></a><a class="indexterm" name="id2605190"></a><a class="indexterm" name="id2605198"></a><a class="indexterm" name="id2605206"></a><a class="indexterm" name="id2605213"></a><a class="indexterm" name="id2605221"></a><a class="indexterm" name="id2605229"></a>181 </p></dd><dt><span class="term">User and Group Controls</span></dt><dd><p><a class="indexterm" name="id2605155"></a><a class="indexterm" name="id2605163"></a><a class="indexterm" name="id2605174"></a><a class="indexterm" name="id2605185"></a><a class="indexterm" name="id2605193"></a><a class="indexterm" name="id2605201"></a><a class="indexterm" name="id2605209"></a><a class="indexterm" name="id2605217"></a><a class="indexterm" name="id2605225"></a> 182 182 User and group management facilities as known in the Windows ADS environment may be 183 183 used to provide equivalent access control constraints or to provide equivalent … … 186 186 Windows 200x/XP. For example, access controls on a Samba server may be set within 187 187 the share definition in a manner for which Windows has no equivalent. 188 </p><p><a class="indexterm" name="id260524 9"></a><a class="indexterm" name="id2605257"></a><a class="indexterm" name="id2605265"></a><a class="indexterm" name="id2605273"></a><a class="indexterm" name="id2605284"></a><a class="indexterm" name="id2605292"></a><a class="indexterm" name="id2605300"></a>188 </p><p><a class="indexterm" name="id2605245"></a><a class="indexterm" name="id2605252"></a><a class="indexterm" name="id2605260"></a><a class="indexterm" name="id2605268"></a><a class="indexterm" name="id2605280"></a><a class="indexterm" name="id2605288"></a><a class="indexterm" name="id2605296"></a> 189 189 In any serious analysis of system security, it is important to examine the safeguards 190 190 that remain when all other protective measures fail. An administrator may inadvertently … … 194 194 possible to guard against that by enforcing controls on the share definition itself. You 195 195 see a practical example of this a little later in this chapter. 196 </p><p><a class="indexterm" name="id26053 22"></a><a class="indexterm" name="id2605330"></a>196 </p><p><a class="indexterm" name="id2605317"></a><a class="indexterm" name="id2605325"></a> 197 197 The report that is critical of Samba really ought to have exercised greater due 198 198 diligence: the real weakness is on the side of a Microsoft Windows environment. 199 </p></dd><dt><span class="term">Security Overall</span></dt><dd><p><a class="indexterm" name="id26053 52"></a>199 </p></dd><dt><span class="term">Security Overall</span></dt><dd><p><a class="indexterm" name="id2605347"></a> 200 200 Samba is designed in such a manner that weaknesses inherent in the design of 201 201 Microsoft Windows networking ought not to expose the underlying UNIX/Linux file 202 202 system in any way. All software has potential defects, and Samba is no exception. 203 203 What matters more is how defects that are discovered get dealt with. 204 </p><p><a class="indexterm" name="id260536 9"></a><a class="indexterm" name="id2605376"></a><a class="indexterm" name="id2605384"></a><a class="indexterm" name="id2605392"></a>204 </p><p><a class="indexterm" name="id2605364"></a><a class="indexterm" name="id2605372"></a><a class="indexterm" name="id2605380"></a><a class="indexterm" name="id2605388"></a> 205 205 The Samba Team totally agrees with the necessity to observe and fully implement 206 206 every security facility to provide a level of protection and security that is necessary … … 209 209 security be publicly condoned; yet this is the practice by many Windows network 210 210 administrators just to make happy users who have no notion of consequential risk. 211 </p><p><a class="indexterm" name="id26054 12"></a><a class="indexterm" name="id2605420"></a><a class="indexterm" name="id2605428"></a><a class="indexterm" name="id2605436"></a><a class="indexterm" name="id2605444"></a><a class="indexterm" name="id2605452"></a><a class="indexterm" name="id2605460"></a>211 </p><p><a class="indexterm" name="id2605408"></a><a class="indexterm" name="id2605415"></a><a class="indexterm" name="id2605423"></a><a class="indexterm" name="id2605431"></a><a class="indexterm" name="id2605439"></a><a class="indexterm" name="id2605447"></a><a class="indexterm" name="id2605455"></a> 212 212 The report condemns Samba for releasing updates and security fixes, yet Microsoft 213 213 online updates need to be applied almost weekly. The answer to the criticism … … 215 215 user needs are being increasingly met or exceeded, and security updates are issued 216 216 with a short turnaround time. 217 </p><p><a class="indexterm" name="id260547 8"></a><a class="indexterm" name="id2605486"></a><a class="indexterm" name="id2605494"></a><a class="indexterm" name="id2605501"></a><a class="indexterm" name="id2605509"></a>217 </p><p><a class="indexterm" name="id2605473"></a><a class="indexterm" name="id2605481"></a><a class="indexterm" name="id2605489"></a><a class="indexterm" name="id2605497"></a><a class="indexterm" name="id2605505"></a> 218 218 The release of Samba-4 is expected around late 2004 to early 2005 and involves a near 219 219 complete rewrite to permit extensive modularization and to prepare Samba for new … … 222 222 degree of dependability and on charter development consistent with published 223 223 roadmap projections. 224 </p><p><a class="indexterm" name="id260553 9"></a><a class="indexterm" name="id2605547"></a><a class="indexterm" name="id2605559"></a><a class="indexterm" name="id2605570"></a><a class="indexterm" name="id2605578"></a><a class="indexterm" name="id2605586"></a><a class="indexterm" name="id2605594"></a>224 </p><p><a class="indexterm" name="id2605535"></a><a class="indexterm" name="id2605543"></a><a class="indexterm" name="id2605554"></a><a class="indexterm" name="id2605566"></a><a class="indexterm" name="id2605574"></a><a class="indexterm" name="id2605582"></a><a class="indexterm" name="id2605590"></a> 225 225 Not well published is the fact that Microsoft was a foundation member of 226 226 the Common Internet File System (CIFS) initiative, together with the participation … … 231 231 CIFS conferences and at the interoperability laboratories run concurrently with 232 232 them. 233 </p></dd><dt><span class="term">Cryptographic Controls (schannel, sign'n'seal)</span></dt><dd><p><a class="indexterm" name="id26056 24"></a><a class="indexterm" name="id2605632"></a><a class="indexterm" name="id2605640"></a>233 </p></dd><dt><span class="term">Cryptographic Controls (schannel, sign'n'seal)</span></dt><dd><p><a class="indexterm" name="id2605619"></a><a class="indexterm" name="id2605627"></a><a class="indexterm" name="id2605635"></a> 234 234 The report correctly mentions that Samba did not support the most recent 235 235 <code class="constant">schannel</code> and <code class="constant">digital sign'n'seal</code> features … … 239 239 pathology report they reflect accurately (at best) status at a snapshot in time. 240 240 Meanwhile, the world moves on. 241 </p><p><a class="indexterm" name="id26056 70"></a><a class="indexterm" name="id2605678"></a><a class="indexterm" name="id2605685"></a><a class="indexterm" name="id2605693"></a><a class="indexterm" name="id2605701"></a><a class="indexterm" name="id2605716"></a><a class="indexterm" name="id2605724"></a>241 </p><p><a class="indexterm" name="id2605665"></a><a class="indexterm" name="id2605673"></a><a class="indexterm" name="id2605681"></a><a class="indexterm" name="id2605688"></a><a class="indexterm" name="id2605696"></a><a class="indexterm" name="id2605711"></a><a class="indexterm" name="id2605719"></a> 242 242 It should be pointed out that had clear public specifications for the protocols 243 243 been published, it would have been much easier to implement these features and would have … … 247 247 and defensible standards is obvious to all and would have enabled more secure networking 248 248 for everyone. 249 </p><p><a class="indexterm" name="id260574 5"></a><a class="indexterm" name="id2605752"></a>249 </p><p><a class="indexterm" name="id2605740"></a><a class="indexterm" name="id2605748"></a> 250 250 Critics of Samba often ignore fundamental problems that may plague (or may have plagued) 251 251 the users of Microsoft's products also. Those who are first to criticize Samba … … 259 259 Windows networking sites. From notes such as this it is clear that there are benefits 260 260 from not rushing new technology out of the door too soon. 261 </p><p><a class="indexterm" name="id26057 92"></a><a class="indexterm" name="id2605801"></a><a class="indexterm" name="id2605809"></a><a class="indexterm" name="id2605816"></a><a class="indexterm" name="id2605824"></a><a class="indexterm" name="id2605832"></a><a class="indexterm" name="id2605840"></a><a class="indexterm" name="id2605848"></a><a class="indexterm" name="id2605856"></a>261 </p><p><a class="indexterm" name="id2605788"></a><a class="indexterm" name="id2605796"></a><a class="indexterm" name="id2605804"></a><a class="indexterm" name="id2605812"></a><a class="indexterm" name="id2605820"></a><a class="indexterm" name="id2605828"></a><a class="indexterm" name="id2605836"></a><a class="indexterm" name="id2605844"></a><a class="indexterm" name="id2605852"></a> 262 262 One final comment is warranted. If companies want more secure networking protocols, 263 263 the most effective method by which this can be achieved is by users seeking … … 275 275 and yet by which they are made to interoperate in ways that the components do not 276 276 support. 277 </p><p><a class="indexterm" name="id26059 44"></a><a class="indexterm" name="id2605955"></a><a class="indexterm" name="id2605963"></a><a class="indexterm" name="id2605971"></a><a class="indexterm" name="id2605979"></a>277 </p><p><a class="indexterm" name="id2605939"></a><a class="indexterm" name="id2605951"></a><a class="indexterm" name="id2605958"></a><a class="indexterm" name="id2605966"></a><a class="indexterm" name="id2605974"></a> 278 278 In order to make the popular request for Samba to be an Active Directory Server a 279 279 reality, it is necessary to add to OpenLDAP, Kerberos, as well as Samba, RPC calls … … 283 283 the Samba Team does not make it a priority to absorb Kerberos and LDAP functionality 284 284 into the Samba project, this dream request cannot become a reality. 285 </p><p><a class="indexterm" name="id26060 10"></a><a class="indexterm" name="id2606018"></a><a class="indexterm" name="id2606026"></a><a class="indexterm" name="id2606037"></a><a class="indexterm" name="id2606044"></a>285 </p><p><a class="indexterm" name="id2606005"></a><a class="indexterm" name="id2606013"></a><a class="indexterm" name="id2606021"></a><a class="indexterm" name="id2606032"></a><a class="indexterm" name="id2606040"></a> 286 286 At this time, the integration of LDAP, Kerberos, and the missing RPCs is not on the 287 287 Samba development roadmap. If it is not on the published roadmap, it cannot be delivered … … 289 289 The Samba Team is most committed to permitting Samba to be a full ADS domain member 290 290 that is increasingly capable of being managed using Microsoft Windows MMC tools. 291 </p></dd></dl></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id260606 4"></a>Kerberos Exposed</h4></div></div></div><p><a class="indexterm" name="id2606071"></a><a class="indexterm" name="id2606079"></a><a class="indexterm" name="id2606087"></a>291 </p></dd></dl></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2606060"></a>Kerberos Exposed</h4></div></div></div><p><a class="indexterm" name="id2606066"></a><a class="indexterm" name="id2606074"></a><a class="indexterm" name="id2606082"></a> 292 292 Kerberos is a network authentication protocol that provides secure authentication for 293 293 client-server applications by using secret-key cryptography. Firewalls are an insufficient … … 295 295 traffic but cannot prevent network traffic that comes from authorized locations from 296 296 performing unauthorized activities. 297 </p><p><a class="indexterm" name="id260610 5"></a><a class="indexterm" name="id2606113"></a><a class="indexterm" name="id2606121"></a>297 </p><p><a class="indexterm" name="id2606100"></a><a class="indexterm" name="id2606108"></a><a class="indexterm" name="id2606116"></a> 298 298 Kerberos was created by MIT as a solution to network security problems. The Kerberos protocol uses 299 299 strong cryptography so that a client can prove its identity to a server (and vice versa) across an … … 301 301 they can also encrypt all of their communications to assure privacy and data integrity as they go 302 302 about their business. 303 </p><p><a class="indexterm" name="id260613 9"></a><a class="indexterm" name="id2606147"></a><a class="indexterm" name="id2606155"></a><a class="indexterm" name="id2606163"></a><a class="indexterm" name="id2606174"></a>303 </p><p><a class="indexterm" name="id2606134"></a><a class="indexterm" name="id2606142"></a><a class="indexterm" name="id2606150"></a><a class="indexterm" name="id2606158"></a><a class="indexterm" name="id2606170"></a> 304 304 Kerberos is a trusted third-party service. That means that there is a third party (the kerberos 305 305 server) that is trusted by all the entities on the network (users and services, usually called … … 308 308 trusting the kerberos server, users and services can authenticate each other. 309 309 </p><p> 310 <a class="indexterm" name="id260619 4"></a>311 <a class="indexterm" name="id2606 201"></a>312 <a class="indexterm" name="id260620 8"></a>310 <a class="indexterm" name="id2606190"></a> 311 <a class="indexterm" name="id2606197"></a> 312 <a class="indexterm" name="id2606204"></a> 313 313 Kerberos was, until recently, a technology that was restricted from being exported from the United States. 314 314 For many years that hindered global adoption of more secure networking technologies both within the United States … … 320 320 and use of Kerberos across the spectrum of the information technology industry. 321 321 </p><p> 322 <a class="indexterm" name="id260623 8"></a>322 <a class="indexterm" name="id2606233"></a> 323 323 A storm has broken out concerning interoperability between MIT Kerberos and Microsofts' implementation 324 324 of it. For example, a 2002 325 325 <a class="ulink" href="http://www.idg.com.sg/idgwww.nsf/0/5DDA8D153A7505A748256BAB000D992A?OpenDocument" target="_top">IDG</a> 326 report<sup>[<a name="id260625 6" href="#ftn.id2606256" class="footnote">13</a>]</sup> by326 report<sup>[<a name="id2606252" href="#ftn.id2606252" class="footnote">13</a>]</sup> by 327 327 states: 328 328 </p><div class="blockquote"><blockquote class="blockquote"><p> … … 332 332 use of the Kerberos authentication specification, not everyone agrees. 333 333 </p><p> 334 <a class="indexterm" name="id26062 82"></a>334 <a class="indexterm" name="id2606278"></a> 335 335 Robert Short, vice president of Windows core technology at Microsoft, wrote in his direct testimony prepared 336 336 before his appearance that non-Microsoft operating systems can disregard the portion of the Kerberos version … … 340 340 that software developers could add their own authorization information, he said. 341 341 </p></blockquote></div><p> 342 <a class="indexterm" name="id260630 5"></a>343 <a class="indexterm" name="id26063 12"></a>342 <a class="indexterm" name="id2606301"></a> 343 <a class="indexterm" name="id2606307"></a> 344 344 It so happens that Microsoft Windows clients depend on and expect the contents of the <span class="emphasis"><em>unspecified 345 345 fields</em></span> in the Kerberos 5 communications data stream for their Windows interoperability, … … 353 353 <a class="ulink" href="http://www.microsoft.com/technet/itsolutions/interop/mgmt/kerberos.asp" target="_top"> 354 354 technet</a> article: 355 </p><div class="blockquote"><blockquote class="blockquote"><p><a class="indexterm" name="id260634 7"></a><a class="indexterm" name="id2606359"></a>355 </p><div class="blockquote"><blockquote class="blockquote"><p><a class="indexterm" name="id2606342"></a><a class="indexterm" name="id2606354"></a> 356 356 The DCE Security Services are also layered on the Kerberos protocol. DCE authentication services use RPC 357 357 representation of Kerberos protocol messages. In addition, DCE uses the authorization data field in Kerberos … … 363 363 </p></blockquote></div></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="ch10expl"></a>Implementation</h2></div></div></div><p> 364 364 The following procedures outline the implementation of the security measures discussed so far. 365 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id26064 10"></a>Share Access Controls</h3></div></div></div><p><a class="indexterm" name="id2606417"></a><a class="indexterm" name="id2606425"></a><a class="indexterm" name="id2606433"></a>365 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2606406"></a>Share Access Controls</h3></div></div></div><p><a class="indexterm" name="id2606412"></a><a class="indexterm" name="id2606420"></a><a class="indexterm" name="id2606428"></a> 366 366 Access control entries placed on the share itself act as a filter at the time a when CIFS/SMB client (such as 367 367 Windows XP Pro) attempts to make a connection to the Samba server. 368 </p><div class="procedure"><a name="id260644 6"></a><p class="title"><b>Procedure 11.1. Create/Edit/Delete Share ACLs</b></p><ol type="1"><li><p><a class="indexterm" name="id2606456"></a><a class="indexterm" name="id2606465"></a>368 </p><div class="procedure"><a name="id2606441"></a><p class="title"><b>Procedure 11.1. Create/Edit/Delete Share ACLs</b></p><ol type="1"><li><p><a class="indexterm" name="id2606452"></a><a class="indexterm" name="id2606460"></a> 369 369 From a Windows 200x/XP Professional workstation, log on to the domain using the Domain Administrator 370 370 account (on Samba domains, this is usually the account called <code class="constant">root</code>). … … 375 375 In the left panel, 376 376 <span class="guimenu">[Right mouse menu item] Computer Management (Local)</span> → <span class="guimenuitem">Connect to another computer ...</span> → <span class="guimenuitem">Browse...</span> → <span class="guimenuitem">Advanced</span> → <span class="guimenuitem">Find Now</span>. In the lower panel, click on the name of the server you wish to 377 administer. Click <span class="guimenu">OK</span> → <span class="guimenuitem">OK</span> → <span class="guimenuitem">OK</span>.<a class="indexterm" name="id260658 8"></a>377 administer. Click <span class="guimenu">OK</span> → <span class="guimenuitem">OK</span> → <span class="guimenuitem">OK</span>.<a class="indexterm" name="id2606583"></a> 378 378 In the left panel, the entry <span class="guimenu">Computer Management (Local)</span> should now reflect 379 379 the change made. For example, if the server you are administering is called <code class="constant">FRODO</code>, … … 381 381 </p></li><li><p> 382 382 In the left panel, click <span class="guimenu">Computer Management (FRODO)</span> → <span class="guimenuitem">[+] Shared Folders</span> → <span class="guimenuitem">Shares</span>. 383 </p></li><li><p><a class="indexterm" name="id26066 52"></a><a class="indexterm" name="id2606660"></a>383 </p></li><li><p><a class="indexterm" name="id2606647"></a><a class="indexterm" name="id2606655"></a> 384 384 In the right panel, double-click on the share on which you wish to set/edit ACLs. This 385 385 will bring up the Properties panel. Click the <span class="guimenu">Share Permissions</span> tab. 386 </p></li><li><p><a class="indexterm" name="id26066 83"></a><a class="indexterm" name="id2606691"></a><a class="indexterm" name="id2606699"></a><a class="indexterm" name="id2606707"></a><a class="indexterm" name="id2606715"></a><a class="indexterm" name="id2606723"></a>386 </p></li><li><p><a class="indexterm" name="id2606678"></a><a class="indexterm" name="id2606686"></a><a class="indexterm" name="id2606694"></a><a class="indexterm" name="id2606702"></a><a class="indexterm" name="id2606710"></a><a class="indexterm" name="id2606718"></a> 387 387 You may now edit/add/remove access control settings. Be very careful. Many problems have been 388 388 created by people who decided that everyone should be rejected but one particular group should … … 393 393 When you are done with editing, close all panels by clicking through the <span class="guimenu">OK</span> 394 394 buttons. 395 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id260675 9"></a>Share Definition Controls</h3></div></div></div><p><a class="indexterm" name="id2606766"></a><a class="indexterm" name="id2606777"></a><a class="indexterm" name="id2606785"></a><a class="indexterm" name="id2606793"></a><a class="indexterm" name="id2606801"></a><a class="indexterm" name="id2606809"></a>395 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2606754"></a>Share Definition Controls</h3></div></div></div><p><a class="indexterm" name="id2606761"></a><a class="indexterm" name="id2606773"></a><a class="indexterm" name="id2606780"></a><a class="indexterm" name="id2606788"></a><a class="indexterm" name="id2606796"></a><a class="indexterm" name="id2606804"></a> 396 396 Share-definition-based access controls can be used like a checkpoint or like a pile-driver. Just as a 397 397 checkpoint can be used to require someone who wants to get through to meet certain requirements, so … … 400 400 credential-related objectives, the user can be granted powers and privileges that would not normally be 401 401 available under default settings. 402 </p><p><a class="indexterm" name="id260682 9"></a><a class="indexterm" name="id2606837"></a><a class="indexterm" name="id2606845"></a><a class="indexterm" name="id2606853"></a>402 </p><p><a class="indexterm" name="id2606824"></a><a class="indexterm" name="id2606832"></a><a class="indexterm" name="id2606840"></a><a class="indexterm" name="id2606848"></a> 403 403 It must be emphasized that the controls discussed here can act as a filter or give rights of passage 404 404 that act as a superstructure over normal directory and file access controls. However, share-level … … 406 406 share-level controls to get to the share-definition controls. The proper hierarchy of controls implemented 407 407 by Samba and Windows networking consists of: 408 </p><div class="orderedlist"><ol type="1"><li><p>Share-level ACLs</p></li><li><p>Share-definition controls</p></li><li><p>Directory and file permissions</p></li><li><p>Directory and file POSIX ACLs</p></li></ol></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id260689 8"></a>Checkpoint Controls</h4></div></div></div><p><a class="indexterm" name="id2606905"></a>408 </p><div class="orderedlist"><ol type="1"><li><p>Share-level ACLs</p></li><li><p>Share-definition controls</p></li><li><p>Directory and file permissions</p></li><li><p>Directory and file POSIX ACLs</p></li></ol></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2606894"></a>Checkpoint Controls</h4></div></div></div><p><a class="indexterm" name="id2606900"></a> 409 409 Consider the following extract from a <code class="filename">smb.conf</code> file defining the share called <code class="constant">Apps</code>: 410 410 </p><pre class="screen"> … … 417 417 This definition permits only those who are members of the group called <code class="constant">Employees</code> to 418 418 access the share. 419 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p><a class="indexterm" name="id26069 41"></a><a class="indexterm" name="id2606952"></a><a class="indexterm" name="id2606960"></a><a class="indexterm" name="id2606968"></a><a class="indexterm" name="id2606976"></a>419 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p><a class="indexterm" name="id2606936"></a><a class="indexterm" name="id2606948"></a><a class="indexterm" name="id2606956"></a><a class="indexterm" name="id2606964"></a><a class="indexterm" name="id2606972"></a> 420 420 On domain member servers and clients, even when the <em class="parameter"><code>winbind use default domain</code></em> has 421 421 been specified, the use of domain accounts in security controls requires fully qualified domain specification, … … 423 423 Note the necessity to use the double quotes to avoid having the space in the Windows group name interpreted as a 424 424 delimiter. 425 </p></div><p><a class="indexterm" name="id26070 11"></a><a class="indexterm" name="id2607018"></a><a class="indexterm" name="id2607026"></a>425 </p></div><p><a class="indexterm" name="id2607006"></a><a class="indexterm" name="id2607014"></a><a class="indexterm" name="id2607021"></a> 426 426 If there is an ACL on the share itself to permit read/write access for all <code class="constant">Employees</code> 427 427 as well as read/write for the group <code class="constant">Doctors</code>, both groups are permitted through … … 429 429 the group <code class="constant">Doctors</code>, who is not also a member of the group <code class="constant">Employees</code>, 430 430 would immediately fail to validate. 431 </p><p><a class="indexterm" name="id260705 8"></a>431 </p><p><a class="indexterm" name="id2607053"></a> 432 432 Consider another example. In this case, you want to permit all members of the group <code class="constant">Employees</code> 433 433 except the user <code class="constant">patrickj</code> to access the <code class="constant">Apps</code> share. This can be … … 442 442 invalid users = patrickj 443 443 </pre><p> 444 <a class="indexterm" name="id260709 8"></a>444 <a class="indexterm" name="id2607093"></a> 445 445 Let us assume that you want to permit the user <code class="constant">gbshaw</code> to manage any file in the 446 446 UNIX/Linux file system directory <code class="filename">/data/apps</code>, but you do not want to grant any write … … 454 454 admin users = gbshaw 455 455 </pre><p> 456 <a class="indexterm" name="id260712 9"></a>456 <a class="indexterm" name="id2607124"></a> 457 457 Now we have a set of controls that permits only <code class="constant">Employees</code> who are also members of 458 458 the group <code class="constant">Doctors</code>, excluding the user <code class="constant">patrickj</code>, to have … … 476 476 write list = peters 477 477 </pre><p> 478 <a class="indexterm" name="id260718 9"></a>478 <a class="indexterm" name="id2607184"></a> 479 479 This is a particularly complex example at this point, but it begins to demonstrate the possibilities. 480 480 You should refer to the online manual page for the <code class="filename">smb.conf</code> file for more information regarding 481 481 the checkpoint controls that Samba implements. 482 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id26072 10"></a>Override Controls</h4></div></div></div><p><a class="indexterm" name="id2607217"></a>482 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2607206"></a>Override Controls</h4></div></div></div><p><a class="indexterm" name="id2607212"></a> 483 483 Override controls implemented by Samba permit actions like the adoption of a different identity 484 484 during file system operations, the forced overwriting of normal file and directory permissions, … … 498 498 force group = Mentors 499 499 </pre><p> 500 <a class="indexterm" name="id26072 61"></a><a class="indexterm" name="id2607269"></a>500 <a class="indexterm" name="id2607256"></a><a class="indexterm" name="id2607264"></a> 501 501 That is all there is to it. Well, it is almost that simple. The downside of this method is that 502 502 users are logged onto the Windows client as themselves, and then immediately before accessing the … … 505 505 This imposes significant overhead on Samba. The alternative way to effectively achieve the same result 506 506 (but with lower system CPU overheads) is described next. 507 </p><p><a class="indexterm" name="id260728 9"></a><a class="indexterm" name="id2607297"></a><a class="indexterm" name="id2607305"></a><a class="indexterm" name="id2607316"></a><a class="indexterm" name="id2607324"></a>507 </p><p><a class="indexterm" name="id2607285"></a><a class="indexterm" name="id2607292"></a><a class="indexterm" name="id2607300"></a><a class="indexterm" name="id2607312"></a><a class="indexterm" name="id2607320"></a> 508 508 The use of the <em class="parameter"><code>force user</code></em> or the <em class="parameter"><code>force group</code></em> may 509 509 also have a severe impact on system (particularly on Windows client) performance. If opportunistic … … 515 515 apparent performance degradation as the client continually attempts to reconnect to overcome the 516 516 effect of the lost <code class="constant">oplock break</code>, or time-out. 517 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id26073 72"></a>Share Point Directory and File Permissions</h3></div></div></div><p><a class="indexterm" name="id2607379"></a><a class="indexterm" name="id2607387"></a><a class="indexterm" name="id2607395"></a><a class="indexterm" name="id2607403"></a>517 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2607367"></a>Share Point Directory and File Permissions</h3></div></div></div><p><a class="indexterm" name="id2607374"></a><a class="indexterm" name="id2607382"></a><a class="indexterm" name="id2607390"></a><a class="indexterm" name="id2607398"></a> 518 518 Samba has been designed and implemented so that it respects as far as is feasible the security and 519 519 user privilege controls that are built into the UNIX/Linux operating system. Samba does nothing … … 523 523 from a basic UNIX training guide. Instead, one common example of a typical problem is used 524 524 to demonstrate the most effective solution referred to in the immediately preceding paragraph. 525 </p><p><a class="indexterm" name="id260742 5"></a><a class="indexterm" name="id2607433"></a><a class="indexterm" name="id2607441"></a>525 </p><p><a class="indexterm" name="id2607421"></a><a class="indexterm" name="id2607429"></a><a class="indexterm" name="id2607437"></a> 526 526 One of the common issues that repeatedly pops up on the Samba mailing lists involves the saving of 527 527 Microsoft Office files (Word and Excel) to a network drive. Here is the typical sequence: … … 543 543 want to know when this “<span class="quote">bug</span>” will be fixed. The fact is, this is not a bug in Samba at all. 544 544 Here is the real sequence of what happens in this case. 545 </p><p><a class="indexterm" name="id26075 33"></a><a class="indexterm" name="id2607541"></a><a class="indexterm" name="id2607549"></a>545 </p><p><a class="indexterm" name="id2607528"></a><a class="indexterm" name="id2607536"></a><a class="indexterm" name="id2607544"></a> 546 546 When the user saves a file, MS Word creates a new (temporary) file. This file is naturally owned 547 547 by the user who creates the file (<code class="constant">billc</code>) and has the permissions that follow … … 561 561 simple steps to create a share in which all files will consistently be owned by the same user and the 562 562 same group: 563 </p><div class="procedure"><a name="id260759 5"></a><p class="title"><b>Procedure 11.2. Using Directory Permissions to Force File User and Group Ownership</b></p><ol type="1"><li><p>563 </p><div class="procedure"><a name="id2607591"></a><p class="title"><b>Procedure 11.2. Using Directory Permissions to Force File User and Group Ownership</b></p><ol type="1"><li><p> 564 564 Change your share definition so that it matches this pattern: 565 565 </p><pre class="screen"> … … 569 569 read only = No 570 570 </pre><p> 571 </p></li><li><p><a class="indexterm" name="id26076 21"></a><a class="indexterm" name="id2607633"></a>571 </p></li><li><p><a class="indexterm" name="id2607617"></a><a class="indexterm" name="id2607628"></a> 572 572 Set consistent user and group permissions recursively down the directory tree as shown here: 573 573 </p><pre class="screen"> 574 574 <code class="prompt">root# </code> chown -R janetp.users /usr/data/finance 575 575 </pre><p> 576 </p></li><li><p><a class="indexterm" name="id260766 4"></a>576 </p></li><li><p><a class="indexterm" name="id2607660"></a> 577 577 Set the files and directory permissions to be read/write for owner and group, and not accessible 578 578 to others (everyone), using the following command: … … 580 580 <code class="prompt">root# </code> chmod ug+rwx,o-rwx /usr/data/finance 581 581 </pre><p> 582 </p></li><li><p><a class="indexterm" name="id26076 94"></a>582 </p></li><li><p><a class="indexterm" name="id2607689"></a> 583 583 Set the SGID (supergroup) bit on all directories from the top down. This means all files 584 584 can be created with the permissions of the group set on the directory. It means all users … … 590 590 </pre><p> 591 591 592 </p></li><li><p><a class="indexterm" name="id26077 34"></a><a class="indexterm" name="id2607742"></a><a class="indexterm" name="id2607750"></a>592 </p></li><li><p><a class="indexterm" name="id2607729"></a><a class="indexterm" name="id2607737"></a><a class="indexterm" name="id2607745"></a> 593 593 Make sure all users that must have read/write access to the directory have 594 594 <code class="constant">finance</code> group membership as their primary group, 595 595 for example, the group they belong to in <code class="filename">/etc/passwd</code>. 596 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id260777 5"></a>Managing Windows 200x ACLs</h3></div></div></div><p><a class="indexterm" name="id2607782"></a><a class="indexterm" name="id2607790"></a><a class="indexterm" name="id2607798"></a><a class="indexterm" name="id2607805"></a>596 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2607770"></a>Managing Windows 200x ACLs</h3></div></div></div><p><a class="indexterm" name="id2607777"></a><a class="indexterm" name="id2607785"></a><a class="indexterm" name="id2607793"></a><a class="indexterm" name="id2607801"></a> 597 597 Samba must translate Windows 2000 ACLs to UNIX POSIX ACLs. This has some interesting side effects because 598 598 there is not a one-to-one equivalence between them. The as-close-as-possible ACLs match means … … 602 602 There are two possible ways to set ACLs on UNIX/Linux file systems from a Windows network workstation, 603 603 either via File Manager or via the Microsoft Management Console (MMC) Computer Management interface. 604 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id260782 9"></a>Using the MMC Computer Management Interface</h4></div></div></div><div class="procedure"><ol type="1"><li><p>604 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2607825"></a>Using the MMC Computer Management Interface</h4></div></div></div><div class="procedure"><ol type="1"><li><p> 605 605 From a Windows 200x/XP Professional workstation, log on to the domain using the Domain Administrator 606 606 account (on Samba domains, this is usually the account called <code class="constant">root</code>). … … 617 617 </p></li><li><p> 618 618 In the left panel, click <span class="guimenu">Computer Management (FRODO)</span> → <span class="guimenuitem">[+] Shared Folders</span> → <span class="guimenuitem">Shares</span>. 619 </p></li><li><p><a class="indexterm" name="id26080 12"></a><a class="indexterm" name="id2608020"></a><a class="indexterm" name="id2608028"></a><a class="indexterm" name="id2608036"></a>619 </p></li><li><p><a class="indexterm" name="id2608008"></a><a class="indexterm" name="id2608016"></a><a class="indexterm" name="id2608023"></a><a class="indexterm" name="id2608031"></a> 620 620 In the right panel, double-click on the share on which you wish to set/edit ACLs. This 621 621 brings up the Properties panel. Click the <span class="guimenu">Security</span> tab. It is best … … 624 624 functionality under the <code class="constant">Permissions</code> tab can be utilized with respect 625 625 to a Samba domain server. 626 </p></li><li><p><a class="indexterm" name="id260807 6"></a><a class="indexterm" name="id2608084"></a>626 </p></li><li><p><a class="indexterm" name="id2608071"></a><a class="indexterm" name="id2608079"></a> 627 627 You may now edit/add/remove access control settings. Be very careful. Many problems have been 628 628 created by people who decided that everyone should be rejected but one particular group should … … 633 633 When you are done with editing, close all panels by clicking through the <span class="guimenu">OK</span> 634 634 buttons until the last panel closes. 635 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id26081 20"></a>Using MS Windows Explorer (File Manager)</h4></div></div></div><p>635 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2608116"></a>Using MS Windows Explorer (File Manager)</h4></div></div></div><p> 636 636 The following alternative method may be used from a Windows workstation. In this example we work 637 637 with a domain called <code class="constant">MEGANET</code>, a server called <code class="constant">MASSIVE</code>, and a … … 641 641 Click <span class="guimenu">Start</span> → <span class="guimenuitem">[right-click] My Computer</span> → <span class="guimenuitem">Explore</span> → <span class="guimenuitem">[left panel] [+] My Network Places</span> → <span class="guimenuitem">[+] Entire Network</span> → <span class="guimenuitem">[+] Microsoft Windows Network</span> → <span class="guimenuitem">[+] Meganet</span> → <span class="guimenuitem">[+] Massive</span> → <span class="guimenuitem">[right-click] Apps</span> → <span class="guimenuitem">Properties</span> → <span class="guimenuitem">Security</span> → <span class="guimenuitem">Advanced</span>. This opens a panel that has four tabs. Only the functionality under the 642 642 <code class="constant">Permissions</code> tab can be utilized for a Samba domain server. 643 </p></li><li><p><a class="indexterm" name="id260824 5"></a><a class="indexterm" name="id2608253"></a>643 </p></li><li><p><a class="indexterm" name="id2608240"></a><a class="indexterm" name="id2608248"></a> 644 644 You may now edit/add/remove access control settings. Be very careful. Many problems have been 645 645 created by people who decided that everyone should be rejected but one particular group should … … 650 650 When you are done with editing, close all panels by clicking through the <span class="guimenu">OK</span> 651 651 buttons until the last panel closes. 652 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id26082 91"></a>Setting Posix ACLs in UNIX/Linux</h4></div></div></div><p><a class="indexterm" name="id2608298"></a><a class="indexterm" name="id2608307"></a>652 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2608287"></a>Setting Posix ACLs in UNIX/Linux</h4></div></div></div><p><a class="indexterm" name="id2608294"></a><a class="indexterm" name="id2608302"></a> 653 653 Yet another alternative method for setting desired security settings on the shared resource files and 654 654 directories can be achieved by logging into UNIX/Linux and setting POSIX ACLs directly using command-line … … 673 673 other::r-x 674 674 </pre><p> 675 </p></li><li><p><a class="indexterm" name="id26083 81"></a>675 </p></li><li><p><a class="indexterm" name="id2608376"></a> 676 676 You want to add permission for <code class="constant">AppsMgrs</code> to enable them to 677 677 manage the applications (apps) share. It is important to set the ACL recursively … … 696 696 </pre><p> 697 697 This confirms that the change of POSIX ACL permissions has been effective. 698 </p></li><li><p><a class="indexterm" name="id260843 6"></a><a class="indexterm" name="id2608444"></a><a class="indexterm" name="id2608452"></a><a class="indexterm" name="id2608460"></a><a class="indexterm" name="id2608468"></a>698 </p></li><li><p><a class="indexterm" name="id2608432"></a><a class="indexterm" name="id2608439"></a><a class="indexterm" name="id2608447"></a><a class="indexterm" name="id2608455"></a><a class="indexterm" name="id2608463"></a> 699 699 It is highly recommended that you read the online manual page for the <code class="literal">setfacl</code> 700 700 and <code class="literal">getfacl</code> commands. This provides information regarding how to set/read the default 701 701 ACLs and how that may be propagated through the directory tree. In Windows ACLs terms, this is the equivalent 702 702 of setting <code class="constant">inheritance</code> properties. 703 </p></li></ol></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2608 502"></a>Key Points Learned</h3></div></div></div><p>703 </p></li></ol></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2608497"></a>Key Points Learned</h3></div></div></div><p> 704 704 The mish-mash of issues were thrown together into one chapter because it seemed like a good idea. 705 705 Looking back, this chapter could be broken into two, but it's too late now. It has been done. 706 706 The highlights covered are as follows: 707 </p><div class="itemizedlist"><ul type="disc"><li><p><a class="indexterm" name="id260851 9"></a><a class="indexterm" name="id2608527"></a><a class="indexterm" name="id2608535"></a><a class="indexterm" name="id2608543"></a>707 </p><div class="itemizedlist"><ul type="disc"><li><p><a class="indexterm" name="id2608514"></a><a class="indexterm" name="id2608522"></a><a class="indexterm" name="id2608530"></a><a class="indexterm" name="id2608538"></a> 708 708 Winbind honors and does not override account controls set in Active Directory. 709 709 This means that password change, logon hours, and so on, are (or soon will be) enforced … … 711 711 change is enforced. At this time, if logon hours expire, the user is not forcibly 712 712 logged off. That may be implemented at some later date. 713 </p></li><li><p><a class="indexterm" name="id26085 62"></a><a class="indexterm" name="id2608570"></a>713 </p></li><li><p><a class="indexterm" name="id2608557"></a><a class="indexterm" name="id2608565"></a> 714 714 Sign'n'seal (plus schannel support) has been implemented in Samba-3. Beware of potential 715 715 problems acknowledged by Microsoft as having been fixed but reported by some as still 716 716 possibly an open issue. 717 </p></li><li><p><a class="indexterm" name="id260858 5"></a><a class="indexterm" name="id2608593"></a><a class="indexterm" name="id2608601"></a><a class="indexterm" name="id2608609"></a>717 </p></li><li><p><a class="indexterm" name="id2608581"></a><a class="indexterm" name="id2608589"></a><a class="indexterm" name="id2608596"></a><a class="indexterm" name="id2608604"></a> 718 718 The combination of Kerberos 5, plus OpenLDAP, plus Samba, cannot replace Microsoft 719 719 Active Directory. The possibility to do this is not planned in the current Samba-3 … … 724 724 the four key methodologies was reviewed with specific reference to example deployment 725 725 techniques. 726 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id260863 6"></a>Questions and Answers</h2></div></div></div><p>727 </p><div class="qandaset"><dl><dt> <a href="kerberos.html#id26086 52">726 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2608631"></a>Questions and Answers</h2></div></div></div><p> 727 </p><div class="qandaset"><dl><dt> <a href="kerberos.html#id2608647"> 728 728 Does Samba-3 require the Sign'n'seal registry hacks needed by Samba-2? 729 </a></dt><dt> <a href="kerberos.html#id26087 22">729 </a></dt><dt> <a href="kerberos.html#id2608717"> 730 730 Does Samba-3 support Active Directory? 731 </a></dt><dt> <a href="kerberos.html#id26087 53">731 </a></dt><dt> <a href="kerberos.html#id2608748"> 732 732 When Samba-3 is used with Active Directory, is it necessary to run mixed-mode operation, as was 733 733 necessary with Samba-2? 734 </a></dt><dt> <a href="kerberos.html#id26087 92">734 </a></dt><dt> <a href="kerberos.html#id2608787"> 735 735 Is it safe to set share-level access controls in Samba? 736 </a></dt><dt> <a href="kerberos.html#id26088 21">736 </a></dt><dt> <a href="kerberos.html#id2608816"> 737 737 Is it mandatory to set share ACLs to get a secure Samba-3 server? 738 </a></dt><dt> <a href="kerberos.html#id260889 7">738 </a></dt><dt> <a href="kerberos.html#id2608893"> 739 739 The valid users did not work on the [homes]. 740 740 Has this functionality been restored yet? 741 </a></dt><dt> <a href="kerberos.html#id26089 63">741 </a></dt><dt> <a href="kerberos.html#id2608959"> 742 742 Is the bias against use of the force user and force group 743 743 really warranted? 744 </a></dt><dt> <a href="kerberos.html#id260902 7">744 </a></dt><dt> <a href="kerberos.html#id2609022"> 745 745 The example given for file and directory access control forces all files to be owned by one 746 746 particular user. I do not like that. Is there any way I can see who created the file? 747 </a></dt><dt> <a href="kerberos.html#id260907 5">747 </a></dt><dt> <a href="kerberos.html#id2609070"> 748 748 In the book, “The Official Samba-3 HOWTO and Reference Guide”, you recommended use 749 749 of the Windows NT4 Server Manager (part of the SRVTOOLS.EXE) utility. Why 750 750 have you mentioned only the use of the Windows 200x/XP MMC Computer Management utility? 751 </a></dt><dt> <a href="kerberos.html#id26091 42">751 </a></dt><dt> <a href="kerberos.html#id2609137"> 752 752 I tried to set valid users = @Engineers, but it does not work. My Samba 753 753 server is an Active Directory domain member server. Has this been fixed now? 754 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id26086 52"></a><a name="id2608654"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2608657"></a><a class="indexterm" name="id2608665"></a>754 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2608647"></a><a name="id2608649"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2608652"></a><a class="indexterm" name="id2608660"></a> 755 755 Does Samba-3 require the <code class="constant">Sign'n'seal</code> registry hacks needed by Samba-2? 756 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id260868 4"></a><a class="indexterm" name="id2608692"></a><a class="indexterm" name="id2608700"></a>756 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2608680"></a><a class="indexterm" name="id2608687"></a><a class="indexterm" name="id2608695"></a> 757 757 No. Samba-3 fully supports <code class="constant">Sign'n'seal</code> as well as <code class="constant">schannel</code> 758 758 operation. The registry change should not be applied when Samba-3 is used as a domain controller. 759 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id26087 22"></a><a name="id2608724"></a></td><td align="left" valign="top"><p>759 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2608717"></a><a name="id2608720"></a></td><td align="left" valign="top"><p> 760 760 Does Samba-3 support Active Directory? 761 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id260873 5"></a>761 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2608730"></a> 762 762 Yes. Samba-3 can be a fully participating native mode Active Directory client. Samba-3 does not 763 763 provide Active Directory services. It cannot be used to replace a Microsoft Active Directory 764 764 server implementation. Samba-3 can function as an Active Directory client (workstation) toolkit, 765 765 and it can function as an Active Directory domain member server. 766 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id26087 53"></a><a name="id2608755"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2608758"></a>766 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2608748"></a><a name="id2608751"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2608754"></a> 767 767 When Samba-3 is used with Active Directory, is it necessary to run mixed-mode operation, as was 768 768 necessary with Samba-2? 769 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id260877 5"></a>769 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2608770"></a> 770 770 No. Samba-3 can be used with NetBIOS over TCP/IP disabled, just as can be done with Windows 200x 771 771 Server and 200x/XPPro client products. It is no longer necessary to run mixed-mode operation, 772 772 because Samba-3 can join a native Windows 2003 Server ADS domain. 773 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id26087 92"></a><a name="id2608794"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2608797"></a>773 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2608787"></a><a name="id2608789"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2608792"></a> 774 774 Is it safe to set share-level access controls in Samba? 775 775 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 777 777 very mature technology. Not enough sites make use of this powerful capability, neither on 778 778 Windows server or with Samba servers. 779 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id26088 21"></a><a name="id2608823"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2608826"></a>779 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2608816"></a><a name="id2608818"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2608822"></a> 780 780 Is it mandatory to set share ACLs to get a secure Samba-3 server? 781 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id26088 42"></a><a class="indexterm" name="id2608850"></a><a class="indexterm" name="id2608858"></a><a class="indexterm" name="id2608866"></a><a class="indexterm" name="id2608874"></a>781 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2608837"></a><a class="indexterm" name="id2608845"></a><a class="indexterm" name="id2608853"></a><a class="indexterm" name="id2608862"></a><a class="indexterm" name="id2608870"></a> 782 782 No. Samba-3 honors UNIX/Linux file system security, supports Windows 200x ACLs, and provides 783 783 means of securing shares through share definition controls in the <code class="filename">smb.conf</code> file. The additional 784 784 support for share-level ACLs is like frosting on the cake. It adds to security but is not essential 785 785 to it. 786 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id260889 7"></a><a name="id2608900"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2608903"></a>786 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2608893"></a><a name="id2608895"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2608898"></a> 787 787 The <em class="parameter"><code>valid users</code></em> did not work on the <em class="parameter"><code>[homes]</code></em>. 788 788 Has this functionality been restored yet? 789 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id26089 30"></a>789 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2608926"></a> 790 790 Yes. This was fixed in Samba-3.0.2. The use of this parameter is strongly recommended as a safeguard 791 791 on the <em class="parameter"><code>[homes]</code></em> meta-service. The correct way to specify this is: 792 792 <a class="link" href="smb.conf.5.html#VALIDUSERS">valid users = %S</a>. 793 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id26089 63"></a><a name="id2608966"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2608969"></a><a class="indexterm" name="id2608976"></a><a class="indexterm" name="id2608984"></a>793 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2608959"></a><a name="id2608961"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2608964"></a><a class="indexterm" name="id2608972"></a><a class="indexterm" name="id2608980"></a> 794 794 Is the bias against use of the <em class="parameter"><code>force user</code></em> and <em class="parameter"><code>force group</code></em> 795 795 really warranted? 796 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id26090 11"></a>796 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2609007"></a> 797 797 There is no bias. There is a determination to recommend the right tool for the task at hand. 798 798 After all, it is better than putting users through performance problems, isn't it? 799 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id260902 7"></a><a name="id2609029"></a></td><td align="left" valign="top"><p>799 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2609022"></a><a name="id2609024"></a></td><td align="left" valign="top"><p> 800 800 The example given for file and directory access control forces all files to be owned by one 801 801 particular user. I do not like that. Is there any way I can see who created the file? 802 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id26090 42"></a>802 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2609037"></a> 803 803 Sure. You do not have to set the SUID bit on the directory. Simply execute the following command 804 804 to permit file ownership to be retained by the user who created it: … … 808 808 Note that this required no more than removing the <code class="constant">u</code> argument so that the 809 809 SUID bit is not set for the owner. 810 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id260907 5"></a><a name="id2609077"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2609080"></a>810 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2609070"></a><a name="id2609072"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2609076"></a> 811 811 In the book, “<span class="quote">The Official Samba-3 HOWTO and Reference Guide</span>”, you recommended use 812 812 of the Windows NT4 Server Manager (part of the <code class="filename">SRVTOOLS.EXE</code>) utility. Why 813 813 have you mentioned only the use of the Windows 200x/XP MMC Computer Management utility? 814 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id260910 8"></a><a class="indexterm" name="id2609116"></a>814 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2609104"></a><a class="indexterm" name="id2609111"></a> 815 815 Either tool can be used with equal effect. There is no benefit of one over the other, except that 816 816 the MMC utility is present on all Windows 200x/XP systems and does not require additional software … … 818 818 Samba-controlled domain, the only tool that permits that is the NT4 Domain User Manager, which 819 819 is provided as part of the <code class="filename">SRVTOOLS.EXE</code> utility. 820 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id26091 42"></a><a name="id2609144"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2609147"></a><a class="indexterm" name="id2609155"></a><a class="indexterm" name="id2609163"></a>820 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2609137"></a><a name="id2609139"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2609142"></a><a class="indexterm" name="id2609150"></a><a class="indexterm" name="id2609158"></a> 821 821 I tried to set <em class="parameter"><code>valid users = @Engineers</code></em>, but it does not work. My Samba 822 822 server is an Active Directory domain member server. Has this been fixed now? … … 824 824 The use of this parameter has always required the full specification of the domain account, for 825 825 example, <em class="parameter"><code>valid users = @"MEGANET2\Domain Admins"</code></em>. 826 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"></div><div class="footnote"><a class="ulink" href="http://199.105.191.226/Man/2699/020430msdoj/" target="_top"><sup>[<a name="ftn.id260625 6" href="#id2606256" class="ulink">13</a>] </sup>ITWorld.com</a></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="RefSection.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="RefSection.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="DomApps.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Part III. Reference Section </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 12. Integrating Additional Services</td></tr></table></div></body></html>826 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"></div><div class="footnote"><a class="ulink" href="http://199.105.191.226/Man/2699/020430msdoj/" target="_top"><sup>[<a name="ftn.id2606252" href="#id2606252" class="ulink">13</a>] </sup>ITWorld.com</a></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="RefSection.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="RefSection.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="DomApps.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Part III. Reference Section </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 12. Integrating Additional Services</td></tr></table></div></body></html> -
branches/samba-3.2.x/docs/htmldocs/Samba3-ByExample/ntmigration.html
r204 r226 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 9. Migrating NT4 Domain to Samba-3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="upgrades.html" title="Chapter 8. Updating Samba-3"><link rel="next" href="nw4migration.html" title="Chapter 10. Migrating NetWare Server to Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 9. Migrating NT4 Domain to Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="upgrades.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="nw4migration.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="ntmigration"></a>Chapter 9. Migrating NT4 Domain to Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ntmigration.html#id259443 9">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2594524">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2594579">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2594765">Technical Issues</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2595088">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2595114">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2595255">NT4 Migration Using LDAP Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2597714">NT4 Migration Using tdbsam Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2598120">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2598159">Questions and Answers</a></span></dt></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 9. Migrating NT4 Domain to Samba-3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="upgrades.html" title="Chapter 8. Updating Samba-3"><link rel="next" href="nw4migration.html" title="Chapter 10. Migrating NetWare Server to Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 9. Migrating NT4 Domain to Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="upgrades.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="nw4migration.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="ntmigration"></a>Chapter 9. Migrating NT4 Domain to Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ntmigration.html#id2594435">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2594520">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2594574">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2594760">Technical Issues</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2595084">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2595109">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2595250">NT4 Migration Using LDAP Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2597709">NT4 Migration Using tdbsam Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2598116">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2598154">Questions and Answers</a></span></dt></dl></div><p> 2 2 Ever since Microsoft announced that it was discontinuing support for Windows 3 3 NT4, Samba users started to ask for detailed instructions on how to migrate … … 7 7 One wonders how many NT4 systems will be left in service by the time you read this 8 8 book though. 9 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id259443 9"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id2594446"></a>9 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2594435"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id2594441"></a> 10 10 Network administrators who want to migrate off a Windows NT4 environment know 11 11 one thing with certainty. They feel that NT4 has been abandoned, and they want … … 14 14 failure, and much more. 15 15 </p><p> 16 <a class="indexterm" name="id25944 64"></a>17 <a class="indexterm" name="id25944 71"></a>18 <a class="indexterm" name="id25944 80"></a>19 <a class="indexterm" name="id259448 9"></a>16 <a class="indexterm" name="id2594459"></a> 17 <a class="indexterm" name="id2594466"></a> 18 <a class="indexterm" name="id2594475"></a> 19 <a class="indexterm" name="id2594484"></a> 20 20 The migration from NT4 to Samba-3 can involve a number of factors, including 21 21 migration of data to another server, migration of network environment controls … … 23 23 accounts. 24 24 </p><p> 25 <a class="indexterm" name="id259450 6"></a>25 <a class="indexterm" name="id2594501"></a> 26 26 It should be pointed out now that it is possible to migrate some systems from 27 27 a Windows NT4 domain environment to a Samba-3 domain environment. This is certainly … … 31 31 migration before an environment that is acceptable for immediate use 32 32 is obtained. 33 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id259452 4"></a>Assignment Tasks</h3></div></div></div><p>34 <a class="indexterm" name="id25945 32"></a>35 <a class="indexterm" name="id259453 9"></a>36 <a class="indexterm" name="id259454 6"></a>33 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2594520"></a>Assignment Tasks</h3></div></div></div><p> 34 <a class="indexterm" name="id2594528"></a> 35 <a class="indexterm" name="id2594534"></a> 36 <a class="indexterm" name="id2594541"></a> 37 37 You are about to migrate an MS Windows NT4 domain accounts database to 38 38 a Samba-3 server. The Samba-3 server is using a … … 43 43 Your objective is to document the process of migrating user and group accounts 44 44 from several NT4 domains into a single Samba-3 LDAP backend database. 45 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id259457 9"></a>Dissection and Discussion</h2></div></div></div><p>46 <a class="indexterm" name="id259458 7"></a>47 <a class="indexterm" name="id25945 93"></a>48 <a class="indexterm" name="id2594 600"></a>49 <a class="indexterm" name="id25946 12"></a>50 <a class="indexterm" name="id25946 23"></a>51 <a class="indexterm" name="id25946 30"></a>45 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2594574"></a>Dissection and Discussion</h2></div></div></div><p> 46 <a class="indexterm" name="id2594582"></a> 47 <a class="indexterm" name="id2594589"></a> 48 <a class="indexterm" name="id2594596"></a> 49 <a class="indexterm" name="id2594607"></a> 50 <a class="indexterm" name="id2594619"></a> 51 <a class="indexterm" name="id2594625"></a> 52 52 The migration process takes a snapshot of information that is stored in the 53 53 Windows NT4 registry-based accounts database. That information resides in … … 55 55 <code class="constant">SAM</code> and <code class="constant">SECURITY</code>. 56 56 </p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p> 57 <a class="indexterm" name="id259465 4"></a>58 <a class="indexterm" name="id25946 61"></a>57 <a class="indexterm" name="id2594650"></a> 58 <a class="indexterm" name="id2594656"></a> 59 59 The Windows NT4 registry keys called <code class="constant">SAM</code> and <code class="constant">SECURITY</code> 60 60 are protected so that you cannot view the contents. If you change the security setting … … 62 62 do this unless you are willing to render your domain controller inoperative. 63 63 </p></div><p> 64 <a class="indexterm" name="id25946 83"></a>65 <a class="indexterm" name="id25946 92"></a>64 <a class="indexterm" name="id2594679"></a> 65 <a class="indexterm" name="id2594688"></a> 66 66 Before commencing an NT4 to Samba-3 migration, you should consider what your objectives are. 67 67 While in some cases it is possible simply to migrate an NT4 domain to a single Samba-3 server, … … 71 71 interact with the network environment. 72 72 </p><p> 73 <a class="indexterm" name="id25947 11"></a>74 <a class="indexterm" name="id25947 20"></a>75 <a class="indexterm" name="id259472 7"></a>73 <a class="indexterm" name="id2594706"></a> 74 <a class="indexterm" name="id2594716"></a> 75 <a class="indexterm" name="id2594723"></a> 76 76 MS Windows NT4 was introduced some time around 1996. Many environments in which NT4 was deployed 77 77 have done little to keep the NT4 server environment up to date with more recent Windows releases, … … 84 84 real disruption to users, but rather, with due diligence and care, should make their network experience 85 85 a much happier one. 86 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id259476 5"></a>Technical Issues</h3></div></div></div><p>87 <a class="indexterm" name="id25947 73"></a>88 <a class="indexterm" name="id25947 80"></a>86 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2594760"></a>Technical Issues</h3></div></div></div><p> 87 <a class="indexterm" name="id2594768"></a> 88 <a class="indexterm" name="id2594775"></a> 89 89 Migration of an NT4 domain user and group database to Samba-3 involves a certain strategic 90 90 element. Many sites have asked for instructions regarding merging of multiple NT4 … … 94 94 from a Windows NT4 domain to a Samba domain. 95 95 </p><div class="figure"><a name="ch8-migration"></a><p class="title"><b>Figure 9.1. Schematic Explaining the <code class="literal">net rpc vampire</code> Process</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/ch8-migration.png" width="297" alt="Schematic Explaining the net rpc vampire Process"></div></div></div><br class="figure-break"><p> 96 <a class="indexterm" name="id25948 53"></a>97 <a class="indexterm" name="id25948 60"></a>96 <a class="indexterm" name="id2594848"></a> 97 <a class="indexterm" name="id2594855"></a> 98 98 If you want to merge multiple NT4 domain account databases into one Samba domain, 99 99 you must now dump the contents of the first migration and edit it as appropriate. Now clean … … 101 101 files. You must start each migration with a new database into which you merge your NT4 102 102 domains. 103 </p><p><a class="indexterm" name="id25948 80"></a>103 </p><p><a class="indexterm" name="id2594876"></a> 104 104 At this point, you are ready to perform the second migration, following the same steps as 105 105 for the first. In other words, dump the database, edit it, and then you may merge the 106 106 dump for the first and second migrations. 107 </p><p><a class="indexterm" name="id259489 5"></a><a class="indexterm" name="id2594903"></a><a class="indexterm" name="id2594911"></a>107 </p><p><a class="indexterm" name="id2594891"></a><a class="indexterm" name="id2594898"></a><a class="indexterm" name="id2594906"></a> 108 108 You must be careful. If you choose to migrate to an LDAP backend, your dump file 109 109 now contains the full account information, including the domain SID. The domain SID for each … … 111 111 portion of the account SIDs so that all are the same. 112 112 </p><p> 113 <a class="indexterm" name="id259492 9"></a>114 <a class="indexterm" name="id259493 5"></a>115 <a class="indexterm" name="id25949 42"></a>116 <a class="indexterm" name="id259494 9"></a>117 <a class="indexterm" name="id259495 6"></a>118 <a class="indexterm" name="id25949 63"></a>119 <a class="indexterm" name="id25949 70"></a>120 <a class="indexterm" name="id259497 7"></a>121 <a class="indexterm" name="id25949 83"></a>122 <a class="indexterm" name="id25949 90"></a>123 <a class="indexterm" name="id259499 7"></a>124 <a class="indexterm" name="id259 5004"></a>113 <a class="indexterm" name="id2594924"></a> 114 <a class="indexterm" name="id2594931"></a> 115 <a class="indexterm" name="id2594938"></a> 116 <a class="indexterm" name="id2594944"></a> 117 <a class="indexterm" name="id2594951"></a> 118 <a class="indexterm" name="id2594958"></a> 119 <a class="indexterm" name="id2594965"></a> 120 <a class="indexterm" name="id2594972"></a> 121 <a class="indexterm" name="id2594979"></a> 122 <a class="indexterm" name="id2594986"></a> 123 <a class="indexterm" name="id2594992"></a> 124 <a class="indexterm" name="id2594999"></a> 125 125 If you choose to use a tdbsam (<code class="filename">passdb.tdb</code>) backend file, your best choice 126 126 is to use <code class="literal">pdbedit</code> to export the contents of the tdbsam file into an … … 132 132 may be exported or imported into either a tdbsam (<code class="filename">passdb.tdb</code>) or 133 133 an LDAP backend. 134 </p><div class="figure"><a name="NT4DUM"></a><p class="title"><b>Figure 9.2. View of Accounts in NT4 Domain User Manager</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/UserMgrNT4.png" width="270" alt="View of Accounts in NT4 Domain User Manager"></div></div></div><br class="figure-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id259508 8"></a>Political Issues</h3></div></div></div><p>134 </p><div class="figure"><a name="NT4DUM"></a><p class="title"><b>Figure 9.2. View of Accounts in NT4 Domain User Manager</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/UserMgrNT4.png" width="270" alt="View of Accounts in NT4 Domain User Manager"></div></div></div><br class="figure-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2595084"></a>Political Issues</h3></div></div></div><p> 135 135 The merging of multiple Windows NT4-style domains into a single LDAP-backend-based Samba-3 136 136 domain may be seen by those who had power over them as a loss of prestige or a loss of … … 142 142 Samba-3 domain is to promote (sell) the action as one that reduces costs and delivers 143 143 greater network interoperability and manageability. 144 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id25951 14"></a>Implementation</h2></div></div></div><p>144 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2595109"></a>Implementation</h2></div></div></div><p> 145 145 From feedback on the Samba mailing lists, it seems that most Windows NT4 migrations 146 146 to Samba-3 are being performed using a new server or a new installation of a Linux or UNIX … … 165 165 migration to either a tdbsam or an ldapsam backend. 166 166 </p></li><li><p> 167 <a class="indexterm" name="id2595 201"></a>168 <a class="indexterm" name="id259520 8"></a>169 <a class="indexterm" name="id259521 4"></a>167 <a class="indexterm" name="id2595197"></a> 168 <a class="indexterm" name="id2595203"></a> 169 <a class="indexterm" name="id2595210"></a> 170 170 Clean up the source NT4 PDC. Delete all accounts that need not be migrated. 171 171 Delete all files that should not be migrated. Where possible, change NT group … … 175 175 </p></li><li><p> 176 176 Step through the migration process. 177 </p></li><li><p><a class="indexterm" name="id259523 5"></a>177 </p></li><li><p><a class="indexterm" name="id2595230"></a> 178 178 Remove the NT4 PDC from the network. 179 179 </p></li><li><p> … … 182 182 </p></li></ul></div><p> 183 183 It may help to use the above outline as a pre-migration checklist. 184 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id259525 5"></a>NT4 Migration Using LDAP Backend</h3></div></div></div><p>184 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2595250"></a>NT4 Migration Using LDAP Backend</h3></div></div></div><p> 185 185 In this example, the migration is of an NT4 PDC to a Samba-3 PDC with an LDAP backend. The accounts about 186 186 to be migrated are shown in <a class="link" href="ntmigration.html#NT4DUM" title="Figure 9.2. View of Accounts in NT4 Domain User Manager">“View of Accounts in NT4 Domain User Manager”</a>. In this example use is made of the … … 200 200 before commencing the following configuration steps. 201 201 </p></div><div class="table"><a name="ch8-vampire"></a><p class="title"><b>Table 9.1. Samba <code class="filename">smb.conf</code> Scripts Essential to Samba Operation</b></p><div class="table-contents"><table summary="Samba smb.conf Scripts Essential to Samba Operation" border="1"><colgroup><col align="left"><col align="center"><col align="center"></colgroup><thead><tr><th align="left">Entity</th><th align="center">ldapsam Script</th><th align="center">tdbsam Script</th></tr></thead><tbody><tr><td align="left">Add User Accounts</td><td align="center">smbldap-useradd</td><td align="center">useradd</td></tr><tr><td align="left">Delete User Accounts</td><td align="center">smbldap-userdel</td><td align="center">userdel</td></tr><tr><td align="left">Add Group Accounts</td><td align="center">smbldap-groupadd</td><td align="center">groupadd</td></tr><tr><td align="left">Delete Group Accounts</td><td align="center">smbldap-groupdel</td><td align="center">groupdel</td></tr><tr><td align="left">Add User to Group</td><td align="center">smbldap-groupmod</td><td align="center">usermod (See Note)</td></tr><tr><td align="left">Add Machine Accounts</td><td align="center">smbldap-useradd</td><td align="center">useradd</td></tr></tbody></table></div></div><br class="table-break"><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 202 <a class="indexterm" name="id259545 8"></a>203 <a class="indexterm" name="id259546 5"></a>204 <a class="indexterm" name="id25954 71"></a>202 <a class="indexterm" name="id2595453"></a> 203 <a class="indexterm" name="id2595460"></a> 204 <a class="indexterm" name="id2595467"></a> 205 205 The UNIX/Linux <code class="literal">usermod</code> utility does not permit simple user addition to (or deletion 206 206 of users from) groups. This is a feature provided by the smbldap-tools scripts. If you want this … … 210 210 in the formal commands provided by Linux distributions (March 2004). 211 211 </p></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 212 <a class="indexterm" name="id259550 8"></a>212 <a class="indexterm" name="id2595504"></a> 213 213 The <code class="literal">tdbdump</code> utility is a utility that you can build from the Samba source-code tree. Not all Linux binary distributions include this tool. If it is missing from your 214 214 Linux distribution, you will need to build this yourself or else forgo its use. 215 215 </p></div><p> 216 <a class="indexterm" name="id259552 9"></a>216 <a class="indexterm" name="id2595524"></a> 217 217 Before starting the migration, all dead accounts were removed from the NT4 domain using the User Manager for Domains. 218 </p><div class="procedure"><a name="id259553 9"></a><p class="title"><b>Procedure 9.1. User Migration Steps</b></p><div class="example"><a name="sbent4smb"></a><p class="title"><b>Example 9.1. NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2595599"></a><em class="parameter"><code>workgroup = DAMNATION</code></em></td></tr><tr><td><a class="indexterm" name="id2595611"></a><em class="parameter"><code>netbios name = MERLIN</code></em></td></tr><tr><td><a class="indexterm" name="id2595623"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id2595635"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2595646"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2595658"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2595670"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2595682"></a><em class="parameter"><code>smb ports = 139 445</code></em></td></tr><tr><td><a class="indexterm" name="id2595693"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2595705"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2595718"></a><em class="parameter"><code>#delete user script = /opt/IDEALX/sbin/smbldap-userdel '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2595730"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2595742"></a><em class="parameter"><code>#delete group script = /opt/IDEALX/sbin/smbldap-groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2595755"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/ smbldap-groupmod -m '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2595768"></a><em class="parameter"><code>#delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2595781"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2595794"></a><em class="parameter"><code>add machine script = /opt/IDEALX/sbin/smbldap-useradd -w '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2595806"></a><em class="parameter"><code>logon script = scripts\logon.cmd</code></em></td></tr><tr><td><a class="indexterm" name="id2595818"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2595830"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2595842"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2595854"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2595865"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id2595877"></a><em class="parameter"><code>#wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2595889"></a><em class="parameter"><code>wins server = 192.168.123.124</code></em></td></tr><tr><td><a class="indexterm" name="id2595901"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=terpstra-world,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2595913"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2595925"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2595937"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2595949"></a><em class="parameter"><code>ldap passwd sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2595961"></a><em class="parameter"><code>ldap suffix = dc=terpstra-world,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2595973"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id2595984"></a><em class="parameter"><code>ldap timeout = 20</code></em></td></tr><tr><td><a class="indexterm" name="id2595996"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2596008"></a><em class="parameter"><code>idmap backend = ldap:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id2596020"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2596032"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2596044"></a><em class="parameter"><code>winbind nested groups = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2596056"></a><em class="parameter"><code>ea support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2596067"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbent4smb2"></a><p class="title"><b>Example 9.2. NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id2596113"></a><em class="parameter"><code>comment = Application Data</code></em></td></tr><tr><td><a class="indexterm" name="id2596124"></a><em class="parameter"><code>path = /data/home/apps</code></em></td></tr><tr><td><a class="indexterm" name="id2596136"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2596157"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2596168"></a><em class="parameter"><code>path = /home/users/%U/Documents</code></em></td></tr><tr><td><a class="indexterm" name="id2596180"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2596192"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2596203"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2596224"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2596236"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2596247"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2596259"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2596271"></a><em class="parameter"><code>use client driver = No</code></em></td></tr><tr><td><a class="indexterm" name="id2596282"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2596303"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2596315"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2596327"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2596338"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2596359"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2596371"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2596382"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2596394"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id2596415"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id2596427"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id2596438"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2596450"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id2596471"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2596482"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbentslapd"></a><p class="title"><b>Example 9.3. NT4 Migration LDAP Server Configuration File: <code class="filename">/etc/openldap/slapd.conf</code> Part A</b></p><div class="example-contents"><pre class="screen">218 </p><div class="procedure"><a name="id2595534"></a><p class="title"><b>Procedure 9.1. User Migration Steps</b></p><div class="example"><a name="sbent4smb"></a><p class="title"><b>Example 9.1. NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2595594"></a><em class="parameter"><code>workgroup = DAMNATION</code></em></td></tr><tr><td><a class="indexterm" name="id2595606"></a><em class="parameter"><code>netbios name = MERLIN</code></em></td></tr><tr><td><a class="indexterm" name="id2595618"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id2595630"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2595642"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2595653"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2595665"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2595677"></a><em class="parameter"><code>smb ports = 139 445</code></em></td></tr><tr><td><a class="indexterm" name="id2595688"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2595701"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2595713"></a><em class="parameter"><code>#delete user script = /opt/IDEALX/sbin/smbldap-userdel '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2595725"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2595738"></a><em class="parameter"><code>#delete group script = /opt/IDEALX/sbin/smbldap-groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2595750"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/ smbldap-groupmod -m '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2595763"></a><em class="parameter"><code>#delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2595776"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2595789"></a><em class="parameter"><code>add machine script = /opt/IDEALX/sbin/smbldap-useradd -w '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2595802"></a><em class="parameter"><code>logon script = scripts\logon.cmd</code></em></td></tr><tr><td><a class="indexterm" name="id2595814"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2595826"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2595837"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2595849"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2595861"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id2595872"></a><em class="parameter"><code>#wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2595884"></a><em class="parameter"><code>wins server = 192.168.123.124</code></em></td></tr><tr><td><a class="indexterm" name="id2595896"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=terpstra-world,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2595908"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2595920"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2595932"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2595944"></a><em class="parameter"><code>ldap passwd sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2595956"></a><em class="parameter"><code>ldap suffix = dc=terpstra-world,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2595968"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id2595980"></a><em class="parameter"><code>ldap timeout = 20</code></em></td></tr><tr><td><a class="indexterm" name="id2595991"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2596003"></a><em class="parameter"><code>idmap backend = ldap:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id2596016"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2596027"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2596039"></a><em class="parameter"><code>winbind nested groups = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2596051"></a><em class="parameter"><code>ea support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2596063"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbent4smb2"></a><p class="title"><b>Example 9.2. NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id2596108"></a><em class="parameter"><code>comment = Application Data</code></em></td></tr><tr><td><a class="indexterm" name="id2596120"></a><em class="parameter"><code>path = /data/home/apps</code></em></td></tr><tr><td><a class="indexterm" name="id2596131"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2596152"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2596164"></a><em class="parameter"><code>path = /home/users/%U/Documents</code></em></td></tr><tr><td><a class="indexterm" name="id2596176"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2596187"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2596199"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2596219"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2596231"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2596243"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2596254"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2596266"></a><em class="parameter"><code>use client driver = No</code></em></td></tr><tr><td><a class="indexterm" name="id2596278"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2596298"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2596310"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2596322"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2596334"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2596354"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2596366"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2596378"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2596389"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id2596410"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id2596422"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id2596434"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2596445"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id2596466"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2596478"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbentslapd"></a><p class="title"><b>Example 9.3. NT4 Migration LDAP Server Configuration File: <code class="filename">/etc/openldap/slapd.conf</code> Part A</b></p><div class="example-contents"><pre class="screen"> 219 219 include /etc/openldap/schema/core.schema 220 220 include /etc/openldap/schema/cosine.schema … … 337 337 no account information can be deleted. 338 338 </p></li><li><p> 339 <a class="indexterm" name="id2596 501"></a>339 <a class="indexterm" name="id2596496"></a> 340 340 Configure OpenLDAP in preparation for the migration. An example 341 341 <code class="filename">sladp.conf</code> file is shown in <a class="link" href="ntmigration.html#sbentslapd" title="Example 9.3. NT4 Migration LDAP Server Configuration File: /etc/openldap/slapd.conf Part A">“NT4 Migration LDAP Server Configuration File: /etc/openldap/slapd.conf Part A”</a>. … … 343 343 be obtained by executing the <code class="literal">slappasswd</code> command. 344 344 </p></li><li><p> 345 <a class="indexterm" name="id259661 4"></a>346 <a class="indexterm" name="id25966 21"></a>345 <a class="indexterm" name="id2596610"></a> 346 <a class="indexterm" name="id2596617"></a> 347 347 Install the PADL <code class="literal">nss_ldap</code> tool set, then configure the <code class="filename">/etc/ldap.conf</code> 348 348 as shown in <a class="link" href="ntmigration.html#sbrntldapconf" title="Example 9.5. NT4 Migration NSS LDAP File: /etc/ldap.conf">“NT4 Migration NSS LDAP File: /etc/ldap.conf”</a>. 349 349 </p></li><li><p> 350 <a class="indexterm" name="id25966 82"></a>350 <a class="indexterm" name="id2596677"></a> 351 351 Edit the <code class="filename">/etc/nsswitch.conf</code> file so it has the entries shown 352 352 in <a class="link" href="ntmigration.html#sbentnss" title="Example 9.6. NT4 Migration NSS Control File: /etc/nsswitch.conf (Stage:1)">“NT4 Migration NSS Control File: /etc/nsswitch.conf (Stage:1)”</a>. Note that the LDAP entries have been commented out. … … 393 393 </pre><p> 394 394 </p></li><li><p> 395 <a class="indexterm" name="id25968 51"></a>396 <a class="indexterm" name="id259685 8"></a>397 <a class="indexterm" name="id259686 5"></a>398 <a class="indexterm" name="id25968 72"></a>395 <a class="indexterm" name="id2596847"></a> 396 <a class="indexterm" name="id2596854"></a> 397 <a class="indexterm" name="id2596860"></a> 398 <a class="indexterm" name="id2596867"></a> 399 399 Install the Idealx <code class="literal">smbldap-tools</code> software package, following 400 400 the instructions given in <a class="link" href="happy.html#sbeidealx" title="Install and Configure Idealx smbldap-tools Scripts">“Install and Configure Idealx smbldap-tools Scripts”</a>. The resulting perl scripts … … 490 490 /etc/smbldap-tools/smbldap_bind.conf done. 491 491 </pre><p> 492 <a class="indexterm" name="id25970 22"></a>493 <a class="indexterm" name="id259702 9"></a>494 <a class="indexterm" name="id259703 6"></a>495 <a class="indexterm" name="id25970 43"></a>492 <a class="indexterm" name="id2597017"></a> 493 <a class="indexterm" name="id2597024"></a> 494 <a class="indexterm" name="id2597031"></a> 495 <a class="indexterm" name="id2597038"></a> 496 496 Note that the NT4 domain SID that was previously obtained was entered above. Also, 497 497 the sambaUnixIdPooldn object was specified as sambaDomainName=DAMNATION. This is … … 546 546 This is expected behavior. 547 547 </p></li><li><p> 548 <a class="indexterm" name="id259720 7"></a>548 <a class="indexterm" name="id2597202"></a> 549 549 Restart the LDAP server following initialization of the LDAP directory. Execute the 550 550 system control script provided on your system. The following steps can be used on … … 713 713 across, set up privileges, and set share and file/directory access controls. 714 714 </p></li><li><p> 715 <a class="indexterm" name="id25975 21"></a>716 <a class="indexterm" name="id259752 8"></a>715 <a class="indexterm" name="id2597517"></a> 716 <a class="indexterm" name="id2597524"></a> 717 717 Edit the <code class="filename">smb.conf</code> file to reset the parameter 718 718 <a class="link" href="smb.conf.5.html#DOMAINMASTER">domain master = Yes</a> so that … … 842 842 Creating unix group: 'Users' 843 843 </pre><p> 844 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id25977 14"></a>NT4 Migration Using tdbsam Backend</h3></div></div></div><p>844 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2597709"></a>NT4 Migration Using tdbsam Backend</h3></div></div></div><p> 845 845 In this example, we change the domain name of the NT4 server from 846 846 <code class="constant">DRUGPREP</code> to <code class="constant">MEGANET</code> prior to the use … … 850 850 databases. These entries must therefore be present, and correct options specified, 851 851 in your <code class="filename">smb.conf</code> file, or else the migration does not work as it should. 852 </p><div class="procedure"><a name="id25977 61"></a><p class="title"><b>Procedure 9.2. Migration Steps Using tdbsam</b></p><ol type="1"><li><p>852 </p><div class="procedure"><a name="id2597756"></a><p class="title"><b>Procedure 9.2. Migration Steps Using tdbsam</b></p><ol type="1"><li><p> 853 853 Prepare a Samba-3 server precisely per the instructions shown in <a class="link" href="Big500users.html" title="Chapter 4. The 500-User Office">“The 500-User Office”</a>. 854 854 Set the workgroup name to <code class="constant">MEGANET</code>. 855 </p></li><li><p><a class="indexterm" name="id259778 9"></a><a class="indexterm" name="id2597797"></a>855 </p></li><li><p><a class="indexterm" name="id2597784"></a><a class="indexterm" name="id2597792"></a> 856 856 Edit the <code class="filename">smb.conf</code> file to temporarily change the parameter 857 857 <a class="link" href="smb.conf.5.html#DOMAINMASTER">domain master = No</a> so … … 859 859 </p></li><li><p> 860 860 Start Samba as you have done previously. 861 </p></li><li><p><a class="indexterm" name="id259783 9"></a>861 </p></li><li><p><a class="indexterm" name="id2597834"></a> 862 862 Join the NT4 Domain as a BDC, as shown here: 863 863 </p><pre class="screen"> … … 865 865 Joined domain MEGANET. 866 866 </pre><p> 867 </p></li><li><p><a class="indexterm" name="id25978 74"></a>867 </p></li><li><p><a class="indexterm" name="id2597869"></a> 868 868 You may vampire the accounts from the NT4 PDC by executing the command, as shown here: 869 869 </p><pre class="screen"> … … 905 905 SAM_DELTA_DOMAIN_INFO not handled 906 906 </pre><p> 907 </p></li><li><p><a class="indexterm" name="id259792 8"></a>907 </p></li><li><p><a class="indexterm" name="id2597923"></a> 908 908 At this point, we can validate our migration. Let's look at the accounts 909 909 in the form in which they are seen in a smbpasswd file. This achieves that: … … 937 937 CF271B744F7A55AFDA277FF88D80C527:[UX ]:LCT-3E8B4270: 938 938 </pre><p> 939 </p></li><li><p><a class="indexterm" name="id259800 5"></a>939 </p></li><li><p><a class="indexterm" name="id2598000"></a> 940 940 An expanded view of a user account entry shows more of what was 941 941 obtained from the NT4 PDC: … … 963 963 Password must change: Mon, 18 Jan 2038 20:14:07 GMT 964 964 </pre><p> 965 </p></li><li><p><a class="indexterm" name="id25980 40"></a>965 </p></li><li><p><a class="indexterm" name="id2598035"></a> 966 966 The following command lists the long names of the groups that have been 967 967 imported (vampired) from the NT4 PDC: … … 980 980 </pre><p> 981 981 Everything looks well and in order. 982 </p></li><li><p><a class="indexterm" name="id25980 80"></a><a class="indexterm" name="id2598088"></a>982 </p></li><li><p><a class="indexterm" name="id2598075"></a><a class="indexterm" name="id2598083"></a> 983 983 Edit the <code class="filename">smb.conf</code> file to reset the parameter 984 984 <a class="link" href="smb.conf.5.html#DOMAINMASTER">domain master = Yes</a> so 985 985 the Samba server functions as a PDC for the purpose of migration. 986 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id25981 20"></a>Key Points Learned</h3></div></div></div><p>986 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2598116"></a>Key Points Learned</h3></div></div></div><p> 987 987 Migration of an NT4 PDC database to a Samba-3 PDC is possible. 988 988 </p><div class="itemizedlist"><ul type="disc"><li><p> … … 996 996 The net Samba-3 domain most likely requires some 997 997 administration and updating before going live. 998 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id259815 9"></a>Questions and Answers</h2></div></div></div><p>999 </p><div class="qandaset"><dl><dt> <a href="ntmigration.html#id25981 74">998 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2598154"></a>Questions and Answers</h2></div></div></div><p> 999 </p><div class="qandaset"><dl><dt> <a href="ntmigration.html#id2598169"> 1000 1000 Why must I start each migration with a clean database? 1001 </a></dt><dt> <a href="ntmigration.html#id259821 4">1001 </a></dt><dt> <a href="ntmigration.html#id2598210"> 1002 1002 Is it possible to set my domain SID to anything I like? 1003 </a></dt><dt> <a href="ntmigration.html#id25982 71">1003 </a></dt><dt> <a href="ntmigration.html#id2598267"> 1004 1004 When using a tdbsam passdb backend, why must I have all domain user and group accounts 1005 1005 in /etc/passwd and /etc/group? 1006 </a></dt><dt> <a href="ntmigration.html#id25984 51">1006 </a></dt><dt> <a href="ntmigration.html#id2598447"> 1007 1007 Why did you validate connectivity before attempting migration? 1008 </a></dt><dt> <a href="ntmigration.html#id259849 7">1008 </a></dt><dt> <a href="ntmigration.html#id2598492"> 1009 1009 How would you merge 10 tdbsam-based domains into an LDAP database? 1010 </a></dt><dt> <a href="ntmigration.html#id259861 9">1010 </a></dt><dt> <a href="ntmigration.html#id2598614"> 1011 1011 I want to change my domain name after I migrate all accounts from an NT4 domain to a 1012 1012 Samba-3 domain. Does it make any sense to migrate the machine accounts in that case? 1013 </a></dt><dt> <a href="ntmigration.html#id259869 5">1013 </a></dt><dt> <a href="ntmigration.html#id2598690"> 1014 1014 After merging multiple NT4 domains into a Samba-3 domain, I lost all multiple group mappings. Why? 1015 </a></dt><dt> <a href="ntmigration.html#id25987 60">1015 </a></dt><dt> <a href="ntmigration.html#id2598755"> 1016 1016 How can I reset group membership after loading the account information into the LDAP database? 1017 </a></dt><dt> <a href="ntmigration.html#id25987 94">1017 </a></dt><dt> <a href="ntmigration.html#id2598789"> 1018 1018 What are the limits or constraints that apply to group names? 1019 </a></dt><dt> <a href="ntmigration.html#id259889 9">1019 </a></dt><dt> <a href="ntmigration.html#id2598894"> 1020 1020 My Windows NT4 PDC has 323,000 user accounts. How long will it take to migrate them to a Samba-3 1021 1021 LDAP backend system using the vampire process? 1022 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id25981 74"></a><a name="id2598176"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2598179"></a>1022 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2598169"></a><a name="id2598171"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2598174"></a> 1023 1023 Why must I start each migration with a clean database? 1024 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id259819 5"></a>1024 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2598190"></a> 1025 1025 This is a recommendation that permits the data from each NT4 domain to 1026 1026 be kept separate until you are ready to merge them. Also, if you do not start with a clean database, … … 1029 1029 without undue errors and then to handle the merging of vampired data under 1030 1030 proper supervision. 1031 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id259821 4"></a><a name="id2598216"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2598220"></a>1031 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2598210"></a><a name="id2598212"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2598215"></a> 1032 1032 Is it possible to set my domain SID to anything I like? 1033 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id259823 5"></a><a class="indexterm" name="id2598243"></a><a class="indexterm" name="id2598251"></a>1033 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2598230"></a><a class="indexterm" name="id2598238"></a><a class="indexterm" name="id2598246"></a> 1034 1034 Yes, so long as the SID you create has the same structure as an autogenerated SID. 1035 1035 The typical SID looks like this: S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX, where … … 1038 1038 You may want to set the SID to one that is already in use somewhere on your network, 1039 1039 but that is a little different from straight out creating your own domain SID. 1040 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id25982 71"></a><a name="id2598274"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2598277"></a><a class="indexterm" name="id2598284"></a><a class="indexterm" name="id2598292"></a><a class="indexterm" name="id2598300"></a><a class="indexterm" name="id2598308"></a><a class="indexterm" name="id2598319"></a><a class="indexterm" name="id2598330"></a>1040 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2598267"></a><a name="id2598269"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2598272"></a><a class="indexterm" name="id2598279"></a><a class="indexterm" name="id2598287"></a><a class="indexterm" name="id2598295"></a><a class="indexterm" name="id2598303"></a><a class="indexterm" name="id2598314"></a><a class="indexterm" name="id2598326"></a> 1041 1041 When using a tdbsam passdb backend, why must I have all domain user and group accounts 1042 1042 in <code class="filename">/etc/passwd</code> and <code class="filename">/etc/group</code>? 1043 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id25983 62"></a><a class="indexterm" name="id2598369"></a><a class="indexterm" name="id2598377"></a><a class="indexterm" name="id2598385"></a><a class="indexterm" name="id2598393"></a><a class="indexterm" name="id2598400"></a>1043 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2598357"></a><a class="indexterm" name="id2598365"></a><a class="indexterm" name="id2598372"></a><a class="indexterm" name="id2598380"></a><a class="indexterm" name="id2598388"></a><a class="indexterm" name="id2598396"></a> 1044 1044 Samba-3 must be able to tie all user and group account SIDs to a UNIX UID or GID. Samba 1045 1045 does not fabricate the UNIX IDs from thin air, but rather requires them to be located … … 1056 1056 In short then, all UNIX and Windows networking accounts, both in tdbsam as well as in 1057 1057 LDAP, require UIDs/GIDs. 1058 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id25984 51"></a><a name="id2598454"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2598457"></a><a class="indexterm" name="id2598465"></a><a class="indexterm" name="id2598473"></a>1058 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2598447"></a><a name="id2598449"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2598452"></a><a class="indexterm" name="id2598460"></a><a class="indexterm" name="id2598468"></a> 1059 1059 Why did you validate connectivity before attempting migration? 1060 1060 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1062 1062 potential problems that may otherwise affect or impede account migration. I am always 1063 1063 mindful of the 4 P's of migration: Planning Prevents Poor Performance. 1064 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id259849 7"></a><a name="id2598499"></a></td><td align="left" valign="top"><p>1064 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2598492"></a><a name="id2598494"></a></td><td align="left" valign="top"><p> 1065 1065 How would you merge 10 tdbsam-based domains into an LDAP database? 1066 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id25985 10"></a><a class="indexterm" name="id2598518"></a><a class="indexterm" name="id2598526"></a><a class="indexterm" name="id2598533"></a><a class="indexterm" name="id2598541"></a><a class="indexterm" name="id2598549"></a><a class="indexterm" name="id2598557"></a><a class="indexterm" name="id2598564"></a><a class="indexterm" name="id2598572"></a><a class="indexterm" name="id2598580"></a><a class="indexterm" name="id2598588"></a>1066 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2598505"></a><a class="indexterm" name="id2598513"></a><a class="indexterm" name="id2598521"></a><a class="indexterm" name="id2598529"></a><a class="indexterm" name="id2598537"></a><a class="indexterm" name="id2598544"></a><a class="indexterm" name="id2598552"></a><a class="indexterm" name="id2598560"></a><a class="indexterm" name="id2598568"></a><a class="indexterm" name="id2598576"></a><a class="indexterm" name="id2598583"></a> 1067 1067 If you have 10 tdbsam Samba domains, there is considerable risk that there are a number of 1068 1068 accounts that have the same UNIX identifier (UID/GID). This means that you almost … … 1074 1074 you have migrated before handing over access to a user. After all, too many users with a bad 1075 1075 migration experience may threaten your career. 1076 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id259861 9"></a><a name="id2598621"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2598624"></a><a class="indexterm" name="id2598632"></a>1076 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2598614"></a><a name="id2598617"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2598620"></a><a class="indexterm" name="id2598628"></a> 1077 1077 I want to change my domain name after I migrate all accounts from an NT4 domain to a 1078 1078 Samba-3 domain. Does it make any sense to migrate the machine accounts in that case? 1079 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id25986 53"></a><a class="indexterm" name="id2598661"></a><a class="indexterm" name="id2598669"></a><a class="indexterm" name="id2598677"></a>1079 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2598649"></a><a class="indexterm" name="id2598656"></a><a class="indexterm" name="id2598664"></a><a class="indexterm" name="id2598672"></a> 1080 1080 I would recommend not to migrate the machine account. The machine accounts should still work, but there are registry entries 1081 1081 on each Windows NT4 and upward client that have a tattoo of the old domain name. If you 1082 1082 unjoin the domain and then rejoin the newly renamed Samba-3 domain, you can be certain to avoid 1083 1083 this tattooing effect. 1084 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id259869 5"></a><a name="id2598697"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2598700"></a>1084 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2598690"></a><a name="id2598692"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2598696"></a> 1085 1085 After merging multiple NT4 domains into a Samba-3 domain, I lost all multiple group mappings. Why? 1086 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id259871 7"></a><a class="indexterm" name="id2598724"></a>1086 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2598712"></a><a class="indexterm" name="id2598720"></a> 1087 1087 Samba-3 currently does not implement multiple group membership internally. If you use the Windows 1088 1088 NT4 Domain User Manager to manage accounts and you have an LDAP backend, the multiple group … … 1093 1093 and <code class="filename">/etc/group</code> information also. That is where the multiple group information 1094 1094 is most closely at your fingertips. 1095 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id25987 60"></a><a name="id2598762"></a></td><td align="left" valign="top"><p>1095 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2598755"></a><a name="id2598757"></a></td><td align="left" valign="top"><p> 1096 1096 How can I reset group membership after loading the account information into the LDAP database? 1097 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id25987 73"></a>1097 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2598769"></a> 1098 1098 You can use the NT4 Domain User Manager that can be downloaded from the Microsoft Web site. The 1099 1099 installation file is called <code class="filename">SRVTOOLS.EXE</code>. 1100 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id25987 94"></a><a name="id2598796"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2598799"></a>1100 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2598789"></a><a name="id2598792"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2598795"></a> 1101 1101 What are the limits or constraints that apply to group names? 1102 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id259881 5"></a><a class="indexterm" name="id2598823"></a><a class="indexterm" name="id2598831"></a><a class="indexterm" name="id2598839"></a><a class="indexterm" name="id2598846"></a><a class="indexterm" name="id2598854"></a>1102 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2598810"></a><a class="indexterm" name="id2598818"></a><a class="indexterm" name="id2598826"></a><a class="indexterm" name="id2598834"></a><a class="indexterm" name="id2598842"></a><a class="indexterm" name="id2598850"></a> 1103 1103 A Windows 200x group name can be up to 254 characters long, while in Windows NT4 the group 1104 1104 name is limited to 20 characters. Most UNIX systems limit this to 32 characters. Windows … … 1112 1112 or user account names. You have to experiment with your system to find what its 1113 1113 peculiarities are. 1114 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id259889 9"></a><a name="id2598901"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2598904"></a>1114 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2598894"></a><a name="id2598896"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2598899"></a> 1115 1115 My Windows NT4 PDC has 323,000 user accounts. How long will it take to migrate them to a Samba-3 1116 1116 LDAP backend system using the vampire process? … … 1121 1121 integer. UNIX/Linux systems that have a 32-bit UID/GID can easily handle this number of accounts. 1122 1122 Please check this carefully before you attempt to effect a migration using the vampire process. 1123 </p><p><a class="indexterm" name="id25989 41"></a>1123 </p><p><a class="indexterm" name="id2598937"></a> 1124 1124 Migration speed depends much on the processor speed, the network speed, disk I/O capability, and 1125 1125 LDAP update overheads. On a dual processor AMD MP1600+ with 1 GB memory that was mirroring LDAP -
branches/samba-3.2.x/docs/htmldocs/Samba3-ByExample/nw4migration.html
r204 r226 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 10. Migrating NetWare Server to Samba-3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="ntmigration.html" title="Chapter 9. Migrating NT4 Domain to Samba-3"><link rel="next" href="RefSection.html" title="Part III. Reference Section"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 10. Migrating NetWare Server to Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="ntmigration.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="RefSection.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="nw4migration"></a>Chapter 10. Migrating NetWare Server to Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="nw4migration.html#id259913 4">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id2599251">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id2599364">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id2599440">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id2599631">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id2599640">NetWare Migration Using LDAP Backend</a></span></dt></dl></dd></dl></div><p>2 <a class="indexterm" name="id259897 9"></a>3 <a class="indexterm" name="id259898 6"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 10. Migrating NetWare Server to Samba-3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="ntmigration.html" title="Chapter 9. Migrating NT4 Domain to Samba-3"><link rel="next" href="RefSection.html" title="Part III. Reference Section"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 10. Migrating NetWare Server to Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="ntmigration.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="RefSection.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="nw4migration"></a>Chapter 10. Migrating NetWare Server to Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="nw4migration.html#id2599130">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id2599246">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id2599359">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id2599436">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id2599626">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id2599635">NetWare Migration Using LDAP Backend</a></span></dt></dl></dd></dl></div><p> 2 <a class="indexterm" name="id2598975"></a> 3 <a class="indexterm" name="id2598981"></a> 4 4 Novell is a company any seasoned IT manager has to admire. It has become increasingly 5 5 Linux-friendly and is emerging out of a deep regression that almost saw the company … … 9 9 Meanwhile, there can be no denying that Novell is a Linux company. 10 10 </p><p> 11 <a class="indexterm" name="id259 9004"></a>12 <a class="indexterm" name="id25990 11"></a>13 <a class="indexterm" name="id259901 8"></a>14 <a class="indexterm" name="id259902 4"></a>11 <a class="indexterm" name="id2598999"></a> 12 <a class="indexterm" name="id2599006"></a> 13 <a class="indexterm" name="id2599013"></a> 14 <a class="indexterm" name="id2599020"></a> 15 15 Whatever flavor of Linux is preferred in your environment, whether Red Hat, Debian, 16 16 Gentoo, Mandrake, or SUSE (Novell), the information in this chapter should be read with … … 18 18 in this chapter should provide something of value. 19 19 </p><p> 20 <a class="indexterm" name="id25990 40"></a>20 <a class="indexterm" name="id2599035"></a> 21 21 Contributions to this chapter were made by Misty Stanley-Jones, a UNIX administrator of many 22 22 years who surfaced on the Samba mailing list with a barrage of questions and who 23 23 regularly helps other administrators to solve thorny Samba migration questions. 24 24 </p><p> 25 <a class="indexterm" name="id25990 54"></a>26 <a class="indexterm" name="id25990 61"></a>27 <a class="indexterm" name="id259906 7"></a>28 <a class="indexterm" name="id25990 74"></a>25 <a class="indexterm" name="id2599049"></a> 26 <a class="indexterm" name="id2599056"></a> 27 <a class="indexterm" name="id2599063"></a> 28 <a class="indexterm" name="id2599069"></a> 29 29 One wonders how many NetWare servers remain in active service. Many are being migrated 30 30 to Samba on Linux. Red Hat Linux, SUSE Linux 9.x, and SUSE Linux Enterprise Server 9 are … … 50 50 original documentation contributed by Misty, the Courier-IMAP package had been built 51 51 directly from the original source tarball. 52 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id259913 4"></a>Introduction</h2></div></div></div><p>53 <a class="indexterm" name="id25991 42"></a>52 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2599130"></a>Introduction</h2></div></div></div><p> 53 <a class="indexterm" name="id2599137"></a> 54 54 Misty Stanley-Jones was recruited by Abmas to administer a network that had 55 55 not received much attention for some years and was much in need of a makeover. … … 65 65 drives, causing backup integrity problems 66 66 </p></li></ul></div></li></ul></div><p> 67 <a class="indexterm" name="id259923 7"></a>67 <a class="indexterm" name="id2599232"></a> 68 68 At one point disk space had filled up to 100 percent, causing the payroll database 69 69 to become corrupt. This caused the accounting department to be down for over … … 71 71 server was created with very poor security and design considerations from 72 72 a discarded desktop PC. 73 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id25992 51"></a>Assignment Tasks</h3></div></div></div><p>73 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2599246"></a>Assignment Tasks</h3></div></div></div><p> 74 74 Misty has provided this summary of her migration experience in the hope 75 75 that it will help someone to avoid the challenges she faced. Perhaps her … … 90 90 the overall information more useful to you. 91 91 </p><p> 92 <a class="indexterm" name="id259928 8"></a>92 <a class="indexterm" name="id2599283"></a> 93 93 After management reviewed a cost-benefit report as well as an estimated 94 94 time-to-completion, approval was given proceed with the solution proposed. … … 112 112 The new system has operated for 6 months without problems. Over the past months 113 113 much attention has been focused on cleaning up desktops and user profiles. 114 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id25993 64"></a>Dissection and Discussion</h2></div></div></div><p>115 <a class="indexterm" name="id25993 72"></a>116 <a class="indexterm" name="id259937 9"></a>117 <a class="indexterm" name="id259938 5"></a>118 <a class="indexterm" name="id25993 92"></a>114 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2599359"></a>Dissection and Discussion</h2></div></div></div><p> 115 <a class="indexterm" name="id2599367"></a> 116 <a class="indexterm" name="id2599374"></a> 117 <a class="indexterm" name="id2599381"></a> 118 <a class="indexterm" name="id2599388"></a> 119 119 A decision to use LDAP was made even though I knew nothing about LDAP except that 120 120 I had been reading the book “<span class="quote">LDAP System Administration,</span>” by Gerald Carter. … … 122 122 and would provide centralized authentication and identity management. 123 123 </p><p> 124 <a class="indexterm" name="id25994 11"></a>125 <a class="indexterm" name="id259941 8"></a>126 <a class="indexterm" name="id259942 5"></a>124 <a class="indexterm" name="id2599407"></a> 125 <a class="indexterm" name="id2599413"></a> 126 <a class="indexterm" name="id2599420"></a> 127 127 Building the LDAP database took a while and a lot of trial and error. Following 128 128 the guidance I obtained from “<span class="quote">LDAP System 129 129 Administration,</span>” I installed OpenLDAP (from RPM; later I compiled 130 130 a more current version from source) and built my initial LDAP tree. 131 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id25994 40"></a>Technical Issues</h3></div></div></div><p>132 <a class="indexterm" name="id259944 8"></a>133 <a class="indexterm" name="id259945 5"></a>134 <a class="indexterm" name="id25994 62"></a>135 <a class="indexterm" name="id259946 9"></a>136 <a class="indexterm" name="id259947 6"></a>137 <a class="indexterm" name="id25994 82"></a>138 <a class="indexterm" name="id259948 9"></a>139 <a class="indexterm" name="id259949 6"></a>140 <a class="indexterm" name="id2599 503"></a>131 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2599436"></a>Technical Issues</h3></div></div></div><p> 132 <a class="indexterm" name="id2599444"></a> 133 <a class="indexterm" name="id2599450"></a> 134 <a class="indexterm" name="id2599457"></a> 135 <a class="indexterm" name="id2599464"></a> 136 <a class="indexterm" name="id2599471"></a> 137 <a class="indexterm" name="id2599478"></a> 138 <a class="indexterm" name="id2599485"></a> 139 <a class="indexterm" name="id2599491"></a> 140 <a class="indexterm" name="id2599498"></a> 141 141 The first challenge was to create a company white pages, followed by manually 142 142 entering everything from the printed company directory. This used only the inetOrgPerson … … 190 190 aliases, hosts, netgroups, networks, protocols, PRCs, and services from the existing ASCII text 191 191 files (or from a name service such as NIS). This too set can be obtained from the <a class="ulink" href="http://www.padl.com" target="_top">PADL Web site</a>. 192 </p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id25996 31"></a>Implementation</h2></div></div></div><p>193 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id25996 40"></a>NetWare Migration Using LDAP Backend</h3></div></div></div><p>192 </p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2599626"></a>Implementation</h2></div></div></div><p> 193 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2599635"></a>NetWare Migration Using LDAP Backend</h3></div></div></div><p> 194 194 The following software must be installed on the SUSE Linux Enterprise Server to perform 195 195 this migration: … … 198 198 The configuration files used at Abmas are provided as a guide and should be modified 199 199 to meet needs at your site. 200 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id259971 5"></a>LDAP Server Configuration</h4></div></div></div><p>200 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2599710"></a>LDAP Server Configuration</h4></div></div></div><p> 201 201 The <code class="filename">/etc/openldap/slapd.conf</code> file Misty used is shown here: 202 202 </p><pre class="programlisting"> … … 363 363 </pre><p> 364 364 </p><p> 365 <a class="indexterm" name="id259990 6"></a>365 <a class="indexterm" name="id2599902"></a> 366 366 The <code class="filename">/etc/ldap.conf</code> file used is listed in <a class="link" href="nw4migration.html#ch8ldap" title="Example 10.2. NSS LDAP Control File /etc/ldap.conf">“NSS LDAP Control File /etc/ldap.conf”</a>. 367 367 </p><div class="example"><a name="ch8ldap"></a><p class="title"><b>Example 10.2. NSS LDAP Control File /etc/ldap.conf</b></p><div class="example-contents"><pre class="screen"> … … 417 417 </pre><p> 418 418 </p><p> 419 <a class="indexterm" name="id25999 91"></a>420 <a class="indexterm" name="id259999 7"></a>419 <a class="indexterm" name="id2599986"></a> 420 <a class="indexterm" name="id2599992"></a> 421 421 In my setup, users authenticate via PAM and NSS using LDAP-based accounts. 422 422 The configuration file that controls the behavior of the PAM <code class="literal">pam_unix2</code> … … 459 459 password: use_ldap 460 460 session: none 461 </pre></div></div><br class="example-break"><a class="indexterm" name="id26000 80"></a><a class="indexterm" name="id2600087"></a><a class="indexterm" name="id2600094"></a><div class="itemizedlist"><ul type="disc"><li><p>461 </pre></div></div><br class="example-break"><a class="indexterm" name="id2600075"></a><a class="indexterm" name="id2600082"></a><a class="indexterm" name="id2600089"></a><div class="itemizedlist"><ul type="disc"><li><p> 462 462 If your LDAP database goes down, nobody can authenticate except for root. 463 463 </p></li><li><p> … … 469 469 </p><p> 470 470 The following services authenticate using LDAP: 471 </p><a class="indexterm" name="id26001 30"></a><a class="indexterm" name="id2600136"></a><a class="indexterm" name="id2600143"></a><table class="simplelist" border="0" summary="Simple list"><tr><td><p>UNIX login/ssh</p></td></tr><tr><td><p>Postfix (SMTP)</p></td></tr><tr><td><p>Courier-IMAP/IMAPS/POP3/POP3S</p></td></tr></table><p>472 <a class="indexterm" name="id26001 72"></a>473 <a class="indexterm" name="id260017 9"></a>471 </p><a class="indexterm" name="id2600125"></a><a class="indexterm" name="id2600132"></a><a class="indexterm" name="id2600139"></a><table class="simplelist" border="0" summary="Simple list"><tr><td><p>UNIX login/ssh</p></td></tr><tr><td><p>Postfix (SMTP)</p></td></tr><tr><td><p>Courier-IMAP/IMAPS/POP3/POP3S</p></td></tr></table><p> 472 <a class="indexterm" name="id2600167"></a> 473 <a class="indexterm" name="id2600174"></a> 474 474 Companywide white pages can be searched using an LDAP client 475 475 such as the one in the Windows Address Book. 476 476 </p><p> 477 <a class="indexterm" name="id26001 91"></a>478 <a class="indexterm" name="id260019 8"></a>477 <a class="indexterm" name="id2600186"></a> 478 <a class="indexterm" name="id2600193"></a> 479 479 Having gained a solid understanding of LDAP and a relatively workable LDAP tree 480 480 thus far, it was time to configure Samba. I compiled the latest stable Samba and … … 483 483 </p><p> 484 484 The Samba <code class="filename">smb.conf</code> file was configured as shown in <a class="link" href="nw4migration.html#ch8smbconf" title="Example 10.4. Samba Configuration File smb.conf Part A">“Samba Configuration File smb.conf Part A”</a>. 485 </p><div class="example"><a name="ch8smbconf"></a><p class="title"><b>Example 10.4. Samba Configuration File smb.conf Part A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id260026 8"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id2600280"></a><em class="parameter"><code>netbios name = MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id2600291"></a><em class="parameter"><code>server string = Corp File Server</code></em></td></tr><tr><td><a class="indexterm" name="id2600303"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id2600316"></a><em class="parameter"><code>pam password change = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2600327"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2600339"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2600351"></a><em class="parameter"><code>log file = /data/samba/log/%m.log</code></em></td></tr><tr><td><a class="indexterm" name="id2600363"></a><em class="parameter"><code>name resolve order = wins host bcast</code></em></td></tr><tr><td><a class="indexterm" name="id2600375"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2600387"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2600398"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2600411"></a><em class="parameter"><code>cups options = Raw</code></em></td></tr><tr><td><a class="indexterm" name="id2600422"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id2600435"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd -p "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id2600447"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/smbldap-groupmod -m "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id2600460"></a><em class="parameter"><code>delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id2600473"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g "%g" "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id2600486"></a><em class="parameter"><code>add machine script = /usr/local/sbin/smbldap-useradd -w "%m"</code></em></td></tr><tr><td><a class="indexterm" name="id2600498"></a><em class="parameter"><code>logon script = logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2600510"></a><em class="parameter"><code>logon path = \\%L\profiles\%U\%a</code></em></td></tr><tr><td><a class="indexterm" name="id2600522"></a><em class="parameter"><code>logon drive = H:</code></em></td></tr><tr><td><a class="indexterm" name="id2600534"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2600546"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2600557"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2600569"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2600581"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2600593"></a><em class="parameter"><code>ldap idmap suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2600605"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2600617"></a><em class="parameter"><code>ldap passwd sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2600629"></a><em class="parameter"><code>ldap suffix = ou=MEGANET2,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2600641"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id2600653"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2600665"></a><em class="parameter"><code>admin users = root, "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id2600677"></a><em class="parameter"><code>printer admin = "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id2600689"></a><em class="parameter"><code>force printername = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch8smbconf2"></a><p class="title"><b>Example 10.5. Samba Configuration File smb.conf Part B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2600728"></a><em class="parameter"><code>comment = Network logon service</code></em></td></tr><tr><td><a class="indexterm" name="id2600740"></a><em class="parameter"><code>path = /data/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2600752"></a><em class="parameter"><code>write list = "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id2600764"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2600784"></a><em class="parameter"><code>comment = Roaming Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2600796"></a><em class="parameter"><code>path = /data/samba/profiles/</code></em></td></tr><tr><td><a class="indexterm" name="id2600808"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2600819"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2600831"></a><em class="parameter"><code>veto files = desktop.ini</code></em></td></tr><tr><td><a class="indexterm" name="id2600843"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2600863"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2600875"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2600887"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2600898"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td><a class="indexterm" name="id2600910"></a><em class="parameter"><code>veto files = desktop.ini</code></em></td></tr><tr><td><a class="indexterm" name="id2600922"></a><em class="parameter"><code>hide files = desktop.ini</code></em></td></tr><tr><td><a class="indexterm" name="id2600933"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[software]</code></em></td></tr><tr><td><a class="indexterm" name="id2600954"></a><em class="parameter"><code>comment = Software for %a computers</code></em></td></tr><tr><td><a class="indexterm" name="id2600966"></a><em class="parameter"><code>path = /data/samba/shares/software/%a</code></em></td></tr><tr><td><a class="indexterm" name="id2600978"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[public]</code></em></td></tr><tr><td><a class="indexterm" name="id2600998"></a><em class="parameter"><code>comment = Public Files</code></em></td></tr><tr><td><a class="indexterm" name="id2601010"></a><em class="parameter"><code>path = /data/samba/shares/public</code></em></td></tr><tr><td><a class="indexterm" name="id2601022"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2601034"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[PDF]</code></em></td></tr><tr><td><a class="indexterm" name="id2601054"></a><em class="parameter"><code>comment = Location of documents printed to PDFCreator printer</code></em></td></tr><tr><td><a class="indexterm" name="id2601066"></a><em class="parameter"><code>path = /data/samba/shares/pdf</code></em></td></tr><tr><td><a class="indexterm" name="id2601078"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch8smbconf3"></a><p class="title"><b>Example 10.6. Samba Configuration File smb.conf Part C</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[EVERYTHING]</code></em></td></tr><tr><td><a class="indexterm" name="id2601118"></a><em class="parameter"><code>comment = All shares</code></em></td></tr><tr><td><a class="indexterm" name="id2601129"></a><em class="parameter"><code>path = /data/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2601141"></a><em class="parameter"><code>valid users = "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id2601153"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[CDROM]</code></em></td></tr><tr><td><a class="indexterm" name="id2601173"></a><em class="parameter"><code>comment = CD-ROM on MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id2601185"></a><em class="parameter"><code>path = /mnt</code></em></td></tr><tr><td><a class="indexterm" name="id2601197"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id2601217"></a><em class="parameter"><code>comment = Printer Drivers Share</code></em></td></tr><tr><td><a class="indexterm" name="id2601229"></a><em class="parameter"><code>path = /data/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2601241"></a><em class="parameter"><code>write list = root</code></em></td></tr><tr><td><a class="indexterm" name="id2601252"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2601273"></a><em class="parameter"><code>comment = All Printers</code></em></td></tr><tr><td><a class="indexterm" name="id2601285"></a><em class="parameter"><code>path = /data/samba/spool</code></em></td></tr><tr><td><a class="indexterm" name="id2601296"></a><em class="parameter"><code>create mask = 0644</code></em></td></tr><tr><td><a class="indexterm" name="id2601308"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2601320"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[acct_hp8500]</code></em></td></tr><tr><td><a class="indexterm" name="id2601340"></a><em class="parameter"><code>comment = "Accounting Color Laser Printer"</code></em></td></tr><tr><td><a class="indexterm" name="id2601352"></a><em class="parameter"><code>path = /data/samba/spool/private</code></em></td></tr><tr><td><a class="indexterm" name="id2601364"></a><em class="parameter"><code>valid users = @acct, @acct_admin, @hr, "@Domain Admins",@Receptionist, dwayne, terri, danae, jerry</code></em></td></tr><tr><td><a class="indexterm" name="id2601377"></a><em class="parameter"><code>create mask = 0644</code></em></td></tr><tr><td><a class="indexterm" name="id2601389"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2601400"></a><em class="parameter"><code>copy = printers</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[plotter]</code></em></td></tr><tr><td><a class="indexterm" name="id2601421"></a><em class="parameter"><code>comment = Engineering Plotter</code></em></td></tr><tr><td><a class="indexterm" name="id2601433"></a><em class="parameter"><code>path = /data/samba/spool</code></em></td></tr><tr><td><a class="indexterm" name="id2601444"></a><em class="parameter"><code>create mask = 0644</code></em></td></tr><tr><td><a class="indexterm" name="id2601456"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2601468"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2601479"></a><em class="parameter"><code>copy = printers</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch8smbconf4"></a><p class="title"><b>Example 10.7. Samba Configuration File smb.conf Part D</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[APPS]</code></em></td></tr><tr><td><a class="indexterm" name="id2601519"></a><em class="parameter"><code>path = /data/samba/shares/Apps</code></em></td></tr><tr><td><a class="indexterm" name="id2601530"></a><em class="parameter"><code>force group = "Domain Users"</code></em></td></tr><tr><td><a class="indexterm" name="id2601542"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[ACCT]</code></em></td></tr><tr><td><a class="indexterm" name="id2601563"></a><em class="parameter"><code>path = /data/samba/shares/Accounting</code></em></td></tr><tr><td><a class="indexterm" name="id2601575"></a><em class="parameter"><code>valid users = @acct, "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id2601587"></a><em class="parameter"><code>force group = acct</code></em></td></tr><tr><td><a class="indexterm" name="id2601598"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2601610"></a><em class="parameter"><code>create mask = 0660</code></em></td></tr><tr><td><a class="indexterm" name="id2601622"></a><em class="parameter"><code>directory mask = 0770</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[ACCT_ADMIN]</code></em></td></tr><tr><td><a class="indexterm" name="id2601643"></a><em class="parameter"><code>path = /data/samba/shares/Acct_Admin</code></em></td></tr><tr><td><a class="indexterm" name="id2601655"></a><em class="parameter"><code>valid users = @âacct_adminâ</code></em></td></tr><tr><td><a class="indexterm" name="id2601667"></a><em class="parameter"><code>force group = acct_admin</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[HR_PR]</code></em></td></tr><tr><td><a class="indexterm" name="id2601688"></a><em class="parameter"><code>path = /data/samba/shares/HR_PR</code></em></td></tr><tr><td><a class="indexterm" name="id2601700"></a><em class="parameter"><code>valid users = @hr, @acct_admin</code></em></td></tr><tr><td><a class="indexterm" name="id2601712"></a><em class="parameter"><code>force group = hr</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[ENGR]</code></em></td></tr><tr><td><a class="indexterm" name="id2601732"></a><em class="parameter"><code>path = /data/samba/shares/Engr</code></em></td></tr><tr><td><a class="indexterm" name="id2601744"></a><em class="parameter"><code>valid users = @engr, @receptionist, @truss, "@Domain Admins", cheri</code></em></td></tr><tr><td><a class="indexterm" name="id2601756"></a><em class="parameter"><code>force group = engr</code></em></td></tr><tr><td><a class="indexterm" name="id2601768"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2601780"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[DATA]</code></em></td></tr><tr><td><a class="indexterm" name="id2601800"></a><em class="parameter"><code>path = /data/samba/shares/DATA</code></em></td></tr><tr><td><a class="indexterm" name="id2601812"></a><em class="parameter"><code>valid users = @engr, @receptionist, @truss, "@Domain Admins", cheri</code></em></td></tr><tr><td><a class="indexterm" name="id2601824"></a><em class="parameter"><code>force group = engr</code></em></td></tr><tr><td><a class="indexterm" name="id2601836"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2601848"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td><a class="indexterm" name="id2601859"></a><em class="parameter"><code>copy = engr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch8smbconf5"></a><p class="title"><b>Example 10.8. Samba Configuration File smb.conf Part E</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[X]</code></em></td></tr><tr><td><a class="indexterm" name="id2601898"></a><em class="parameter"><code>path = /data/samba/shares/X</code></em></td></tr><tr><td><a class="indexterm" name="id2601910"></a><em class="parameter"><code>valid users = @engr, @acct</code></em></td></tr><tr><td><a class="indexterm" name="id2601921"></a><em class="parameter"><code>force group = engr</code></em></td></tr><tr><td><a class="indexterm" name="id2601933"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2601945"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td><a class="indexterm" name="id2601956"></a><em class="parameter"><code>copy = engr</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[NETWORK]</code></em></td></tr><tr><td><a class="indexterm" name="id2601977"></a><em class="parameter"><code>path = /data/samba/shares/network</code></em></td></tr><tr><td><a class="indexterm" name="id2601988"></a><em class="parameter"><code>valid users = "@Domain Users"</code></em></td></tr><tr><td><a class="indexterm" name="id2602000"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2602012"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td><a class="indexterm" name="id2602024"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[UTILS]</code></em></td></tr><tr><td><a class="indexterm" name="id2602044"></a><em class="parameter"><code>path = /data/samba/shares/Utils</code></em></td></tr><tr><td><a class="indexterm" name="id2602056"></a><em class="parameter"><code>write list = "@Domain Admins"</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[SYS]</code></em></td></tr><tr><td><a class="indexterm" name="id2602077"></a><em class="parameter"><code>path = /data/samba/shares/SYS</code></em></td></tr><tr><td><a class="indexterm" name="id2602089"></a><em class="parameter"><code>valid users = chad</code></em></td></tr><tr><td><a class="indexterm" name="id2602100"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2602112"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><p>486 <a class="indexterm" name="id260212 7"></a>487 <a class="indexterm" name="id26021 33"></a>488 <a class="indexterm" name="id26021 40"></a>485 </p><div class="example"><a name="ch8smbconf"></a><p class="title"><b>Example 10.4. Samba Configuration File smb.conf Part A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2600263"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id2600275"></a><em class="parameter"><code>netbios name = MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id2600287"></a><em class="parameter"><code>server string = Corp File Server</code></em></td></tr><tr><td><a class="indexterm" name="id2600299"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id2600311"></a><em class="parameter"><code>pam password change = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2600323"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2600335"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2600346"></a><em class="parameter"><code>log file = /data/samba/log/%m.log</code></em></td></tr><tr><td><a class="indexterm" name="id2600358"></a><em class="parameter"><code>name resolve order = wins host bcast</code></em></td></tr><tr><td><a class="indexterm" name="id2600370"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2600382"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2600394"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2600406"></a><em class="parameter"><code>cups options = Raw</code></em></td></tr><tr><td><a class="indexterm" name="id2600418"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id2600430"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd -p "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id2600443"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/smbldap-groupmod -m "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id2600455"></a><em class="parameter"><code>delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id2600468"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g "%g" "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id2600481"></a><em class="parameter"><code>add machine script = /usr/local/sbin/smbldap-useradd -w "%m"</code></em></td></tr><tr><td><a class="indexterm" name="id2600494"></a><em class="parameter"><code>logon script = logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2600506"></a><em class="parameter"><code>logon path = \\%L\profiles\%U\%a</code></em></td></tr><tr><td><a class="indexterm" name="id2600518"></a><em class="parameter"><code>logon drive = H:</code></em></td></tr><tr><td><a class="indexterm" name="id2600529"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2600541"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2600553"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2600564"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2600576"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2600588"></a><em class="parameter"><code>ldap idmap suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2600600"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2600612"></a><em class="parameter"><code>ldap passwd sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2600624"></a><em class="parameter"><code>ldap suffix = ou=MEGANET2,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2600636"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id2600648"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2600660"></a><em class="parameter"><code>admin users = root, "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id2600672"></a><em class="parameter"><code>printer admin = "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id2600684"></a><em class="parameter"><code>force printername = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch8smbconf2"></a><p class="title"><b>Example 10.5. Samba Configuration File smb.conf Part B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2600723"></a><em class="parameter"><code>comment = Network logon service</code></em></td></tr><tr><td><a class="indexterm" name="id2600735"></a><em class="parameter"><code>path = /data/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2600747"></a><em class="parameter"><code>write list = "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id2600759"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2600779"></a><em class="parameter"><code>comment = Roaming Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2600791"></a><em class="parameter"><code>path = /data/samba/profiles/</code></em></td></tr><tr><td><a class="indexterm" name="id2600803"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2600815"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2600826"></a><em class="parameter"><code>veto files = desktop.ini</code></em></td></tr><tr><td><a class="indexterm" name="id2600838"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2600859"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2600870"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2600882"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2600894"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td><a class="indexterm" name="id2600905"></a><em class="parameter"><code>veto files = desktop.ini</code></em></td></tr><tr><td><a class="indexterm" name="id2600917"></a><em class="parameter"><code>hide files = desktop.ini</code></em></td></tr><tr><td><a class="indexterm" name="id2600929"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[software]</code></em></td></tr><tr><td><a class="indexterm" name="id2600949"></a><em class="parameter"><code>comment = Software for %a computers</code></em></td></tr><tr><td><a class="indexterm" name="id2600961"></a><em class="parameter"><code>path = /data/samba/shares/software/%a</code></em></td></tr><tr><td><a class="indexterm" name="id2600973"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[public]</code></em></td></tr><tr><td><a class="indexterm" name="id2600994"></a><em class="parameter"><code>comment = Public Files</code></em></td></tr><tr><td><a class="indexterm" name="id2601005"></a><em class="parameter"><code>path = /data/samba/shares/public</code></em></td></tr><tr><td><a class="indexterm" name="id2601017"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2601029"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[PDF]</code></em></td></tr><tr><td><a class="indexterm" name="id2601049"></a><em class="parameter"><code>comment = Location of documents printed to PDFCreator printer</code></em></td></tr><tr><td><a class="indexterm" name="id2601062"></a><em class="parameter"><code>path = /data/samba/shares/pdf</code></em></td></tr><tr><td><a class="indexterm" name="id2601074"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch8smbconf3"></a><p class="title"><b>Example 10.6. Samba Configuration File smb.conf Part C</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[EVERYTHING]</code></em></td></tr><tr><td><a class="indexterm" name="id2601113"></a><em class="parameter"><code>comment = All shares</code></em></td></tr><tr><td><a class="indexterm" name="id2601125"></a><em class="parameter"><code>path = /data/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2601136"></a><em class="parameter"><code>valid users = "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id2601148"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[CDROM]</code></em></td></tr><tr><td><a class="indexterm" name="id2601169"></a><em class="parameter"><code>comment = CD-ROM on MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id2601180"></a><em class="parameter"><code>path = /mnt</code></em></td></tr><tr><td><a class="indexterm" name="id2601192"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id2601212"></a><em class="parameter"><code>comment = Printer Drivers Share</code></em></td></tr><tr><td><a class="indexterm" name="id2601224"></a><em class="parameter"><code>path = /data/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2601236"></a><em class="parameter"><code>write list = root</code></em></td></tr><tr><td><a class="indexterm" name="id2601248"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2601268"></a><em class="parameter"><code>comment = All Printers</code></em></td></tr><tr><td><a class="indexterm" name="id2601280"></a><em class="parameter"><code>path = /data/samba/spool</code></em></td></tr><tr><td><a class="indexterm" name="id2601292"></a><em class="parameter"><code>create mask = 0644</code></em></td></tr><tr><td><a class="indexterm" name="id2601303"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2601315"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[acct_hp8500]</code></em></td></tr><tr><td><a class="indexterm" name="id2601336"></a><em class="parameter"><code>comment = "Accounting Color Laser Printer"</code></em></td></tr><tr><td><a class="indexterm" name="id2601348"></a><em class="parameter"><code>path = /data/samba/spool/private</code></em></td></tr><tr><td><a class="indexterm" name="id2601359"></a><em class="parameter"><code>valid users = @acct, @acct_admin, @hr, "@Domain Admins",@Receptionist, dwayne, terri, danae, jerry</code></em></td></tr><tr><td><a class="indexterm" name="id2601372"></a><em class="parameter"><code>create mask = 0644</code></em></td></tr><tr><td><a class="indexterm" name="id2601384"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2601396"></a><em class="parameter"><code>copy = printers</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[plotter]</code></em></td></tr><tr><td><a class="indexterm" name="id2601416"></a><em class="parameter"><code>comment = Engineering Plotter</code></em></td></tr><tr><td><a class="indexterm" name="id2601428"></a><em class="parameter"><code>path = /data/samba/spool</code></em></td></tr><tr><td><a class="indexterm" name="id2601440"></a><em class="parameter"><code>create mask = 0644</code></em></td></tr><tr><td><a class="indexterm" name="id2601451"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2601463"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2601475"></a><em class="parameter"><code>copy = printers</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch8smbconf4"></a><p class="title"><b>Example 10.7. Samba Configuration File smb.conf Part D</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[APPS]</code></em></td></tr><tr><td><a class="indexterm" name="id2601514"></a><em class="parameter"><code>path = /data/samba/shares/Apps</code></em></td></tr><tr><td><a class="indexterm" name="id2601526"></a><em class="parameter"><code>force group = "Domain Users"</code></em></td></tr><tr><td><a class="indexterm" name="id2601538"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[ACCT]</code></em></td></tr><tr><td><a class="indexterm" name="id2601558"></a><em class="parameter"><code>path = /data/samba/shares/Accounting</code></em></td></tr><tr><td><a class="indexterm" name="id2601570"></a><em class="parameter"><code>valid users = @acct, "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id2601582"></a><em class="parameter"><code>force group = acct</code></em></td></tr><tr><td><a class="indexterm" name="id2601594"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2601605"></a><em class="parameter"><code>create mask = 0660</code></em></td></tr><tr><td><a class="indexterm" name="id2601617"></a><em class="parameter"><code>directory mask = 0770</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[ACCT_ADMIN]</code></em></td></tr><tr><td><a class="indexterm" name="id2601638"></a><em class="parameter"><code>path = /data/samba/shares/Acct_Admin</code></em></td></tr><tr><td><a class="indexterm" name="id2601650"></a><em class="parameter"><code>valid users = @âacct_adminâ</code></em></td></tr><tr><td><a class="indexterm" name="id2601662"></a><em class="parameter"><code>force group = acct_admin</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[HR_PR]</code></em></td></tr><tr><td><a class="indexterm" name="id2601683"></a><em class="parameter"><code>path = /data/samba/shares/HR_PR</code></em></td></tr><tr><td><a class="indexterm" name="id2601695"></a><em class="parameter"><code>valid users = @hr, @acct_admin</code></em></td></tr><tr><td><a class="indexterm" name="id2601707"></a><em class="parameter"><code>force group = hr</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[ENGR]</code></em></td></tr><tr><td><a class="indexterm" name="id2601727"></a><em class="parameter"><code>path = /data/samba/shares/Engr</code></em></td></tr><tr><td><a class="indexterm" name="id2601739"></a><em class="parameter"><code>valid users = @engr, @receptionist, @truss, "@Domain Admins", cheri</code></em></td></tr><tr><td><a class="indexterm" name="id2601752"></a><em class="parameter"><code>force group = engr</code></em></td></tr><tr><td><a class="indexterm" name="id2601763"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2601775"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[DATA]</code></em></td></tr><tr><td><a class="indexterm" name="id2601795"></a><em class="parameter"><code>path = /data/samba/shares/DATA</code></em></td></tr><tr><td><a class="indexterm" name="id2601807"></a><em class="parameter"><code>valid users = @engr, @receptionist, @truss, "@Domain Admins", cheri</code></em></td></tr><tr><td><a class="indexterm" name="id2601820"></a><em class="parameter"><code>force group = engr</code></em></td></tr><tr><td><a class="indexterm" name="id2601831"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2601843"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td><a class="indexterm" name="id2601854"></a><em class="parameter"><code>copy = engr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch8smbconf5"></a><p class="title"><b>Example 10.8. Samba Configuration File smb.conf Part E</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[X]</code></em></td></tr><tr><td><a class="indexterm" name="id2601893"></a><em class="parameter"><code>path = /data/samba/shares/X</code></em></td></tr><tr><td><a class="indexterm" name="id2601905"></a><em class="parameter"><code>valid users = @engr, @acct</code></em></td></tr><tr><td><a class="indexterm" name="id2601917"></a><em class="parameter"><code>force group = engr</code></em></td></tr><tr><td><a class="indexterm" name="id2601928"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2601940"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td><a class="indexterm" name="id2601952"></a><em class="parameter"><code>copy = engr</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[NETWORK]</code></em></td></tr><tr><td><a class="indexterm" name="id2601972"></a><em class="parameter"><code>path = /data/samba/shares/network</code></em></td></tr><tr><td><a class="indexterm" name="id2601984"></a><em class="parameter"><code>valid users = "@Domain Users"</code></em></td></tr><tr><td><a class="indexterm" name="id2601996"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2602007"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td><a class="indexterm" name="id2602019"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[UTILS]</code></em></td></tr><tr><td><a class="indexterm" name="id2602039"></a><em class="parameter"><code>path = /data/samba/shares/Utils</code></em></td></tr><tr><td><a class="indexterm" name="id2602051"></a><em class="parameter"><code>write list = "@Domain Admins"</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[SYS]</code></em></td></tr><tr><td><a class="indexterm" name="id2602072"></a><em class="parameter"><code>path = /data/samba/shares/SYS</code></em></td></tr><tr><td><a class="indexterm" name="id2602084"></a><em class="parameter"><code>valid users = chad</code></em></td></tr><tr><td><a class="indexterm" name="id2602096"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2602107"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><p> 486 <a class="indexterm" name="id2602122"></a> 487 <a class="indexterm" name="id2602129"></a> 488 <a class="indexterm" name="id2602136"></a> 489 489 Most of these shares are only used by one company group, but they are required 490 490 because of some ancient Qbasic and Rbase applications were that written expecting 491 491 their own drive letters. 492 492 </p><p> 493 <a class="indexterm" name="id26021 54"></a>494 <a class="indexterm" name="id26021 60"></a>495 <a class="indexterm" name="id260216 7"></a>493 <a class="indexterm" name="id2602149"></a> 494 <a class="indexterm" name="id2602156"></a> 495 <a class="indexterm" name="id2602163"></a> 496 496 Note: During the process of building the new server, I kept data files 497 497 up to date with the Novell server via use of <code class="literal">rsync</code>. … … 740 740 smbpasswd="/usr/bin/smbpasswd" 741 741 </pre></div></div><br class="example-break"><p> 742 <a class="indexterm" name="id260262 9"></a>742 <a class="indexterm" name="id2602625"></a> 743 743 Note: I chose not to take advantage of the TLS capability of this. 744 744 Eventually I may go back and tweak it. Also, I chose not to take advantage … … 814 814 </pre><p> 815 815 </p><p> 816 <a class="indexterm" name="id26027 30"></a>817 <a class="indexterm" name="id260273 7"></a>818 <a class="indexterm" name="id26027 44"></a>819 <a class="indexterm" name="id26027 50"></a>820 <a class="indexterm" name="id260275 7"></a>816 <a class="indexterm" name="id2602725"></a> 817 <a class="indexterm" name="id2602732"></a> 818 <a class="indexterm" name="id2602739"></a> 819 <a class="indexterm" name="id2602746"></a> 820 <a class="indexterm" name="id2602752"></a> 821 821 With the LDAP directory now initialized, it was time to create the Windows and POSIX 822 822 (UNIX) group accounts as well as the mappings from Windows groups to UNIX groups. … … 826 826 try to do this by hand. 827 827 </p><p> 828 <a class="indexterm" name="id26027 80"></a>829 <a class="indexterm" name="id260278 7"></a>830 <a class="indexterm" name="id26027 94"></a>828 <a class="indexterm" name="id2602775"></a> 829 <a class="indexterm" name="id2602782"></a> 830 <a class="indexterm" name="id2602789"></a> 831 831 After I had my group mappings in place, I added users to the groups (the users 832 832 don't really have to exist yet). I used the <code class="literal">smbldap-groupmod</code> … … 834 834 attributes to the group entries in LDAP. 835 835 </p><p> 836 <a class="indexterm" name="id26028 14"></a>837 <a class="indexterm" name="id26028 21"></a>838 <a class="indexterm" name="id260282 8"></a>836 <a class="indexterm" name="id2602809"></a> 837 <a class="indexterm" name="id2602816"></a> 838 <a class="indexterm" name="id2602823"></a> 839 839 The most monumental task of all was adding the sambaSamAccount information to each 840 840 already existent posixAccount entry. I did it one at a time as I moved people onto … … 843 843 <code class="prompt">root# </code> smbldap-usermod -a -P username 844 844 </pre><p> 845 <a class="indexterm" name="id26028 50"></a>846 <a class="indexterm" name="id260285 7"></a>847 <a class="indexterm" name="id26028 64"></a>845 <a class="indexterm" name="id2602846"></a> 846 <a class="indexterm" name="id2602853"></a> 847 <a class="indexterm" name="id2602859"></a> 848 848 I completed that step for every user after asking the person what his or her current 849 849 NetWare password was. The wiser way to have done it would probably have been to dump the … … 852 852 <code class="prompt">root# </code> slapcat > somefile.ldif 853 853 </pre><p> 854 <a class="indexterm" name="id260288 8"></a>855 <a class="indexterm" name="id260289 4"></a>854 <a class="indexterm" name="id2602883"></a> 855 <a class="indexterm" name="id2602890"></a> 856 856 Then update the LDIF file created by using a Perl script to parse and add the 857 857 appropriate attributes and objectClasses to each entry, followed by re-importing … … 934 934 </pre><p> 935 935 </p><p> 936 <a class="indexterm" name="id26030 10"></a>936 <a class="indexterm" name="id2603005"></a> 937 937 So now I could log on with a test user from the machine w2kengrspare. It was all well and 938 938 good, but that user was in no groups yet and so had pretty boring access. I fixed that … … 943 943 I also did not have to do a logon script per user or per group. 944 944 </p><p> 945 <a class="indexterm" name="id260303 4"></a>945 <a class="indexterm" name="id2603030"></a> 946 946 I downloaded Kixtart and put the following files in my netlogon share: 947 947 </p><pre class="screen"> … … 955 955 </pre><p> 956 956 </p><p> 957 <a class="indexterm" name="id260306 5"></a>957 <a class="indexterm" name="id2603061"></a> 958 958 I then wrote the <code class="filename">logon.kix</code> file that is shown in 959 959 <a class="link" href="nw4migration.html#ch8kix" title="Example 10.15. Kixtart Control File File: logon.kix">“Kixtart Control File File: logon.kix”</a>. I chose to keep it all in one file, but it … … 1138 1138 so it was easier to do it by hand. 1139 1139 </p><p> 1140 <a class="indexterm" name="id26033 62"></a>1140 <a class="indexterm" name="id2603357"></a> 1141 1141 At this point I was able to add the users. This is the part that really falls 1142 1142 into upgrade. I moved the users over one group at a time, starting with the -
branches/samba-3.2.x/docs/htmldocs/Samba3-ByExample/pr01.html
r204 r226 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>About the Cover Artwork</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="index.html" title="Samba-3 by Example"><link rel="next" href="pr02.html" title="Acknowledgments"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">About the Cover Artwork</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="index.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="pr02.html">Next</a></td></tr></table><hr></div><div class="preface" lang="en-US"><div class="titlepage"><div><div><h2 class="title"><a name="id253264 6"></a>About the Cover Artwork</h2></div></div></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>About the Cover Artwork</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="index.html" title="Samba-3 by Example"><link rel="next" href="pr02.html" title="Acknowledgments"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">About the Cover Artwork</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="index.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="pr02.html">Next</a></td></tr></table><hr></div><div class="preface" lang="en-US"><div class="titlepage"><div><div><h2 class="title"><a name="id2532643"></a>About the Cover Artwork</h2></div></div></div><p> 2 2 The cover artwork of this book continues the freedom theme of the first 3 3 edition of “<span class="quote">Samba-3 by Example</span>”. The history of civilization -
branches/samba-3.2.x/docs/htmldocs/Samba3-ByExample/pr02.html
r204 r226 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Acknowledgments</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="pr01.html" title="About the Cover Artwork"><link rel="next" href="pr03.html" title="Foreword"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Acknowledgments</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="pr01.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="pr03.html">Next</a></td></tr></table><hr></div><div class="preface" lang="en-US"><div class="titlepage"><div><div><h2 class="title"><a name="id24957 91"></a>Acknowledgments</h2></div></div></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Acknowledgments</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="pr01.html" title="About the Cover Artwork"><link rel="next" href="pr03.html" title="Foreword"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Acknowledgments</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="pr01.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="pr03.html">Next</a></td></tr></table><hr></div><div class="preface" lang="en-US"><div class="titlepage"><div><div><h2 class="title"><a name="id2495784"></a>Acknowledgments</h2></div></div></div><p> 2 2 <span class="emphasis"><em>Samba-3 by Example</em></span> would not have been written except 3 3 as a result of feedback provided by reviewers and readers of the book <span class="emphasis"><em>The -
branches/samba-3.2.x/docs/htmldocs/Samba3-ByExample/pr03.html
r204 r226 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Foreword</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="pr02.html" title="Acknowledgments"><link rel="next" href="preface.html" title="Preface"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Foreword</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="pr02.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="preface.html">Next</a></td></tr></table><hr></div><div class="preface" lang="en-US"><div class="titlepage"><div><div><h2 class="title"><a name="id24958 90"></a>Foreword</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="pr03.html#id2495898">By John M. Weathersby, Executive Director, OSSI</a></span></dt></dl></div><div class="sect1" lang="en-US"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2495898"></a>By John M. Weathersby, Executive Director, OSSI</h2></div></div></div><div class="blockquote"><blockquote class="blockquote"><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Foreword</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="pr02.html" title="Acknowledgments"><link rel="next" href="preface.html" title="Preface"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Foreword</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="pr02.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="preface.html">Next</a></td></tr></table><hr></div><div class="preface" lang="en-US"><div class="titlepage"><div><div><h2 class="title"><a name="id2495883"></a>Foreword</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="pr03.html#id2495890">By John M. Weathersby, Executive Director, OSSI</a></span></dt></dl></div><div class="sect1" lang="en-US"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2495890"></a>By John M. Weathersby, Executive Director, OSSI</h2></div></div></div><div class="blockquote"><blockquote class="blockquote"><p> 2 2 The Open Source Software Institute (OSSI) is comprised of representatives from a broad spectrum of business and 3 3 non-business organizations that share a common interest in the promotion of development and implementation -
branches/samba-3.2.x/docs/htmldocs/Samba3-ByExample/preface.html
r204 r226 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Preface</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="pr03.html" title="Foreword"><link rel="next" href="ExNetworks.html" title="Part I. Example Network Configurations"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Preface</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="pr03.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="ExNetworks.html">Next</a></td></tr></table><hr></div><div class="preface" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="preface"></a>Preface</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="preface.html#id24960 86">Why Is This Book Necessary?</a></span></dt><dd><dl><dt><span class="sect2"><a href="preface.html#id2494873">Samba 3.0.20 Update Edition</a></span></dt></dl></dd><dt><span class="sect1"><a href="preface.html#id2494769">Prerequisites</a></span></dt><dt><span class="sect1"><a href="preface.html#id2494801">Approach</a></span></dt><dt><span class="sect1"><a href="preface.html#id2542046">Summary of Topics</a></span></dt><dt><span class="sect1"><a href="preface.html#id2542784">Conventions Used</a></span></dt></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Preface</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="pr03.html" title="Foreword"><link rel="next" href="ExNetworks.html" title="Part I. Example Network Configurations"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Preface</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="pr03.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="ExNetworks.html">Next</a></td></tr></table><hr></div><div class="preface" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="preface"></a>Preface</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="preface.html#id2496079">Why Is This Book Necessary?</a></span></dt><dd><dl><dt><span class="sect2"><a href="preface.html#id2494865">Samba 3.0.20 Update Edition</a></span></dt></dl></dd><dt><span class="sect1"><a href="preface.html#id2494761">Prerequisites</a></span></dt><dt><span class="sect1"><a href="preface.html#id2494793">Approach</a></span></dt><dt><span class="sect1"><a href="preface.html#id2542043">Summary of Topics</a></span></dt><dt><span class="sect1"><a href="preface.html#id2542780">Conventions Used</a></span></dt></dl></div><p> 2 2 Network administrators live busy lives. We face distractions and pressures 3 3 that drive us to seek proven, working case scenarios that can be easily … … 34 34 services and applications such as OpenLDAP, DNS and DHCP, the need for which 35 35 can be met from other resources that are dedicated to the subject. 36 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id24960 86"></a>Why Is This Book Necessary?</h2></div></div></div><p>36 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2496079"></a>Why Is This Book Necessary?</h2></div></div></div><p> 37 37 This book is the result of observations and feedback. The feedback from 38 38 the Samba-HOWTO-Collection has been positive and complimentary. There … … 54 54 on the CD-ROM. This book is descriptive, provides detailed diagrams, and 55 55 makes deployment of Samba-3 a breeze. 56 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id24948 73"></a>Samba 3.0.20 Update Edition</h3></div></div></div><p>56 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2494865"></a>Samba 3.0.20 Update Edition</h3></div></div></div><p> 57 57 The Samba 3.0.x series has been remarkably popular. At the time this book first 58 58 went to print samba-3.0.2 was being released. There have been significant modifications … … 127 127 be delegated to normal user accounts or to groups of users. 128 128 </p> 129 </td></tr></tbody></table></div></div><br class="table-break"></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id249476 9"></a>Prerequisites</h2></div></div></div><p>129 </td></tr></tbody></table></div></div><br class="table-break"></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2494761"></a>Prerequisites</h2></div></div></div><p> 130 130 This book is not a tutorial on UNIX or Linux administration. UNIX and Linux 131 131 training is best obtained from books dedicated to the subject. This book … … 140 140 may need to refer to administrative guides or manuals for your operating system 141 141 platform to find what is the best method to achieve what the text of this book describes. 142 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2494 801"></a>Approach</h2></div></div></div><p>142 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2494793"></a>Approach</h2></div></div></div><p> 143 143 The first chapter deals with some rather thorny network analysis issues. Do not be 144 144 put off by this. The information you glean, even without a detailed understanding … … 168 168 Each chapter has a set of questions and answers to help you to 169 169 to understand and digest key attributes of the solutions presented. 170 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id254204 6"></a>Summary of Topics</h2></div></div></div><p>170 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2542043"></a>Summary of Topics</h2></div></div></div><p> 171 171 The contents of this second edition of <span class="emphasis"><em>Samba-3 by Example</em></span> 172 172 have been rearranged based on feedback from purchasers of the first edition. … … 365 365 a file and print server to create a connection over which file and print 366 366 operations may take place. 367 </p></dd></dl></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id254278 4"></a>Conventions Used</h2></div></div></div><p>367 </p></dd></dl></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2542780"></a>Conventions Used</h2></div></div></div><p> 368 368 The following notation conventions are used throughout this book: 369 369 </p><div class="itemizedlist"><ul type="disc"><li><p> -
branches/samba-3.2.x/docs/htmldocs/Samba3-ByExample/primer.html
r204 r226 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 16. Networking Primer</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits"><link rel="next" href="apa.html" title="Appendix A. GNU General Public License version 3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 16. Networking Primer</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="appendix.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="apa.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="primer"></a>Chapter 16. Networking Primer</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="primer.html#id261850 7">Requirements and Notes</a></span></dt><dt><span class="sect1"><a href="primer.html#id2618669">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id2618729">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#id2618846">Exercises</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id2618972">Single-Machine Broadcast Activity</a></span></dt><dt><span class="sect2"><a href="primer.html#secondmachine">Second Machine Startup Broadcast Interaction</a></span></dt><dt><span class="sect2"><a href="primer.html#id2620118">Simple Windows Client Connection Characteristics</a></span></dt><dt><span class="sect2"><a href="primer.html#id2620620">Windows 200x/XP Client Interaction with Samba-3</a></span></dt><dt><span class="sect2"><a href="primer.html#id2621188">Conclusions to Exercises</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01conc">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id2621302">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01qa">Questions and Answers</a></span></dt></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 16. Networking Primer</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits"><link rel="next" href="apa.html" title="Appendix A. GNU General Public License version 3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 16. Networking Primer</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="appendix.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="apa.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="primer"></a>Chapter 16. Networking Primer</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="primer.html#id2618502">Requirements and Notes</a></span></dt><dt><span class="sect1"><a href="primer.html#id2618664">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id2618724">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#id2618841">Exercises</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id2618968">Single-Machine Broadcast Activity</a></span></dt><dt><span class="sect2"><a href="primer.html#secondmachine">Second Machine Startup Broadcast Interaction</a></span></dt><dt><span class="sect2"><a href="primer.html#id2620113">Simple Windows Client Connection Characteristics</a></span></dt><dt><span class="sect2"><a href="primer.html#id2620615">Windows 200x/XP Client Interaction with Samba-3</a></span></dt><dt><span class="sect2"><a href="primer.html#id2621183">Conclusions to Exercises</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01conc">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id2621297">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01qa">Questions and Answers</a></span></dt></dl></div><p> 2 2 You are about to use the equivalent of a microscope to look at the information 3 3 that runs through the veins of a Windows network. We do more to observe the information than … … 9 9 Samba can be configured with a minimum of complexity. Simplicity should be mastered 10 10 before you get too deeply into complexities. Let's get moving: we have work to do. 11 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id261850 7"></a>Requirements and Notes</h2></div></div></div><p>11 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2618502"></a>Requirements and Notes</h2></div></div></div><p> 12 12 Successful completion of this primer requires two Microsoft Windows 9x/Me Workstations 13 13 as well as two Microsoft Windows XP Professional Workstations, each equipped with an Ethernet … … 17 17 on a quiet network where there is no other traffic. It is best to use a dedicated hub 18 18 with only the machines under test connected at the time of the exercises. 19 </p><p><a class="indexterm" name="id261852 7"></a>19 </p><p><a class="indexterm" name="id2618523"></a> 20 20 Wireshark (formerly Ethereal) has become the network protocol analyzer of choice for many network administrators. 21 21 You may find more information regarding this tool from the … … 37 37 that is used to monitor traffic; this would not allow you to complete the projects. 38 38 </p></div><p> 39 <a class="indexterm" name="id261859 7"></a>39 <a class="indexterm" name="id2618592"></a> 40 40 Do not worry too much if you do not have access to all this equipment; network captures 41 41 from the exercises are provided on the enclosed CD-ROM. This makes it possible to dive directly 42 42 into the analytical part of the exercises if you so desire. 43 </p><p><a class="indexterm" name="id26186 13"></a><a class="indexterm" name="id2618624"></a>43 </p><p><a class="indexterm" name="id2618608"></a><a class="indexterm" name="id2618619"></a> 44 44 Please do not be alarmed at the use of a high-powered analysis tool (Wireshark) in this 45 45 primer. We expose you only to a minimum of detail necessary to complete … … 55 55 <a class="link" href="primer.html#chap01qa" title="Questions and Answers">“Questions and Answers”</a> also provides useful information 56 56 that may help you to avoid significantly time-consuming networking problems. 57 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id261866 9"></a>Introduction</h2></div></div></div><p>57 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2618664"></a>Introduction</h2></div></div></div><p> 58 58 The purpose of this chapter is to create familiarity with key aspects of Microsoft Windows 59 59 network computing. If you want a solid technical grounding, do not gloss over these exercises. 60 60 The points covered are recurrent issues on the Samba mailing lists. 61 </p><p><a class="indexterm" name="id26186 83"></a>61 </p><p><a class="indexterm" name="id2618678"></a> 62 62 You can see from these exercises that Windows networking involves quite a lot of network 63 63 broadcast traffic. You can look into the contents of some packets, but only to see … … 75 75 Edition</em></span> (TOSHARG2) Chapter 9, “<span class="quote">Network Browsing,</span>” and Chapter 3, 76 76 “<span class="quote">Server Types and Security Modes.</span>” 77 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id261872 9"></a>Assignment Tasks</h3></div></div></div><p><a class="indexterm" name="id2618736"></a>77 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2618724"></a>Assignment Tasks</h3></div></div></div><p><a class="indexterm" name="id2618731"></a> 78 78 You are about to witness how Microsoft Windows computer networking functions. The 79 79 exercises step through identification of how a client machine establishes a … … 81 81 each other (i.e., how browsing works) and how the two key types of user identification 82 82 (share mode security and user mode security) are affected. 83 </p><p><a class="indexterm" name="id26187 54"></a>83 </p><p><a class="indexterm" name="id2618749"></a> 84 84 The networking protocols used by MS Windows networking when working with Samba 85 85 use TCP/IP as the transport protocol. The protocols that are specific to Windows 86 86 networking are encapsulated in TCP/IP. The network analyzer we use (Wireshark) 87 87 is able to show you the contents of the TCP/IP packets (or messages). 88 </p><div class="procedure"><a name="chap01tasks"></a><p class="title"><b>Procedure 16.1. Diagnostic Tasks</b></p><ol type="1"><li><p><a class="indexterm" name="id261878 7"></a><a class="indexterm" name="id2618798"></a><a class="indexterm" name="id2618806"></a>88 </p><div class="procedure"><a name="chap01tasks"></a><p class="title"><b>Procedure 16.1. Diagnostic Tasks</b></p><ol type="1"><li><p><a class="indexterm" name="id2618782"></a><a class="indexterm" name="id2618793"></a><a class="indexterm" name="id2618801"></a> 89 89 Examine network traces to witness SMB broadcasts, host announcements, 90 90 and name resolution processes. … … 96 96 Review traces of network logons for a Windows 9x/Me client as well as 97 97 a domain logon for a Windows XP Professional client. 98 </p></li></ol></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id261884 6"></a>Exercises</h2></div></div></div><p>99 <a class="indexterm" name="id26188 54"></a>98 </p></li></ol></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2618841"></a>Exercises</h2></div></div></div><p> 99 <a class="indexterm" name="id2618849"></a> 100 100 You are embarking on a course of discovery. The first part of the exercise requires 101 101 two MS Windows 9x/Me systems. We called one machine <code class="constant">WINEPRESSME</code> and the … … 112 112 Choose a workgroup name (MIDEARTH) for each exercise. 113 113 </p><p> 114 <a class="indexterm" name="id26189 43"></a>114 <a class="indexterm" name="id2618939"></a> 115 115 The network captures provided on the CD-ROM included with this book were captured using <code class="constant">Ethereal</code> 116 116 version <code class="literal">0.10.6</code>. A later version suffices without problems (i.e. you should be using Wireshark), but an earlier version may not … … 120 120 that can be derived from this book really does warrant your taking sufficient time to practice each exercise with 121 121 care and attention to detail. 122 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id26189 72"></a>Single-Machine Broadcast Activity</h3></div></div></div><p>122 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2618968"></a>Single-Machine Broadcast Activity</h3></div></div></div><p> 123 123 In this section, we start a single Windows 9x/Me machine, then monitor network activity for 30 minutes. 124 </p><div class="procedure"><a name="id26189 83"></a><p class="title"><b>Procedure 16.2. Monitoring Windows 9x Steps</b></p><ol type="1"><li><p>124 </p><div class="procedure"><a name="id2618979"></a><p class="title"><b>Procedure 16.2. Monitoring Windows 9x Steps</b></p><ol type="1"><li><p> 125 125 Start the machine from which network activity will be monitored (using <code class="literal">Wireshark</code>). 126 126 Launch <code class="literal">Wireshark</code>, click … … 139 139 Analyze the capture. Identify each discrete message type that was captured. Note what transport protocol 140 140 was used. Identify the timing between messages of identical types. 141 </p></li></ol></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id261910 6"></a>Findings</h4></div></div></div><p>141 </p></li></ol></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2619102"></a>Findings</h4></div></div></div><p> 142 142 The summary of the first 10 minutes of the packet capture should look like <a class="link" href="primer.html#pktcap01" title="Figure 16.1. Windows Me Broadcasts The First 10 Minutes">“Windows Me Broadcasts The First 10 Minutes”</a>. 143 143 A screenshot of a later stage of the same capture is shown in <a class="link" href="primer.html#pktcap02" title="Figure 16.2. Windows Me Later Broadcast Sample">“Windows Me Later Broadcast Sample”</a>. 144 </p><div class="figure"><a name="pktcap01"></a><p class="title"><b>Figure 16.1. Windows Me Broadcasts The First 10 Minutes</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/WINREPRESSME-Capture.png" width="216" alt="Windows Me Broadcasts The First 10 Minutes"></div></div></div><br class="figure-break"><div class="figure"><a name="pktcap02"></a><p class="title"><b>Figure 16.2. Windows Me Later Broadcast Sample</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/WINREPRESSME-Capture2.png" width="226.8" alt="Windows Me Later Broadcast Sample"></div></div></div><br class="figure-break"><p><a class="indexterm" name="id26192 23"></a><a class="indexterm" name="id2619235"></a>144 </p><div class="figure"><a name="pktcap01"></a><p class="title"><b>Figure 16.1. Windows Me Broadcasts The First 10 Minutes</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/WINREPRESSME-Capture.png" width="216" alt="Windows Me Broadcasts The First 10 Minutes"></div></div></div><br class="figure-break"><div class="figure"><a name="pktcap02"></a><p class="title"><b>Figure 16.2. Windows Me Later Broadcast Sample</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/WINREPRESSME-Capture2.png" width="226.8" alt="Windows Me Later Broadcast Sample"></div></div></div><br class="figure-break"><p><a class="indexterm" name="id2619219"></a><a class="indexterm" name="id2619230"></a> 145 145 Broadcast messages observed are shown in <a class="link" href="primer.html#capsstats01" title="Table 16.1. Windows Me Startup Broadcast Capture Statistics">“Windows Me Startup Broadcast Capture Statistics”</a>. 146 146 Actual observations vary a little, but not by much. … … 148 148 first to ensure that its name would not result in a name clash, and second to establish its 149 149 presence with the Local Master Browser (LMB). 150 </p><div class="table"><a name="capsstats01"></a><p class="title"><b>Table 16.1. Windows Me Startup Broadcast Capture Statistics</b></p><div class="table-contents"><table summary="Windows Me Startup Broadcast Capture Statistics" border="1"><colgroup><col align="left"><col align="center"><col align="center"><col align="left"></colgroup><thead><tr><th align="left">Message</th><th align="center">Type</th><th align="center">Num</th><th align="left">Notes</th></tr></thead><tbody><tr><td align="left">WINEPRESSME<00></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.6 sec apart</td></tr><tr><td align="left">WINEPRESSME<03></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.6 sec apart</td></tr><tr><td align="left">WINEPRESSME<20></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<00></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1d></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1e></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1b></td><td align="center">Qry</td><td align="center">84</td><td align="left">300 sec apart at stable operation</td></tr><tr><td align="left">__MSBROWSE__</td><td align="center">Reg</td><td align="center">8</td><td align="left">Registered after winning election to Browse Master</td></tr><tr><td align="left">JHT<03></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 x 2. This is the name of the user that logged onto Windows</td></tr><tr><td align="left">Host Announcement WINEPRESSME</td><td align="center">Ann</td><td align="center">2</td><td align="left">Observed at 10 sec</td></tr><tr><td align="left">Domain/Workgroup Announcement MIDEARTH</td><td align="center">Ann</td><td align="center">18</td><td align="left">300 sec apart at stable operation</td></tr><tr><td align="left">Local Master Announcement WINEPRESSME</td><td align="center">Ann</td><td align="center">18</td><td align="left">300 sec apart at stable operation</td></tr><tr><td align="left">Get Backup List Request</td><td align="center">Qry</td><td align="center">12</td><td align="left">6 x 2 early in startup, 0.5 sec apart</td></tr><tr><td align="left">Browser Election Request</td><td align="center">Ann</td><td align="center">10</td><td align="left">5 x 2 early in startup</td></tr><tr><td align="left">Request Announcement WINEPRESSME</td><td align="center">Ann</td><td align="center">4</td><td align="left">Early in startup</td></tr></tbody></table></div></div><br class="table-break"><p><a class="indexterm" name="id26195 80"></a><a class="indexterm" name="id2619588"></a>150 </p><div class="table"><a name="capsstats01"></a><p class="title"><b>Table 16.1. Windows Me Startup Broadcast Capture Statistics</b></p><div class="table-contents"><table summary="Windows Me Startup Broadcast Capture Statistics" border="1"><colgroup><col align="left"><col align="center"><col align="center"><col align="left"></colgroup><thead><tr><th align="left">Message</th><th align="center">Type</th><th align="center">Num</th><th align="left">Notes</th></tr></thead><tbody><tr><td align="left">WINEPRESSME<00></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.6 sec apart</td></tr><tr><td align="left">WINEPRESSME<03></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.6 sec apart</td></tr><tr><td align="left">WINEPRESSME<20></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<00></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1d></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1e></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1b></td><td align="center">Qry</td><td align="center">84</td><td align="left">300 sec apart at stable operation</td></tr><tr><td align="left">__MSBROWSE__</td><td align="center">Reg</td><td align="center">8</td><td align="left">Registered after winning election to Browse Master</td></tr><tr><td align="left">JHT<03></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 x 2. This is the name of the user that logged onto Windows</td></tr><tr><td align="left">Host Announcement WINEPRESSME</td><td align="center">Ann</td><td align="center">2</td><td align="left">Observed at 10 sec</td></tr><tr><td align="left">Domain/Workgroup Announcement MIDEARTH</td><td align="center">Ann</td><td align="center">18</td><td align="left">300 sec apart at stable operation</td></tr><tr><td align="left">Local Master Announcement WINEPRESSME</td><td align="center">Ann</td><td align="center">18</td><td align="left">300 sec apart at stable operation</td></tr><tr><td align="left">Get Backup List Request</td><td align="center">Qry</td><td align="center">12</td><td align="left">6 x 2 early in startup, 0.5 sec apart</td></tr><tr><td align="left">Browser Election Request</td><td align="center">Ann</td><td align="center">10</td><td align="left">5 x 2 early in startup</td></tr><tr><td align="left">Request Announcement WINEPRESSME</td><td align="center">Ann</td><td align="center">4</td><td align="left">Early in startup</td></tr></tbody></table></div></div><br class="table-break"><p><a class="indexterm" name="id2619575"></a><a class="indexterm" name="id2619583"></a> 151 151 From the packet trace, it should be noted that no messages were propagated over TCP/IP; 152 152 all messages employed UDP/IP. When steady-state operation has been achieved, there is a cycle 153 153 of various announcements, re-election of a browse master, and name queries. These create 154 154 the symphony of announcements by which network browsing is made possible. 155 </p><p><a class="indexterm" name="id261960 5"></a>155 </p><p><a class="indexterm" name="id2619600"></a> 156 156 For detailed information regarding the precise behavior of the CIFS/SMB protocols, 157 157 refer to the book “<span class="quote">Implementing CIFS: The Common Internet File System,</span>” … … 160 160 At this time, the machine you used to capture the single-system startup trace should still be running. 161 161 The objective of this task is to identify the interaction of two machines in respect to broadcast activity. 162 </p><div class="procedure"><a name="id26196 41"></a><p class="title"><b>Procedure 16.3. Monitoring of Second Machine Activity</b></p><ol type="1"><li><p>162 </p><div class="procedure"><a name="id2619637"></a><p class="title"><b>Procedure 16.3. Monitoring of Second Machine Activity</b></p><ol type="1"><li><p> 163 163 On the machine from which network activity will be monitored (using <code class="literal">Wireshark</code>), 164 164 launch <code class="literal">Wireshark</code> and click … … 177 177 Analyze the capture trace, taking note of the transport protocols used, the types of messages observed, 178 178 and what interaction took place between the two machines. Leave both machines running for the next task. 179 </p></li></ol></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id261975 8"></a>Findings</h4></div></div></div><p>179 </p></li></ol></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2619753"></a>Findings</h4></div></div></div><p> 180 180 <a class="link" href="primer.html#capsstats02" title="Table 16.2. Second Machine (Windows 98) Capture Statistics">“Second Machine (Windows 98) Capture Statistics”</a> summarizes capture statistics observed. As in the previous case, 181 181 all announcements used UDP/IP broadcasts. Also, as was observed with the last example, the second … … 185 185 “<span class="quote">Implementing CIFS: The Common Internet File System.</span>” 186 186 </p><div class="table"><a name="capsstats02"></a><p class="title"><b>Table 16.2. Second Machine (Windows 98) Capture Statistics</b></p><div class="table-contents"><table summary="Second Machine (Windows 98) Capture Statistics" border="1"><colgroup><col align="left"><col align="center"><col align="center"><col align="left"></colgroup><thead><tr><th align="left">Message</th><th align="center">Type</th><th align="center">Num</th><th align="left">Notes</th></tr></thead><tbody><tr><td align="left">MILGATE98<00></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.6 sec apart</td></tr><tr><td align="left">MILGATE98<03></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.6 sec apart</td></tr><tr><td align="left">MILGATE98<20></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<00></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1d></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1e></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1b></td><td align="center">Qry</td><td align="center">18</td><td align="left">900 sec apart at stable operation</td></tr><tr><td align="left">JHT<03></td><td align="center">Reg</td><td align="center">2</td><td align="left">This is the name of the user that logged onto Windows</td></tr><tr><td align="left">Host Announcement MILGATE98</td><td align="center">Ann</td><td align="center">14</td><td align="left">Every 120 sec</td></tr><tr><td align="left">Domain/Workgroup Announcement MIDEARTH</td><td align="center">Ann</td><td align="center">6</td><td align="left">900 sec apart at stable operation</td></tr><tr><td align="left">Local Master Announcement WINEPRESSME</td><td align="center">Ann</td><td align="center">6</td><td align="left">Insufficient detail to determine frequency</td></tr></tbody></table></div></div><br class="table-break"><p> 187 <a class="indexterm" name="id26200 40"></a>188 <a class="indexterm" name="id262004 6"></a>189 <a class="indexterm" name="id26200 54"></a>187 <a class="indexterm" name="id2620035"></a> 188 <a class="indexterm" name="id2620042"></a> 189 <a class="indexterm" name="id2620049"></a> 190 190 Observation of the contents of Host Announcements, Domain/Workgroup Announcements, 191 191 and Local Master Announcements is instructive. These messages convey a significant 192 192 level of detail regarding the nature of each machine that is on the network. An example 193 193 dissection of a Host Announcement is given in <a class="link" href="primer.html#hostannounce" title="Figure 16.3. Typical Windows 9x/Me Host Announcement">“Typical Windows 9x/Me Host Announcement”</a>. 194 </p><div class="figure"><a name="hostannounce"></a><p class="title"><b>Figure 16.3. Typical Windows 9x/Me Host Announcement</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/HostAnnouncment.png" width="221.4" alt="Typical Windows 9x/Me Host Announcement"></div></div></div><br class="figure-break"></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id262011 8"></a>Simple Windows Client Connection Characteristics</h3></div></div></div><p>194 </p><div class="figure"><a name="hostannounce"></a><p class="title"><b>Figure 16.3. Typical Windows 9x/Me Host Announcement</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/HostAnnouncment.png" width="221.4" alt="Typical Windows 9x/Me Host Announcement"></div></div></div><br class="figure-break"></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2620113"></a>Simple Windows Client Connection Characteristics</h3></div></div></div><p> 195 195 The purpose of this exercise is to discover how Microsoft Windows clients create (establish) 196 196 connections with remote servers. The methodology involves analysis of a key aspect of how 197 197 Windows clients access remote servers: the session setup protocol. 198 </p><div class="procedure"><a name="id26201 32"></a><p class="title"><b>Procedure 16.4. Client Connection Exploration Steps</b></p><ol type="1"><li><p>198 </p><div class="procedure"><a name="id2620127"></a><p class="title"><b>Procedure 16.4. Client Connection Exploration Steps</b></p><ol type="1"><li><p> 199 199 Configure a Windows 9x/Me machine (MILGATE98) with a share called <code class="constant">Stuff</code>. 200 200 Create a <em class="parameter"><code>Full Access</code></em> control password on this share. … … 217 217 Save the captured data in case it is needed for later analysis. 218 218 </p></li><li><p> 219 <a class="indexterm" name="id26202 62"></a>219 <a class="indexterm" name="id2620258"></a> 220 220 From the top of the packets captured, scan down to locate the first packet that has 221 221 interpreted as <code class="constant">Session Setup AndX, User: anonymous; Tree Connect AndX, 222 222 Path: \\MILGATE98\IPC$</code>. 223 </p></li><li><p><a class="indexterm" name="id26202 82"></a><a class="indexterm" name="id2620290"></a>223 </p></li><li><p><a class="indexterm" name="id2620277"></a><a class="indexterm" name="id2620285"></a> 224 224 In the dissection (analysis) panel, expand the <code class="constant">SMB, Session Setup AndX Request, 225 225 and Tree Connect AndX Request</code>. Examine both operations. Identify the name of … … 231 231 that was targeted at the <code class="constant">\\MILGATE98\IPC$</code> service. 232 232 </p></li><li><p> 233 <a class="indexterm" name="id262033 4"></a>234 <a class="indexterm" name="id26203 41"></a>233 <a class="indexterm" name="id2620330"></a> 234 <a class="indexterm" name="id2620336"></a> 235 235 Dissect this packet as per the previous one. This packet should have a password length 236 236 of 24 (characters) and should have a password field, the contents of which is a 237 237 long hexadecimal number. Observe the name in the Account field. This is a User Mode 238 238 session setup packet. 239 </p></li></ol></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id262035 5"></a>Findings and Comments</h4></div></div></div><p>240 <a class="indexterm" name="id26203 63"></a>241 The <code class="constant">IPC$</code> share serves a vital purpose<sup>[<a name="id262037 4" href="#ftn.id2620374" class="footnote">15</a>]</sup>239 </p></li></ol></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2620350"></a>Findings and Comments</h4></div></div></div><p> 240 <a class="indexterm" name="id2620358"></a> 241 The <code class="constant">IPC$</code> share serves a vital purpose<sup>[<a name="id2620370" href="#ftn.id2620370" class="footnote">15</a>]</sup> 242 242 in SMB/CIFS-based networking. A Windows client connects to this resource to obtain the list of 243 243 resources that are available on the server. The server responds with the shares and print queues that … … 245 245 username and a <code class="constant">NULL</code> password. 246 246 </p><p> 247 <a class="indexterm" name="id262039 5"></a>247 <a class="indexterm" name="id2620390"></a> 248 248 The two packets examined are material evidence of how Windows clients may 249 249 interoperate with Samba. Samba requires every connection setup to be authenticated using … … 252 252 account. 253 253 </p><p> 254 <a class="indexterm" name="id26204 14"></a><a class="indexterm" name="id2620420"></a>255 <a class="indexterm" name="id262042 9"></a>254 <a class="indexterm" name="id2620409"></a><a class="indexterm" name="id2620415"></a> 255 <a class="indexterm" name="id2620424"></a> 256 256 Samba has a special name for the <code class="constant">NULL</code>, or empty, user account: 257 257 it calls it the <a class="link" href="smb.conf.5.html#GUESTACCOUNT">guest account</a>. The … … 262 262 <a class="link" href="primer.html#nullconnect" title="Figure 16.4. Typical Windows 9x/Me NULL SessionSetUp AndX Request">“Typical Windows 9x/Me NULL SessionSetUp AndX Request”</a>. 263 263 </p><div class="figure"><a name="nullconnect"></a><p class="title"><b>Figure 16.4. Typical Windows 9x/Me NULL SessionSetUp AndX Request</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/NullConnect.png" width="221.4" alt="Typical Windows 9x/Me NULL SessionSetUp AndX Request"></div></div></div><br class="figure-break"><p> 264 <a class="indexterm" name="id262051 5"></a>265 <a class="indexterm" name="id26205 22"></a>266 <a class="indexterm" name="id262052 8"></a>264 <a class="indexterm" name="id2620510"></a> 265 <a class="indexterm" name="id2620517"></a> 266 <a class="indexterm" name="id2620524"></a> 267 267 When a UNIX/Linux system does not have a <code class="constant">nobody</code> user account 268 268 (<code class="filename">/etc/passwd</code>), the operation of the <code class="constant">NULL</code> … … 272 272 is shown in <a class="link" href="primer.html#userconnect" title="Figure 16.5. Typical Windows 9x/Me User SessionSetUp AndX Request">“Typical Windows 9x/Me User SessionSetUp AndX Request”</a>. 273 273 </p><div class="figure"><a name="userconnect"></a><p class="title"><b>Figure 16.5. Typical Windows 9x/Me User SessionSetUp AndX Request</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/UserConnect.png" width="221.4" alt="Typical Windows 9x/Me User SessionSetUp AndX Request"></div></div></div><br class="figure-break"><p> 274 <a class="indexterm" name="id262060 6"></a>274 <a class="indexterm" name="id2620601"></a> 275 275 The User Mode connection packet contains the account name and the domain name. 276 276 The password is provided in Microsoft encrypted form, and its length is shown 277 277 as 24 characters. This is the length of Microsoft encrypted passwords. 278 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id26206 20"></a>Windows 200x/XP Client Interaction with Samba-3</h3></div></div></div><p>278 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2620615"></a>Windows 200x/XP Client Interaction with Samba-3</h3></div></div></div><p> 279 279 By now you may be asking, “<span class="quote">Why did you choose to work with Windows 9x/Me?</span>” 280 280 </p><p> … … 291 291 a domain member of either a Samba-controlled domain or a Windows NT4 or 200x Active Directory domain. 292 292 Here we do not provide details for how to configure this, as full coverage is provided earlier in this book. 293 </p><div class="procedure"><a name="id26206 62"></a><p class="title"><b>Procedure 16.5. Steps to Explore Windows XP Pro Connection Set-up</b></p><ol type="1"><li><p>293 </p><div class="procedure"><a name="id2620658"></a><p class="title"><b>Procedure 16.5. Steps to Explore Windows XP Pro Connection Set-up</b></p><ol type="1"><li><p> 294 294 Start your domain controller. Also, start the Wireshark monitoring machine, launch Wireshark, 295 295 and then wait for the next step to complete. … … 320 320 in this chapter. 321 321 </p></li><li><p> 322 <a class="indexterm" name="id262088 9"></a>323 <a class="indexterm" name="id262089 6"></a>322 <a class="indexterm" name="id2620884"></a> 323 <a class="indexterm" name="id2620891"></a> 324 324 From the top of the packets captured, scan down to locate the first packet that has 325 325 interpreted as <code class="constant">Session Setup AndX Request, NTLMSSP_AUTH</code>. 326 326 </p></li><li><p> 327 <a class="indexterm" name="id262091 6"></a>328 <a class="indexterm" name="id26209 23"></a>329 <a class="indexterm" name="id262092 9"></a>327 <a class="indexterm" name="id2620911"></a> 328 <a class="indexterm" name="id2620918"></a> 329 <a class="indexterm" name="id2620925"></a> 330 330 In the dissection (analysis) panel, expand the <code class="constant">SMB, Session Setup AndX Request</code>. 331 331 Expand the packet decode information, beginning at the <code class="constant">Security Blob:</code> … … 339 339 has been decoded as <code class="constant">Session Setup AndX Request, NTLMSSP_AUTH</code>. 340 340 </p></li><li><p> 341 <a class="indexterm" name="id26209 92"></a>341 <a class="indexterm" name="id2620987"></a> 342 342 In the dissection (analysis) panel, expand the <code class="constant">SMB, Session Setup AndX Request</code>. 343 343 Expand the packet decode information, beginning at the <code class="constant">Security Blob:</code> … … 350 350 password and then the NT (case-preserving) password hash. 351 351 </p></li><li><p> 352 <a class="indexterm" name="id26210 53"></a>353 <a class="indexterm" name="id26210 60"></a>352 <a class="indexterm" name="id2621048"></a> 353 <a class="indexterm" name="id2621055"></a> 354 354 The passwords are 24-character hexadecimal numbers. This packet confirms that this is a User Mode 355 355 session setup packet. 356 </p></li></ol></div><div class="figure"><a name="XPCap01"></a><p class="title"><b>Figure 16.6. Typical Windows XP NULL Session Setup AndX Request</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/WindowsXP-NullConnection.png" width="270" alt="Typical Windows XP NULL Session Setup AndX Request"></div></div></div><br class="figure-break"><div class="figure"><a name="XPCap02"></a><p class="title"><b>Figure 16.7. Typical Windows XP User Session Setup AndX Request</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/WindowsXP-UserConnection.png" width="270" alt="Typical Windows XP User Session Setup AndX Request"></div></div></div><br class="figure-break"><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id262115 6"></a>Discussion</h4></div></div></div><p><a class="indexterm" name="id2621163"></a>356 </p></li></ol></div><div class="figure"><a name="XPCap01"></a><p class="title"><b>Figure 16.6. Typical Windows XP NULL Session Setup AndX Request</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/WindowsXP-NullConnection.png" width="270" alt="Typical Windows XP NULL Session Setup AndX Request"></div></div></div><br class="figure-break"><div class="figure"><a name="XPCap02"></a><p class="title"><b>Figure 16.7. Typical Windows XP User Session Setup AndX Request</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/WindowsXP-UserConnection.png" width="270" alt="Typical Windows XP User Session Setup AndX Request"></div></div></div><br class="figure-break"><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2621152"></a>Discussion</h4></div></div></div><p><a class="indexterm" name="id2621158"></a> 357 357 This exercise demonstrates that, while the specific protocol for the Session Setup AndX is handled 358 358 in a more sophisticated manner by recent MS Windows clients, the underlying rules or principles … … 361 361 technology server (one using Windows NT4/200x or Samba). It also demonstrates that an authenticated 362 362 connection must be made before resources can be used. 363 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id262118 8"></a>Conclusions to Exercises</h3></div></div></div><p>363 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2621183"></a>Conclusions to Exercises</h3></div></div></div><p> 364 364 In summary, the following points have been established in this chapter: 365 365 </p><div class="itemizedlist"><ul type="disc"><li><p> … … 380 380 databases in concurrent deployment. Refer to <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 10, “<span class="quote">Account Information Databases.</span>” 381 381 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="chap01conc"></a>Dissection and Discussion</h2></div></div></div><p> 382 <a class="indexterm" name="id262127 5"></a>382 <a class="indexterm" name="id2621270"></a> 383 383 The exercises demonstrate the use of the <code class="constant">guest</code> account, the way that 384 384 MS Windows clients and servers resolve computer names to a TCP/IP address, and how connections … … 388 388 the Microsoft knowledgebase article 389 389 <a class="ulink" href="http://support.microsoft.com/support/kb/articles/Q102/78/8.asp" target="_top">Q102878.</a> 390 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2621 302"></a>Technical Issues</h3></div></div></div><p>391 <a class="indexterm" name="id26213 10"></a>390 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2621297"></a>Technical Issues</h3></div></div></div><p> 391 <a class="indexterm" name="id2621305"></a> 392 392 Network browsing involves SMB broadcast announcements, SMB enumeration requests, 393 393 connections to the <code class="constant">IPC$</code> share, share enumerations, and SMB connection … … 397 397 The questions and answers given in this section are designed to highlight important aspects of Microsoft 398 398 Windows networking. 399 </p><div class="qandaset"><dl><dt> <a href="primer.html#id262135 6">399 </p><div class="qandaset"><dl><dt> <a href="primer.html#id2621352"> 400 400 What is the significance of the MIDEARTH<1b> type query? 401 </a></dt><dt> <a href="primer.html#id2621 402">401 </a></dt><dt> <a href="primer.html#id2621398"> 402 402 What is the significance of the MIDEARTH<1d> type name registration? 403 </a></dt><dt> <a href="primer.html#id262147 6">403 </a></dt><dt> <a href="primer.html#id2621472"> 404 404 What is the role and significance of the <01><02>__MSBROWSE__<02><01> 405 405 name registration? 406 </a></dt><dt> <a href="primer.html#id262150 9">406 </a></dt><dt> <a href="primer.html#id2621504"> 407 407 What is the significance of the MIDEARTH<1e> type name registration? 408 </a></dt><dt> <a href="primer.html#id26215 40">408 </a></dt><dt> <a href="primer.html#id2621535"> 409 409 410 410 What is the significance of the guest account in smb.conf? 411 </a></dt><dt> <a href="primer.html#id262161 8">411 </a></dt><dt> <a href="primer.html#id2621613"> 412 412 Is it possible to reduce network broadcast activity with Samba-3? 413 </a></dt><dt> <a href="primer.html#id262172 7">413 </a></dt><dt> <a href="primer.html#id2621722"> 414 414 Can I just use plain-text passwords with Samba? 415 </a></dt><dt> <a href="primer.html#id26218 14">415 </a></dt><dt> <a href="primer.html#id2621809"> 416 416 What parameter in the smb.conf file is used to enable the use of encrypted passwords? 417 </a></dt><dt> <a href="primer.html#id262185 5">417 </a></dt><dt> <a href="primer.html#id2621850"> 418 418 Is it necessary to specify encrypt passwords = Yes 419 419 when Samba-3 is configured as a domain member? 420 </a></dt><dt> <a href="primer.html#id262188 7">420 </a></dt><dt> <a href="primer.html#id2621882"> 421 421 Is it necessary to specify a guest account when Samba-3 is configured 422 422 as a domain member server? 423 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id262135 6"></a><a name="id2621358"></a></td><td align="left" valign="top"><p>423 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2621352"></a><a name="id2621354"></a></td><td align="left" valign="top"><p> 424 424 What is the significance of the MIDEARTH<1b> type query? 425 425 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 426 <a class="indexterm" name="id26213 71"></a>427 <a class="indexterm" name="id26213 80"></a>426 <a class="indexterm" name="id2621366"></a> 427 <a class="indexterm" name="id2621375"></a> 428 428 This is a broadcast announcement by which the Windows machine is attempting to 429 429 locate a Domain Master Browser (DMB) in the event that it might exist on the network. 430 430 Refer to <span class="emphasis"><em>TOSHARG2,</em></span> Chapter 9, Section 9.7, “<span class="quote">Technical Overview of Browsing,</span>” 431 431 for details regarding the function of the DMB and its role in network browsing. 432 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2621 402"></a><a name="id2621404"></a></td><td align="left" valign="top"><p>432 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2621398"></a><a name="id2621400"></a></td><td align="left" valign="top"><p> 433 433 What is the significance of the MIDEARTH<1d> type name registration? 434 434 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 435 <a class="indexterm" name="id262141 7"></a>436 <a class="indexterm" name="id262142 6"></a>435 <a class="indexterm" name="id2621412"></a> 436 <a class="indexterm" name="id2621421"></a> 437 437 This name registration records the machine IP addresses of the LMBs. 438 438 Network clients can query this name type to obtain a list of browser servers from the … … 452 452 </p></li><li><p> 453 453 The IP address of the LMB on the local segment 454 </p></li></ul></div></td></tr><tr class="question"><td align="left" valign="top"><a name="id262147 6"></a><a name="id2621479"></a></td><td align="left" valign="top"><p>454 </p></li></ul></div></td></tr><tr class="question"><td align="left" valign="top"><a name="id2621472"></a><a name="id2621474"></a></td><td align="left" valign="top"><p> 455 455 What is the role and significance of the <01><02>__MSBROWSE__<02><01> 456 456 name registration? 457 457 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 458 <a class="indexterm" name="id26214 94"></a>458 <a class="indexterm" name="id2621489"></a> 459 459 This name is registered by the browse master to broadcast and receive domain announcements. 460 460 Its scope is limited to the local network segment, or subnet. By querying this name type, 461 461 master browsers on networks that have multiple domains can find the names of master browsers 462 462 for each domain. 463 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id262150 9"></a><a name="id2621511"></a></td><td align="left" valign="top"><p>463 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2621504"></a><a name="id2621506"></a></td><td align="left" valign="top"><p> 464 464 What is the significance of the MIDEARTH<1e> type name registration? 465 465 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 466 <a class="indexterm" name="id26215 23"></a>466 <a class="indexterm" name="id2621519"></a> 467 467 This name is registered by all browse masters in a domain or workgroup. The registration 468 468 name type is known as the Browser Election Service. Master browsers register themselves 469 469 with this name type so that DMBs can locate them to perform cross-subnet 470 470 browse list updates. This name type is also used to initiate elections for Master Browsers. 471 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id26215 40"></a><a name="id2621542"></a></td><td align="left" valign="top"><p>472 <a class="indexterm" name="id262154 6"></a>471 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2621535"></a><a name="id2621537"></a></td><td align="left" valign="top"><p> 472 <a class="indexterm" name="id2621541"></a> 473 473 What is the significance of the <em class="parameter"><code>guest account</code></em> in smb.conf? 474 474 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 483 483 or there must be an entry in the <code class="filename">smb.conf</code> file with a valid UNIX account, such as 484 484 <a class="link" href="smb.conf.5.html#GUESTACCOUNT">guest account = ftp</a>. 485 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id262161 8"></a><a name="id2621620"></a></td><td align="left" valign="top"><p>485 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2621613"></a><a name="id2621615"></a></td><td align="left" valign="top"><p> 486 486 Is it possible to reduce network broadcast activity with Samba-3? 487 487 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 488 <a class="indexterm" name="id26216 32"></a>489 <a class="indexterm" name="id262163 8"></a>488 <a class="indexterm" name="id2621627"></a> 489 <a class="indexterm" name="id2621634"></a> 490 490 Yes, there are two ways to do this. The first involves use of WINS (See <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 9, 491 491 Section 9.5, “<span class="quote">WINS The Windows Inter-networking Name Server</span>”); the … … 493 493 a correctly configured DNS server (see <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 9, Section 9.3, “<span class="quote">Discussion</span>”). 494 494 </p><p> 495 <a class="indexterm" name="id26216 70"></a>496 <a class="indexterm" name="id262167 7"></a>497 <a class="indexterm" name="id262168 6"></a>495 <a class="indexterm" name="id2621665"></a> 496 <a class="indexterm" name="id2621672"></a> 497 <a class="indexterm" name="id2621681"></a> 498 498 The use of WINS reduces network broadcast traffic. The reduction is greatest when all network 499 499 clients are configured to operate in <em class="parameter"><code>Hybrid Mode</code></em>. This can be effected through … … 503 503 Use of SMB without NetBIOS is possible only on Windows 200x/XP Professional clients and servers, as 504 504 well as with Samba-3. 505 </p></div></td></tr><tr class="question"><td align="left" valign="top"><a name="id262172 7"></a><a name="id2621729"></a></td><td align="left" valign="top"><p>505 </p></div></td></tr><tr class="question"><td align="left" valign="top"><a name="id2621722"></a><a name="id2621724"></a></td><td align="left" valign="top"><p> 506 506 Can I just use plain-text passwords with Samba? 507 507 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 526 526 PDC/BDC to provide Windows user and group accounts, the <em class="parameter"><code>idmap uid, idmap gid</code></em> ranges 527 527 set in the <code class="filename">smb.conf</code> file provide the local UID/GIDs needed for local identity management purposes. 528 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id26218 14"></a><a name="id2621816"></a></td><td align="left" valign="top"><p>528 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2621809"></a><a name="id2621811"></a></td><td align="left" valign="top"><p> 529 529 What parameter in the <code class="filename">smb.conf</code> file is used to enable the use of encrypted passwords? 530 530 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 531 531 The parameter in the <code class="filename">smb.conf</code> file that controls this behavior is known as <em class="parameter"><code>encrypt 532 532 passwords</code></em>. The default setting for this in Samba-3 is <code class="constant">Yes (Enabled)</code>. 533 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id262185 5"></a><a name="id2621857"></a></td><td align="left" valign="top"><p>533 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2621850"></a><a name="id2621852"></a></td><td align="left" valign="top"><p> 534 534 Is it necessary to specify <a class="link" href="smb.conf.5.html#ENCRYPTPASSWORDS">encrypt passwords = Yes</a> 535 535 when Samba-3 is configured as a domain member? 536 536 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 537 537 No. This is the default behavior. 538 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id262188 7"></a><a name="id2621889"></a></td><td align="left" valign="top"><p>538 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2621882"></a><a name="id2621884"></a></td><td align="left" valign="top"><p> 539 539 Is it necessary to specify a <em class="parameter"><code>guest account</code></em> when Samba-3 is configured 540 540 as a domain member server? … … 544 544 necessary to provide a <a class="link" href="smb.conf.5.html#GUESTACCOUNT">guest account = an_account</a>, 545 545 where <code class="constant">an_account</code> is a valid local UNIX user account. 546 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id262037 4" href="#id2620374" class="para">15</a>] </sup>TOSHARG2, Sect 4.5.1</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="appendix.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="RefSection.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="apa.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 15. A Collection of Useful Tidbits </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Appendix A.546 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id2620370" href="#id2620370" class="para">15</a>] </sup>TOSHARG2, Sect 4.5.1</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="appendix.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="RefSection.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="apa.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 15. A Collection of Useful Tidbits </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Appendix A. 547 547 <acronym class="acronym">GNU</acronym> General Public License version 3 548 548 </td></tr></table></div></body></html> -
branches/samba-3.2.x/docs/htmldocs/Samba3-ByExample/secure.html
r204 r226 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 3. Secure Office Networking</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="small.html" title="Chapter 2. Small Office Networking"><link rel="next" href="Big500users.html" title="Chapter 4. The 500-User Office"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 3. Secure Office Networking</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="small.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="Big500users.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="secure"></a>Chapter 3. Secure Office Networking</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="secure.html#id255138 7">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id2551439">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2551688">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id2551704">Technical Issues</a></span></dt><dt><span class="sect2"><a href="secure.html#id2552156">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2552197">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#ch4bsc">Basic System Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id2553134">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4ptrcfg">Printer Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4valid">Validation</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4appscfg">Application Share Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id2557769">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2557831">Questions and Answers</a></span></dt></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 3. Secure Office Networking</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="small.html" title="Chapter 2. Small Office Networking"><link rel="next" href="Big500users.html" title="Chapter 4. The 500-User Office"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 3. Secure Office Networking</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="small.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="Big500users.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="secure"></a>Chapter 3. Secure Office Networking</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="secure.html#id2551382">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id2551434">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2551684">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id2551699">Technical Issues</a></span></dt><dt><span class="sect2"><a href="secure.html#id2552152">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2552192">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#ch4bsc">Basic System Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id2553129">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4ptrcfg">Printer Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4valid">Validation</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4appscfg">Application Share Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id2557764">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2557826">Questions and Answers</a></span></dt></dl></div><p> 2 2 Congratulations, your Samba networking skills are developing nicely. You started out 3 3 with three simple networks in <a class="link" href="simple.html" title="Chapter 1. No-Frills Samba Servers">“No-Frills Samba Servers”</a>, and then in <a class="link" href="small.html" title="Chapter 2. Small Office Networking">“Small Office Networking”</a> … … 12 12 To avoid confusion, this book is all about Samba-3. Let's get the exercises in this 13 13 chapter underway. 14 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id255138 7"></a>Introduction</h2></div></div></div><p>14 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2551382"></a>Introduction</h2></div></div></div><p> 15 15 You have made Mr. Meany a very happy man. Recently he paid you a fat bonus for work 16 16 well done. It is one year since the last network upgrade. You have been quite busy. … … 41 41 about your move, she almost resigned, although she was reassured that a new manager would 42 42 be hired to run Information Technology, and she would be responsible only for operations. 43 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id255143 9"></a>Assignment Tasks</h3></div></div></div><p>43 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2551434"></a>Assignment Tasks</h3></div></div></div><p> 44 44 You promised the staff Internet services including Web browsing, electronic mail, virus 45 45 protection, and a company Web site. Christine is eager to help turn the vision into … … 84 84 some problems with desktop computers and software installation into the new users' 85 85 desktop profiles. 86 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id255168 8"></a>Dissection and Discussion</h2></div></div></div><p>86 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2551684"></a>Dissection and Discussion</h2></div></div></div><p> 87 87 Many of the conclusions you draw here are obvious. Some requirements are not very clear 88 88 or may simply be your means of drawing the most out of Samba-3. Much can be done more simply … … 90 90 users. This means that some functionality will be overdesigned for the current 130-user 91 91 environment. 92 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2551 704"></a>Technical Issues</h3></div></div></div><p>92 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2551699"></a>Technical Issues</h3></div></div></div><p> 93 93 In this exercise we use a 24-bit subnet mask for the two local networks. This, 94 94 of course, limits our network to a maximum of 253 usable IP addresses. The network … … 98 98 in the 172.16.0.0/16 range. This is done in subsequent chapters. 99 99 </p><p> 100 <a class="indexterm" name="id25517 23"></a>101 <a class="indexterm" name="id25517 30"></a>100 <a class="indexterm" name="id2551718"></a> 101 <a class="indexterm" name="id2551725"></a> 102 102 The high growth rates projected are a good reason to use the <code class="constant">tdbsam</code> 103 103 passdb backend. The use of <code class="constant">smbpasswd</code> for the backend may result in … … 105 105 are not available with the older, flat ASCII-based <code class="constant">smbpasswd</code> database. 106 106 </p><p> 107 <a class="indexterm" name="id255175 8"></a>107 <a class="indexterm" name="id2551754"></a> 108 108 The proposed network design uses a single server to act as an Internet services host for 109 109 electronic mail, Web serving, remote administrative access via SSH, … … 118 118 directly connected to the Internet. 119 119 </p><p> 120 <a class="indexterm" name="id255178 4"></a>121 <a class="indexterm" name="id25517 91"></a>122 <a class="indexterm" name="id255179 8"></a>123 <a class="indexterm" name="id255180 7"></a>120 <a class="indexterm" name="id2551780"></a> 121 <a class="indexterm" name="id2551787"></a> 122 <a class="indexterm" name="id2551793"></a> 123 <a class="indexterm" name="id2551803"></a> 124 124 You know that your ISP is providing full firewall services, but you cannot rely on that. 125 125 Always assume that human error will occur, so be prepared by using Linux firewall facilities … … 132 132 covered except insofar as this affects Samba-3. 133 133 </p><p> 134 <a class="indexterm" name="id255183 7"></a>134 <a class="indexterm" name="id2551833"></a> 135 135 Notebook computers are configured to use a network login when in the office and a 136 136 local account to log in while away from the office. Users store all work done in … … 142 142 records. 143 143 </p><p> 144 <a class="indexterm" name="id255186 8"></a>144 <a class="indexterm" name="id2551864"></a> 145 145 All applications are served from the central server from a share called <code class="constant">apps</code>. 146 146 Microsoft Office XP Professional and OpenOffice 1.1.0 will be installed using a network … … 149 149 locally installed applications on a need-to-have basis only. 150 150 </p><p> 151 <a class="indexterm" name="id255188 9"></a>151 <a class="indexterm" name="id2551884"></a> 152 152 The introduction of roaming profiles support means that users can move between 153 153 desktop computer systems without constraint while retaining full access to their data. 154 154 The desktop travels with them as they move. 155 155 </p><p> 156 <a class="indexterm" name="id2551 903"></a>156 <a class="indexterm" name="id2551898"></a> 157 157 The DNS server implementation must now address both internal and external 158 158 needs. You forward DNS lookups to your ISP-provided server as well as the 159 159 <code class="constant">abmas.us</code> external secondary DNS server. 160 160 </p><p> 161 <a class="indexterm" name="id255191 9"></a>162 <a class="indexterm" name="id255192 6"></a>163 <a class="indexterm" name="id255193 5"></a>161 <a class="indexterm" name="id2551915"></a> 162 <a class="indexterm" name="id2551922"></a> 163 <a class="indexterm" name="id2551931"></a> 164 164 Compared with the DHCP server configuration in <a class="link" href="small.html" title="Chapter 2. Small Office Networking">“Small Office Networking”</a>, <a class="link" href="small.html#dhcp01" title="Example 2.2. Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf">“Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf”</a>, the 165 165 configuration used in this example has to deal with the presence of an Internet connection. … … 185 185 then clone that configuration, using Norton Ghost, to all workstations. Each machine is 186 186 identical, so this should pose no problem. 187 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id25519 90"></a>Hardware Requirements</h4></div></div></div><p>188 <a class="indexterm" name="id255199 8"></a>187 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2551986"></a>Hardware Requirements</h4></div></div></div><p> 188 <a class="indexterm" name="id2551994"></a> 189 189 This server runs a considerable number of services. From similarly configured Linux 190 190 installations, the approximate calculated memory requirements are as shown in … … 214 214 compromise in this area. 215 215 </p><p> 216 <a class="indexterm" name="id255205 5"></a>216 <a class="indexterm" name="id2552050"></a> 217 217 Aggregate input/output loads should be considered for sizing network configuration as 218 218 well as disk subsystems. For network bandwidth calculations, one would typically use an … … 223 223 switched ports. 224 224 </p><p> 225 <a class="indexterm" name="id255207 4"></a>226 <a class="indexterm" name="id25520 81"></a>225 <a class="indexterm" name="id2552070"></a> 226 <a class="indexterm" name="id2552077"></a> 227 227 Considering the choice of 1 Gb Ethernet interfaces for the two local network segments, 228 228 the aggregate network I/O capacity will be 2100 Mb/sec (about 230 MB/sec), an I/O … … 256 256 Recommended Storage: 908 GBytes 257 257 </pre></div></div><p><br class="example-break"> 258 <a class="indexterm" name="id25521 43"></a>258 <a class="indexterm" name="id2552138"></a> 259 259 The preferred storage capacity should be approximately 1 Terabyte. Use of RAID level 5 260 260 with two hot spare drives would require an 8-drive by 200 GB capacity per drive array. 261 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id255215 6"></a>Political Issues</h3></div></div></div><p>261 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2552152"></a>Political Issues</h3></div></div></div><p> 262 262 Your industry is coming under increasing accountability pressures. Increased paranoia 263 263 is necessary so you can demonstrate that you have acted with due diligence. You must … … 268 268 gives you greater control over software licensing. 269 269 </p><p> 270 <a class="indexterm" name="id255217 8"></a>270 <a class="indexterm" name="id2552174"></a> 271 271 You are well aware that the current configuration results in some performance issues 272 272 as the size of the desktop profile grows. Given that users use Microsoft Outlook 273 273 Express, you know that the storage implications of the <code class="constant">.PST</code> file 274 274 is something that needs to be addressed later. 275 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id255219 7"></a>Implementation</h2></div></div></div><p>275 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2552192"></a>Implementation</h2></div></div></div><p> 276 276 <a class="link" href="secure.html#ch04net" title="Figure 3.1. Abmas Network Topology 130 Users">“Abmas Network Topology 130 Users”</a> demonstrates the overall design of the network that you will implement. 277 277 </p><p> … … 289 289 The Domain name is set to <code class="constant">PROMISES</code>. 290 290 </p></li><li><p> 291 <a class="indexterm" name="id255225 8"></a>292 <a class="indexterm" name="id255226 5"></a>293 <a class="indexterm" name="id25522 72"></a>291 <a class="indexterm" name="id2552253"></a> 292 <a class="indexterm" name="id2552260"></a> 293 <a class="indexterm" name="id2552267"></a> 294 294 Ethernet interface <code class="constant">eth0</code> is attached to the Internet connection 295 295 and is externally exposed. This interface is explicitly not available for Samba to use. … … 299 299 <em class="parameter"><code>bind interfaces only</code></em> entry. 300 300 </p></li><li><p> 301 <a class="indexterm" name="id255230 8"></a>302 <a class="indexterm" name="id255231 5"></a>303 <a class="indexterm" name="id25523 22"></a>301 <a class="indexterm" name="id2552304"></a> 302 <a class="indexterm" name="id2552311"></a> 303 <a class="indexterm" name="id2552318"></a> 304 304 The <em class="parameter"><code>passdb backend</code></em> parameter specifies the creation and use 305 305 of the <code class="constant">tdbsam</code> password backend. This is a binary database that 306 306 has excellent scalability for a large number of user account entries. 307 307 </p></li><li><p> 308 <a class="indexterm" name="id255234 6"></a>309 <a class="indexterm" name="id25523 53"></a>310 <a class="indexterm" name="id25523 60"></a>308 <a class="indexterm" name="id2552342"></a> 309 <a class="indexterm" name="id2552349"></a> 310 <a class="indexterm" name="id2552356"></a> 311 311 WINS serving is enabled by the <a class="link" href="smb.conf.5.html#WINSSUPPORT">wins support = Yes</a>, 312 312 and name resolution is set to use it by means of the 313 313 <a class="link" href="smb.conf.5.html#NAMERESOLVEORDER">name resolve order = wins bcast hosts</a> entry. 314 314 </p></li><li><p> 315 <a class="indexterm" name="id255239 9"></a>315 <a class="indexterm" name="id2552395"></a> 316 316 The Samba server is configured for use by Windows clients as a time server. 317 317 </p></li><li><p> 318 <a class="indexterm" name="id25524 11"></a>319 <a class="indexterm" name="id255241 8"></a>320 <a class="indexterm" name="id255242 5"></a>318 <a class="indexterm" name="id2552407"></a> 319 <a class="indexterm" name="id2552414"></a> 320 <a class="indexterm" name="id2552420"></a> 321 321 Samba is configured to directly interface with CUPS via the direct internal interface 322 322 that is provided by CUPS libraries. This is achieved with the … … 324 324 <a class="link" href="smb.conf.5.html#PRINTCAPNAME">printcap name = CUPS</a> entries. 325 325 </p></li><li><p> 326 <a class="indexterm" name="id255246 4"></a>327 <a class="indexterm" name="id25524 71"></a>328 <a class="indexterm" name="id255247 8"></a>326 <a class="indexterm" name="id2552460"></a> 327 <a class="indexterm" name="id2552466"></a> 328 <a class="indexterm" name="id2552473"></a> 329 329 External interface scripts are provided to enable Samba to interface smoothly to 330 330 essential operating system functions for user and group management. This is important … … 335 335 <a class="ulink" href="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE" target="_top">site</a>. 336 336 </p></li><li><p> 337 <a class="indexterm" name="id255250 8"></a>337 <a class="indexterm" name="id2552505"></a> 338 338 The <code class="filename">smb.conf</code> file specifies that the Samba server will operate in (default) <em class="parameter"><code> 339 security = user</code></em> mode<sup>[<a name="id255252 8" href="#ftn.id2552528" class="footnote">5</a>]</sup>339 security = user</code></em> mode<sup>[<a name="id2552525" href="#ftn.id2552525" class="footnote">5</a>]</sup> 340 340 (User Mode). 341 341 </p></li><li><p> 342 <a class="indexterm" name="id255254 7"></a>343 <a class="indexterm" name="id25525 54"></a>342 <a class="indexterm" name="id2552542"></a> 343 <a class="indexterm" name="id2552549"></a> 344 344 Domain logon services as well as a Domain logon script are specified. The logon script 345 345 will be used to add robustness to the overall network configuration. 346 346 </p></li><li><p> 347 <a class="indexterm" name="id255256 8"></a>348 <a class="indexterm" name="id255257 5"></a>349 <a class="indexterm" name="id25525 82"></a>347 <a class="indexterm" name="id2552563"></a> 348 <a class="indexterm" name="id2552570"></a> 349 <a class="indexterm" name="id2552577"></a> 350 350 Roaming profiles are enabled through the specification of the parameter, 351 351 <a class="link" href="smb.conf.5.html#LOGONPATH">logon path = \\%L\profiles\%U</a>. The value of this parameter translates the … … 357 357 requirement is when a profile is created for group use. 358 358 </p></li><li><p> 359 <a class="indexterm" name="id255262 6"></a>360 <a class="indexterm" name="id25526 33"></a>359 <a class="indexterm" name="id2552622"></a> 360 <a class="indexterm" name="id2552629"></a> 361 361 Precautionary veto is effected for particular Windows file names that have been targeted by 362 362 virus-related activity. Additionally, Microsoft Office files are vetoed from opportunistic locking … … 386 386 The following sections cover each step in logical and defined detail. 387 387 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch4bsc"></a>Basic System Configuration</h3></div></div></div><p> 388 <a class="indexterm" name="id255272 4"></a>388 <a class="indexterm" name="id2552720"></a> 389 389 The preparation in this section assumes that your SUSE Enterprise Linux Server 8.0 system has been 390 390 freshly installed. It prepares basic files so that the system is ready for comprehensive 391 391 operation in line with the network diagram shown in <a class="link" href="secure.html#ch04net" title="Figure 3.1. Abmas Network Topology 130 Users">“Abmas Network Topology 130 Users”</a>. 392 </p><div class="procedure"><a name="id25527 42"></a><p class="title"><b>Procedure 3.1. Server Configuration Steps</b></p><ol type="1"><li><p>393 <a class="indexterm" name="id25527 53"></a>392 </p><div class="procedure"><a name="id2552738"></a><p class="title"><b>Procedure 3.1. Server Configuration Steps</b></p><ol type="1"><li><p> 393 <a class="indexterm" name="id2552749"></a> 394 394 Using the UNIX/Linux system tools, name the server <code class="constant">server.abmas.us</code>. 395 395 Verify that your hostname is correctly set by running: … … 404 404 </pre><p> 405 405 </p></li><li><p> 406 <a class="indexterm" name="id255279 7"></a>407 <a class="indexterm" name="id2552 804"></a>406 <a class="indexterm" name="id2552792"></a> 407 <a class="indexterm" name="id2552799"></a> 408 408 Edit your <code class="filename">/etc/hosts</code> file to include the primary names and addresses 409 409 of all network interfaces that are on the host server. This is necessary so that during … … 426 426 192.168.2.30 hplj6f.abmas.biz hplj6f 427 427 </pre><p> 428 <a class="indexterm" name="id25528 60"></a>429 <a class="indexterm" name="id255286 6"></a>430 <a class="indexterm" name="id25528 73"></a>428 <a class="indexterm" name="id2552855"></a> 429 <a class="indexterm" name="id2552862"></a> 430 <a class="indexterm" name="id2552869"></a> 431 431 The printer entries are not necessary if <code class="literal">named</code> is started prior to 432 432 startup of <code class="literal">cupsd</code>, the CUPS daemon. 433 433 </p></li><li><p> 434 <a class="indexterm" name="id2552 900"></a>435 <a class="indexterm" name="id255290 7"></a>436 <a class="indexterm" name="id255291 4"></a>434 <a class="indexterm" name="id2552896"></a> 435 <a class="indexterm" name="id2552903"></a> 436 <a class="indexterm" name="id2552910"></a> 437 437 The host server is acting as a router between the two internal network segments as well 438 438 as for all Internet access. This necessitates that IP forwarding be enabled. This can be … … 443 443 To ensure that your kernel is capable of IP forwarding during configuration, you may 444 444 wish to execute that command manually also. This setting permits the Linux system to 445 act as a router.<sup>[<a name="id25529 42" href="#ftn.id2552942" class="footnote">6</a>]</sup>446 </p></li><li><p> 447 <a class="indexterm" name="id255295 5"></a>448 <a class="indexterm" name="id25529 62"></a>445 act as a router.<sup>[<a name="id2552938" href="#ftn.id2552938" class="footnote">6</a>]</sup> 446 </p></li><li><p> 447 <a class="indexterm" name="id2552951"></a> 448 <a class="indexterm" name="id2552958"></a> 449 449 Installation of a basic firewall and NAT facility is necessary. 450 450 The following script can be installed in the <code class="filename">/usr/local/sbin</code> … … 525 525 </pre><p> 526 526 </p></li></ol></div><p> 527 <a class="indexterm" name="id25531 11"></a>527 <a class="indexterm" name="id2553107"></a> 528 528 The server is now ready for Samba configuration. During the validation step, you remove 529 529 the entry for the Samba server <code class="constant">diamond</code> from the <code class="filename">/etc/hosts</code> 530 530 file. This is done after you are satisfied that DNS-based name resolution is functioning correctly. 531 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id25531 34"></a>Samba Configuration</h3></div></div></div><p>531 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2553129"></a>Samba Configuration</h3></div></div></div><p> 532 532 When you have completed this section, the Samba server is ready for testing and validation; 533 533 however, testing and validation have to wait until DHCP, DNS, and printing (CUPS) services have 534 534 been configured. 535 </p><div class="procedure"><a name="id255314 6"></a><p class="title"><b>Procedure 3.2. Samba Configuration Steps</b></p><ol type="1"><li><p>535 </p><div class="procedure"><a name="id2553142"></a><p class="title"><b>Procedure 3.2. Samba Configuration Steps</b></p><ol type="1"><li><p> 536 536 Install the Samba-3 binary RPM from the Samba-Team FTP site. Assuming that the binary 537 537 RPM file is called <code class="filename">samba-3.0.20-1.i386.rpm</code>, one way to install this … … 548 548 file. The final, fully qualified path for this file should be <code class="filename">/etc/samba/smb.conf</code>. 549 549 550 </p><div class="example"><a name="promisnet"></a><p class="title"><b>Example 3.4. 130 User Network with <span class="emphasis"><em>tdbsam</em></span> [globals] Section</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id255326 8"></a><em class="parameter"><code>workgroup = PROMISES</code></em></td></tr><tr><td><a class="indexterm" name="id2553280"></a><em class="parameter"><code>netbios name = DIAMOND</code></em></td></tr><tr><td><a class="indexterm" name="id2553292"></a><em class="parameter"><code>interfaces = eth1, eth2, lo</code></em></td></tr><tr><td><a class="indexterm" name="id2553304"></a><em class="parameter"><code>bind interfaces only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2553316"></a><em class="parameter"><code>passdb backend = tdbsam</code></em></td></tr><tr><td><a class="indexterm" name="id2553327"></a><em class="parameter"><code>pam password change = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2553339"></a><em class="parameter"><code>passwd program = /usr/bin/passwd %u</code></em></td></tr><tr><td><a class="indexterm" name="id2553351"></a><em class="parameter"><code>passwd chat = *New*Password* %n\n *Re-enter*new*password*%n\n *Password*changed*</code></em></td></tr><tr><td><a class="indexterm" name="id2553364"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2553376"></a><em class="parameter"><code>unix password sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2553388"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2553399"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2553411"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2553423"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id2553434"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2553446"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2553458"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2553470"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2553482"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2553494"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2553506"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2553518"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2553530"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2553543"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -G '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2553555"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /tmp '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2553568"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id2553580"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id2553592"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2553604"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2553616"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2553628"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2553640"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2553651"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2553663"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2553675"></a><em class="parameter"><code>utmp = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2553686"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2553698"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2553710"></a><em class="parameter"><code>cups options = Raw</code></em></td></tr><tr><td><a class="indexterm" name="id2553722"></a><em class="parameter"><code>veto files = /*.eml/*.nws/*.{*}/</code></em></td></tr><tr><td><a class="indexterm" name="id2553733"></a><em class="parameter"><code>veto oplock files = /*.doc/*.xls/*.mdb/</code></em></td></tr></table></div></div><p><br class="example-break">551 552 </p><div class="example"><a name="promisnetsvca"></a><p class="title"><b>Example 3.5. 130 User Network with <span class="emphasis"><em>tdbsam</em></span> Services Section Part A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id255377 7"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2553789"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2553800"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2553812"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2553832"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2553844"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2553856"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2553867"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2553879"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2553891"></a><em class="parameter"><code>default devmode = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2553903"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2553923"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2553935"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2553947"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2553958"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2553979"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2553991"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2554003"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2554014"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id2554035"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id2554047"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id2554058"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><p><br class="example-break">553 554 </p><div class="example"><a name="promisnetsvcb"></a><p class="title"><b>Example 3.6. 130 User Network with <span class="emphasis"><em>tdbsam</em></span> Services Section Part B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id2554 102"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id2554113"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id2554125"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id2554145"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id2554157"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id2554169"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id2554189"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id2554201"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id2554213"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2554224"></a><em class="parameter"><code>admin users = bjordan</code></em></td></tr></table></div></div><p><br class="example-break">555 </p></li><li><p> 556 <a class="indexterm" name="id25542 44"></a><a class="indexterm" name="id2554249"></a>550 </p><div class="example"><a name="promisnet"></a><p class="title"><b>Example 3.4. 130 User Network with <span class="emphasis"><em>tdbsam</em></span> [globals] Section</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2553264"></a><em class="parameter"><code>workgroup = PROMISES</code></em></td></tr><tr><td><a class="indexterm" name="id2553275"></a><em class="parameter"><code>netbios name = DIAMOND</code></em></td></tr><tr><td><a class="indexterm" name="id2553287"></a><em class="parameter"><code>interfaces = eth1, eth2, lo</code></em></td></tr><tr><td><a class="indexterm" name="id2553299"></a><em class="parameter"><code>bind interfaces only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2553311"></a><em class="parameter"><code>passdb backend = tdbsam</code></em></td></tr><tr><td><a class="indexterm" name="id2553323"></a><em class="parameter"><code>pam password change = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2553335"></a><em class="parameter"><code>passwd program = /usr/bin/passwd %u</code></em></td></tr><tr><td><a class="indexterm" name="id2553347"></a><em class="parameter"><code>passwd chat = *New*Password* %n\n *Re-enter*new*password*%n\n *Password*changed*</code></em></td></tr><tr><td><a class="indexterm" name="id2553359"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2553371"></a><em class="parameter"><code>unix password sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2553383"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2553395"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2553406"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2553418"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id2553430"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2553442"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2553454"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2553465"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2553477"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2553489"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2553501"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2553514"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2553526"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2553538"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -G '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2553551"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /tmp '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2553563"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id2553576"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id2553588"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2553600"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2553612"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2553623"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2553635"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2553647"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2553659"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2553670"></a><em class="parameter"><code>utmp = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2553682"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2553694"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2553705"></a><em class="parameter"><code>cups options = Raw</code></em></td></tr><tr><td><a class="indexterm" name="id2553717"></a><em class="parameter"><code>veto files = /*.eml/*.nws/*.{*}/</code></em></td></tr><tr><td><a class="indexterm" name="id2553729"></a><em class="parameter"><code>veto oplock files = /*.doc/*.xls/*.mdb/</code></em></td></tr></table></div></div><p><br class="example-break"> 551 552 </p><div class="example"><a name="promisnetsvca"></a><p class="title"><b>Example 3.5. 130 User Network with <span class="emphasis"><em>tdbsam</em></span> Services Section Part A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2553773"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2553784"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2553796"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2553807"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2553828"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2553839"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2553851"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2553863"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2553874"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2553886"></a><em class="parameter"><code>default devmode = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2553898"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2553919"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2553930"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2553942"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2553954"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2553974"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2553986"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2553998"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2554010"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id2554030"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id2554042"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id2554054"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><p><br class="example-break"> 553 554 </p><div class="example"><a name="promisnetsvcb"></a><p class="title"><b>Example 3.6. 130 User Network with <span class="emphasis"><em>tdbsam</em></span> Services Section Part B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id2554097"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id2554109"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id2554121"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id2554141"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id2554153"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id2554164"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id2554185"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id2554196"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id2554208"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2554220"></a><em class="parameter"><code>admin users = bjordan</code></em></td></tr></table></div></div><p><br class="example-break"> 555 </p></li><li><p> 556 <a class="indexterm" name="id2554239"></a><a class="indexterm" name="id2554245"></a> 557 557 Add the <code class="constant">root</code> user to the password backend as follows: 558 558 </p><pre class="screen"> … … 567 567 without considerable trouble. 568 568 </p></li><li><p> 569 <a class="indexterm" name="id255429 7"></a>569 <a class="indexterm" name="id2554292"></a> 570 570 Create the username map file to permit the <code class="constant">root</code> account to be called 571 571 <code class="constant">Administrator</code> from the Windows network environment. To do this, create … … 594 594 </pre><p> 595 595 </p></li><li><p> 596 <a class="indexterm" name="id25543 41"></a>597 <a class="indexterm" name="id255434 8"></a>598 <a class="indexterm" name="id255435 9"></a>599 <a class="indexterm" name="id25543 71"></a>596 <a class="indexterm" name="id2554337"></a> 597 <a class="indexterm" name="id2554343"></a> 598 <a class="indexterm" name="id2554355"></a> 599 <a class="indexterm" name="id2554366"></a> 600 600 Create and map Windows Domain Groups to UNIX groups. A sample script is provided in <a class="link" href="small.html" title="Chapter 2. Small Office Networking">“Small Office Networking”</a>, 601 601 <a class="link" href="small.html#initGrps" title="Example 2.1. Script to Map Windows NT Groups to UNIX Groups">“Script to Map Windows NT Groups to UNIX Groups”</a>. Create a file containing this script. We called ours … … 603 603 and then execute the script. Sample output should be as follows: 604 604 605 </p><div class="example"><a name="ch4initGrps"></a><p class="title"><b>Example 3.7. Script to Map Windows NT Groups to UNIX Groups</b></p><div class="example-contents"><a class="indexterm" name="id255441 4"></a><pre class="screen">605 </p><div class="example"><a name="ch4initGrps"></a><p class="title"><b>Example 3.7. Script to Map Windows NT Groups to UNIX Groups</b></p><div class="example-contents"><a class="indexterm" name="id2554410"></a><pre class="screen"> 606 606 #!/bin/bash 607 607 # … … 656 656 </pre><p> 657 657 </p></li><li><p> 658 <a class="indexterm" name="id25544 91"></a>659 <a class="indexterm" name="id255449 8"></a>660 <a class="indexterm" name="id255450 4"></a>661 <a class="indexterm" name="id25545 11"></a>662 <a class="indexterm" name="id255451 8"></a>663 <a class="indexterm" name="id255452 5"></a>664 <a class="indexterm" name="id25545 34"></a>658 <a class="indexterm" name="id2554486"></a> 659 <a class="indexterm" name="id2554493"></a> 660 <a class="indexterm" name="id2554500"></a> 661 <a class="indexterm" name="id2554507"></a> 662 <a class="indexterm" name="id2554513"></a> 663 <a class="indexterm" name="id2554520"></a> 664 <a class="indexterm" name="id2554529"></a> 665 665 There is one preparatory step without which you will not have a working Samba 666 666 network environment. You must add an account for each network user. … … 687 687 You do of course use a valid user login ID in place of <em class="parameter"><code>username</code></em>. 688 688 </p></li><li><p> 689 <a class="indexterm" name="id255464 9"></a>690 <a class="indexterm" name="id255465 8"></a>691 <a class="indexterm" name="id255466 7"></a>689 <a class="indexterm" name="id2554644"></a> 690 <a class="indexterm" name="id2554654"></a> 691 <a class="indexterm" name="id2554663"></a> 692 692 Using the preferred tool for your UNIX system, add each user to the UNIX groups created 693 693 previously as necessary. File system access control will be based on UNIX group membership. … … 698 698 file system partition using appropriate system tools. 699 699 </p></li><li><p> 700 <a class="indexterm" name="id255470 9"></a>700 <a class="indexterm" name="id2554705"></a> 701 701 Create the top-level file storage directories for data and applications as follows: 702 702 </p><pre class="screen"> … … 739 739 </pre><p> 740 740 </p></li><li><p> 741 <a class="indexterm" name="id25549 22"></a>742 <a class="indexterm" name="id255492 8"></a>743 <a class="indexterm" name="id255493 5"></a>741 <a class="indexterm" name="id2554917"></a> 742 <a class="indexterm" name="id2554924"></a> 743 <a class="indexterm" name="id2554931"></a> 744 744 Create a logon script. It is important that each line is correctly terminated with 745 745 a carriage return and line-feed combination (i.e., DOS encoding). The following procedure … … 761 761 foundational to Internet access as well as to trouble-free operation of local networking. When 762 762 you have completed this section, the server should be ready for solid duty operation. 763 </p><div class="procedure"><a name="id25550 10"></a><p class="title"><b>Procedure 3.3. DHCP and DNS Server Configuration Steps</b></p><ol type="1"><li><p>764 <a class="indexterm" name="id25550 22"></a>763 </p><div class="procedure"><a name="id2555006"></a><p class="title"><b>Procedure 3.3. DHCP and DNS Server Configuration Steps</b></p><ol type="1"><li><p> 764 <a class="indexterm" name="id2555017"></a> 765 765 Create a file called <code class="filename">/etc/dhcpd.conf</code> with the contents as 766 766 shown in <a class="link" href="secure.html#prom-dhcp" title="Example 3.8. DHCP Server Configuration File /etc/dhcpd.conf">“DHCP Server Configuration File /etc/dhcpd.conf”</a>. … … 813 813 </pre></div></div><p><br class="example-break"> 814 814 </p></li><li><p> 815 <a class="indexterm" name="id255509 7"></a>815 <a class="indexterm" name="id2555092"></a> 816 816 Create a file called <code class="filename">/etc/named.conf</code> that has the combined contents 817 817 of the <a class="link" href="secure.html#ch4namedcfg" title="Example 3.9. DNS Master Configuration File /etc/named.conf Master Section">“DNS Master Configuration File /etc/named.conf Master Section”</a>, <a class="link" href="secure.html#ch4namedvarfwd" title="Example 3.10. DNS Master Configuration File /etc/named.conf Forward Lookup Definition Section">“DNS Master Configuration File /etc/named.conf Forward Lookup Definition Section”</a>, and … … 824 824 </p><div class="table"><a name="namedrscfiles"></a><p class="title"><b>Table 3.2. DNS (named) Resource Files</b></p><div class="table-contents"><table summary="DNS (named) Resource Files" border="1"><colgroup><col align="left"><col align="left"></colgroup><thead><tr><th align="left">Reference</th><th align="left">File Location</th></tr></thead><tbody><tr><td align="left"><a class="link" href="appendix.html#loopback" title="Example 15.3. DNS Localhost Forward Zone File: /var/lib/named/localhost.zone">“DNS Localhost Forward Zone File: /var/lib/named/localhost.zone”</a></td><td align="left">/var/lib/named/localhost.zone</td></tr><tr><td align="left"><a class="link" href="appendix.html#dnsloopy" title="Example 15.4. DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone">“DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone”</a></td><td align="left">/var/lib/named/127.0.0.zone</td></tr><tr><td align="left"><a class="link" href="appendix.html#roothint" title="Example 15.5. DNS Root Name Server Hint File: /var/lib/named/root.hint">“DNS Root Name Server Hint File: /var/lib/named/root.hint”</a></td><td align="left">/var/lib/named/root.hint</td></tr><tr><td align="left"><a class="link" href="secure.html#abmasbiz" title="Example 3.14. DNS Abmas.biz Forward Zone File">“DNS Abmas.biz Forward Zone File”</a></td><td align="left">/var/lib/named/master/abmas.biz.hosts</td></tr><tr><td align="left"><a class="link" href="secure.html#abmasus" title="Example 3.15. DNS Abmas.us Forward Zone File">“DNS Abmas.us Forward Zone File”</a></td><td align="left">/var/lib/named/abmas.us.hosts</td></tr><tr><td align="left"><a class="link" href="secure.html#eth1zone" title="Example 3.12. DNS 192.168.1 Reverse Zone File">“DNS 192.168.1 Reverse Zone File”</a></td><td align="left">/var/lib/named/192.168.1.0.rev</td></tr><tr><td align="left"><a class="link" href="secure.html#eth2zone" title="Example 3.13. DNS 192.168.2 Reverse Zone File">“DNS 192.168.2 Reverse Zone File”</a></td><td align="left">/var/lib/named/192.168.2.0.rev</td></tr></tbody></table></div></div><p><br class="table-break"> 825 825 826 </p><div class="example"><a name="ch4namedcfg"></a><p class="title"><b>Example 3.9. DNS Master Configuration File <code class="filename">/etc/named.conf</code> Master Section</b></p><div class="example-contents"><a class="indexterm" name="id255530 8"></a><pre class="screen">826 </p><div class="example"><a name="ch4namedcfg"></a><p class="title"><b>Example 3.9. DNS Master Configuration File <code class="filename">/etc/named.conf</code> Master Section</b></p><div class="example-contents"><a class="indexterm" name="id2555304"></a><pre class="screen"> 827 827 ### 828 828 # Abmas Biz DNS Control File … … 1009 1009 1010 1010 </p></li><li><p> 1011 <a class="indexterm" name="id25555 22"></a><a class="indexterm" name="id2555528"></a>1011 <a class="indexterm" name="id2555517"></a><a class="indexterm" name="id2555523"></a> 1012 1012 All DNS name resolution should be handled locally. To ensure that the server is configured 1013 1013 correctly to handle this, edit <code class="filename">/etc/resolv.conf</code> to have the following … … 1018 1018 nameserver 123.45.54.23 1019 1019 </pre><p> 1020 <a class="indexterm" name="id25555 53"></a>1020 <a class="indexterm" name="id2555548"></a> 1021 1021 This instructs the name resolver function (when configured correctly) to ask the DNS server 1022 1022 that is running locally to resolve names to addresses. In the event that the local name server … … 1024 1024 purely local names to IP addresses. 1025 1025 </p></li><li><p> 1026 <a class="indexterm" name="id25555 74"></a>1026 <a class="indexterm" name="id2555569"></a> 1027 1027 The final step is to edit the <code class="filename">/etc/nsswitch.conf</code> file. 1028 1028 This file controls the operation of the various resolver libraries that are part of the Linux … … 1043 1043 submitted to it. In other words, our configuration turns CUPS into a raw-mode print queue. This means that 1044 1044 the correct printer driver must be installed on all clients. 1045 </p><div class="procedure"><a name="id25556 32"></a><p class="title"><b>Procedure 3.4. Printer Configuration Steps</b></p><ol type="1"><li><p>1045 </p><div class="procedure"><a name="id2555628"></a><p class="title"><b>Procedure 3.4. Printer Configuration Steps</b></p><ol type="1"><li><p> 1046 1046 Configure each printer to be a DHCP client, carefully following the manufacturer's guidelines. 1047 1047 </p></li><li><p> … … 1050 1050 port as necessary in the following example commands. 1051 1051 This allows the CUPS spooler to print using raw mode protocols. 1052 <a class="indexterm" name="id255565 8"></a>1053 <a class="indexterm" name="id255566 5"></a>1052 <a class="indexterm" name="id2555653"></a> 1053 <a class="indexterm" name="id2555660"></a> 1054 1054 </p></li><li><p> 1055 <a class="indexterm" name="id255567 8"></a><a class="indexterm" name="id2555686"></a>1055 <a class="indexterm" name="id2555674"></a><a class="indexterm" name="id2555682"></a> 1056 1056 Configure the CUPS Print Queues as follows: 1057 1057 </p><pre class="screen"> … … 1061 1061 <code class="prompt">root# </code> lpadmin -p hplj6f -v socket://hplj6f.abmas.biz:9100 -E 1062 1062 </pre><p> 1063 <a class="indexterm" name="id255572 9"></a>1063 <a class="indexterm" name="id2555725"></a> 1064 1064 This creates the necessary print queues with no assigned print filter. 1065 </p></li><li><p><a class="indexterm" name="id25557 44"></a>1065 </p></li><li><p><a class="indexterm" name="id2555739"></a> 1066 1066 Print queues may not be enabled at creation. Use <code class="literal">lpc stat</code> to check 1067 1067 the status of the print queues and, if necessary, make certain that the queues you have … … 1073 1073 <code class="prompt">root# </code> /usr/bin/enable hplj6f 1074 1074 </pre><p> 1075 </p></li><li><p><a class="indexterm" name="id255579 8"></a>1075 </p></li><li><p><a class="indexterm" name="id2555794"></a> 1076 1076 Even though your print queues may be enabled, it is still possible that they 1077 1077 are not accepting print jobs. A print queue services incoming printing … … 1085 1085 </pre><p> 1086 1086 </p></li><li><p> 1087 <a class="indexterm" name="id255584 9"></a>1088 <a class="indexterm" name="id255585 6"></a>1089 <a class="indexterm" name="id25558 63"></a>1087 <a class="indexterm" name="id2555845"></a> 1088 <a class="indexterm" name="id2555852"></a> 1089 <a class="indexterm" name="id2555859"></a> 1090 1090 Edit the file <code class="filename">/etc/cups/mime.convs</code> to uncomment the line: 1091 1091 </p><pre class="screen"> … … 1093 1093 </pre><p> 1094 1094 </p></li><li><p> 1095 <a class="indexterm" name="id25558 91"></a>1095 <a class="indexterm" name="id2555886"></a> 1096 1096 Edit the file <code class="filename">/etc/cups/mime.types</code> to uncomment the line: 1097 1097 </p><pre class="screen"> … … 1106 1106 The UNIX system print queues have been configured and are ready for validation testing. 1107 1107 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="procstart"></a>Process Startup Configuration</h3></div></div></div><p> 1108 <a class="indexterm" name="id255595 6"></a>1108 <a class="indexterm" name="id2555952"></a> 1109 1109 There are two essential steps to process startup configuration. First, the process 1110 1110 must be configured so that it automatically restarts each time the server … … 1115 1115 necessary start or kill script is run. 1116 1116 </p><p> 1117 <a class="indexterm" name="id25559 92"></a>1118 <a class="indexterm" name="id255599 8"></a>1119 <a class="indexterm" name="id255600 5"></a>1120 <a class="indexterm" name="id25560 12"></a>1121 <a class="indexterm" name="id255601 9"></a>1117 <a class="indexterm" name="id2555987"></a> 1118 <a class="indexterm" name="id2555994"></a> 1119 <a class="indexterm" name="id2556001"></a> 1120 <a class="indexterm" name="id2556008"></a> 1121 <a class="indexterm" name="id2556014"></a> 1122 1122 In the event that a service is not run as a daemon, but via the internetworking 1123 1123 super daemon (<code class="literal">inetd</code> or <code class="literal">xinetd</code>), then the <code class="literal">chkconfig</code> … … 1130 1130 Use the standard system tool to configure each service to restart 1131 1131 automatically at every system reboot. For example, 1132 <a class="indexterm" name="id25560 70"></a>1132 <a class="indexterm" name="id2556066"></a> 1133 1133 </p><pre class="screen"> 1134 1134 <code class="prompt">root# </code> chkconfig dhpcd on … … 1138 1138 </pre><p> 1139 1139 </p></li><li><p> 1140 <a class="indexterm" name="id255611 4"></a>1141 <a class="indexterm" name="id25561 21"></a>1142 <a class="indexterm" name="id255612 8"></a>1140 <a class="indexterm" name="id2556110"></a> 1141 <a class="indexterm" name="id2556117"></a> 1142 <a class="indexterm" name="id2556124"></a> 1143 1143 Now start each service to permit the system to be validated. 1144 1144 Execute each of the following in the sequence shown: … … 1151 1151 </pre><p> 1152 1152 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch4valid"></a>Validation</h3></div></div></div><p> 1153 <a class="indexterm" name="id25561 83"></a>1153 <a class="indexterm" name="id2556178"></a> 1154 1154 Complex networking problems are most often caused by simple things that are poorly or incorrectly 1155 1155 configured. The validation process adopted here should be followed carefully; it is the result of the … … 1161 1161 Later in this book you learn how to make users happier. For now, it is enough to learn to 1162 1162 validate. Let's get on with it. 1163 </p><div class="procedure"><a name="id255620 5"></a><p class="title"><b>Procedure 3.5. Server Validation Steps</b></p><ol type="1"><li><p>1164 <a class="indexterm" name="id255621 6"></a>1163 </p><div class="procedure"><a name="id2556201"></a><p class="title"><b>Procedure 3.5. Server Validation Steps</b></p><ol type="1"><li><p> 1164 <a class="indexterm" name="id2556212"></a> 1165 1165 One of the most important facets of Samba configuration is to ensure that 1166 1166 name resolution functions correctly. You can check name resolution … … 1188 1188 is working. 1189 1189 </p></li><li><p> 1190 <a class="indexterm" name="id255628 6"></a>1190 <a class="indexterm" name="id2556281"></a> 1191 1191 So far, your installation is going particularly well. In this step we validate 1192 1192 DNS server and name resolution operation. Using your favorite UNIX system editor, … … 1197 1197 </pre><p> 1198 1198 </p></li><li><p> 1199 <a class="indexterm" name="id255631 9"></a>1199 <a class="indexterm" name="id2556314"></a> 1200 1200 Before you test DNS operation, it is a good idea to verify that the DNS server 1201 1201 is running by executing the following: … … 1211 1211 </pre><p> 1212 1212 This means that we are ready to check DNS operation. Do so by executing: 1213 <a class="indexterm" name="id255634 9"></a>1213 <a class="indexterm" name="id2556344"></a> 1214 1214 </p><pre class="screen"> 1215 1215 <code class="prompt">root# </code> ping diamond … … 1227 1227 sleeth1.abmas.biz has address 192.168.1.1 1228 1228 </pre><p> 1229 <a class="indexterm" name="id255638 7"></a>1229 <a class="indexterm" name="id2556383"></a> 1230 1230 You may now remove the entry called <code class="constant">diamond</code> from the 1231 1231 <code class="filename">/etc/hosts</code> file. It does not hurt to leave it there, 1232 1232 but its removal reduces the number of administrative steps for this name. 1233 1233 </p></li><li><p> 1234 <a class="indexterm" name="id25564 13"></a>1234 <a class="indexterm" name="id2556408"></a> 1235 1235 WINS is a great way to resolve NetBIOS names to their IP address. You can test 1236 1236 the operation of WINS by starting <code class="literal">nmbd</code> (manually or by way … … 1251 1251 64 bytes from 192.168.1.1: icmp_seq=2 ttl=64 time=0.479 ms 1252 1252 </pre><p> 1253 <a class="indexterm" name="id255650 5"></a>1253 <a class="indexterm" name="id2556500"></a> 1254 1254 Now that you can relax with the knowledge that all three major forms of name 1255 1255 resolution to IP address resolution are working, edit the <code class="filename">/etc/nsswitch.conf</code> … … 1272 1272 comes when you try to add the first DHCP client to the network. 1273 1273 </p></li><li><p> 1274 <a class="indexterm" name="id255656 5"></a>1274 <a class="indexterm" name="id2556560"></a> 1275 1275 This is a good point at which to start validating Samba operation. You are 1276 1276 content that name resolution is working for basic TCP/IP needs. Let's move on. … … 1344 1344 Clear away all errors before proceeding. 1345 1345 </p></li><li><p> 1346 <a class="indexterm" name="id255666 6"></a>1347 <a class="indexterm" name="id25566 72"></a>1348 <a class="indexterm" name="id255667 9"></a>1349 <a class="indexterm" name="id255668 6"></a>1346 <a class="indexterm" name="id2556661"></a> 1347 <a class="indexterm" name="id2556668"></a> 1348 <a class="indexterm" name="id2556674"></a> 1349 <a class="indexterm" name="id2556681"></a> 1350 1350 Check that the Samba server is running: 1351 1351 </p><pre class="screen"> … … 1360 1360 </pre><p> 1361 1361 The <code class="literal">winbindd</code> daemon is running in split mode (normal), so there are also 1362 two instances<sup>[<a name="id255671 7" href="#ftn.id2556717" class="footnote">7</a>]</sup> of it.1362 two instances<sup>[<a name="id2556713" href="#ftn.id2556713" class="footnote">7</a>]</sup> of it. 1363 1363 </p></li><li><p> 1364 <a class="indexterm" name="id255674 7"></a>1365 <a class="indexterm" name="id255675 4"></a>1364 <a class="indexterm" name="id2556743"></a> 1365 <a class="indexterm" name="id2556750"></a> 1366 1366 Check that an anonymous connection can be made to the Samba server: 1367 1367 </p><pre class="screen"> … … 1395 1395 a <code class="constant">NULL</code> password. 1396 1396 </p></li><li><p> 1397 <a class="indexterm" name="id25568 12"></a>1398 <a class="indexterm" name="id255681 9"></a>1399 <a class="indexterm" name="id255682 6"></a>1397 <a class="indexterm" name="id2556808"></a> 1398 <a class="indexterm" name="id2556815"></a> 1399 <a class="indexterm" name="id2556822"></a> 1400 1400 Verify that each printer has the IP address assigned in the DHCP server configuration file. 1401 1401 The easiest way to do this is to ping the printer name. Immediately after the ping response … … 1412 1412 hplj6a (192.168.1.30) at 00:03:47:CB:81:E0 [ether] on eth0 1413 1413 </pre><p> 1414 <a class="indexterm" name="id25568 73"></a>1414 <a class="indexterm" name="id2556868"></a> 1415 1415 The MAC address <code class="constant">00:03:47:CB:81:E0</code> matches that specified for the 1416 1416 IP address from which the printer has responded and with the entry for it in the 1417 1417 <code class="filename">/etc/dhcpd.conf</code> file. Repeat this for each printer configured. 1418 1418 </p></li><li><p> 1419 <a class="indexterm" name="id2556 902"></a>1419 <a class="indexterm" name="id2556897"></a> 1420 1420 Make an authenticated connection to the server using the <code class="literal">smbclient</code> tool: 1421 1421 </p><pre class="screen"> … … 1436 1436 </pre><p> 1437 1437 </p></li><li><p> 1438 <a class="indexterm" name="id255695 8"></a>1438 <a class="indexterm" name="id2556954"></a> 1439 1439 Your new server is connected to an Internet-accessible connection. Before you start 1440 1440 your firewall, you should run a port scanner against your system. You should repeat that … … 1511 1511 </pre><p> 1512 1512 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch4appscfg"></a>Application Share Configuration</h3></div></div></div><p> 1513 <a class="indexterm" name="id25570 62"></a>1514 <a class="indexterm" name="id255706 8"></a>1513 <a class="indexterm" name="id2557057"></a> 1514 <a class="indexterm" name="id2557064"></a> 1515 1515 The use of an application server is a key mechanism by which desktop administration overheads 1516 1516 can be reduced. Check the application manual for your software to identify how best to … … 1533 1533 of work files on the local workstation. 1534 1534 </p></li></ul></div><p> 1535 <a class="indexterm" name="id25571 20"></a>1535 <a class="indexterm" name="id2557116"></a> 1536 1536 A common application deployed in this environment is an office suite. 1537 1537 Enterprise editions of Microsoft Office XP Professional can be administratively installed … … 1550 1550 local disk space. In the latter case, when the applications are used, they load over the network. 1551 1551 </p><p> 1552 <a class="indexterm" name="id255715 8"></a>1553 <a class="indexterm" name="id255716 5"></a>1552 <a class="indexterm" name="id2557153"></a> 1553 <a class="indexterm" name="id2557160"></a> 1554 1554 Microsoft Office Service Packs can be unpacked to update an administrative share. This makes 1555 1555 it possible to update MS Office XP Professional for all users from a single installation … … 1560 1560 editing or by way of configuration options inside each Office XP Professional application. 1561 1561 </p><p> 1562 <a class="indexterm" name="id255718 6"></a>1562 <a class="indexterm" name="id2557182"></a> 1563 1563 OpenOffice.Org OpenOffice Version 1.1.0 can be installed locally. It can also 1564 1564 be installed to run off a network share. The latter is a most desirable solution for office-bound … … 1573 1573 share point. The full administrative OpenOffice share takes approximately 150 MB of disk 1574 1574 space. 1575 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id255721 8"></a>Comments Regarding Software Terms of Use</h4></div></div></div><p>1575 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2557213"></a>Comments Regarding Software Terms of Use</h4></div></div></div><p> 1576 1576 Many single-user products can be installed into an administrative share, but 1577 1577 personal versions of products such as Microsoft Office XP Professional do not permit this. … … 1597 1597 please do not use the software. 1598 1598 </p><p> 1599 <a class="indexterm" name="id255726 6"></a>1599 <a class="indexterm" name="id2557261"></a> 1600 1600 Samba is provided under the terms of the GNU GPL Version 2, a copy of which is provided 1601 1601 with the source code. … … 1608 1608 be done with notebook computers as long as they are identical or sufficiently similar. 1609 1609 </p><div class="procedure"><a name="sbewinclntprep"></a><p class="title"><b>Procedure 3.6. Windows Client Configuration Procedure</b></p><ol type="1"><li><p> 1610 <a class="indexterm" name="id255731 6"></a>1611 <a class="indexterm" name="id25573 23"></a>1610 <a class="indexterm" name="id2557312"></a> 1611 <a class="indexterm" name="id2557319"></a> 1612 1612 Install MS Windows XP Professional. During installation, configure the client to use DHCP for 1613 1613 TCP/IP protocol configuration. DHCP configures all Windows clients to use the WINS Server … … 1642 1642 preparation procedure below. 1643 1643 </p></li><li><p> 1644 <a class="indexterm" name="id25574 61"></a>1644 <a class="indexterm" name="id2557456"></a> 1645 1645 When you are satisfied that the staging systems are complete, use the appropriate procedure to 1646 1646 remove the client from the domain. Reboot the system and then log on as the local administrator … … 1651 1651 machine to a network share on the server. 1652 1652 </p></li><li><p> 1653 <a class="indexterm" name="id25574 90"></a>1654 <a class="indexterm" name="id255749 9"></a>1653 <a class="indexterm" name="id2557486"></a> 1654 <a class="indexterm" name="id2557495"></a> 1655 1655 You may now replicate the image to the target machines using the appropriate Norton Ghost 1656 1656 procedure. Make sure to use the procedure that ensures each machine has a unique … … 1687 1687 Repeat the printer installation steps above for both HP LaserJet 6 printers 1688 1688 as well as for both QMS Magicolor laser printers. 1689 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id255776 9"></a>Key Points Learned</h3></div></div></div><p>1689 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2557764"></a>Key Points Learned</h3></div></div></div><p> 1690 1690 How do you feel? You have built a capable network, a truly ambitious project. 1691 1691 Future network updates can be handled by … … 1710 1710 client in order to effect improved standardization of desktops and to reduce 1711 1711 the costs of network management. 1712 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id25578 31"></a>Questions and Answers</h2></div></div></div><p>1713 </p><div class="qandaset"><dl><dt>1. <a href="secure.html#id255784 7">1712 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2557826"></a>Questions and Answers</h2></div></div></div><p> 1713 </p><div class="qandaset"><dl><dt>1. <a href="secure.html#id2557842"> 1714 1714 What is the maximum number of account entries that the tdbsam 1715 1715 passdb backend can handle? 1716 </a></dt><dt>2. <a href="secure.html#id255791 6">1716 </a></dt><dt>2. <a href="secure.html#id2557911"> 1717 1717 Would Samba operate any better if the OS level is set to a value higher than 35? 1718 </a></dt><dt>3. <a href="secure.html#id255793 7">1718 </a></dt><dt>3. <a href="secure.html#id2557933"> 1719 1719 Why in this example have you provided UNIX group to Windows Group mappings for only Domain Groups? 1720 </a></dt><dt>4. <a href="secure.html#id25579 60">1720 </a></dt><dt>4. <a href="secure.html#id2557956"> 1721 1721 Why has a path been specified in the IPC$ share? 1722 </a></dt><dt>5. <a href="secure.html#id255798 9">1722 </a></dt><dt>5. <a href="secure.html#id2557984"> 1723 1723 Why does the smb.conf file in this exercise include an entry for smb ports? 1724 </a></dt><dt>6. <a href="secure.html#id255803 5">1724 </a></dt><dt>6. <a href="secure.html#id2558031"> 1725 1725 What is the difference between a print queue and a printer? 1726 </a></dt><dt>7. <a href="secure.html#id25580 71">1726 </a></dt><dt>7. <a href="secure.html#id2558067"> 1727 1727 Can all MS Windows application software be installed onto an application server share? 1728 </a></dt><dt>8. <a href="secure.html#id255809 6">1728 </a></dt><dt>8. <a href="secure.html#id2558091"> 1729 1729 Why use dynamic DNS (DDNS)? 1730 </a></dt><dt>9. <a href="secure.html#id255811 5">1730 </a></dt><dt>9. <a href="secure.html#id2558111"> 1731 1731 Why would you use WINS as well as DNS-based name resolution? 1732 </a></dt><dt>10. <a href="secure.html#id2558 200">1732 </a></dt><dt>10. <a href="secure.html#id2558196"> 1733 1733 What are the major benefits of using an application server? 1734 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id255784 7"></a><a name="id2557849"></a><p><b>1.</b></p></td><td align="left" valign="top"><p>1734 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2557842"></a><a name="id2557844"></a><p><b>1.</b></p></td><td align="left" valign="top"><p> 1735 1735 What is the maximum number of account entries that the <em class="parameter"><code>tdbsam</code></em> 1736 1736 passdb backend can handle? … … 1758 1758 not provide a mechanism for replicating tdbsam data so it can be used by a BDC. The 1759 1759 limitation of 250 users per tdbsam is predicated only on the need for replication, 1760 not on the limits<sup>[<a name="id255790 5" href="#ftn.id2557905" class="footnote">8</a>]</sup> of the tdbsam backend itself.1761 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id255791 6"></a><a name="id2557918"></a><p><b>2.</b></p></td><td align="left" valign="top"><p>1760 not on the limits<sup>[<a name="id2557900" href="#ftn.id2557900" class="footnote">8</a>]</sup> of the tdbsam backend itself. 1761 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2557911"></a><a name="id2557913"></a><p><b>2.</b></p></td><td align="left" valign="top"><p> 1762 1762 Would Samba operate any better if the OS level is set to a value higher than 35? 1763 1763 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1765 1765 of 35 already assures Samba of precedence over MS Windows products in browser elections. There is 1766 1766 no gain to be had from setting this higher. 1767 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id255793 7"></a><a name="id2557940"></a><p><b>3.</b></p></td><td align="left" valign="top"><p>1767 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2557933"></a><a name="id2557935"></a><p><b>3.</b></p></td><td align="left" valign="top"><p> 1768 1768 Why in this example have you provided UNIX group to Windows Group mappings for only Domain Groups? 1769 1769 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1771 1771 a later date Samba may make use of Windows Local Groups, as well as of the Active Directory special 1772 1772 Groups. Proper operation requires Domain Groups to be mapped to valid UNIX groups. 1773 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id25579 60"></a><a name="id2557962"></a><p><b>4.</b></p></td><td align="left" valign="top"><p>1773 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2557956"></a><a name="id2557958"></a><p><b>4.</b></p></td><td align="left" valign="top"><p> 1774 1774 Why has a path been specified in the <em class="parameter"><code>IPC$</code></em> share? 1775 1775 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1777 1777 obtain access to the file system, it does so at a location that presents least risk. Under normal operation 1778 1778 this type of paranoid step should not be necessary. The use of this parameter should not be necessary. 1779 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id255798 9"></a><a name="id2557991"></a><p><b>5.</b></p></td><td align="left" valign="top"><p>1779 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2557984"></a><a name="id2557986"></a><p><b>5.</b></p></td><td align="left" valign="top"><p> 1780 1780 Why does the <code class="filename">smb.conf</code> file in this exercise include an entry for <a class="link" href="smb.conf.5.html#SMBPORTS">smb ports</a>? 1781 1781 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1786 1786 The result of this is improved network performance. Where Samba-3 is installed as an Active Directory Domain 1787 1787 member, the default behavior is highly beneficial and should not be changed. 1788 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id255803 5"></a><a name="id2558037"></a><p><b>6.</b></p></td><td align="left" valign="top"><p>1788 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2558031"></a><a name="id2558033"></a><p><b>6.</b></p></td><td align="left" valign="top"><p> 1789 1789 What is the difference between a print queue and a printer? 1790 1790 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1800 1800 and the job is then submitted to a sequential print queue where the job is stored until 1801 1801 the printer is ready to receive the job. 1802 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id25580 71"></a><a name="id2558073"></a><p><b>7.</b></p></td><td align="left" valign="top"><p>1802 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2558067"></a><a name="id2558069"></a><p><b>7.</b></p></td><td align="left" valign="top"><p> 1803 1803 Can all MS Windows application software be installed onto an application server share? 1804 1804 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1808 1808 Professional do not permit installation to an application server share and can be installed 1809 1809 and used only to/from a local workstation hard disk. 1810 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id255809 6"></a><a name="id2558098"></a><p><b>8.</b></p></td><td align="left" valign="top"><p>1810 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2558091"></a><a name="id2558094"></a><p><b>8.</b></p></td><td align="left" valign="top"><p> 1811 1811 Why use dynamic DNS (DDNS)? 1812 1812 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1814 1814 network clients that are not NetBIOS-enabled, and thus cannot use WINS, to locate 1815 1815 Windows clients via DNS. 1816 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id255811 5"></a><a name="id2558118"></a><p><b>9.</b></p></td><td align="left" valign="top"><p>1816 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2558111"></a><a name="id2558113"></a><p><b>9.</b></p></td><td align="left" valign="top"><p> 1817 1817 Why would you use WINS as well as DNS-based name resolution? 1818 1818 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1822 1822 expression that may be up to 1024 characters in length and that represents an IP address. 1823 1823 A NetBIOS name is always 16 characters long. The 16<sup>th</sup> character 1824 is a name type indicator. A specific name type is registered<sup>[<a name="id25581 53" href="#ftn.id2558153" class="footnote">9</a>]</sup> for each1824 is a name type indicator. A specific name type is registered<sup>[<a name="id2558148" href="#ftn.id2558148" class="footnote">9</a>]</sup> for each 1825 1825 type of service that is provided by the Windows server or client and that may be registered 1826 1826 where a WINS server is in use. … … 1837 1837 </p><p> 1838 1838 Windows 200x Active Directory requires the registration in the DNS zone for the domain it 1839 controls of service locator<sup>[<a name="id255818 7" href="#ftn.id2558187" class="footnote">10</a>]</sup> records1839 controls of service locator<sup>[<a name="id2558182" href="#ftn.id2558182" class="footnote">10</a>]</sup> records 1840 1840 that Windows clients and servers will use to locate Kerberos and LDAP services. ADS also 1841 1841 requires the registration of special records that are called global catalog (GC) entries 1842 1842 and site entries by which domain controllers and other essential ADS servers may be located. 1843 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2558 200"></a><a name="id2558202"></a><p><b>10.</b></p></td><td align="left" valign="top"><p>1843 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2558196"></a><a name="id2558198"></a><p><b>10.</b></p></td><td align="left" valign="top"><p> 1844 1844 What are the major benefits of using an application server? 1845 1845 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1848 1848 one location for all major applications used. This results in faster update roll-outs and 1849 1849 significantly better application usage control. 1850 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id255252 8" href="#id2552528" class="para">5</a>] </sup>See <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 3.1850 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id2552525" href="#id2552525" class="para">5</a>] </sup>See <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 3. 1851 1851 This is necessary so that Samba can act as a Domain Controller (PDC); see 1852 <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 4, for additional information.</p></div><div class="footnote"><p><sup>[<a name="ftn.id25529 42" href="#id2552942" class="para">6</a>] </sup>You may want to do the echo command last and include1853 "0" in the init scripts, since it opens up your network for a short time.</p></div><div class="footnote"><p><sup>[<a name="ftn.id255671 7" href="#id2556717" class="para">7</a>] </sup>For more information regarding winbindd, see <span class="emphasis"><em>TOSHARG2</em></span>,1852 <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 4, for additional information.</p></div><div class="footnote"><p><sup>[<a name="ftn.id2552938" href="#id2552938" class="para">6</a>] </sup>You may want to do the echo command last and include 1853 "0" in the init scripts, since it opens up your network for a short time.</p></div><div class="footnote"><p><sup>[<a name="ftn.id2556713" href="#id2556713" class="para">7</a>] </sup>For more information regarding winbindd, see <span class="emphasis"><em>TOSHARG2</em></span>, 1854 1854 Chapter 23, Section 23.3. The single instance of <code class="literal">smbd</code> is normal. One additional 1855 1855 <code class="literal">smbd</code> slave process is spawned for each SMB/CIFS client 1856 connection.</p></div><div class="footnote"><p><sup>[<a name="ftn.id255790 5" href="#id2557905" class="para">8</a>] </sup>Bench tests have shown that tdbsam is a very1856 connection.</p></div><div class="footnote"><p><sup>[<a name="ftn.id2557900" href="#id2557900" class="para">8</a>] </sup>Bench tests have shown that tdbsam is a very 1857 1857 effective database technology. There is surprisingly little performance loss even 1858 with over 4000 users.</p></div><div class="footnote"><p><sup>[<a name="ftn.id25581 53" href="#id2558153" class="para">9</a>] </sup>1859 See <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 9, for more information.</p></div><div class="footnote"><p><sup>[<a name="ftn.id255818 7" href="#id2558187" class="para">10</a>] </sup>See TOSHARG2, Chapter 9, Section 9.3.3.</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="small.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="ExNetworks.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="Big500users.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 2. Small Office Networking </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 4. The 500-User Office</td></tr></table></div></body></html>1858 with over 4000 users.</p></div><div class="footnote"><p><sup>[<a name="ftn.id2558148" href="#id2558148" class="para">9</a>] </sup> 1859 See <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 9, for more information.</p></div><div class="footnote"><p><sup>[<a name="ftn.id2558182" href="#id2558182" class="para">10</a>] </sup>See TOSHARG2, Chapter 9, Section 9.3.3.</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="small.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="ExNetworks.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="Big500users.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 2. Small Office Networking </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 4. The 500-User Office</td></tr></table></div></body></html> -
branches/samba-3.2.x/docs/htmldocs/Samba3-ByExample/simple.html
r204 r226 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 1. No-Frills Samba Servers</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="next" href="small.html" title="Chapter 2. Small Office Networking"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 1. No-Frills Samba Servers</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="ExNetworks.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="small.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="simple"></a>Chapter 1. No-Frills Samba Servers</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="simple.html#id25429 93">Introduction</a></span></dt><dt><span class="sect1"><a href="simple.html#id2543034">Assignment Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="simple.html#id2543078">Drafting Office</a></span></dt><dt><span class="sect2"><a href="simple.html#id2543849">Charity Administration Office</a></span></dt><dt><span class="sect2"><a href="simple.html#AccountingOffice">Accounting Office</a></span></dt></dl></dd><dt><span class="sect1"><a href="simple.html#id2547514">Questions and Answers</a></span></dt></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 1. No-Frills Samba Servers</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="next" href="small.html" title="Chapter 2. Small Office Networking"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 1. No-Frills Samba Servers</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="ExNetworks.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="small.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="simple"></a>Chapter 1. No-Frills Samba Servers</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="simple.html#id2542989">Introduction</a></span></dt><dt><span class="sect1"><a href="simple.html#id2543030">Assignment Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="simple.html#id2543074">Drafting Office</a></span></dt><dt><span class="sect2"><a href="simple.html#id2543845">Charity Administration Office</a></span></dt><dt><span class="sect2"><a href="simple.html#AccountingOffice">Accounting Office</a></span></dt></dl></dd><dt><span class="sect1"><a href="simple.html#id2547510">Questions and Answers</a></span></dt></dl></div><p> 2 2 This is the start of the real journey toward the successful deployment of Samba. For some this chapter 3 3 is the end of the road because their needs will have been adequately met. For others, this chapter is … … 5 5 example configurations of, for the greater part, complete networking solutions. The intent of this book 6 6 is to help you to get your Samba installation working with the least amount of pain and aggravation. 7 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id25429 93"></a>Introduction</h2></div></div></div><p>7 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2542989"></a>Introduction</h2></div></div></div><p> 8 8 This chapter lays the groundwork for understanding the basics of Samba operation. 9 9 Instead of a bland technical discussion, each principle is demonstrated by way of a 10 real-world scenario for which a working solution<sup>[<a name="id254300 5" href="#ftn.id2543005" class="footnote">1</a>]</sup> is fully described.10 real-world scenario for which a working solution<sup>[<a name="id2543001" href="#ftn.id2543001" class="footnote">1</a>]</sup> is fully described. 11 11 </p><p> 12 12 The practical exercises take you on a journey through a drafting office, a charity administration … … 18 18 you should aim to be a Samba expert, so do attempt to find better solutions and try them as you work your 19 19 way through the examples. 20 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id254303 4"></a>Assignment Tasks</h2></div></div></div><p>20 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2543030"></a>Assignment Tasks</h2></div></div></div><p> 21 21 Each case presented highlights different aspects of Windows networking for which a simple 22 22 Samba-based solution can be provided. Each has subtly different requirements taken from real-world cases. … … 29 29 </p><p> 30 30 Let's get started. 31 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id254307 8"></a>Drafting Office</h3></div></div></div><p>31 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2543074"></a>Drafting Office</h3></div></div></div><p> 32 32 Our fictitious company is called <span class="emphasis"><em>Abmas Design, Inc.</em></span> This is a three-person 33 33 computer-aided design (CAD) business that often has more work than can be handled. The … … 39 39 plans from each machine. The files available from the server must remain read-only. 40 40 Anyone should be able to access the plans at any time and without barriers or difficulty. 41 </p><p><a class="indexterm" name="id254310 5"></a>42 <a class="indexterm" name="id25431 12"></a>41 </p><p><a class="indexterm" name="id2543101"></a> 42 <a class="indexterm" name="id2543107"></a> 43 43 Mr. Bob Jordan has asked you to install the new server as economically as possible. The central 44 44 server has a Pentium-IV 1.6GHz CPU, 768MB RAM, a 20GB IDE boot drive, a 160GB IDE second disk … … 47 47 <a class="ulink" href="http://www.samba.org" target="_top">FTP</a> sites. (Note: Fedora CoreX indicates your favorite 48 48 version.) 49 </p><p><a class="indexterm" name="id25431 40"></a>49 </p><p><a class="indexterm" name="id2543136"></a> 50 50 The four permanent drafting machines (Microsoft Windows workstations) have attached printers 51 51 and plotters that are shared on a peer-to-peer basis by any and all network users. The intent … … 56 56 machine. The office works best with this arrangement and does not want to change anything. 57 57 Old habits are too ingrained. 58 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id25431 62"></a>Dissection and Discussion</h4></div></div></div><p>59 <a class="indexterm" name="id25431 70"></a>58 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2543158"></a>Dissection and Discussion</h4></div></div></div><p> 59 <a class="indexterm" name="id2543166"></a> 60 60 The requirements for this server installation demand simplicity. An anonymous read-only 61 61 file server adequately meets all needs. The network consultant determines how … … 64 64 </p><p> 65 65 It is not necessary to have specific users on the server. The site has a method for storing 66 all design files (plans). Each plan is stored in a directory that is named YYYYWW,<sup>[<a name="id25431 91" href="#ftn.id2543191" class="footnote">2</a>]</sup> where66 all design files (plans). Each plan is stored in a directory that is named YYYYWW,<sup>[<a name="id2543187" href="#ftn.id2543187" class="footnote">2</a>]</sup> where 67 67 YYYY is the year, and WW is the week of the year. This arrangement allows work to be stored 68 68 by week of year to preserve the filing technique the site is familiar with. … … 74 74 demanding the disk space that would be needed if a duplicate file copy were to be stored. 75 75 The share containing the plans is called <span class="emphasis"><em>Plans</em></span>. 76 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id25432 20"></a>Implementation</h4></div></div></div><p>76 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2543216"></a>Implementation</h4></div></div></div><p> 77 77 It is assumed that the server is fully installed and ready for installation and 78 78 configuration of Samba 3.0.20 and any support files needed. All TCP/IP addresses … … 80 80 <code class="constant">192.168.1.1</code> and the netmask is <code class="constant">255.255.255.0</code>. 81 81 The hostname of the server used is <code class="constant">server</code>. 82 </p><div class="procedure"><a name="id254324 6"></a><p class="title"><b>Procedure 1.1. Samba Server Configuration</b></p><ol type="1"><li><p>82 </p><div class="procedure"><a name="id2543241"></a><p class="title"><b>Procedure 1.1. Samba Server Configuration</b></p><ol type="1"><li><p> 83 83 Download the Samba-3 RPM packages for Red Hat Fedora Core2 from the Samba 84 84 <a class="ulink" href="http://www.samba.org" target="_top">FTP servers.</a> 85 85 </p></li><li><p> 86 <a class="indexterm" name="id25432 71"></a>87 <a class="indexterm" name="id25432 80"></a>86 <a class="indexterm" name="id2543267"></a> 87 <a class="indexterm" name="id2543276"></a> 88 88 Install the RPM package using either the Red Hat Linux preferred GUI 89 89 tool or the <code class="literal">rpm</code>: … … 101 101 and execute, and the group and everyone else to read and execute only. 102 102 </p><p> 103 <a class="indexterm" name="id254334 5"></a>103 <a class="indexterm" name="id2543340"></a> 104 104 Use Red Hat Linux system tools (refer to Red Hat instructions) 105 105 to format the 160GB hard drive with a suitable file system. An Ext3 file system … … 110 110 <code class="filename">/etc/samba</code> directory. 111 111 112 </p><div class="example"><a name="draft-smbconf"></a><p class="title"><b>Example 1.1. Drafting Office <code class="filename">smb.conf</code> File</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global Parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id25434 24"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2543435"></a><em class="parameter"><code>security = SHARE</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[Plans]</code></em></td></tr><tr><td><a class="indexterm" name="id2543456"></a><em class="parameter"><code>path = /plans</code></em></td></tr><tr><td><a class="indexterm" name="id2543467"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2543479"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr></table></div></div><p><br class="example-break">113 </p></li><li><p> 114 <a class="indexterm" name="id254349 8"></a>112 </p><div class="example"><a name="draft-smbconf"></a><p class="title"><b>Example 1.1. Drafting Office <code class="filename">smb.conf</code> File</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global Parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2543419"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2543431"></a><em class="parameter"><code>security = SHARE</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[Plans]</code></em></td></tr><tr><td><a class="indexterm" name="id2543451"></a><em class="parameter"><code>path = /plans</code></em></td></tr><tr><td><a class="indexterm" name="id2543463"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2543475"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr></table></div></div><p><br class="example-break"> 113 </p></li><li><p> 114 <a class="indexterm" name="id2543494"></a> 115 115 Verify that the <code class="filename">/etc/hosts</code> file contains the following entry: 116 116 </p><pre class="screen"> … … 119 119 120 120 </p></li><li><p> 121 <a class="indexterm" name="id254352 5"></a>122 <a class="indexterm" name="id254353 4"></a>123 <a class="indexterm" name="id25435 41"></a>121 <a class="indexterm" name="id2543520"></a> 122 <a class="indexterm" name="id2543530"></a> 123 <a class="indexterm" name="id2543536"></a> 124 124 Use the standard system tool to start Samba and to configure it to restart 125 125 automatically at every system reboot. For example, … … 128 128 <code class="prompt">root# </code> /etc/rc.d/init.d/smb restart 129 129 </pre><p> 130 </p></li></ol></div><div class="procedure"><a name="id25435 70"></a><p class="title"><b>Procedure 1.2. Windows Client Configuration</b></p><ol type="1"><li><p>130 </p></li></ol></div><div class="procedure"><a name="id2543566"></a><p class="title"><b>Procedure 1.2. Windows Client Configuration</b></p><ol type="1"><li><p> 131 131 Make certain that all clients are set to the same network address range as 132 132 used for the Samba server. For example, one client might have an IP 133 133 address 192.168.1.10. 134 134 </p></li><li><p> 135 <a class="indexterm" name="id25435 92"></a>135 <a class="indexterm" name="id2543587"></a> 136 136 Ensure that the netmask used on the Windows clients matches that used 137 137 for the Samba server. All clients must have the same netmask, such as 138 138 255.255.255.0. 139 139 </p></li><li><p> 140 <a class="indexterm" name="id254360 8"></a>140 <a class="indexterm" name="id2543603"></a> 141 141 Set the workgroup name on all clients to <code class="constant">MIDEARTH</code>. 142 142 </p></li><li><p> … … 146 146 and that it is possible to open that share to reveal its contents. 147 147 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="validate1"></a>Validation</h4></div></div></div><p> 148 <a class="indexterm" name="id254365 9"></a>148 <a class="indexterm" name="id2543655"></a> 149 149 The first priority in validating the new Samba configuration should be to check 150 150 that Samba answers on the loop-back interface. Then it is time to check that Samba … … 152 152 server. 153 153 </p><div class="procedure"><ol type="1"><li><p> 154 <a class="indexterm" name="id254367 9"></a>155 <a class="indexterm" name="id254368 6"></a>156 <a class="indexterm" name="id25436 93"></a>154 <a class="indexterm" name="id2543675"></a> 155 <a class="indexterm" name="id2543682"></a> 156 <a class="indexterm" name="id2543689"></a> 157 157 To check the ability to access the <code class="literal">smbd</code> daemon 158 158 services, execute the following: … … 173 173 MIDEARTH SERVER 174 174 </pre><p> 175 <a class="indexterm" name="id254372 6"></a>176 <a class="indexterm" name="id25437 33"></a>175 <a class="indexterm" name="id2543722"></a> 176 <a class="indexterm" name="id2543729"></a> 177 177 This indicates that Samba is able to respond on the loopback interface to 178 178 a NULL connection. The <em class="parameter"><code>-U%</code></em> means send an empty … … 189 189 <em class="parameter"><code>guest account</code></em> for all connections. 190 190 </p></li><li><p> 191 <a class="indexterm" name="id254378 7"></a>192 <a class="indexterm" name="id25437 94"></a>191 <a class="indexterm" name="id2543782"></a> 192 <a class="indexterm" name="id2543789"></a> 193 193 From the Windows 9x/Me client, launch Windows Explorer: 194 194 <span class="guiicon">[Desktop: right-click] Network Neighborhood</span>+<span class="guimenu">Explore</span> → <span class="guimenuitem">[Left Panel] [+] Entire Network</span> → <span class="guimenuitem">[Left Panel] [+] Server</span> → <span class="guimenuitem">[Left Panel] [+] Plans</span>. In the right panel you should see the files and directories 195 195 (folders) that are in the <span class="guiicon">Plans</span> share. 196 </p></li></ol></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id254384 9"></a>Charity Administration Office</h3></div></div></div><p>196 </p></li></ol></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2543845"></a>Charity Administration Office</h3></div></div></div><p> 197 197 The fictitious charity organization is called <span class="emphasis"><em>Abmas Vision NL</em></span>. This office 198 198 has five networked computers. Staff are all volunteers, staff changes are frequent. … … 217 217 file share. 218 218 </p><p> 219 <a class="indexterm" name="id254391 5"></a>220 <a class="indexterm" name="id25439 22"></a>219 <a class="indexterm" name="id2543911"></a> 220 <a class="indexterm" name="id2543917"></a> 221 221 Printer handling in Samba results in a significant level of confusion. Samba presents to the 222 222 MS Windows client only a print queue. The Samba <code class="literal">smbd</code> process passes a … … 232 232 used on this network. 233 233 </p><p> 234 <a class="indexterm" name="id254395 6"></a>234 <a class="indexterm" name="id2543952"></a> 235 235 The central server was donated by a local computer store. It is a dual processor Pentium-III 236 236 server, has 1GB RAM, a 3-Ware IDE RAID Controller that has four 200GB IDE hard drives, and a … … 243 243 to the printers was accepted. You have supplied SUSE Enterprise Linux Server 9 and 244 244 have upgraded Samba to version 3.0.20. 245 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id254397 9"></a>Dissection and Discussion</h4></div></div></div><p>246 <a class="indexterm" name="id254398 7"></a>247 <a class="indexterm" name="id25439 94"></a>248 <a class="indexterm" name="id254 4001"></a>249 <a class="indexterm" name="id254400 7"></a>245 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2543975"></a>Dissection and Discussion</h4></div></div></div><p> 246 <a class="indexterm" name="id2543983"></a> 247 <a class="indexterm" name="id2543989"></a> 248 <a class="indexterm" name="id2543996"></a> 249 <a class="indexterm" name="id2544003"></a> 250 250 This installation demands simplicity. Frequent turnover of volunteer staff indicates that 251 251 a network environment that requires users to logon might be problematic. It is suggested that the … … 259 259 an inadvertent ACL from overriding actual file permissions. 260 260 </p><p> 261 <a class="indexterm" name="id254404 9"></a>262 <a class="indexterm" name="id254405 5"></a>263 <a class="indexterm" name="id25440 62"></a>261 <a class="indexterm" name="id2544044"></a> 262 <a class="indexterm" name="id2544051"></a> 263 <a class="indexterm" name="id2544058"></a> 264 264 This organization is a prime candidate for Share Mode security. The <em class="parameter"><code>force user</code></em> 265 265 allows all files to be owned by the same user and group. In addition, it would not hurt to … … 268 268 For further information regarding the significance of the SUID/SGID settings, see <a class="link" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">“A Collection of Useful Tidbits”</a>, <a class="link" href="appendix.html#ch12-SUIDSGID" title="Effect of Setting File and Directory SUID/SGID Permissions Explained">“Effect of Setting File and Directory SUID/SGID Permissions Explained”</a>. 269 269 </p><p> 270 <a class="indexterm" name="id2544 102"></a>271 <a class="indexterm" name="id254410 8"></a>272 <a class="indexterm" name="id254411 7"></a>273 <a class="indexterm" name="id254412 4"></a>270 <a class="indexterm" name="id2544097"></a> 271 <a class="indexterm" name="id2544104"></a> 272 <a class="indexterm" name="id2544113"></a> 273 <a class="indexterm" name="id2544120"></a> 274 274 All client workstations print to a print queue on the server. This ensures that print jobs 275 275 continue to print in the event that a user shuts down the workstation immediately after … … 278 278 that CUPS has become the leading UNIX printing technology. 279 279 </p><p> 280 <a class="indexterm" name="id25441 42"></a>280 <a class="indexterm" name="id2544137"></a> 281 281 The print queues are set up as <code class="constant">Raw</code> devices, which means that CUPS will 282 282 not do intelligent print processing, and vendor-supplied drivers must be installed locally on the … … 298 298 really is just a print queue. The name of the print queue is representative of 299 299 the device to which the print spooler delivers print jobs. 300 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id25441 90"></a>Implementation</h4></div></div></div><p>300 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2544185"></a>Implementation</h4></div></div></div><p> 301 301 It is assumed that the server is fully installed and ready for configuration of 302 302 Samba 3.0.20 and for necessary support files. All TCP/IP addresses should be hard-coded. … … 304 304 255.255.255.0. The hostname of the server used is <code class="constant">server</code>. 305 305 The office network is built as shown in <a class="link" href="simple.html#charitynet" title="Figure 1.1. Charity Administration Office Network">“Charity Administration Office Network”</a>. 306 </p><div class="figure"><a name="charitynet"></a><p class="title"><b>Figure 1.1. Charity Administration Office Network</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/Charity-Network.png" width="432" alt="Charity Administration Office Network"></div></div></div><br class="figure-break"><div class="procedure"><a name="id254425 6"></a><p class="title"><b>Procedure 1.3. Samba Server Configuration</b></p><ol type="1"><li><p>307 <a class="indexterm" name="id254426 7"></a>306 </p><div class="figure"><a name="charitynet"></a><p class="title"><b>Figure 1.1. Charity Administration Office Network</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/Charity-Network.png" width="432" alt="Charity Administration Office Network"></div></div></div><br class="figure-break"><div class="procedure"><a name="id2544251"></a><p class="title"><b>Procedure 1.3. Samba Server Configuration</b></p><ol type="1"><li><p> 307 <a class="indexterm" name="id2544263"></a> 308 308 Create a group account for office file storage: 309 309 </p><pre class="screen"> … … 311 311 </pre><p> 312 312 </p></li><li><p> 313 <a class="indexterm" name="id25442 93"></a>314 <a class="indexterm" name="id2544 300"></a>313 <a class="indexterm" name="id2544289"></a> 314 <a class="indexterm" name="id2544296"></a> 315 315 Create a user account for office file storage: 316 316 </p><pre class="screen"> … … 329 329 The resulting drive has a capacity of approximately 500GB of usable space. 330 330 </p></li><li><p> 331 <a class="indexterm" name="id254434 7"></a>331 <a class="indexterm" name="id2544343"></a> 332 332 Create a mount point for the file system that can be used to store all data files. 333 333 Create a directory called <code class="filename">/data</code>: … … 361 361 /data/officefiles/misc 362 362 </pre><p> 363 <a class="indexterm" name="id254446 8"></a>363 <a class="indexterm" name="id2544463"></a> 364 364 The <code class="literal">chown</code> operation sets the owner to the user <code class="constant">abmas</code> 365 365 and the group to <code class="constant">office</code> on all directories just created. It recursively … … 369 369 created. Any new directories created still have the same owner, group, and permissions as the 370 370 directory they are in. This should eliminate all permissions-based file access problems. For 371 more information on this subject, refer to TOSHARG2<sup>[<a name="id254449 9" href="#ftn.id2544499" class="footnote">3</a>]</sup> or refer371 more information on this subject, refer to TOSHARG2<sup>[<a name="id2544494" href="#ftn.id2544494" class="footnote">3</a>]</sup> or refer 372 372 to the UNIX man page for the <code class="literal">chmod</code> and the <code class="literal">chown</code> commands. 373 373 </p></li><li><p> … … 381 381 <code class="filename">/etc/samba</code> directory. 382 382 </p></li><li><p> 383 <a class="indexterm" name="id254457 7"></a>383 <a class="indexterm" name="id2544573"></a> 384 384 We must ensure that the <code class="literal">smbd</code> can resolve the name of the Samba 385 385 server to its IP address. Verify that the <code class="filename">/etc/hosts</code> file … … 393 393 so that the CUPS spooler can print using raw mode protocols. 394 394 </p></li><li><p> 395 <a class="indexterm" name="id254462 7"></a>395 <a class="indexterm" name="id2544622"></a> 396 396 Configure the CUPS Print Queues: 397 397 </p><pre class="screen"> … … 401 401 This creates the necessary print queues with no assigned print filter. 402 402 </p></li><li><p> 403 <a class="indexterm" name="id25446 62"></a>404 <a class="indexterm" name="id254466 8"></a>405 <a class="indexterm" name="id254467 5"></a>403 <a class="indexterm" name="id2544657"></a> 404 <a class="indexterm" name="id2544664"></a> 405 <a class="indexterm" name="id2544671"></a> 406 406 Edit the file <code class="filename">/etc/cups/mime.convs</code> to uncomment the line: 407 407 </p><pre class="screen"> … … 409 409 </pre><p> 410 410 </p></li><li><p> 411 <a class="indexterm" name="id2544 703"></a>411 <a class="indexterm" name="id2544698"></a> 412 412 Edit the file <code class="filename">/etc/cups/mime.types</code> to uncomment the line: 413 413 </p><pre class="screen"> … … 415 415 </pre><p> 416 416 </p></li><li><p> 417 <a class="indexterm" name="id25447 30"></a>417 <a class="indexterm" name="id2544725"></a> 418 418 Use the standard system tool to start Samba and CUPS to configure them to restart 419 419 automatically at every system reboot. For example, 420 420 </p><p> 421 <a class="indexterm" name="id25447 42"></a>422 <a class="indexterm" name="id254474 9"></a>423 <a class="indexterm" name="id254475 6"></a>421 <a class="indexterm" name="id2544738"></a> 422 <a class="indexterm" name="id2544745"></a> 423 <a class="indexterm" name="id2544752"></a> 424 424 </p><pre class="screen"> 425 425 <code class="prompt">root# </code> chkconfig smb on … … 428 428 <code class="prompt">root# </code> /etc/rc.d/init.d/cups restart 429 429 </pre><p> 430 </p></li></ol></div><div class="example"><a name="charity-smbconfnew"></a><p class="title"><b>Example 1.2. Charity Administration Office <code class="filename">smb.conf</code> New-style File</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global Parameters - Newer Configuration</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id25448 30"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2544841"></a><em class="parameter"><code>printing = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2544853"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2544865"></a><em class="parameter"><code>map to guest = Bad User</code></em></td></tr><tr><td><a class="indexterm" name="id2544877"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2544889"></a><em class="parameter"><code>wins support = yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[FTMFILES]</code></em></td></tr><tr><td><a class="indexterm" name="id2544909"></a><em class="parameter"><code>comment = Funds Tracking & Management Files</code></em></td></tr><tr><td><a class="indexterm" name="id2544922"></a><em class="parameter"><code>path = /data/ftmfiles</code></em></td></tr><tr><td><a class="indexterm" name="id2544933"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2544945"></a><em class="parameter"><code>force user = abmas</code></em></td></tr><tr><td><a class="indexterm" name="id2544957"></a><em class="parameter"><code>force group = office</code></em></td></tr><tr><td><a class="indexterm" name="id2544968"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2544980"></a><em class="parameter"><code>nt acl support = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[office]</code></em></td></tr><tr><td><a class="indexterm" name="id2545001"></a><em class="parameter"><code>comment = General Office Files</code></em></td></tr><tr><td><a class="indexterm" name="id2545012"></a><em class="parameter"><code>path = /data/officefiles</code></em></td></tr><tr><td><a class="indexterm" name="id2545024"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2545036"></a><em class="parameter"><code>force user = abmas</code></em></td></tr><tr><td><a class="indexterm" name="id2545047"></a><em class="parameter"><code>force group = office</code></em></td></tr><tr><td><a class="indexterm" name="id2545059"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2545071"></a><em class="parameter"><code>nt acl support = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2545091"></a><em class="parameter"><code>comment = Print Temporary Spool Configuration</code></em></td></tr><tr><td><a class="indexterm" name="id2545104"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2545115"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2545127"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2545138"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2545150"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="charity-smbconf"></a><p class="title"><b>Example 1.3. Charity Administration Office <code class="filename">smb.conf</code> Old-style File</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global Parameters - Older Style Configuration</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2545197"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2545209"></a><em class="parameter"><code>security = SHARE</code></em></td></tr><tr><td><a class="indexterm" name="id2545220"></a><em class="parameter"><code>printing = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2545232"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2545244"></a><em class="parameter"><code>disable spoolss = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2545256"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2545268"></a><em class="parameter"><code>wins support = yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[FTMFILES]</code></em></td></tr><tr><td><a class="indexterm" name="id2545288"></a><em class="parameter"><code>comment = Funds Tracking & Management Files</code></em></td></tr><tr><td><a class="indexterm" name="id2545301"></a><em class="parameter"><code>path = /data/ftmfiles</code></em></td></tr><tr><td><a class="indexterm" name="id2545312"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2545324"></a><em class="parameter"><code>force user = abmas</code></em></td></tr><tr><td><a class="indexterm" name="id2545336"></a><em class="parameter"><code>force group = office</code></em></td></tr><tr><td><a class="indexterm" name="id2545347"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2545359"></a><em class="parameter"><code>nt acl support = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[office]</code></em></td></tr><tr><td><a class="indexterm" name="id2545380"></a><em class="parameter"><code>comment = General Office Files</code></em></td></tr><tr><td><a class="indexterm" name="id2545392"></a><em class="parameter"><code>path = /data/officefiles</code></em></td></tr><tr><td><a class="indexterm" name="id2545403"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2545415"></a><em class="parameter"><code>force user = abmas</code></em></td></tr><tr><td><a class="indexterm" name="id2545426"></a><em class="parameter"><code>force group = office</code></em></td></tr><tr><td><a class="indexterm" name="id2545438"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2545450"></a><em class="parameter"><code>nt acl support = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2545470"></a><em class="parameter"><code>comment = Print Temporary Spool Configuration</code></em></td></tr><tr><td><a class="indexterm" name="id2545483"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2545494"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2545506"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2545518"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2545529"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="procedure"><a name="id2545542"></a><p class="title"><b>Procedure 1.4. Windows Client Configuration</b></p><ol type="1"><li><p>430 </p></li></ol></div><div class="example"><a name="charity-smbconfnew"></a><p class="title"><b>Example 1.2. Charity Administration Office <code class="filename">smb.conf</code> New-style File</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global Parameters - Newer Configuration</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2544825"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2544837"></a><em class="parameter"><code>printing = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2544848"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2544860"></a><em class="parameter"><code>map to guest = Bad User</code></em></td></tr><tr><td><a class="indexterm" name="id2544872"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2544884"></a><em class="parameter"><code>wins support = yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[FTMFILES]</code></em></td></tr><tr><td><a class="indexterm" name="id2544905"></a><em class="parameter"><code>comment = Funds Tracking & Management Files</code></em></td></tr><tr><td><a class="indexterm" name="id2544917"></a><em class="parameter"><code>path = /data/ftmfiles</code></em></td></tr><tr><td><a class="indexterm" name="id2544929"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2544941"></a><em class="parameter"><code>force user = abmas</code></em></td></tr><tr><td><a class="indexterm" name="id2544952"></a><em class="parameter"><code>force group = office</code></em></td></tr><tr><td><a class="indexterm" name="id2544964"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2544976"></a><em class="parameter"><code>nt acl support = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[office]</code></em></td></tr><tr><td><a class="indexterm" name="id2544996"></a><em class="parameter"><code>comment = General Office Files</code></em></td></tr><tr><td><a class="indexterm" name="id2545008"></a><em class="parameter"><code>path = /data/officefiles</code></em></td></tr><tr><td><a class="indexterm" name="id2545020"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2545031"></a><em class="parameter"><code>force user = abmas</code></em></td></tr><tr><td><a class="indexterm" name="id2545043"></a><em class="parameter"><code>force group = office</code></em></td></tr><tr><td><a class="indexterm" name="id2545055"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2545066"></a><em class="parameter"><code>nt acl support = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2545087"></a><em class="parameter"><code>comment = Print Temporary Spool Configuration</code></em></td></tr><tr><td><a class="indexterm" name="id2545099"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2545111"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2545122"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2545134"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2545146"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="charity-smbconf"></a><p class="title"><b>Example 1.3. Charity Administration Office <code class="filename">smb.conf</code> Old-style File</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global Parameters - Older Style Configuration</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2545193"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2545204"></a><em class="parameter"><code>security = SHARE</code></em></td></tr><tr><td><a class="indexterm" name="id2545216"></a><em class="parameter"><code>printing = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2545228"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2545239"></a><em class="parameter"><code>disable spoolss = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2545251"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2545263"></a><em class="parameter"><code>wins support = yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[FTMFILES]</code></em></td></tr><tr><td><a class="indexterm" name="id2545284"></a><em class="parameter"><code>comment = Funds Tracking & Management Files</code></em></td></tr><tr><td><a class="indexterm" name="id2545296"></a><em class="parameter"><code>path = /data/ftmfiles</code></em></td></tr><tr><td><a class="indexterm" name="id2545308"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2545320"></a><em class="parameter"><code>force user = abmas</code></em></td></tr><tr><td><a class="indexterm" name="id2545331"></a><em class="parameter"><code>force group = office</code></em></td></tr><tr><td><a class="indexterm" name="id2545343"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2545355"></a><em class="parameter"><code>nt acl support = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[office]</code></em></td></tr><tr><td><a class="indexterm" name="id2545375"></a><em class="parameter"><code>comment = General Office Files</code></em></td></tr><tr><td><a class="indexterm" name="id2545387"></a><em class="parameter"><code>path = /data/officefiles</code></em></td></tr><tr><td><a class="indexterm" name="id2545399"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2545410"></a><em class="parameter"><code>force user = abmas</code></em></td></tr><tr><td><a class="indexterm" name="id2545422"></a><em class="parameter"><code>force group = office</code></em></td></tr><tr><td><a class="indexterm" name="id2545434"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2545445"></a><em class="parameter"><code>nt acl support = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2545466"></a><em class="parameter"><code>comment = Print Temporary Spool Configuration</code></em></td></tr><tr><td><a class="indexterm" name="id2545478"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2545490"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2545502"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2545513"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2545525"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="procedure"><a name="id2545538"></a><p class="title"><b>Procedure 1.4. Windows Client Configuration</b></p><ol type="1"><li><p> 431 431 Configure clients to the network settings shown in <a class="link" href="simple.html#charitynet" title="Figure 1.1. Charity Administration Office Network">“Charity Administration Office Network”</a>. 432 432 </p></li><li><p> … … 435 435 <code class="constant">255.255.255.0</code>. 436 436 </p></li><li><p> 437 <a class="indexterm" name="id25455 80"></a>437 <a class="indexterm" name="id2545575"></a> 438 438 On all Windows clients, set the WINS Server address to <code class="constant">192.168.1.1</code>, 439 439 the IP address of the server. … … 441 441 Set the workgroup name on all clients to <code class="constant">MIDEARTH</code>. 442 442 </p></li><li><p> 443 <a class="indexterm" name="id25456 10"></a>443 <a class="indexterm" name="id2545605"></a> 444 444 Install the “<span class="quote">Client for Microsoft Networks.</span>” Ensure that the only option 445 445 enabled in its properties is the option “<span class="quote">Logon and restore network connections.</span>” … … 448 448 system, then log on using any username and password you choose. 449 449 </p></li><li><p> 450 <a class="indexterm" name="id254564 7"></a>450 <a class="indexterm" name="id2545643"></a> 451 451 Verify on each client that the machine called <code class="constant">SERVER</code> 452 452 is visible in <span class="guimenu">My Network Places</span>, that it is … … 454 454 and that it is possible to open that share to reveal its contents. 455 455 </p></li><li><p> 456 <a class="indexterm" name="id25456 80"></a>457 <a class="indexterm" name="id254568 7"></a>456 <a class="indexterm" name="id2545675"></a> 457 <a class="indexterm" name="id2545682"></a> 458 458 Disable password caching on all Windows 9x/Me machines using the registry change file 459 459 shown in <a class="link" href="simple.html#MEreg" title="Example 1.4. Windows Me Registry Edit File: Disable Password Caching">“Windows Me Registry Edit File: Disable Password Caching”</a>. Be sure to remove all files that have the … … 533 533 handing the newly configured network over to the Charity Administration Office 534 534 for production use. 535 </p></li></ol></div></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id25461 32"></a>Validation</h4></div></div></div><p>535 </p></li></ol></div></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2546127"></a>Validation</h4></div></div></div><p> 536 536 Use the same validation process as was followed in <a class="link" href="simple.html#validate1" title="Validation">“Validation”</a>. 537 537 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="AccountingOffice"></a>Accounting Office</h3></div></div></div><p> … … 552 552 on the server. 553 553 </p><p> 554 <a class="indexterm" name="id2546 200"></a>554 <a class="indexterm" name="id2546196"></a> 555 555 The new server will run Red Hat Fedora Core2. You should install Samba-3.0.20 and 556 556 copy all files from the old system to the new one. The existing Windows NT4 server has a parallel … … 562 562 He believes that Windows for Workgroups 3.11 was “<span class="quote">the best server Microsoft ever sold 563 563 </span>” and that Windows NT and 2000 are “<span class="quote">too fang-dangled complex!</span>” 564 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id25462 32"></a>Dissection and Discussion</h4></div></div></div><p>565 <a class="indexterm" name="id25462 40"></a>564 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2546228"></a>Dissection and Discussion</h4></div></div></div><p> 565 <a class="indexterm" name="id2546236"></a> 566 566 The requirements of this network installation are not unusual. The staff are not interested in the 567 567 details of networking. Passwords are never changed. In this example solution, we demonstrate the use … … 583 583 <a class="link" href="simple.html#acctingnet2" title="Figure 1.2. Accounting Office Network Topology">“Accounting Office Network Topology”</a>. All machines have been configured as indicated prior to the 584 584 start of Samba configuration. The following prescriptive steps may now commence. 585 </p><div class="figure"><a name="acctingnet2"></a><p class="title"><b>Figure 1.2. Accounting Office Network Topology</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/AccountingNetwork.png" width="459" alt="Accounting Office Network Topology"></div></div></div><br class="figure-break"><div class="table"><a name="acctingnet"></a><p class="title"><b>Table 1.1. Accounting Office Network Information</b></p><div class="table-contents"><table summary="Accounting Office Network Information" border="1"><colgroup><col align="left"><col align="left"><col align="left"><col align="left"><col align="left"><col align="left"></colgroup><thead><tr><th align="left">User</th><th align="left">Login-ID</th><th align="left">Password</th><th align="left">Share Name</th><th align="left">Directory</th><th align="left">Wkst</th></tr></thead><tbody><tr><td align="left">Alan Meany</td><td align="left">alan</td><td align="left">alm1961</td><td align="left">alan</td><td align="left">/data</td><td align="left">PC1</td></tr><tr><td align="left">James Meany</td><td align="left">james</td><td align="left">jimm1962</td><td align="left">james</td><td align="left">/data/james</td><td align="left">PC2</td></tr><tr><td align="left">Jeannie Meany</td><td align="left">jeannie</td><td align="left">jema1965</td><td align="left">jeannie</td><td align="left">/data/jeannie</td><td align="left">PC3</td></tr><tr><td align="left">Suzy Millicent</td><td align="left">suzy</td><td align="left">suzy1967</td><td align="left">suzy</td><td align="left">/data/suzy</td><td align="left">PC4</td></tr><tr><td align="left">Ursula Jenning</td><td align="left">ujen</td><td align="left">ujen1974</td><td align="left">ursula</td><td align="left">/data/ursula</td><td align="left">PC5</td></tr><tr><td align="left">Peter Pan</td><td align="left">peter</td><td align="left">pete1984</td><td align="left">peter</td><td align="left">/data/peter</td><td align="left">PC6</td></tr><tr><td align="left">Dale Roland</td><td align="left">dale</td><td align="left">dale1986</td><td align="left">dale</td><td align="left">/data/dale</td><td align="left">PC7</td></tr><tr><td align="left">Bertrand E Paoletti</td><td align="left">eric</td><td align="left">eric1993</td><td align="left">eric</td><td align="left">/data/eric</td><td align="left">PC8</td></tr><tr><td align="left">Russell Lewis</td><td align="left">russ</td><td align="left">russ2001</td><td align="left">russell</td><td align="left">/data/russell</td><td align="left">PC9</td></tr></tbody></table></div></div><br class="table-break"><div class="procedure"><a name="id25466 40"></a><p class="title"><b>Procedure 1.5. Migration from Windows NT4 Workstation System to Samba-3</b></p><ol type="1"><li><p><a class="indexterm" name="id2546651"></a>585 </p><div class="figure"><a name="acctingnet2"></a><p class="title"><b>Figure 1.2. Accounting Office Network Topology</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/AccountingNetwork.png" width="459" alt="Accounting Office Network Topology"></div></div></div><br class="figure-break"><div class="table"><a name="acctingnet"></a><p class="title"><b>Table 1.1. Accounting Office Network Information</b></p><div class="table-contents"><table summary="Accounting Office Network Information" border="1"><colgroup><col align="left"><col align="left"><col align="left"><col align="left"><col align="left"><col align="left"></colgroup><thead><tr><th align="left">User</th><th align="left">Login-ID</th><th align="left">Password</th><th align="left">Share Name</th><th align="left">Directory</th><th align="left">Wkst</th></tr></thead><tbody><tr><td align="left">Alan Meany</td><td align="left">alan</td><td align="left">alm1961</td><td align="left">alan</td><td align="left">/data</td><td align="left">PC1</td></tr><tr><td align="left">James Meany</td><td align="left">james</td><td align="left">jimm1962</td><td align="left">james</td><td align="left">/data/james</td><td align="left">PC2</td></tr><tr><td align="left">Jeannie Meany</td><td align="left">jeannie</td><td align="left">jema1965</td><td align="left">jeannie</td><td align="left">/data/jeannie</td><td align="left">PC3</td></tr><tr><td align="left">Suzy Millicent</td><td align="left">suzy</td><td align="left">suzy1967</td><td align="left">suzy</td><td align="left">/data/suzy</td><td align="left">PC4</td></tr><tr><td align="left">Ursula Jenning</td><td align="left">ujen</td><td align="left">ujen1974</td><td align="left">ursula</td><td align="left">/data/ursula</td><td align="left">PC5</td></tr><tr><td align="left">Peter Pan</td><td align="left">peter</td><td align="left">pete1984</td><td align="left">peter</td><td align="left">/data/peter</td><td align="left">PC6</td></tr><tr><td align="left">Dale Roland</td><td align="left">dale</td><td align="left">dale1986</td><td align="left">dale</td><td align="left">/data/dale</td><td align="left">PC7</td></tr><tr><td align="left">Bertrand E Paoletti</td><td align="left">eric</td><td align="left">eric1993</td><td align="left">eric</td><td align="left">/data/eric</td><td align="left">PC8</td></tr><tr><td align="left">Russell Lewis</td><td align="left">russ</td><td align="left">russ2001</td><td align="left">russell</td><td align="left">/data/russell</td><td align="left">PC9</td></tr></tbody></table></div></div><br class="table-break"><div class="procedure"><a name="id2546636"></a><p class="title"><b>Procedure 1.5. Migration from Windows NT4 Workstation System to Samba-3</b></p><ol type="1"><li><p><a class="indexterm" name="id2546646"></a> 586 586 Rename the old server from <code class="constant">CASHPOOL</code> to <code class="constant">STABLE</code> 587 587 by logging onto the console as the <code class="constant">Administrator</code>. Restart the machine … … 594 594 Samba FTP site. 595 595 </p></li><li><p> 596 <a class="indexterm" name="id2546 700"></a>597 <a class="indexterm" name="id254670 7"></a>596 <a class="indexterm" name="id2546696"></a> 597 <a class="indexterm" name="id2546703"></a> 598 598 Add a group account for the office to use. Execute the following: 599 599 </p><pre class="screen"> … … 601 601 </pre><p> 602 602 </p></li><li><p> 603 Install the <code class="filename">smb.conf</code> file shown<sup>[<a name="id25467 40" href="#ftn.id2546740" class="footnote">4</a>]</sup>603 Install the <code class="filename">smb.conf</code> file shown<sup>[<a name="id2546736" href="#ftn.id2546736" class="footnote">4</a>]</sup> 604 604 in <a class="link" href="simple.html#acctconf" title="Example 1.5. Accounting Office Network smb.conf Old Style Configuration File">“Accounting Office Network smb.conf Old Style Configuration File”</a>. 605 605 </p></li><li><p> 606 <a class="indexterm" name="id254677 8"></a>607 <a class="indexterm" name="id254678 5"></a>608 <a class="indexterm" name="id25467 92"></a>606 <a class="indexterm" name="id2546774"></a> 607 <a class="indexterm" name="id2546780"></a> 608 <a class="indexterm" name="id2546787"></a> 609 609 For each user who uses this system (see <a class="link" href="simple.html#acctingnet" title="Table 1.1. Accounting Office Network Information">“Accounting Office Network Information”</a>), 610 610 execute the following: … … 621 621 </pre><p> 622 622 </p></li><li><p> 623 <a class="indexterm" name="id254684 5"></a>623 <a class="indexterm" name="id2546841"></a> 624 624 Create the directory structure for the file shares by executing the following: 625 625 </p><pre class="screen"> … … 636 636 The data storage structure is now prepared for use. 637 637 </p></li><li><p> 638 <a class="indexterm" name="id254689 9"></a>638 <a class="indexterm" name="id2546895"></a> 639 639 Configure the CUPS Print Queues: 640 640 </p><pre class="screen"> … … 643 643 This creates the necessary print queues with no assigned print filter. 644 644 </p></li><li><p> 645 <a class="indexterm" name="id254692 7"></a>646 <a class="indexterm" name="id254693 4"></a>645 <a class="indexterm" name="id2546923"></a> 646 <a class="indexterm" name="id2546930"></a> 647 647 Edit the file <code class="filename">/etc/cups/mime.convs</code> to uncomment the line: 648 648 </p><pre class="screen"> … … 650 650 </pre><p> 651 651 </p></li><li><p> 652 <a class="indexterm" name="id25469 61"></a>653 <a class="indexterm" name="id254696 8"></a>652 <a class="indexterm" name="id2546957"></a> 653 <a class="indexterm" name="id2546964"></a> 654 654 Edit the file <code class="filename">/etc/cups/mime.types</code> to uncomment the line: 655 655 </p><pre class="screen"> … … 657 657 </pre><p> 658 658 </p></li><li><p> 659 <a class="indexterm" name="id254699 5"></a>659 <a class="indexterm" name="id2546991"></a> 660 660 Use the standard system tool to start Samba and CUPS to configure them to restart 661 661 automatically at every system reboot. For example, 662 662 </p><p> 663 <a class="indexterm" name="id254700 8"></a>664 <a class="indexterm" name="id254701 5"></a>665 <a class="indexterm" name="id25470 22"></a>663 <a class="indexterm" name="id2547003"></a> 664 <a class="indexterm" name="id2547010"></a> 665 <a class="indexterm" name="id2547017"></a> 666 666 </p><pre class="screen"> 667 667 <code class="prompt">root# </code> chkconfig smb on … … 708 708 For this, you should make sure all applications, including printing, work before asking the 709 709 customer to test drive the new network. 710 </p></li></ol></div><div class="example"><a name="acctconf"></a><p class="title"><b>Example 1.5. Accounting Office Network <code class="filename">smb.conf</code> Old Style Configuration File</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id25472 72"></a><em class="parameter"><code>workgroup = BILLMORE</code></em></td></tr><tr><td><a class="indexterm" name="id2547284"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2547296"></a><em class="parameter"><code>disable spoolss = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2547307"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2547320"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[files]</code></em></td></tr><tr><td><a class="indexterm" name="id2547340"></a><em class="parameter"><code>comment = Work area files</code></em></td></tr><tr><td><a class="indexterm" name="id2547352"></a><em class="parameter"><code>path = /data/%U</code></em></td></tr><tr><td><a class="indexterm" name="id2547363"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[master]</code></em></td></tr><tr><td><a class="indexterm" name="id2547384"></a><em class="parameter"><code>comment = Master work area files</code></em></td></tr><tr><td><a class="indexterm" name="id2547396"></a><em class="parameter"><code>path = /data</code></em></td></tr><tr><td><a class="indexterm" name="id2547407"></a><em class="parameter"><code>valid users = alan</code></em></td></tr><tr><td><a class="indexterm" name="id2547419"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2547440"></a><em class="parameter"><code>comment = Print Temporary Spool Configuration</code></em></td></tr><tr><td><a class="indexterm" name="id2547452"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2547463"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2547475"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2547487"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2547498"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2547514"></a>Questions and Answers</h2></div></div></div><p>710 </p></li></ol></div><div class="example"><a name="acctconf"></a><p class="title"><b>Example 1.5. Accounting Office Network <code class="filename">smb.conf</code> Old Style Configuration File</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2547268"></a><em class="parameter"><code>workgroup = BILLMORE</code></em></td></tr><tr><td><a class="indexterm" name="id2547279"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2547291"></a><em class="parameter"><code>disable spoolss = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2547303"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2547315"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[files]</code></em></td></tr><tr><td><a class="indexterm" name="id2547336"></a><em class="parameter"><code>comment = Work area files</code></em></td></tr><tr><td><a class="indexterm" name="id2547347"></a><em class="parameter"><code>path = /data/%U</code></em></td></tr><tr><td><a class="indexterm" name="id2547359"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[master]</code></em></td></tr><tr><td><a class="indexterm" name="id2547380"></a><em class="parameter"><code>comment = Master work area files</code></em></td></tr><tr><td><a class="indexterm" name="id2547391"></a><em class="parameter"><code>path = /data</code></em></td></tr><tr><td><a class="indexterm" name="id2547403"></a><em class="parameter"><code>valid users = alan</code></em></td></tr><tr><td><a class="indexterm" name="id2547415"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2547435"></a><em class="parameter"><code>comment = Print Temporary Spool Configuration</code></em></td></tr><tr><td><a class="indexterm" name="id2547447"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2547459"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2547471"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2547482"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2547494"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2547510"></a>Questions and Answers</h2></div></div></div><p> 711 711 The following questions and answers draw from the examples in this chapter. 712 712 Many design decisions are impacted by the configurations chosen. The intent 713 713 is to expose some of the hidden implications. 714 </p><div class="qandaset"><dl><dt> <a href="simple.html#id25475 34">714 </p><div class="qandaset"><dl><dt> <a href="simple.html#id2547529"> 715 715 What makes an anonymous Samba server more simple than a non-anonymous Samba server? 716 </a></dt><dt> <a href="simple.html#id254755 9">716 </a></dt><dt> <a href="simple.html#id2547555"> 717 717 How is the operation of the parameter force user different from 718 718 setting the root directory of the share SUID? 719 </a></dt><dt> <a href="simple.html#id25476 13">719 </a></dt><dt> <a href="simple.html#id2547609"> 720 720 When would you both use the per share parameter force user and set 721 721 the share root directory SUID? 722 </a></dt><dt> <a href="simple.html#id25476 40">722 </a></dt><dt> <a href="simple.html#id2547636"> 723 723 What is better about CUPS printing than LPRng printing? 724 </a></dt><dt> <a href="simple.html#id254768 5">724 </a></dt><dt> <a href="simple.html#id2547680"> 725 725 When should Windows client IP addresses be hard-coded? 726 </a></dt><dt> <a href="simple.html#id25477 10">726 </a></dt><dt> <a href="simple.html#id2547706"> 727 727 Under what circumstances is it best to use a DHCP server? 728 </a></dt><dt> <a href="simple.html#id254774 9">728 </a></dt><dt> <a href="simple.html#id2547745"> 729 729 What is the purpose of setting the parameter guest ok on a share? 730 </a></dt><dt> <a href="simple.html#id254777 5">730 </a></dt><dt> <a href="simple.html#id2547770"> 731 731 When would you set the global parameter disable spoolss? 732 </a></dt><dt> <a href="simple.html#id254786 5">732 </a></dt><dt> <a href="simple.html#id2547860"> 733 733 Why would you disable password caching on Windows 9x/Me clients? 734 </a></dt><dt> <a href="simple.html#id254788 9">734 </a></dt><dt> <a href="simple.html#id2547885"> 735 735 The example of Abmas Accounting uses User Mode security. How does this provide anonymous access? 736 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id25475 34"></a><a name="id2547536"></a></td><td align="left" valign="top"><p>736 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2547529"></a><a name="id2547531"></a></td><td align="left" valign="top"><p> 737 737 What makes an anonymous Samba server more simple than a non-anonymous Samba server? 738 738 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 741 741 UNIX system and to the Samba configuration. Non-anonymous servers require additional 742 742 administration. 743 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id254755 9"></a><a name="id2547561"></a></td><td align="left" valign="top"><p>743 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2547555"></a><a name="id2547557"></a></td><td align="left" valign="top"><p> 744 744 How is the operation of the parameter <em class="parameter"><code>force user</code></em> different from 745 745 setting the root directory of the share SUID? … … 755 755 The parameter <em class="parameter"><code>force user</code></em> has potential security implications that go 756 756 beyond the actual share root directory. Be careful and wary of using this parameter. 757 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id25476 13"></a><a name="id2547615"></a></td><td align="left" valign="top"><p>757 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2547609"></a><a name="id2547611"></a></td><td align="left" valign="top"><p> 758 758 When would you both use the per share parameter <em class="parameter"><code>force user</code></em> and set 759 759 the share root directory SUID? … … 762 762 are conducted as the forced user, while all file and directory creation are done as the SUID 763 763 directory owner. 764 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id25476 40"></a><a name="id2547642"></a></td><td align="left" valign="top"><p>764 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2547636"></a><a name="id2547638"></a></td><td align="left" valign="top"><p> 765 765 What is better about CUPS printing than LPRng printing? 766 766 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 780 780 Which spooling system is better is a matter of personal taste. It depends on what you want to do and how you want to 781 781 do it and manage it. Most modern Linux systems ship with CUPS as the default print management system. 782 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id254768 5"></a><a name="id2547687"></a></td><td align="left" valign="top"><p>782 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2547680"></a><a name="id2547682"></a></td><td align="left" valign="top"><p> 783 783 When should Windows client IP addresses be hard-coded? 784 784 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 789 789 for a DHCP server. This reduces maintenance overheads and eliminates a possible point of network 790 790 failure. 791 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id25477 10"></a><a name="id2547712"></a></td><td align="left" valign="top"><p>791 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2547706"></a><a name="id2547708"></a></td><td align="left" valign="top"><p> 792 792 Under what circumstances is it best to use a DHCP server? 793 793 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 805 805 assigned IP addresses with the DNS server. The benefits of Dynamic DNS (DDNS) are considerable in 806 806 a large Windows network environment. 807 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id254774 9"></a><a name="id2547751"></a></td><td align="left" valign="top"><p>807 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2547745"></a><a name="id2547747"></a></td><td align="left" valign="top"><p> 808 808 What is the purpose of setting the parameter <em class="parameter"><code>guest ok</code></em> on a share? 809 809 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 810 810 If this parameter is set to yes for a service, then no password is required to connect to the service. 811 811 Privileges are those of the guest account. 812 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id254777 5"></a><a name="id2547777"></a></td><td align="left" valign="top"><p>812 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2547770"></a><a name="id2547772"></a></td><td align="left" valign="top"><p> 813 813 When would you set the global parameter <em class="parameter"><code>disable spoolss</code></em>? 814 814 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 834 834 (even though jobs may be printed successfully). This parameter MUST not be enabled on a print share that has a valid 835 835 print driver installed on the Samba server. 836 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id254786 5"></a><a name="id2547867"></a></td><td align="left" valign="top"><p>836 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2547860"></a><a name="id2547862"></a></td><td align="left" valign="top"><p> 837 837 Why would you disable password caching on Windows 9x/Me clients? 838 838 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 841 841 machine) and decrypted, thus revealing the user's access credentials for all systems the user may have accessed. 842 842 It is most insecure to allow any Windows 9x/Me client to operate with password caching enabled. 843 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id254788 9"></a><a name="id2547891"></a></td><td align="left" valign="top"><p>843 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2547885"></a><a name="id2547887"></a></td><td align="left" valign="top"><p> 844 844 The example of Abmas Accounting uses User Mode security. How does this provide anonymous access? 845 845 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 849 849 password are the same as those set on the Samba server, access is transparent and does not require 850 850 separate user authentication. 851 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id254300 5" href="#id2543005" class="para">1</a>] </sup>The examples given mirror those documented851 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id2543001" href="#id2543001" class="para">1</a>] </sup>The examples given mirror those documented 852 852 in The Official Samba-3 HOWTO and Reference Guide, Second Edition (TOSHARG2) Chapter 2, Section 2.3.1. You may gain additional 853 853 insight from the standalone server configurations covered in TOSHARG2, sections 2.3.1.2 through 2.3.1.4. 854 </p></div><div class="footnote"><p><sup>[<a name="ftn.id25431 91" href="#id2543191" class="para">2</a>] </sup>854 </p></div><div class="footnote"><p><sup>[<a name="ftn.id2543187" href="#id2543187" class="para">2</a>] </sup> 855 855 This information is given purely as an example of how data may be stored in such a way that it 856 856 will be easy to locate records at a later date. The example is not meant to imply any instructions 857 857 that may be construed as essential to the design of the solution; this is something you will almost 858 certainly want to determine for yourself.</p></div><div class="footnote"></div><div class="footnote"><p><sup>[<a name="ftn.id25467 40" href="#id2546740" class="para">4</a>] </sup>This example uses the858 certainly want to determine for yourself.</p></div><div class="footnote"></div><div class="footnote"><p><sup>[<a name="ftn.id2546736" href="#id2546736" class="para">4</a>] </sup>This example uses the 859 859 <em class="parameter"><code>smbpasswd</code></em> file in an obtuse way, since the use of 860 860 the <em class="parameter"><code>passdb backend</code></em> has not been specified in the <code class="filename">smb.conf</code> -
branches/samba-3.2.x/docs/htmldocs/Samba3-ByExample/small.html
r204 r226 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 2. Small Office Networking</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="simple.html" title="Chapter 1. No-Frills Samba Servers"><link rel="next" href="secure.html" title="Chapter 3. Secure Office Networking"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 2. Small Office Networking</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="simple.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="secure.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="small"></a>Chapter 2. Small Office Networking</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="small.html#id254799 8">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2548021">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2548082">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2548136">Technical Issues</a></span></dt><dt><span class="sect2"><a href="small.html#id2548347">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2548369">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2550069">Validation</a></span></dt><dt><span class="sect2"><a href="small.html#id2550774">Notebook Computers: A Special Case</a></span></dt><dt><span class="sect2"><a href="small.html#id2550800">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2550876">Questions and Answers</a></span></dt></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 2. Small Office Networking</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="simple.html" title="Chapter 1. No-Frills Samba Servers"><link rel="next" href="secure.html" title="Chapter 3. Secure Office Networking"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 2. Small Office Networking</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="simple.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="secure.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="small"></a>Chapter 2. Small Office Networking</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="small.html#id2547993">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2548016">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2548078">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2548131">Technical Issues</a></span></dt><dt><span class="sect2"><a href="small.html#id2548343">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2548364">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2550065">Validation</a></span></dt><dt><span class="sect2"><a href="small.html#id2550769">Notebook Computers: A Special Case</a></span></dt><dt><span class="sect2"><a href="small.html#id2550795">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2550871">Questions and Answers</a></span></dt></dl></div><p> 2 2 <a class="link" href="simple.html" title="Chapter 1. No-Frills Samba Servers">“No-Frills Samba Servers”</a> focused on the basics of simple yet effective 3 3 network solutions. Network administrators who take pride in their work … … 9 9 good advice that the following two scenarios illustrate. 10 10 </p><p> 11 <a class="indexterm" name="id25479 53"></a>11 <a class="indexterm" name="id2547949"></a> 12 12 In one case the network administrator of a mid-sized company spent three 13 13 months building a new network to replace an old Netware server. What he … … 37 37 sleeves for when you need them.</span>” Was he smart? You decide. Let's 38 38 get on with our next exercise. 39 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id254799 8"></a>Introduction</h2></div></div></div><p>39 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2547993"></a>Introduction</h2></div></div></div><p> 40 40 Abmas Accounting has grown. Mr. Meany likes you and says he knew you 41 41 were the right person for the job. That's why he asked you to install the … … 48 48 some of the workstations that came with the acquired business and found some machines in need of both 49 49 hardware and software maintenance. 50 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id25480 21"></a>Assignment Tasks</h3></div></div></div><p>51 <a class="indexterm" name="id254802 9"></a>50 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2548016"></a>Assignment Tasks</h3></div></div></div><p> 51 <a class="indexterm" name="id2548024"></a> 52 52 Mr. Meany is retiring in 12 months. Before he goes, he wants you to help ensure 53 53 that the business is running efficiently. Many of the new staff want notebook … … 81 81 user accounts from the Windows desktop. That person will be responsible for 82 82 basic operations. 83 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id25480 82"></a>Dissection and Discussion</h2></div></div></div><p>83 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2548078"></a>Dissection and Discussion</h2></div></div></div><p> 84 84 What are the key requirements in this business example? A quick review indicates 85 85 a need for … … 88 88 </p></li><li><p> 89 89 Mobile computing capability 90 <a class="indexterm" name="id254810 4"></a>90 <a class="indexterm" name="id2548100"></a> 91 91 </p></li><li><p> 92 92 Improved reliability and usability … … 97 97 (as in <a class="link" href="simple.html#AccountingOffice" title="Accounting Office">“Accounting Office”</a>). 98 98 99 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id254813 6"></a>Technical Issues</h3></div></div></div><p>100 <a class="indexterm" name="id25481 43"></a>101 <a class="indexterm" name="id25481 50"></a>102 <a class="indexterm" name="id254815 7"></a>103 <a class="indexterm" name="id25481 63"></a>104 <a class="indexterm" name="id25481 70"></a>99 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2548131"></a>Technical Issues</h3></div></div></div><p> 100 <a class="indexterm" name="id2548139"></a> 101 <a class="indexterm" name="id2548145"></a> 102 <a class="indexterm" name="id2548152"></a> 103 <a class="indexterm" name="id2548159"></a> 104 <a class="indexterm" name="id2548166"></a> 105 105 It is time to implement a domain security environment. You will use the <code class="constant"> 106 106 smbpasswd</code> (default) backend. You should implement a DHCP server. There is no need to … … 123 123 other enhancements. It is important that you plan accordingly. 124 124 </p><p> 125 <a class="indexterm" name="id254823 4"></a>125 <a class="indexterm" name="id2548230"></a> 126 126 You have split the network into two separate areas. Each has its own Ethernet switch. 127 127 There are 20 users on the accounting network and 32 users on the financial services … … 138 138 hostname name resolution. 139 139 </p><p> 140 <a class="indexterm" name="id254826 5"></a>141 <a class="indexterm" name="id254827 4"></a>140 <a class="indexterm" name="id2548261"></a> 141 <a class="indexterm" name="id2548270"></a> 142 142 It is necessary to map Windows Domain Groups to UNIX groups. It is 143 143 advisable to also map Windows Local Groups to UNIX groups. Additionally, the two … … 156 156 more information. 157 157 </p><p> 158 <a class="indexterm" name="id25483 33"></a>158 <a class="indexterm" name="id2548328"></a> 159 159 Vendor-supplied printer drivers will be installed on each client. The CUPS print 160 160 spooler on the UNIX host will be operated in <code class="constant">raw</code> mode. 161 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id254834 7"></a>Political Issues</h3></div></div></div><p>161 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2548343"></a>Political Issues</h3></div></div></div><p> 162 162 Mr. Meany is an old-school manager. He sets the rules and wants to see compliance. 163 163 He is willing to spend money on things he believes are of value. You need more … … 167 167 supplied with antivirus software? Above all, demonstrate good purchase value and remember 168 168 to make your users happy. 169 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id254836 9"></a>Implementation</h2></div></div></div><p>170 <a class="indexterm" name="id254837 7"></a>169 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2548364"></a>Implementation</h2></div></div></div><p> 170 <a class="indexterm" name="id2548372"></a> 171 171 In this example, the assumption is made that this server is being configured from a clean start. 172 172 The alternate approach could be to demonstrate the migration of the system that is documented … … 176 176 Additionally, a fresh installation makes the example easier to follow. 177 177 </p><p> 178 <a class="indexterm" name="id254840 8"></a>178 <a class="indexterm" name="id2548403"></a> 179 179 Each user will be given a home directory on the UNIX system, which will be available as a private 180 180 share. Two additional shares will be created, one for the accounting department and the other for … … 182 182 of group membership. 183 183 </p><p> 184 <a class="indexterm" name="id25484 23"></a>184 <a class="indexterm" name="id2548419"></a> 185 185 UNIX group membership is the primary mechanism by which Windows Domain users will be granted 186 186 rights and privileges within the Windows environment. 187 187 </p><p> 188 <a class="indexterm" name="id254843 8"></a>188 <a class="indexterm" name="id2548434"></a> 189 189 The user <code class="literal">alanm</code> will be made the owner of all files. This will be preserved 190 190 by setting the sticky bit (set UID/GID) on the top-level directories. 191 </p><div class="figure"><a name="acct2net"></a><p class="title"><b>Figure 2.1. Abmas Accounting 52-User Network Topology</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/acct2net.png" alt="Abmas Accounting 52-User Network Topology"></div></div></div><br class="figure-break"><div class="procedure"><a name="id254849 8"></a><p class="title"><b>Procedure 2.1. Server Installation Steps</b></p><ol type="1"><li><p>191 </p><div class="figure"><a name="acct2net"></a><p class="title"><b>Figure 2.1. Abmas Accounting 52-User Network Topology</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/acct2net.png" alt="Abmas Accounting 52-User Network Topology"></div></div></div><br class="figure-break"><div class="procedure"><a name="id2548494"></a><p class="title"><b>Procedure 2.1. Server Installation Steps</b></p><ol type="1"><li><p> 192 192 Using UNIX/Linux system tools, name the server <code class="constant">sleeth</code>. 193 193 </p></li><li><p> 194 <a class="indexterm" name="id25485 21"></a>194 <a class="indexterm" name="id2548516"></a> 195 195 Place an entry for the machine <code class="constant">sleeth</code> in the <code class="filename">/etc/hosts</code>. 196 196 The printers are network attached, so there should be entries for the … … 208 208 Install the ISC DHCP server using the UNIX/Linux system tools available to you. 209 209 </p></li><li><p> 210 <a class="indexterm" name="id254857 6"></a>211 <a class="indexterm" name="id25485 83"></a>212 <a class="indexterm" name="id25485 90"></a>213 <a class="indexterm" name="id254859 7"></a>210 <a class="indexterm" name="id2548572"></a> 211 <a class="indexterm" name="id2548579"></a> 212 <a class="indexterm" name="id2548586"></a> 213 <a class="indexterm" name="id2548592"></a> 214 214 Because Samba will be operating over two network interfaces and clients on each side 215 215 may want to be able to reach clients on the other side, it is imperative that IP forwarding … … 226 226 <code class="filename">/etc/samba/smb.conf</code> file. 227 227 </p></li><li><p> 228 <a class="indexterm" name="id254866 4"></a>228 <a class="indexterm" name="id2548660"></a> 229 229 Add the user <code class="literal">root</code> to the Samba password backend: 230 230 </p><pre class="screen"> … … 234 234 <code class="prompt">root# </code> 235 235 </pre><p> 236 <a class="indexterm" name="id254869 7"></a>236 <a class="indexterm" name="id2548692"></a> 237 237 This is the Windows Domain Administrator password. Never delete this account from 238 238 the password backend after Windows Domain Groups have been initialized. If you delete … … 240 240 and your Samba server can no longer be administered. 241 241 </p></li><li><p> 242 <a class="indexterm" name="id254871 5"></a>242 <a class="indexterm" name="id2548711"></a> 243 243 Create the username map file to permit the <code class="constant">root</code> account to be called 244 244 <code class="constant">Administrator</code> from the Windows network environment. To do this, create … … 267 267 </pre><p> 268 268 </p></li><li><p> 269 <a class="indexterm" name="id254875 9"></a>269 <a class="indexterm" name="id2548755"></a> 270 270 Create and map Windows Domain Groups to UNIX groups. A sample script is provided in 271 271 <a class="link" href="small.html#initGrps" title="Example 2.1. Script to Map Windows NT Groups to UNIX Groups">“Script to Map Windows NT Groups to UNIX Groups”</a>. Create a file containing this script. We called ours … … 273 273 and then execute the script. Sample output should be as follows: 274 274 275 </p><div class="example"><a name="initGrps"></a><p class="title"><b>Example 2.1. Script to Map Windows NT Groups to UNIX Groups</b></p><div class="example-contents"><a class="indexterm" name="id25487 92"></a><pre class="screen">275 </p><div class="example"><a name="initGrps"></a><p class="title"><b>Example 2.1. Script to Map Windows NT Groups to UNIX Groups</b></p><div class="example-contents"><a class="indexterm" name="id2548788"></a><pre class="screen"> 276 276 #!/bin/bash 277 277 # … … 323 323 </pre><p> 324 324 </p></li><li><p> 325 <a class="indexterm" name="id254887 5"></a>326 <a class="indexterm" name="id25488 82"></a>327 <a class="indexterm" name="id25488 91"></a>325 <a class="indexterm" name="id2548871"></a> 326 <a class="indexterm" name="id2548878"></a> 327 <a class="indexterm" name="id2548887"></a> 328 328 For each user who needs to be given a Windows Domain account, make an entry in the 329 329 <code class="filename">/etc/passwd</code> file as well as in the Samba password backend. … … 331 331 <code class="literal">smbpasswd</code> program to create the Domain user accounts. 332 332 </p><p> 333 <a class="indexterm" name="id254891 8"></a>334 <a class="indexterm" name="id254892 5"></a>335 <a class="indexterm" name="id25489 32"></a>333 <a class="indexterm" name="id2548914"></a> 334 <a class="indexterm" name="id2548920"></a> 335 <a class="indexterm" name="id2548927"></a> 336 336 There are a number of tools for user management under UNIX, such as 337 337 <code class="literal">useradd</code> and <code class="literal">adduser</code>, as well as a plethora of custom … … 362 362 Follow the instructions in the manufacturers' manuals to permit printing to port 9100. 363 363 This allows the CUPS spooler to print using raw mode protocols. 364 <a class="indexterm" name="id25490 90"></a>365 <a class="indexterm" name="id254909 6"></a>366 </p></li><li><p> 367 <a class="indexterm" name="id25491 10"></a>368 <a class="indexterm" name="id254911 9"></a>364 <a class="indexterm" name="id2549086"></a> 365 <a class="indexterm" name="id2549092"></a> 366 </p></li><li><p> 367 <a class="indexterm" name="id2549106"></a> 368 <a class="indexterm" name="id2549115"></a> 369 369 Configure the CUPS Print Queues as follows: 370 370 </p><pre class="screen"> … … 373 373 <code class="prompt">root# </code> lpadmin -p qms -v socket://192.168.2.10:9100 -E 374 374 </pre><p> 375 <a class="indexterm" name="id25491 52"></a>375 <a class="indexterm" name="id2549148"></a> 376 376 This creates the necessary print queues with no assigned print filter. 377 377 </p></li><li><p> 378 <a class="indexterm" name="id254916 7"></a>379 <a class="indexterm" name="id254917 4"></a>380 <a class="indexterm" name="id25491 81"></a>378 <a class="indexterm" name="id2549163"></a> 379 <a class="indexterm" name="id2549170"></a> 380 <a class="indexterm" name="id2549177"></a> 381 381 Edit the file <code class="filename">/etc/cups/mime.convs</code> to uncomment the line: 382 382 </p><pre class="screen"> … … 384 384 </pre><p> 385 385 </p></li><li><p> 386 <a class="indexterm" name="id254920 9"></a>386 <a class="indexterm" name="id2549204"></a> 387 387 Edit the file <code class="filename">/etc/cups/mime.types</code> to uncomment the line: 388 388 </p><pre class="screen"> … … 390 390 </pre><p> 391 391 </p></li><li><p> 392 <a class="indexterm" name="id254923 5"></a>392 <a class="indexterm" name="id2549231"></a> 393 393 Using your favorite system editor, create an <code class="filename">/etc/dhcpd.conf</code> with the 394 394 contents as shown in <a class="link" href="small.html#dhcp01" title="Example 2.2. Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf">“Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf”</a>. 395 </p><div class="example"><a name="dhcp01"></a><p class="title"><b>Example 2.2. Abmas Accounting DHCP Server Configuration File <code class="filename">/etc/dhcpd.conf</code></b></p><div class="example-contents"><a class="indexterm" name="id25492 71"></a><pre class="screen">395 </p><div class="example"><a name="dhcp01"></a><p class="title"><b>Example 2.2. Abmas Accounting DHCP Server Configuration File <code class="filename">/etc/dhcpd.conf</code></b></p><div class="example-contents"><a class="indexterm" name="id2549267"></a><pre class="screen"> 396 396 default-lease-time 86400; 397 397 max-lease-time 172800; … … 441 441 automatically at every system reboot. For example, 442 442 </p><p> 443 <a class="indexterm" name="id254931 6"></a>444 <a class="indexterm" name="id25493 23"></a>445 <a class="indexterm" name="id25493 30"></a>446 <a class="indexterm" name="id254933 7"></a>447 <a class="indexterm" name="id254934 4"></a>443 <a class="indexterm" name="id2549312"></a> 444 <a class="indexterm" name="id2549319"></a> 445 <a class="indexterm" name="id2549326"></a> 446 <a class="indexterm" name="id2549333"></a> 447 <a class="indexterm" name="id2549340"></a> 448 448 </p><pre class="screen"> 449 449 <code class="prompt">root# </code> chkconfig dhcp on … … 455 455 </pre><p> 456 456 </p></li><li><p> 457 <a class="indexterm" name="id2549 401"></a>458 <a class="indexterm" name="id254940 8"></a>459 <a class="indexterm" name="id254941 7"></a>460 <a class="indexterm" name="id25494 23"></a>461 <a class="indexterm" name="id25494 30"></a>462 <a class="indexterm" name="id254943 7"></a>457 <a class="indexterm" name="id2549396"></a> 458 <a class="indexterm" name="id2549403"></a> 459 <a class="indexterm" name="id2549412"></a> 460 <a class="indexterm" name="id2549419"></a> 461 <a class="indexterm" name="id2549426"></a> 462 <a class="indexterm" name="id2549432"></a> 463 463 Configure the name service switch (NSS) to handle WINS-based name resolution. 464 464 Since this system does not use a DNS server, it is safe to remove this option from … … 468 468 hosts: files wins 469 469 </pre><p> 470 </p></li></ol></div><div class="example"><a name="acct2conf"></a><p class="title"><b>Example 2.3. Accounting Office Network <code class="filename">smb.conf</code> File [globals] Section</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2549 501"></a><em class="parameter"><code>workgroup = BILLMORE</code></em></td></tr><tr><td><a class="indexterm" name="id2549513"></a><em class="parameter"><code>passwd chat = *New*Password* %n\n*Re-enter*new*password* %n\n *Password*changed*</code></em></td></tr><tr><td><a class="indexterm" name="id2549526"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2549538"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2549549"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2549561"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2549573"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2549585"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m -G users '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2549598"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2549610"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2549622"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2549634"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -A '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2549647"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2549660"></a><em class="parameter"><code>logon script = scripts\login.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2549672"></a><em class="parameter"><code>logon path = </code></em></td></tr><tr><td><a class="indexterm" name="id2549683"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2549695"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2549707"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2549719"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2549730"></a><em class="parameter"><code>printing = CUPS</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="acct3conf"></a><p class="title"><b>Example 2.4. Accounting Office Network <code class="filename">smb.conf</code> File Services and Shares Section</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2549775"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2549787"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2549799"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2549810"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2549831"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2549843"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2549854"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2549866"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2549878"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2549889"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2549910"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2549922"></a><em class="parameter"><code>path = /data/%U</code></em></td></tr><tr><td><a class="indexterm" name="id2549933"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2549945"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id2549966"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id2549977"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id2549989"></a><em class="parameter"><code>valid users = %G</code></em></td></tr><tr><td><a class="indexterm" name="id2550001"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[finsvcs]</code></em></td></tr><tr><td><a class="indexterm" name="id2550021"></a><em class="parameter"><code>comment = Financial Service Files</code></em></td></tr><tr><td><a class="indexterm" name="id2550033"></a><em class="parameter"><code>path = /data/finsvcs</code></em></td></tr><tr><td><a class="indexterm" name="id2550045"></a><em class="parameter"><code>valid users = %G</code></em></td></tr><tr><td><a class="indexterm" name="id2550056"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2550069"></a>Validation</h3></div></div></div><p>470 </p></li></ol></div><div class="example"><a name="acct2conf"></a><p class="title"><b>Example 2.3. Accounting Office Network <code class="filename">smb.conf</code> File [globals] Section</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2549497"></a><em class="parameter"><code>workgroup = BILLMORE</code></em></td></tr><tr><td><a class="indexterm" name="id2549509"></a><em class="parameter"><code>passwd chat = *New*Password* %n\n*Re-enter*new*password* %n\n *Password*changed*</code></em></td></tr><tr><td><a class="indexterm" name="id2549521"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2549533"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2549545"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2549557"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2549569"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2549581"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m -G users '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2549593"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2549606"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2549618"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2549630"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -A '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2549643"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2549655"></a><em class="parameter"><code>logon script = scripts\login.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2549667"></a><em class="parameter"><code>logon path = </code></em></td></tr><tr><td><a class="indexterm" name="id2549679"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2549691"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2549702"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2549714"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2549726"></a><em class="parameter"><code>printing = CUPS</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="acct3conf"></a><p class="title"><b>Example 2.4. Accounting Office Network <code class="filename">smb.conf</code> File Services and Shares Section</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2549771"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2549783"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2549794"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2549806"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2549826"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2549838"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2549850"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2549862"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2549873"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2549885"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2549906"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2549917"></a><em class="parameter"><code>path = /data/%U</code></em></td></tr><tr><td><a class="indexterm" name="id2549929"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2549941"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id2549961"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id2549973"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id2549985"></a><em class="parameter"><code>valid users = %G</code></em></td></tr><tr><td><a class="indexterm" name="id2549996"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[finsvcs]</code></em></td></tr><tr><td><a class="indexterm" name="id2550017"></a><em class="parameter"><code>comment = Financial Service Files</code></em></td></tr><tr><td><a class="indexterm" name="id2550029"></a><em class="parameter"><code>path = /data/finsvcs</code></em></td></tr><tr><td><a class="indexterm" name="id2550040"></a><em class="parameter"><code>valid users = %G</code></em></td></tr><tr><td><a class="indexterm" name="id2550052"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2550065"></a>Validation</h3></div></div></div><p> 471 471 Does everything function as it ought? That is the key question at this point. 472 472 Here are some simple steps to validate your Samba server configuration. 473 </p><div class="procedure"><a name="id25500 81"></a><p class="title"><b>Procedure 2.2. Validation Steps</b></p><ol type="1"><li><p>474 <a class="indexterm" name="id25500 92"></a>473 </p><div class="procedure"><a name="id2550076"></a><p class="title"><b>Procedure 2.2. Validation Steps</b></p><ol type="1"><li><p> 474 <a class="indexterm" name="id2550087"></a> 475 475 If your <code class="filename">smb.conf</code> file has bogus options or parameters, this may cause Samba 476 476 to refuse to start. The first step should always be to validate the contents … … 519 519 Clear away all errors before proceeding, and start or restart samba as necessary. 520 520 </p></li><li><p> 521 <a class="indexterm" name="id255017 4"></a>522 <a class="indexterm" name="id25501 81"></a>523 <a class="indexterm" name="id255018 8"></a>524 <a class="indexterm" name="id255019 5"></a>521 <a class="indexterm" name="id2550170"></a> 522 <a class="indexterm" name="id2550177"></a> 523 <a class="indexterm" name="id2550184"></a> 524 <a class="indexterm" name="id2550190"></a> 525 525 Check that the Samba server is running: 526 526 </p><pre class="screen"> … … 539 539 <code class="literal">smbd</code> is normal. 540 540 </p></li><li><p> 541 <a class="indexterm" name="id25502 50"></a>541 <a class="indexterm" name="id2550246"></a> 542 542 Check that an anonymous connection can be made to the Samba server: 543 543 </p><pre class="screen"> … … 568 568 a <code class="constant">NULL</code> password. 569 569 </p></li><li><p> 570 <a class="indexterm" name="id255030 5"></a>571 <a class="indexterm" name="id25503 12"></a>572 <a class="indexterm" name="id255031 9"></a>570 <a class="indexterm" name="id2550300"></a> 571 <a class="indexterm" name="id2550307"></a> 572 <a class="indexterm" name="id2550314"></a> 573 573 Verify that the printers have the IP addresses assigned in the DHCP server configuration file. 574 574 The easiest way to do this is to ping the printer name. Immediately after the ping response … … 589 589 <code class="filename">/etc/dhcpd.conf</code> file. 590 590 </p></li><li><p> 591 <a class="indexterm" name="id255038 4"></a>591 <a class="indexterm" name="id2550380"></a> 592 592 Make an authenticated connection to the server using the <code class="literal">smbclient</code> tool: 593 593 </p><pre class="screen"> … … 606 606 smb: \> q 607 607 </pre><p> 608 </p></li></ol></div></div><div class="procedure"><a name="id255043 6"></a><p class="title"><b>Procedure 2.3. Windows XP Professional Client Configuration</b></p><ol type="1"><li><p>608 </p></li></ol></div></div><div class="procedure"><a name="id2550431"></a><p class="title"><b>Procedure 2.3. Windows XP Professional Client Configuration</b></p><ol type="1"><li><p> 609 609 Configure clients to the network settings shown in <a class="link" href="small.html#acct2net" title="Figure 2.1. Abmas Accounting 52-User Network Topology">“Abmas Accounting 52-User Network Topology”</a>. 610 610 All clients use DHCP for TCP/IP protocol stack configuration. 611 <a class="indexterm" name="id255045 5"></a>612 <a class="indexterm" name="id25504 62"></a>611 <a class="indexterm" name="id2550451"></a> 612 <a class="indexterm" name="id2550457"></a> 613 613 DHCP configures all Windows clients to use the WINS Server address <code class="constant">192.168.1.1</code>. 614 614 </p></li><li><p> … … 652 652 Repeat the printer installation steps above for the HP LaserJet 6 printer 653 653 as well as for the QMS Magicolor XXXX laser printer. 654 </p></li></ol></div></li></ol></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id25507 74"></a>Notebook Computers: A Special Case</h3></div></div></div><p>654 </p></li></ol></div></li></ol></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2550769"></a>Notebook Computers: A Special Case</h3></div></div></div><p> 655 655 As a network administrator, you already know how to create local machine accounts for Windows 200x/XP 656 656 Professional systems. This is the preferred solution to provide continuity of work for notebook users … … 662 662 that mean that as the network is more tightly secured, it becomes necessary to modify Windows client 663 663 configuration somewhat. 664 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2550 800"></a>Key Points Learned</h3></div></div></div><p>664 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2550795"></a>Key Points Learned</h3></div></div></div><p> 665 665 In this network design and implementation exercise, you created a Windows NT4-style Domain 666 666 Controller using Samba-3.0.20. Following these guidelines, you experienced … … 668 668 you build on the experience. These are the highlights from this chapter: 669 669 </p><div class="itemizedlist"><ul type="disc"><li><p> 670 <a class="indexterm" name="id25508 20"></a>670 <a class="indexterm" name="id2550815"></a> 671 671 You implemented a DHCP server, and Microsoft Windows clients were able to obtain all necessary 672 672 network configuration settings from this server. 673 673 </p></li><li><p> 674 <a class="indexterm" name="id25508 33"></a>674 <a class="indexterm" name="id2550829"></a> 675 675 You created a Windows Domain Controller. You were able to use the network logon service 676 676 and successfully joined Windows 200x/XP Professional clients to the Domain. 677 677 </p></li><li><p> 678 <a class="indexterm" name="id255084 8"></a>678 <a class="indexterm" name="id2550843"></a> 679 679 You created raw print queues in the CUPS printing system. You maintained a simple 680 680 printing system so that all users can share centrally managed printers. You installed … … 685 685 You offered Mobile notebook users a solution that allows them to continue to work 686 686 while away from the office and not connected to the corporate network. 687 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id255087 6"></a>Questions and Answers</h2></div></div></div><p>687 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2550871"></a>Questions and Answers</h2></div></div></div><p> 688 688 Your new Domain Controller is ready to serve you. What does it mean? Here are some questions and answers that 689 689 may help. 690 </p><div class="qandaset"><dl><dt>1. <a href="small.html#id255088 9">690 </p><div class="qandaset"><dl><dt>1. <a href="small.html#id2550885"> 691 691 What is the key benefit of using DHCP to configure Windows client TCP/IP stacks? 692 </a></dt><dt>2. <a href="small.html#id255091 6">692 </a></dt><dt>2. <a href="small.html#id2550911"> 693 693 Are there any DHCP server configuration parameters in the /etc/dhcpd.conf 694 694 that should be noted in particular? 695 </a></dt><dt>3. <a href="small.html#id255094 7">695 </a></dt><dt>3. <a href="small.html#id2550943"> 696 696 Is it possible to create a Windows Domain account that is specifically called Administrator? 697 </a></dt><dt>4. <a href="small.html#id255098 6">697 </a></dt><dt>4. <a href="small.html#id2550982"> 698 698 Why is it necessary to give the Windows Domain Administrator a UNIX UID of 0? 699 </a></dt><dt>5. <a href="small.html#id255102 8">699 </a></dt><dt>5. <a href="small.html#id2551023"> 700 700 One of my junior staff needs the ability to add machines to the Domain, but I do not want to give him 701 701 root access. How can we do this? 702 </a></dt><dt>6. <a href="small.html#id25510 70">702 </a></dt><dt>6. <a href="small.html#id2551065"> 703 703 Why must I map Windows Domain Groups to UNIX groups? 704 </a></dt><dt>7. <a href="small.html#id255110 8">704 </a></dt><dt>7. <a href="small.html#id2551104"> 705 705 I deleted my root account and now I cannot add it back! What can I do? 706 </a></dt><dt>8. <a href="small.html#id25511 81">706 </a></dt><dt>8. <a href="small.html#id2551177"> 707 707 When I run net groupmap list, it reports a group called Administrators 708 708 as well as Domain Admins. What is the difference between them? 709 </a></dt><dt>9. <a href="small.html#id25512 30">709 </a></dt><dt>9. <a href="small.html#id2551225"> 710 710 What is the effect of changing the name of a Samba server or of changing the Domain name? 711 </a></dt><dt>10. <a href="small.html#id25512 81">711 </a></dt><dt>10. <a href="small.html#id2551277"> 712 712 How can I manage user accounts from my Windows XP Professional workstation? 713 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id255088 9"></a><a name="id2550891"></a><p><b>1.</b></p></td><td align="left" valign="top"><p>713 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2550885"></a><a name="id2550887"></a><p><b>1.</b></p></td><td align="left" valign="top"><p> 714 714 What is the key benefit of using DHCP to configure Windows client TCP/IP stacks? 715 715 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 720 720 default routes and DNS server addresses that apply only to the Abmas office environment do 721 721 not interfere with remote operations. This is an extremely important feature of DHCP. 722 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id255091 6"></a><a name="id2550918"></a><p><b>2.</b></p></td><td align="left" valign="top"><p>722 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2550911"></a><a name="id2550914"></a><p><b>2.</b></p></td><td align="left" valign="top"><p> 723 723 Are there any DHCP server configuration parameters in the <code class="filename">/etc/dhcpd.conf</code> 724 724 that should be noted in particular? … … 729 729 NetBIOS machine name needs to be resolved to an IP Address. This configuration 730 730 results in far lower UDP broadcast traffic than would be the case if WINS was not used. 731 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id255094 7"></a><a name="id2550950"></a><p><b>3.</b></p></td><td align="left" valign="top"><p>731 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2550943"></a><a name="id2550945"></a><p><b>3.</b></p></td><td align="left" valign="top"><p> 732 732 Is it possible to create a Windows Domain account that is specifically called <code class="constant">Administrator</code>? 733 733 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 736 736 necessary to use the <em class="parameter"><code>username map</code></em> facility to map this account to the UNIX 737 737 account called <code class="constant">root</code>. 738 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id255098 6"></a><a name="id2550988"></a><p><b>4.</b></p></td><td align="left" valign="top"><p>738 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2550982"></a><a name="id2550984"></a><p><b>4.</b></p></td><td align="left" valign="top"><p> 739 739 Why is it necessary to give the Windows Domain <code class="constant">Administrator</code> a UNIX UID of 0? 740 740 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 746 746 settings within the Domain and on the Samba server, equivalent rights must be assigned. This is 747 747 achieved with the <code class="constant">root</code> UID equal to 0. 748 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id255102 8"></a><a name="id2551030"></a><p><b>5.</b></p></td><td align="left" valign="top"><p>748 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2551023"></a><a name="id2551025"></a><p><b>5.</b></p></td><td align="left" valign="top"><p> 749 749 One of my junior staff needs the ability to add machines to the Domain, but I do not want to give him 750 750 <code class="constant">root</code> access. How can we do this? … … 755 755 This must be the primary GID of the account of the user who is a member of the Windows <code class="constant"> 756 756 Domain Admins</code> account. 757 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id25510 70"></a><a name="id2551072"></a><p><b>6.</b></p></td><td align="left" valign="top"><p>757 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2551065"></a><a name="id2551067"></a><p><b>6.</b></p></td><td align="left" valign="top"><p> 758 758 Why must I map Windows Domain Groups to UNIX groups? 759 759 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 761 761 has a UNIX group account equivalent. The Domain groups that should be given UNIX equivalents are 762 762 <span class="guimenu">Domain Guests</span>, <span class="guimenu">Domain Users</span>, and <span class="guimenu">Domain Admins</span>. 763 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id255110 8"></a><a name="id2551110"></a><p><b>7.</b></p></td><td align="left" valign="top"><p>763 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2551104"></a><a name="id2551106"></a><p><b>7.</b></p></td><td align="left" valign="top"><p> 764 764 I deleted my <code class="constant">root</code> account and now I cannot add it back! What can I do? 765 765 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 773 773 </p></li><li><p> 774 774 Restore the <code class="filename">group_mapping.tdb</code> file. 775 </p></li></ol></div></td></tr><tr class="question"><td align="left" valign="top"><a name="id25511 81"></a><a name="id2551183"></a><p><b>8.</b></p></td><td align="left" valign="top"><p>775 </p></li></ol></div></td></tr><tr class="question"><td align="left" valign="top"><a name="id2551177"></a><a name="id2551179"></a><p><b>8.</b></p></td><td align="left" valign="top"><p> 776 776 When I run <code class="literal">net groupmap list</code>, it reports a group called <span class="guimenu">Administrators</span> 777 777 as well as <span class="guimenu">Domain Admins</span>. What is the difference between them? … … 781 781 Groups at this time. A Workstation or Server Local Group has no meaning in a Samba context. This 782 782 may change at some later date. These accounts are provided only so that security objects are correctly shown. 783 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id25512 30"></a><a name="id2551232"></a><p><b>9.</b></p></td><td align="left" valign="top"><p>783 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2551225"></a><a name="id2551227"></a><p><b>9.</b></p></td><td align="left" valign="top"><p> 784 784 What is the effect of changing the name of a Samba server or of changing the Domain name? 785 785 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 793 793 or the <code class="literal">smbpasswd</code> (Samba-2.2.x). To change the SID, you use the same tool. Be sure 794 794 to check the man page for this command for detailed instructions regarding the steps involved. 795 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id25512 81"></a><a name="id2551283"></a><p><b>10.</b></p></td><td align="left" valign="top"><p>795 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2551277"></a><a name="id2551279"></a><p><b>10.</b></p></td><td align="left" valign="top"><p> 796 796 How can I manage user accounts from my Windows XP Professional workstation? 797 797 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> -
branches/samba-3.2.x/docs/htmldocs/Samba3-ByExample/unixclients.html
r204 r226 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 7. Adding Domain Member Servers and Clients</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="next" href="upgrades.html" title="Chapter 8. Updating Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 7. Adding Domain Member Servers and Clients</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="DMSMig.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="upgrades.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="unixclients"></a>Chapter 7. Adding Domain Member Servers and Clients</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="unixclients.html#id25823 70">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id2582424">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id2582459">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id2582487">Technical Issues</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id2583136">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id2583237">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></span></dt><dt><span class="sect2"><a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></span></dt><dt><span class="sect2"><a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a></span></dt><dt><span class="sect2"><a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id2589442">UNIX/Linux Client Domain Member</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id2590017">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id2590071">Questions and Answers</a></span></dt></dl></div><p><a class="indexterm" name="id2582272"></a><a class="indexterm" name="id2582280"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 7. Adding Domain Member Servers and Clients</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="next" href="upgrades.html" title="Chapter 8. Updating Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 7. Adding Domain Member Servers and Clients</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="DMSMig.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="upgrades.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="unixclients"></a>Chapter 7. Adding Domain Member Servers and Clients</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="unixclients.html#id2582366">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id2582419">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id2582454">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id2582483">Technical Issues</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id2583132">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id2583232">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></span></dt><dt><span class="sect2"><a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></span></dt><dt><span class="sect2"><a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a></span></dt><dt><span class="sect2"><a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id2589438">UNIX/Linux Client Domain Member</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id2590012">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id2590066">Questions and Answers</a></span></dt></dl></div><p><a class="indexterm" name="id2582267"></a><a class="indexterm" name="id2582275"></a> 2 2 The most frequently discussed Samba subjects over the past 2 years have focused around domain control and printing. 3 3 It is well known that Samba is a file and print server. A recent survey conducted by <span class="emphasis"><em>Open Magazine</em></span> found … … 12 12 the addition of Samba servers into your present Windows network whatever the controlling technology 13 13 may be. So let's get back to our good friends at Abmas. 14 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id25823 70"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id2582377"></a><a class="indexterm" name="id2582384"></a>14 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2582366"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id2582372"></a><a class="indexterm" name="id2582380"></a> 15 15 Looking back over the achievements of the past year or two, daily events at Abmas are rather straightforward 16 16 with not too many distractions or problems. Your team is doing well, but a number of employees 17 17 are asking for Linux desktop systems. Your network has grown and demands additional domain member servers. Let's 18 18 get on with this; Christine and Stan are ready to go. 19 </p><p><a class="indexterm" name="id258240 6"></a>19 </p><p><a class="indexterm" name="id2582401"></a> 20 20 Stan is firmly in control of the department of the future, while Christine is enjoying a stable and 21 21 predictable network environment. It is time to add more servers and to add Linux desktops. It is 22 22 time to meet the demands of future growth and endure trial by fire. 23 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id25824 24"></a>Assignment Tasks</h3></div></div></div><p><a class="indexterm" name="id2582431"></a>23 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2582419"></a>Assignment Tasks</h3></div></div></div><p><a class="indexterm" name="id2582426"></a> 24 24 You must now add UNIX/Linux domain member servers to your network. You have a friend who has a Windows 2003 25 25 Active Directory domain network who wants to add a Samba/Linux server and has asked Christine to help him … … 31 31 do likewise at Swodniw Biz NL (your friend's company) to help them to evaluate a Linux desktop. You want to make 32 32 the right decision, don't you? 33 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id258245 9"></a>Dissection and Discussion</h2></div></div></div><p>34 <a class="indexterm" name="id258246 7"></a>33 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2582454"></a>Dissection and Discussion</h2></div></div></div><p> 34 <a class="indexterm" name="id2582462"></a> 35 35 Recent Samba mailing-list activity is witness to how many sites are using winbind. Some have no trouble 36 36 at all with it, yet to others the problems seem insurmountable. Periodically there are complaints concerning … … 40 40 resolution. You also provide working examples of solutions for integrated authentication for 41 41 both UNIX/Linux and Windows environments. 42 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id258248 7"></a>Technical Issues</h3></div></div></div><p>42 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2582483"></a>Technical Issues</h3></div></div></div><p> 43 43 One of the great challenges we face when people ask us, “<span class="quote">What is the best way to solve 44 44 this problem?</span>” is to get beyond the facts so we not only can clearly comprehend 45 45 the immediate technical problem, but also can understand how needs may change. 46 46 </p><p> 47 <a class="indexterm" name="id258250 6"></a>47 <a class="indexterm" name="id2582502"></a> 48 48 There are a few facts we should note when dealing with the question of how best to 49 49 integrate UNIX/Linux clients and servers into a Windows networking environment: 50 50 </p><div class="itemizedlist"><ul type="disc"><li><p> 51 <a class="indexterm" name="id25825 22"></a>52 <a class="indexterm" name="id258252 9"></a>53 <a class="indexterm" name="id258253 6"></a>54 <a class="indexterm" name="id258254 6"></a>55 <a class="indexterm" name="id25825 52"></a>51 <a class="indexterm" name="id2582518"></a> 52 <a class="indexterm" name="id2582525"></a> 53 <a class="indexterm" name="id2582532"></a> 54 <a class="indexterm" name="id2582541"></a> 55 <a class="indexterm" name="id2582548"></a> 56 56 A domain controller (PDC or BDC) is always authoritative for all accounts in its domain. 57 57 This means that a BDC must (of necessity) be able to resolve all account UIDs and GIDs 58 58 to the same values that the PDC resolved them to. 59 59 </p></li><li><p> 60 <a class="indexterm" name="id258256 7"></a>61 <a class="indexterm" name="id25825 74"></a>62 <a class="indexterm" name="id258258 6"></a>63 <a class="indexterm" name="id25825 93"></a>60 <a class="indexterm" name="id2582562"></a> 61 <a class="indexterm" name="id2582569"></a> 62 <a class="indexterm" name="id2582581"></a> 63 <a class="indexterm" name="id2582588"></a> 64 64 A domain member can be authoritative for local accounts, but is never authoritative for 65 65 domain accounts. If a user is accessing a domain member server and that user's account … … 71 71 number of sources: 72 72 </p><div class="itemizedlist"><ul type="circle"><li><p> 73 <a class="indexterm" name="id258262 6"></a>74 <a class="indexterm" name="id25826 32"></a>75 <a class="indexterm" name="id258263 9"></a>76 <a class="indexterm" name="id258264 6"></a>77 <a class="indexterm" name="id25826 52"></a>73 <a class="indexterm" name="id2582621"></a> 74 <a class="indexterm" name="id2582628"></a> 75 <a class="indexterm" name="id2582634"></a> 76 <a class="indexterm" name="id2582641"></a> 77 <a class="indexterm" name="id2582648"></a> 78 78 By executing a system <code class="literal">getpwnam()</code> or <code class="literal">getgrnam()</code> call. 79 79 On systems that support it, this utilizes the name service switch (NSS) facility to … … 81 81 file. NSS can be configured to use LDAP, winbind, NIS, or local files. 82 82 </p></li><li><p> 83 <a class="indexterm" name="id258268 6"></a>84 <a class="indexterm" name="id25826 92"></a>85 <a class="indexterm" name="id258269 9"></a>83 <a class="indexterm" name="id2582681"></a> 84 <a class="indexterm" name="id2582688"></a> 85 <a class="indexterm" name="id2582695"></a> 86 86 Performing, via NSS, a direct LDAP search (where an LDAP passdb backend has been configured). 87 87 This requires the use of the PADL nss_ldap tool (or equivalent). 88 88 </p></li><li><p> 89 <a class="indexterm" name="id25827 13"></a>90 <a class="indexterm" name="id25827 20"></a>91 <a class="indexterm" name="id258272 7"></a>92 <a class="indexterm" name="id25827 34"></a>89 <a class="indexterm" name="id2582709"></a> 90 <a class="indexterm" name="id2582716"></a> 91 <a class="indexterm" name="id2582722"></a> 92 <a class="indexterm" name="id2582729"></a> 93 93 Directly by querying <code class="literal">winbindd</code>. The <code class="literal">winbindd</code> 94 94 contacts a domain controller to attempt to resolve the identity of the user or group. It … … 98 98 <code class="filename">winbindd_cache.tdb</code> files. 99 99 </p><p> 100 <a class="indexterm" name="id25827 73"></a>101 <a class="indexterm" name="id25827 80"></a>100 <a class="indexterm" name="id2582769"></a> 101 <a class="indexterm" name="id2582776"></a> 102 102 If the parameter <a class="link" href="smb.conf.5.html#IDMAPBACKEND">idmap backend = ldap:ldap://myserver.domain</a> 103 103 was specified and the LDAP server has been configured with a container in which it may … … 112 112 casual user. 113 113 </p></li><li><p> 114 <a class="indexterm" name="id258284 5"></a>115 <a class="indexterm" name="id25828 52"></a>116 <a class="indexterm" name="id25828 62"></a>114 <a class="indexterm" name="id2582840"></a> 115 <a class="indexterm" name="id2582848"></a> 116 <a class="indexterm" name="id2582857"></a> 117 117 If you wish to make use of accounts (users and/or groups) that are local to (i.e., capable 118 118 of being resolved using) the NSS facility, it is possible to use the … … 121 121 and to domain member servers. 122 122 </p></li></ul></div><p> 123 <a class="indexterm" name="id258289 7"></a>124 <a class="indexterm" name="id258290 4"></a>125 <a class="indexterm" name="id25829 11"></a>123 <a class="indexterm" name="id2582893"></a> 124 <a class="indexterm" name="id2582900"></a> 125 <a class="indexterm" name="id2582907"></a> 126 126 For many administrators, it should be plain that the use of an LDAP-based repository for all network 127 127 accounts (both for POSIX accounts and for Samba accounts) provides the most elegant and 128 128 controllable facility. You eventually appreciate the decision to use LDAP. 129 129 </p><p> 130 <a class="indexterm" name="id258292 6"></a>131 <a class="indexterm" name="id25829 33"></a>132 <a class="indexterm" name="id25829 40"></a>130 <a class="indexterm" name="id2582921"></a> 131 <a class="indexterm" name="id2582928"></a> 132 <a class="indexterm" name="id2582935"></a> 133 133 If your network account information resides in an LDAP repository, you should use it ahead of any 134 134 alternative method. This means that if it is humanly possible to use the <code class="literal">nss_ldap</code> … … 137 137 throughout the network. 138 138 </p><p> 139 <a class="indexterm" name="id25829 62"></a>140 <a class="indexterm" name="id25829 72"></a>141 <a class="indexterm" name="id258297 9"></a>142 <a class="indexterm" name="id258298 6"></a>143 <a class="indexterm" name="id25829 92"></a>144 <a class="indexterm" name="id258299 9"></a>139 <a class="indexterm" name="id2582958"></a> 140 <a class="indexterm" name="id2582967"></a> 141 <a class="indexterm" name="id2582974"></a> 142 <a class="indexterm" name="id2582981"></a> 143 <a class="indexterm" name="id2582988"></a> 144 <a class="indexterm" name="id2582995"></a> 145 145 In the situation where UNIX accounts are held on the domain member server itself, the only effective 146 146 way to use them involves the <code class="filename">smb.conf</code> entry … … 150 150 disables the use of Samba with trusted domains (i.e., external domains). 151 151 </p><p> 152 <a class="indexterm" name="id25830 50"></a>153 <a class="indexterm" name="id258305 7"></a>154 <a class="indexterm" name="id258306 7"></a>155 <a class="indexterm" name="id25830 74"></a>152 <a class="indexterm" name="id2583046"></a> 153 <a class="indexterm" name="id2583053"></a> 154 <a class="indexterm" name="id2583062"></a> 155 <a class="indexterm" name="id2583069"></a> 156 156 Winbind can be used to create an appliance mode domain member server. In this capacity, <code class="literal">winbindd</code> 157 157 is configured to automatically allocate UIDs/GIDs from numeric ranges set in the <code class="filename">smb.conf</code> file. The allocation … … 162 162 is stored in the <code class="filename">winbindd_idmap.tdb</code> and <code class="filename">winbindd_cache.tdb</code> files. 163 163 </p><p> 164 <a class="indexterm" name="id25831 21"></a>164 <a class="indexterm" name="id2583117"></a> 165 165 The use of an LDAP backend for the Winbind IDMAP facility permits Windows domain SIDs 166 166 mappings to UIDs/GIDs to be stored centrally. The result is a consistent mapping across all domain member 167 167 servers so configured. This solves one of the major headaches for network administrators who need to copy 168 168 files between or across network file servers. 169 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id258313 6"></a>Political Issues</h3></div></div></div><p>170 <a class="indexterm" name="id258314 4"></a>171 <a class="indexterm" name="id25831 51"></a>172 <a class="indexterm" name="id258315 8"></a>173 <a class="indexterm" name="id258316 7"></a>169 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2583132"></a>Political Issues</h3></div></div></div><p> 170 <a class="indexterm" name="id2583140"></a> 171 <a class="indexterm" name="id2583146"></a> 172 <a class="indexterm" name="id2583153"></a> 173 <a class="indexterm" name="id2583162"></a> 174 174 One of the most fierce conflicts recently being waged is resistance to the adoption of LDAP, in 175 175 particular OpenLDAP, as a replacement for UNIX NIS (previously called Yellow Pages). Let's face it, LDAP … … 183 183 commercial integration products. But it's not what Active Directory was designed for. 184 184 </p><p> 185 <a class="indexterm" name="id258320 5"></a>186 <a class="indexterm" name="id25832 12"></a>185 <a class="indexterm" name="id2583201"></a> 186 <a class="indexterm" name="id2583207"></a> 187 187 A number of long-term UNIX devotees have recently commented in various communications that the Samba Team 188 188 is the first application group to almost force network administrators to use LDAP. It should be pointed … … 190 190 finally emerged as the preferred identity management backend for Samba. We recommend LDAP for your total 191 191 organizational directory needs. 192 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id258323 7"></a>Implementation</h2></div></div></div><p>193 <a class="indexterm" name="id258324 5"></a>194 <a class="indexterm" name="id25832 54"></a>195 <a class="indexterm" name="id25832 63"></a>192 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2583232"></a>Implementation</h2></div></div></div><p> 193 <a class="indexterm" name="id2583240"></a> 194 <a class="indexterm" name="id2583249"></a> 195 <a class="indexterm" name="id2583259"></a> 196 196 The domain member server and the domain member client are at the center of focus in this chapter. 197 197 Configuration of Samba-3 domain controller is covered in earlier chapters, so if your … … 199 199 oil that helps you to add domain member servers and clients. 200 200 </p><p> 201 <a class="indexterm" name="id258327 9"></a>201 <a class="indexterm" name="id2583275"></a> 202 202 In practice, domain member servers and domain member workstations are very different entities, but in 203 203 terms of technology they share similar core infrastructure. A technologist would argue that servers … … 207 207 but a server is viewed as a core component of the business. 208 208 </p><p> 209 <a class="indexterm" name="id2583 302"></a>209 <a class="indexterm" name="id2583297"></a> 210 210 We can look at this another way. If a workstation breaks down, one user is affected, but if a 211 211 server breaks down, hundreds of users may not be able to work. The services that a workstation … … 213 213 and is distribution oriented. 214 214 </p><p> 215 <a class="indexterm" name="id258331 7"></a>216 <a class="indexterm" name="id258332 4"></a>217 <a class="indexterm" name="id25833 31"></a>215 <a class="indexterm" name="id2583312"></a> 216 <a class="indexterm" name="id2583320"></a> 217 <a class="indexterm" name="id2583326"></a> 218 218 <span class="emphasis"><em>Why is this important?</em></span> For starters, we must identify what 219 219 components of the operating system and its environment must be configured. Also, it is necessary … … 227 227 what type of service need must be fulfilled. 228 228 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="sdcsdmldap"></a>Samba Domain with Samba Domain Member Server Using NSS LDAP</h3></div></div></div><p> 229 <a class="indexterm" name="id25833 72"></a>230 <a class="indexterm" name="id258337 9"></a>231 <a class="indexterm" name="id258338 6"></a>232 <a class="indexterm" name="id25833 93"></a>233 <a class="indexterm" name="id2583 402"></a>234 <a class="indexterm" name="id258340 9"></a>229 <a class="indexterm" name="id2583368"></a> 230 <a class="indexterm" name="id2583374"></a> 231 <a class="indexterm" name="id2583381"></a> 232 <a class="indexterm" name="id2583388"></a> 233 <a class="indexterm" name="id2583397"></a> 234 <a class="indexterm" name="id2583404"></a> 235 235 In this example, it is assumed that you have Samba PDC/BDC servers. This means you are using 236 236 an LDAP ldapsam backend. We are adding to the LDAP backend database (directory) … … 248 248 so that all domain member servers can use a consistent mapping. 249 249 </p><p> 250 <a class="indexterm" name="id25834 73"></a>251 <a class="indexterm" name="id25834 80"></a>252 <a class="indexterm" name="id258348 6"></a>250 <a class="indexterm" name="id2583468"></a> 251 <a class="indexterm" name="id2583475"></a> 252 <a class="indexterm" name="id2583482"></a> 253 253 If your installation is accessed only from clients that are members of your own domain, and all 254 254 user accounts are present in a local passdb backend then it is not necessary to run … … 260 260 source can be provided from 261 261 </p><div class="itemizedlist"><ul type="disc"><li><p> 262 <a class="indexterm" name="id25835 23"></a>263 <a class="indexterm" name="id25835 30"></a>262 <a class="indexterm" name="id2583519"></a> 263 <a class="indexterm" name="id2583526"></a> 264 264 Accounts in <code class="filename">/etc/passwd</code> or in <code class="filename">/etc/group</code>. 265 265 </p></li><li><p> 266 <a class="indexterm" name="id25835 54"></a>267 <a class="indexterm" name="id25835 60"></a>268 <a class="indexterm" name="id258356 7"></a>269 <a class="indexterm" name="id25835 74"></a>270 <a class="indexterm" name="id25835 81"></a>271 <a class="indexterm" name="id258358 8"></a>272 <a class="indexterm" name="id258359 4"></a>273 <a class="indexterm" name="id2583 601"></a>274 <a class="indexterm" name="id258360 8"></a>266 <a class="indexterm" name="id2583549"></a> 267 <a class="indexterm" name="id2583556"></a> 268 <a class="indexterm" name="id2583562"></a> 269 <a class="indexterm" name="id2583569"></a> 270 <a class="indexterm" name="id2583576"></a> 271 <a class="indexterm" name="id2583583"></a> 272 <a class="indexterm" name="id2583590"></a> 273 <a class="indexterm" name="id2583596"></a> 274 <a class="indexterm" name="id2583603"></a> 275 275 Resolution via NSS. On NSS-enabled systems, there is usually a facility to resolve IDs 276 276 via multiple methods. The methods typically include <code class="literal">files</code>, … … 284 284 used only locally on the Samba domain member server under discussion. 285 285 </p></div><p> 286 <a class="indexterm" name="id258368 8"></a>286 <a class="indexterm" name="id2583683"></a> 287 287 The diagram in <a class="link" href="unixclients.html#ch9-sambadc" title="Figure 7.2. Samba Domain: Samba Member Server">“Samba Domain: Samba Member Server”</a> demonstrates the relationship of Samba and system 288 288 components that are involved in the identity resolution process where Samba is used as a domain 289 289 member server within a Samba domain control network. 290 290 </p><div class="figure"><a name="ch9-sambadc"></a><p class="title"><b>Figure 7.2. Samba Domain: Samba Member Server</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap9-SambaDC.png" width="324" alt="Samba Domain: Samba Member Server"></div></div></div><br class="figure-break"><p> 291 <a class="indexterm" name="id258374 9"></a>292 <a class="indexterm" name="id258375 6"></a>291 <a class="indexterm" name="id2583745"></a> 292 <a class="indexterm" name="id2583752"></a> 293 293 In this example configuration, Samba will directly search the LDAP-based passwd backend ldapsam 294 294 to obtain authentication and user identity information. The IDMAP information is stored in the LDAP … … 301 301 If the network does not have an LDAP slave server (i.e., <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a> configuration), 302 302 change the target LDAP server from <code class="constant">lapdc</code> to <code class="constant">massive.</code> 303 </p><div class="procedure"><a name="id258380 4"></a><p class="title"><b>Procedure 7.1. Configuration of NSS_LDAP-Based Identity Resolution</b></p><ol type="1"><li><p>303 </p><div class="procedure"><a name="id2583800"></a><p class="title"><b>Procedure 7.1. Configuration of NSS_LDAP-Based Identity Resolution</b></p><ol type="1"><li><p> 304 304 Create the <code class="filename">smb.conf</code> file as shown in <a class="link" href="unixclients.html#ch9-sdmsdc" title="Example 7.1. Samba Domain Member in Samba Domain Using LDAP smb.conf File">“Samba Domain Member in Samba Domain Using LDAP smb.conf File”</a>. Locate 305 305 this file in the directory <code class="filename">/etc/samba</code>. 306 306 </p></li><li><p> 307 <a class="indexterm" name="id25838 42"></a>307 <a class="indexterm" name="id2583838"></a> 308 308 Configure the file that will be used by <code class="constant">nss_ldap</code> to 309 309 locate and communicate with the LDAP server. This file is called <code class="filename">ldap.conf</code>. … … 327 327 <a class="link" href="unixclients.html#ch9-sdmnss" title="Example 7.4. NSS using LDAP for Identity Resolution File: /etc/nsswitch.conf">“NSS using LDAP for Identity Resolution File: /etc/nsswitch.conf”</a>. 328 328 </p></li><li><p> 329 <a class="indexterm" name="id25839 30"></a>330 <a class="indexterm" name="id258393 7"></a>329 <a class="indexterm" name="id2583925"></a> 330 <a class="indexterm" name="id2583932"></a> 331 331 Before proceeding to configure Samba, validate the operation of the NSS identity 332 332 resolution via LDAP by executing: … … 363 363 sammy:x:4321: 364 364 </pre><p> 365 <a class="indexterm" name="id258 4001"></a>366 <a class="indexterm" name="id258400 8"></a>367 <a class="indexterm" name="id258401 5"></a>365 <a class="indexterm" name="id2583996"></a> 366 <a class="indexterm" name="id2584003"></a> 367 <a class="indexterm" name="id2584010"></a> 368 368 This shows that all is working as it should be. Notice that in the LDAP database 369 369 the users' primary and secondary group memberships are identical. It is not … … 375 375 after Samba-3.0.20 has been released. 376 376 </p></li><li><p> 377 <a class="indexterm" name="id258403 9"></a>377 <a class="indexterm" name="id2584034"></a> 378 378 The LDAP directory must have a container object for IDMAP data. There are several ways you can 379 379 check that your LDAP database is able to receive IDMAP information. One of the simplest is to … … 384 384 ou: idmap 385 385 </pre><p> 386 <a class="indexterm" name="id25840 62"></a>386 <a class="indexterm" name="id2584057"></a> 387 387 If the execution of this command does not return IDMAP entries, you need to create an LDIF 388 388 template file (see <a class="link" href="unixclients.html#ch9-ldifadd" title="Example 7.2. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF">“LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF”</a>). You can add the required entries using … … 400 400 </pre><p> 401 401 </p></li><li><p> 402 <a class="indexterm" name="id258412 6"></a>403 <a class="indexterm" name="id258413 7"></a>402 <a class="indexterm" name="id2584121"></a> 403 <a class="indexterm" name="id2584132"></a> 404 404 The system is ready to join the domain. Execute the following: 405 405 </p><pre class="screen"> … … 419 419 <code class="prompt">root# </code> net rpc join -S 'pdc-name' -U administrator%password -d 5 420 420 </pre><p> 421 <a class="indexterm" name="id258420 9"></a>422 <a class="indexterm" name="id258421 6"></a>423 <a class="indexterm" name="id25842 23"></a>424 <a class="indexterm" name="id258422 9"></a>421 <a class="indexterm" name="id2584204"></a> 422 <a class="indexterm" name="id2584211"></a> 423 <a class="indexterm" name="id2584218"></a> 424 <a class="indexterm" name="id2584225"></a> 425 425 Note: Use "root" for UNIX/Linux and Samba, use "Administrator" for Windows NT4/200X. If the cause of 426 426 the failure appears to be related to a rejected or failed NT_SESSION_SETUP* or an error message that … … 450 450 </pre><p> 451 451 </p></li><li><p> 452 <a class="indexterm" name="id25842 91"></a>452 <a class="indexterm" name="id2584286"></a> 453 453 Just joining the domain is not quite enough; you must now provide a privileged set 454 454 of credentials through which <code class="literal">winbindd</code> can interact with the … … 461 461 You may now start Samba in the usual manner, and your Samba domain member server 462 462 is ready for use. Just add shares as required. 463 </p></li></ol></div><div class="example"><a name="ch9-sdmsdc"></a><p class="title"><b>Example 7.1. Samba Domain Member in Samba Domain Using LDAP <code class="filename">smb.conf</code> File</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id258436 9"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id2584380"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id2584392"></a><em class="parameter"><code>security = DOMAIN</code></em></td></tr><tr><td><a class="indexterm" name="id2584404"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2584416"></a><em class="parameter"><code>log level = 10</code></em></td></tr><tr><td><a class="indexterm" name="id2584427"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2584439"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2584451"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id2584462"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2584474"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2584486"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2584498"></a><em class="parameter"><code>wins server = 192.168.2.1</code></em></td></tr><tr><td><a class="indexterm" name="id2584510"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2584522"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2584534"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2584546"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2584558"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2584570"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2584582"></a><em class="parameter"><code>idmap backend = ldap:ldap://lapdc.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2584594"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2584606"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2584617"></a><em class="parameter"><code>winbind trusted domains only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2584630"></a><em class="parameter"><code>printer admin = root</code></em></td></tr><tr><td><a class="indexterm" name="id2584642"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2584662"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2584674"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2584685"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2584697"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2584718"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2584729"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2584741"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2584753"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2584764"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id2584785"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2584796"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2584808"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id2584820"></a><em class="parameter"><code>write list = root</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch9-ldifadd"></a><p class="title"><b>Example 7.2. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF</b></p><div class="example-contents"><pre class="screen">463 </p></li></ol></div><div class="example"><a name="ch9-sdmsdc"></a><p class="title"><b>Example 7.1. Samba Domain Member in Samba Domain Using LDAP <code class="filename">smb.conf</code> File</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2584364"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id2584376"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id2584388"></a><em class="parameter"><code>security = DOMAIN</code></em></td></tr><tr><td><a class="indexterm" name="id2584399"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2584411"></a><em class="parameter"><code>log level = 10</code></em></td></tr><tr><td><a class="indexterm" name="id2584423"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2584434"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2584446"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id2584458"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2584469"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2584482"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2584493"></a><em class="parameter"><code>wins server = 192.168.2.1</code></em></td></tr><tr><td><a class="indexterm" name="id2584505"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2584517"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2584529"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2584541"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2584553"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2584565"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2584577"></a><em class="parameter"><code>idmap backend = ldap:ldap://lapdc.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2584589"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2584601"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2584613"></a><em class="parameter"><code>winbind trusted domains only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2584625"></a><em class="parameter"><code>printer admin = root</code></em></td></tr><tr><td><a class="indexterm" name="id2584637"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2584657"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2584669"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2584681"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2584692"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2584713"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2584725"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2584736"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2584748"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2584760"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id2584780"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2584792"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2584804"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id2584816"></a><em class="parameter"><code>write list = root</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch9-ldifadd"></a><p class="title"><b>Example 7.2. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF</b></p><div class="example-contents"><pre class="screen"> 464 464 dn: ou=Idmap,dc=abmas,dc=biz 465 465 objectClass: organizationalUnit … … 508 508 The Samba domain member server must be part of a Windows NT4 Domain, or a Samba Domain. 509 509 </p></li></ul></div><p> 510 <a class="indexterm" name="id25849 52"></a>511 <a class="indexterm" name="id258495 8"></a>512 <a class="indexterm" name="id258496 5"></a>510 <a class="indexterm" name="id2584947"></a> 511 <a class="indexterm" name="id2584954"></a> 512 <a class="indexterm" name="id2584961"></a> 513 513 Later in the chapter, you can see how to configure a Samba domain member server for a Windows ADS domain. 514 514 Right now your objective is to configure a Samba server that can be a member of a Windows NT4-style 515 515 domain and/or does not use LDAP. 516 516 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 517 <a class="indexterm" name="id25849 81"></a>517 <a class="indexterm" name="id2584976"></a> 518 518 If you use <code class="literal">winbind</code> for identity resolution, make sure that there are no 519 519 duplicate accounts. 520 520 </p><p> 521 <a class="indexterm" name="id258499 8"></a>521 <a class="indexterm" name="id2584994"></a> 522 522 For example, do not have more than one account that has UID=0 in the password database. If there 523 523 is an account called <code class="constant">root</code> in the <code class="filename">/etc/passwd</code> database, … … 527 527 <code class="constant">root</code>. 528 528 </p><p> 529 <a class="indexterm" name="id258503 5"></a>530 <a class="indexterm" name="id25850 42"></a>531 <a class="indexterm" name="id258504 8"></a>529 <a class="indexterm" name="id2585030"></a> 530 <a class="indexterm" name="id2585037"></a> 531 <a class="indexterm" name="id2585044"></a> 532 532 Winbind will break if there is an account in <code class="filename">/etc/passwd</code> that has 533 533 the same UID as an account that is in LDAP ldapsam (or in tdbsam) but that differs in name only. 534 534 </p></div><p> 535 <a class="indexterm" name="id258506 7"></a>536 <a class="indexterm" name="id25850 74"></a>537 <a class="indexterm" name="id25850 81"></a>538 <a class="indexterm" name="id258508 7"></a>539 <a class="indexterm" name="id258509 7"></a>535 <a class="indexterm" name="id2585062"></a> 536 <a class="indexterm" name="id2585069"></a> 537 <a class="indexterm" name="id2585076"></a> 538 <a class="indexterm" name="id2585083"></a> 539 <a class="indexterm" name="id2585092"></a> 540 540 The following configuration uses CIFS/SMB protocols alone to obtain user and group credentials. 541 541 The winbind information is locally cached in the <code class="filename">winbindd_cache.tdb winbindd_idmap.tdb</code> … … 544 544 files using the tool <code class="literal">tdbdump</code>, though you may have to build this from the Samba 545 545 source code if it has not been supplied as part of a binary package distribution that you may be using. 546 </p><div class="procedure"><a name="id258512 6"></a><p class="title"><b>Procedure 7.2. Configuration of Winbind-Based Identity Resolution</b></p><ol type="1"><li><p>546 </p><div class="procedure"><a name="id2585121"></a><p class="title"><b>Procedure 7.2. Configuration of Winbind-Based Identity Resolution</b></p><ol type="1"><li><p> 547 547 Using your favorite text editor, create the <code class="filename">smb.conf</code> file so it has the contents 548 548 shown in <a class="link" href="unixclients.html#ch0-NT4DSDM" title="Example 7.5. Samba Domain Member Server Using Winbind smb.conf File for NT4 Domain">“Samba Domain Member Server Using Winbind smb.conf File for NT4 Domain”</a>. 549 549 </p></li><li><p> 550 <a class="indexterm" name="id258515 8"></a>550 <a class="indexterm" name="id2585154"></a> 551 551 Edit the <code class="filename">/etc/nsswitch.conf</code> so it has the entries shown in 552 552 <a class="link" href="unixclients.html#ch9-sdmnss" title="Example 7.4. NSS using LDAP for Identity Resolution File: /etc/nsswitch.conf">“NSS using LDAP for Identity Resolution File: /etc/nsswitch.conf”</a>. 553 553 </p></li><li><p> 554 <a class="indexterm" name="id258518 4"></a>554 <a class="indexterm" name="id2585180"></a> 555 555 The system is ready to join the domain. Execute the following: 556 556 </p><pre class="screen"> … … 561 561 562 562 </p></li><li><p> 563 <a class="indexterm" name="id25852 11"></a>564 <a class="indexterm" name="id258521 8"></a>563 <a class="indexterm" name="id2585206"></a> 564 <a class="indexterm" name="id2585213"></a> 565 565 Validate operation of <code class="literal">winbind</code> using the <code class="literal">wbinfo</code> 566 566 tool as follows: … … 589 589 This shows that domain groups have been correctly obtained also. 590 590 </p></li><li><p> 591 <a class="indexterm" name="id25852 74"></a>592 <a class="indexterm" name="id25852 80"></a>593 <a class="indexterm" name="id258528 7"></a>591 <a class="indexterm" name="id2585269"></a> 592 <a class="indexterm" name="id2585276"></a> 593 <a class="indexterm" name="id2585282"></a> 594 594 The next step verifies that NSS is able to obtain this information 595 595 correctly from <code class="literal">winbind</code> also. … … 632 632 </p></li><li><p> 633 633 The Samba member server of a Windows NT4 domain is ready for use. 634 </p></li></ol></div><div class="example"><a name="ch0-NT4DSDM"></a><p class="title"><b>Example 7.5. Samba Domain Member Server Using Winbind <code class="filename">smb.conf</code> File for NT4 Domain</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id258539 8"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id2585410"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id2585422"></a><em class="parameter"><code>security = DOMAIN</code></em></td></tr><tr><td><a class="indexterm" name="id2585433"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2585445"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2585457"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2585468"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2585480"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2585492"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2585504"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2585516"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2585528"></a><em class="parameter"><code>wins server = 192.168.2.1</code></em></td></tr><tr><td><a class="indexterm" name="id2585539"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2585551"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2585563"></a><em class="parameter"><code>template primary group = "Domain Users"</code></em></td></tr><tr><td><a class="indexterm" name="id2585575"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id2585587"></a><em class="parameter"><code>winbind separator = +</code></em></td></tr><tr><td><a class="indexterm" name="id2585599"></a><em class="parameter"><code>printer admin = root</code></em></td></tr><tr><td><a class="indexterm" name="id2585611"></a><em class="parameter"><code>hosts allow = 192.168.2., 192.168.3., 127.</code></em></td></tr><tr><td><a class="indexterm" name="id2585623"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2585643"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2585655"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2585666"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2585678"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2585699"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2585710"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2585722"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2585734"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2585745"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id2585766"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2585778"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2585789"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id2585801"></a><em class="parameter"><code>write list = root</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="dcwonss"></a>NT4/Samba Domain with Samba Domain Member Server without NSS Support</h3></div></div></div><p>634 </p></li></ol></div><div class="example"><a name="ch0-NT4DSDM"></a><p class="title"><b>Example 7.5. Samba Domain Member Server Using Winbind <code class="filename">smb.conf</code> File for NT4 Domain</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2585393"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id2585405"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id2585417"></a><em class="parameter"><code>security = DOMAIN</code></em></td></tr><tr><td><a class="indexterm" name="id2585429"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2585441"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2585452"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2585464"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2585476"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2585487"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2585499"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2585511"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2585523"></a><em class="parameter"><code>wins server = 192.168.2.1</code></em></td></tr><tr><td><a class="indexterm" name="id2585535"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2585546"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2585558"></a><em class="parameter"><code>template primary group = "Domain Users"</code></em></td></tr><tr><td><a class="indexterm" name="id2585570"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id2585582"></a><em class="parameter"><code>winbind separator = +</code></em></td></tr><tr><td><a class="indexterm" name="id2585594"></a><em class="parameter"><code>printer admin = root</code></em></td></tr><tr><td><a class="indexterm" name="id2585606"></a><em class="parameter"><code>hosts allow = 192.168.2., 192.168.3., 127.</code></em></td></tr><tr><td><a class="indexterm" name="id2585618"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2585638"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2585650"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2585662"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2585673"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2585694"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2585706"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2585717"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2585729"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2585741"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id2585761"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2585773"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2585785"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id2585797"></a><em class="parameter"><code>write list = root</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="dcwonss"></a>NT4/Samba Domain with Samba Domain Member Server without NSS Support</h3></div></div></div><p> 635 635 No matter how many UNIX/Linux administrators there may be who believe that a UNIX operating 636 636 system that does not have NSS and PAM support to be outdated, the fact is there … … 643 643 is found, it is used. If the account is not found, one will be automatically created 644 644 on the local machine so that it can then be used for all access controls. 645 </p><div class="procedure"><a name="id258584 5"></a><p class="title"><b>Procedure 7.3. Configuration Using Local Accounts Only</b></p><ol type="1"><li><p>645 </p><div class="procedure"><a name="id2585840"></a><p class="title"><b>Procedure 7.3. Configuration Using Local Accounts Only</b></p><ol type="1"><li><p> 646 646 Using your favorite text editor, create the <code class="filename">smb.conf</code> file so it has the contents 647 647 shown in <a class="link" href="unixclients.html#ch0-NT4DSCM" title="Example 7.6. Samba Domain Member Server Using Local Accounts smb.conf File for NT4 Domain">“Samba Domain Member Server Using Local Accounts smb.conf File for NT4 Domain”</a>. 648 </p></li><li><p><a class="indexterm" name="id258587 7"></a>648 </p></li><li><p><a class="indexterm" name="id2585872"></a> 649 649 The system is ready to join the domain. Execute the following: 650 650 </p><pre class="screen"> … … 657 657 </p></li><li><p> 658 658 The Samba member server of a Windows NT4 domain is ready for use. 659 </p></li></ol></div><div class="example"><a name="ch0-NT4DSCM"></a><p class="title"><b>Example 7.6. Samba Domain Member Server Using Local Accounts <code class="filename">smb.conf</code> File for NT4 Domain</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id258596 6"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id2585977"></a><em class="parameter"><code>workgroup = MEGANET3</code></em></td></tr><tr><td><a class="indexterm" name="id2585989"></a><em class="parameter"><code>netbios name = BSDBOX</code></em></td></tr><tr><td><a class="indexterm" name="id2586001"></a><em class="parameter"><code>security = DOMAIN</code></em></td></tr><tr><td><a class="indexterm" name="id2586013"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2586025"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2586036"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2586048"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2586060"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -M '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2586072"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2586084"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2586096"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2586108"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2586119"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2586132"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2586143"></a><em class="parameter"><code>wins server = 192.168.2.1</code></em></td></tr><tr><td><a class="indexterm" name="id2586155"></a><em class="parameter"><code>printer admin = root</code></em></td></tr><tr><td><a class="indexterm" name="id2586167"></a><em class="parameter"><code>hosts allow = 192.168.2., 192.168.3., 127.</code></em></td></tr><tr><td><a class="indexterm" name="id2586179"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2586200"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2586211"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2586223"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2586234"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2586255"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2586267"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2586278"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2586290"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2586302"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id2586322"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2586334"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2586346"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id2586358"></a><em class="parameter"><code>write list = root</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="adssdm"></a>Active Directory Domain with Samba Domain Member Server</h3></div></div></div><p>660 <a class="indexterm" name="id25863 83"></a>661 <a class="indexterm" name="id25863 92"></a>662 <a class="indexterm" name="id258639 9"></a>659 </p></li></ol></div><div class="example"><a name="ch0-NT4DSCM"></a><p class="title"><b>Example 7.6. Samba Domain Member Server Using Local Accounts <code class="filename">smb.conf</code> File for NT4 Domain</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2585961"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id2585973"></a><em class="parameter"><code>workgroup = MEGANET3</code></em></td></tr><tr><td><a class="indexterm" name="id2585984"></a><em class="parameter"><code>netbios name = BSDBOX</code></em></td></tr><tr><td><a class="indexterm" name="id2585996"></a><em class="parameter"><code>security = DOMAIN</code></em></td></tr><tr><td><a class="indexterm" name="id2586008"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2586020"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2586032"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2586043"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2586055"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -M '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2586067"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2586080"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2586091"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2586103"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2586115"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2586127"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2586139"></a><em class="parameter"><code>wins server = 192.168.2.1</code></em></td></tr><tr><td><a class="indexterm" name="id2586150"></a><em class="parameter"><code>printer admin = root</code></em></td></tr><tr><td><a class="indexterm" name="id2586162"></a><em class="parameter"><code>hosts allow = 192.168.2., 192.168.3., 127.</code></em></td></tr><tr><td><a class="indexterm" name="id2586174"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2586195"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2586207"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2586218"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2586230"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2586250"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2586262"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2586274"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2586285"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2586297"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id2586318"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2586329"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2586341"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id2586353"></a><em class="parameter"><code>write list = root</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="adssdm"></a>Active Directory Domain with Samba Domain Member Server</h3></div></div></div><p> 660 <a class="indexterm" name="id2586379"></a> 661 <a class="indexterm" name="id2586388"></a> 662 <a class="indexterm" name="id2586394"></a> 663 663 One of the much-sought-after features new to Samba-3 is the ability to join an Active Directory 664 664 domain using Kerberos protocols. This makes it possible to operate an entire Windows network … … 668 668 in. For now, we simply focus on how a Samba-3 server can be made a domain member server. 669 669 </p><p> 670 <a class="indexterm" name="id25864 21"></a>671 <a class="indexterm" name="id258642 8"></a>672 <a class="indexterm" name="id258643 5"></a>673 <a class="indexterm" name="id25864 42"></a>670 <a class="indexterm" name="id2586417"></a> 671 <a class="indexterm" name="id2586424"></a> 672 <a class="indexterm" name="id2586430"></a> 673 <a class="indexterm" name="id2586437"></a> 674 674 The diagram in <a class="link" href="unixclients.html#ch9-adsdc" title="Figure 7.3. Active Directory Domain: Samba Member Server">“Active Directory Domain: Samba Member Server”</a> demonstrates how Samba-3 interfaces with 675 675 Microsoft Active Directory components. It should be noted that if Microsoft Windows Services … … 695 695 is known as <code class="constant">w2k3s.london.abmas.biz</code>. In NetBIOS nomenclature, the 696 696 domain name is <code class="constant">LONDON</code> and the server name is <code class="constant">W2K3S</code>. 697 </p><div class="figure"><a name="ch9-adsdc"></a><p class="title"><b>Figure 7.3. Active Directory Domain: Samba Member Server</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap9-ADSDC.png" width="324" alt="Active Directory Domain: Samba Member Server"></div></div></div><br class="figure-break"><div class="procedure"><a name="id258655 5"></a><p class="title"><b>Procedure 7.4. Joining a Samba Server as an ADS Domain Member</b></p><ol type="1"><li><p>698 <a class="indexterm" name="id258656 7"></a>697 </p><div class="figure"><a name="ch9-adsdc"></a><p class="title"><b>Figure 7.3. Active Directory Domain: Samba Member Server</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap9-ADSDC.png" width="324" alt="Active Directory Domain: Samba Member Server"></div></div></div><br class="figure-break"><div class="procedure"><a name="id2586551"></a><p class="title"><b>Procedure 7.4. Joining a Samba Server as an ADS Domain Member</b></p><ol type="1"><li><p> 698 <a class="indexterm" name="id2586562"></a> 699 699 Before you try to use Samba-3, you want to know for certain that your executables have 700 700 support for Kerberos and for LDAP. Execute the following to identify whether or … … 763 763 support. You are relieved to know that it is safe to progress. 764 764 </p></li><li><p> 765 <a class="indexterm" name="id258666 6"></a>766 <a class="indexterm" name="id258667 5"></a>767 <a class="indexterm" name="id25866 82"></a>768 <a class="indexterm" name="id258668 9"></a>769 <a class="indexterm" name="id258669 8"></a>770 <a class="indexterm" name="id258670 8"></a>771 <a class="indexterm" name="id258671 5"></a>772 <a class="indexterm" name="id25867 21"></a>773 <a class="indexterm" name="id258672 8"></a>765 <a class="indexterm" name="id2586661"></a> 766 <a class="indexterm" name="id2586671"></a> 767 <a class="indexterm" name="id2586678"></a> 768 <a class="indexterm" name="id2586684"></a> 769 <a class="indexterm" name="id2586694"></a> 770 <a class="indexterm" name="id2586703"></a> 771 <a class="indexterm" name="id2586710"></a> 772 <a class="indexterm" name="id2586717"></a> 773 <a class="indexterm" name="id2586724"></a> 774 774 The next step is to identify which version of the Kerberos libraries have been used. 775 775 In order to permit Samba-3 to interoperate with Windows 2003 Active Directory, it is … … 799 799 Edit or create the NSS control file so it has the contents shown in <a class="link" href="unixclients.html#ch9-sdmnss" title="Example 7.4. NSS using LDAP for Identity Resolution File: /etc/nsswitch.conf">“NSS using LDAP for Identity Resolution File: /etc/nsswitch.conf”</a>. 800 800 </p></li><li><p> 801 <a class="indexterm" name="id25868 30"></a>801 <a class="indexterm" name="id2586825"></a> 802 802 Delete the file <code class="filename">/etc/samba/secrets.tdb</code> if it exists. Of course, you 803 803 do keep a backup, don't you? … … 810 810 </pre><p> 811 811 </p></li><li><p> 812 <a class="indexterm" name="id25868 74"></a>812 <a class="indexterm" name="id2586869"></a> 813 813 Validate your <code class="filename">smb.conf</code> file using <code class="literal">testparm</code> (as you have 814 814 done previously). Correct all errors reported before proceeding. The command you … … 820 820 ADS domain, let's move on. 821 821 </p></li><li><p> 822 <a class="indexterm" name="id258691 5"></a>823 <a class="indexterm" name="id258692 6"></a>822 <a class="indexterm" name="id2586911"></a> 823 <a class="indexterm" name="id2586922"></a> 824 824 This is a good time to double-check everything and then execute the following 825 825 command when everything you have done has checked out okay: … … 832 832 using Kerberos protocols. 833 833 </p><p> 834 <a class="indexterm" name="id25869 54"></a>835 <a class="indexterm" name="id25869 61"></a>834 <a class="indexterm" name="id2586949"></a> 835 <a class="indexterm" name="id2586956"></a> 836 836 In the event that you receive no output messages, a silent return means that the 837 837 domain join failed. You should use <code class="literal">ethereal</code> to identify what … … 839 839 840 840 </p><div class="itemizedlist"><ul type="disc"><li><p> 841 <a class="indexterm" name="id25869 82"></a>841 <a class="indexterm" name="id2586978"></a> 842 842 Defective or misconfigured DNS name resolution. 843 843 </p></li><li><p> 844 <a class="indexterm" name="id258699 7"></a>844 <a class="indexterm" name="id2586992"></a> 845 845 Restrictive security settings on the Windows 200x ADS domain controller 846 846 preventing needed communications protocols. You can check this by searching … … 854 854 </p></li></ul></div><p> 855 855 856 <a class="indexterm" name="id258702 8"></a>857 <a class="indexterm" name="id258703 9"></a>858 <a class="indexterm" name="id258704 6"></a>856 <a class="indexterm" name="id2587024"></a> 857 <a class="indexterm" name="id2587035"></a> 858 <a class="indexterm" name="id2587042"></a> 859 859 In any case, never execute the <code class="literal">net rpc join</code> command in an attempt 860 860 to join the Samba server to the domain, unless you wish not to use the Kerberos … … 862 862 Windows Server 200x ADS has been configured appropriately for mixed mode operation. 863 863 </p></li><li><p> 864 <a class="indexterm" name="id25870 71"></a>865 <a class="indexterm" name="id258707 8"></a>864 <a class="indexterm" name="id2587066"></a> 865 <a class="indexterm" name="id2587073"></a> 866 866 If the <code class="literal">tdbdump</code> is installed on your system (not essential), 867 867 you can look inside the <code class="filename">/etc/samba/secrets.tdb</code> file. If … … 894 894 in this book). 895 895 </p></li><li><p> 896 <a class="indexterm" name="id258713 5"></a>896 <a class="indexterm" name="id2587130"></a> 897 897 This is a good time to verify that everything is working. First, check that 898 898 winbind is able to obtain the list of users and groups from the ADS domain controller. … … 920 920 </pre><p> 921 921 Excellent. That worked also, as expected. 922 </p></li><li><p><a class="indexterm" name="id25871 81"></a>922 </p></li><li><p><a class="indexterm" name="id2587177"></a> 923 923 Now repeat this via NSS to validate that full identity resolution is 924 924 functional as required. Execute: … … 953 953 This is very pleasing. Everything works as expected. 954 954 </p></li><li><p> 955 <a class="indexterm" name="id258723 9"></a>956 <a class="indexterm" name="id25872 50"></a>957 <a class="indexterm" name="id258725 9"></a>955 <a class="indexterm" name="id2587234"></a> 956 <a class="indexterm" name="id2587245"></a> 957 <a class="indexterm" name="id2587254"></a> 958 958 You may now perform final verification that communications between Samba-3 winbind and 959 959 the Active Directory server is using Kerberos protocols. Execute the following: … … 973 973 In any case, the output we obtained confirms that all systems are operational. 974 974 </p></li><li><p> 975 <a class="indexterm" name="id258729 5"></a>975 <a class="indexterm" name="id2587290"></a> 976 976 There is one more action you elect to take, just because you are paranoid and disbelieving, 977 977 so you execute the following command: … … 1143 1143 Now all is revealed. Your curiosity, as well as that of your team, has been put at ease. 1144 1144 May this server serve well all who happen upon it. 1145 </p><div class="example"><a name="ch9-adssdm"></a><p class="title"><b>Example 7.7. Samba Domain Member <code class="filename">smb.conf</code> File for Active Directory Membership</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id258751 6"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id2587528"></a><em class="parameter"><code>workgroup = LONDON</code></em></td></tr><tr><td><a class="indexterm" name="id2587540"></a><em class="parameter"><code>realm = LONDON.ABMAS.BIZ</code></em></td></tr><tr><td><a class="indexterm" name="id2587551"></a><em class="parameter"><code>server string = Samba 3.0.20</code></em></td></tr><tr><td><a class="indexterm" name="id2587563"></a><em class="parameter"><code>security = ADS</code></em></td></tr><tr><td><a class="indexterm" name="id2587575"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2587587"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2587598"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2587610"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2587622"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id2587634"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2587645"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id2587657"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2587669"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2587680"></a><em class="parameter"><code>template primary group = "Domain Users"</code></em></td></tr><tr><td><a class="indexterm" name="id2587693"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id2587705"></a><em class="parameter"><code>winbind separator = +</code></em></td></tr><tr><td><a class="indexterm" name="id2587716"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2587737"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2587749"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2587760"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2587772"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2587792"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2587804"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2587816"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2587828"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2587839"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id2587860"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2587871"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2587883"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id2587895"></a><em class="parameter"><code>write list = root</code></em></td></tr></table></div></div><br class="example-break"><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2587908"></a>IDMAP_RID with Winbind</h4></div></div></div><p>1146 <a class="indexterm" name="id258791 6"></a>1147 <a class="indexterm" name="id25879 23"></a>1148 <a class="indexterm" name="id258792 9"></a>1149 <a class="indexterm" name="id258793 6"></a>1145 </p><div class="example"><a name="ch9-adssdm"></a><p class="title"><b>Example 7.7. Samba Domain Member <code class="filename">smb.conf</code> File for Active Directory Membership</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2587511"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id2587523"></a><em class="parameter"><code>workgroup = LONDON</code></em></td></tr><tr><td><a class="indexterm" name="id2587535"></a><em class="parameter"><code>realm = LONDON.ABMAS.BIZ</code></em></td></tr><tr><td><a class="indexterm" name="id2587547"></a><em class="parameter"><code>server string = Samba 3.0.20</code></em></td></tr><tr><td><a class="indexterm" name="id2587559"></a><em class="parameter"><code>security = ADS</code></em></td></tr><tr><td><a class="indexterm" name="id2587570"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2587582"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2587594"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2587605"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2587617"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id2587629"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2587641"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id2587652"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2587664"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2587676"></a><em class="parameter"><code>template primary group = "Domain Users"</code></em></td></tr><tr><td><a class="indexterm" name="id2587688"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id2587700"></a><em class="parameter"><code>winbind separator = +</code></em></td></tr><tr><td><a class="indexterm" name="id2587712"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2587732"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2587744"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2587756"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2587767"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2587788"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2587800"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2587811"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2587823"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2587834"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id2587855"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2587867"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2587879"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id2587890"></a><em class="parameter"><code>write list = root</code></em></td></tr></table></div></div><br class="example-break"><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2587903"></a>IDMAP_RID with Winbind</h4></div></div></div><p> 1146 <a class="indexterm" name="id2587911"></a> 1147 <a class="indexterm" name="id2587918"></a> 1148 <a class="indexterm" name="id2587924"></a> 1149 <a class="indexterm" name="id2587931"></a> 1150 1150 The <code class="literal">idmap_rid</code> facility is a new tool that, unlike native winbind, creates a 1151 1151 predictable mapping of MS Windows SIDs to UNIX UIDs and GIDs. The key benefit of this method … … 1154 1154 is not compatible with trusted domain implementations. 1155 1155 </p><p> 1156 <a class="indexterm" name="id258795 9"></a>1157 <a class="indexterm" name="id258796 6"></a>1158 <a class="indexterm" name="id25879 73"></a>1159 <a class="indexterm" name="id25879 80"></a>1156 <a class="indexterm" name="id2587955"></a> 1157 <a class="indexterm" name="id2587961"></a> 1158 <a class="indexterm" name="id2587968"></a> 1159 <a class="indexterm" name="id2587975"></a> 1160 1160 This alternate method of SID to UID/GID mapping can be achieved with the idmap_rid 1161 1161 plug-in. This plug-in uses the RID of the user SID to derive the UID and GID by adding the … … 1165 1165 <em class="parameter"><code>idmap gid</code></em> ranges must be specified. 1166 1166 </p><p> 1167 <a class="indexterm" name="id25880 12"></a>1168 <a class="indexterm" name="id258801 9"></a>1167 <a class="indexterm" name="id2588008"></a> 1168 <a class="indexterm" name="id2588014"></a> 1169 1169 The idmap_rid facility can be used both for NT4/Samba-style domains as well as with Active Directory. 1170 1170 To use this with an NT4 domain, the <em class="parameter"><code>realm</code></em> is not used. Additionally the … … 1172 1172 </p><p> 1173 1173 An example <code class="filename">smb.conf</code> file for an ADS domain environment is shown in <a class="link" href="unixclients.html#sbe-idmapridex" title="Example 7.8. Example smb.conf File Using idmap_rid">“Example smb.conf File Using idmap_rid”</a>. 1174 </p><div class="example"><a name="sbe-idmapridex"></a><p class="title"><b>Example 7.8. Example <code class="filename">smb.conf</code> File Using <code class="constant">idmap_rid</code></b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id25880 94"></a><em class="parameter"><code>workgroup = KPAK</code></em></td></tr><tr><td><a class="indexterm" name="id2588105"></a><em class="parameter"><code>netbios name = BIGJOE</code></em></td></tr><tr><td><a class="indexterm" name="id2588117"></a><em class="parameter"><code>realm = CORP.KPAK.COM</code></em></td></tr><tr><td><a class="indexterm" name="id2588129"></a><em class="parameter"><code>server string = Office Server</code></em></td></tr><tr><td><a class="indexterm" name="id2588141"></a><em class="parameter"><code>security = ADS</code></em></td></tr><tr><td><a class="indexterm" name="id2588152"></a><em class="parameter"><code>allow trusted domains = No</code></em></td></tr><tr><td><a class="indexterm" name="id2588164"></a><em class="parameter"><code>idmap backend = idmap_rid:KPAK=500-100000000</code></em></td></tr><tr><td><a class="indexterm" name="id2588177"></a><em class="parameter"><code>idmap uid = 500-100000000</code></em></td></tr><tr><td><a class="indexterm" name="id2588188"></a><em class="parameter"><code>idmap gid = 500-100000000</code></em></td></tr><tr><td><a class="indexterm" name="id2588200"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id2588212"></a><em class="parameter"><code>winbind use default domain = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2588224"></a><em class="parameter"><code>winbind enum users = No</code></em></td></tr><tr><td><a class="indexterm" name="id2588236"></a><em class="parameter"><code>winbind enum groups = No</code></em></td></tr><tr><td><a class="indexterm" name="id2588248"></a><em class="parameter"><code>winbind nested groups = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2588260"></a><em class="parameter"><code>printer admin = "KPAK\Domain Admins"</code></em></td></tr></table></div></div><br class="example-break"><p>1175 <a class="indexterm" name="id258827 5"></a>1176 <a class="indexterm" name="id25882 82"></a>1177 <a class="indexterm" name="id258828 9"></a>1178 <a class="indexterm" name="id258829 6"></a>1174 </p><div class="example"><a name="sbe-idmapridex"></a><p class="title"><b>Example 7.8. Example <code class="filename">smb.conf</code> File Using <code class="constant">idmap_rid</code></b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2588089"></a><em class="parameter"><code>workgroup = KPAK</code></em></td></tr><tr><td><a class="indexterm" name="id2588100"></a><em class="parameter"><code>netbios name = BIGJOE</code></em></td></tr><tr><td><a class="indexterm" name="id2588112"></a><em class="parameter"><code>realm = CORP.KPAK.COM</code></em></td></tr><tr><td><a class="indexterm" name="id2588124"></a><em class="parameter"><code>server string = Office Server</code></em></td></tr><tr><td><a class="indexterm" name="id2588136"></a><em class="parameter"><code>security = ADS</code></em></td></tr><tr><td><a class="indexterm" name="id2588148"></a><em class="parameter"><code>allow trusted domains = No</code></em></td></tr><tr><td><a class="indexterm" name="id2588160"></a><em class="parameter"><code>idmap backend = idmap_rid:KPAK=500-100000000</code></em></td></tr><tr><td><a class="indexterm" name="id2588172"></a><em class="parameter"><code>idmap uid = 500-100000000</code></em></td></tr><tr><td><a class="indexterm" name="id2588184"></a><em class="parameter"><code>idmap gid = 500-100000000</code></em></td></tr><tr><td><a class="indexterm" name="id2588195"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id2588207"></a><em class="parameter"><code>winbind use default domain = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2588219"></a><em class="parameter"><code>winbind enum users = No</code></em></td></tr><tr><td><a class="indexterm" name="id2588231"></a><em class="parameter"><code>winbind enum groups = No</code></em></td></tr><tr><td><a class="indexterm" name="id2588243"></a><em class="parameter"><code>winbind nested groups = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2588255"></a><em class="parameter"><code>printer admin = "KPAK\Domain Admins"</code></em></td></tr></table></div></div><br class="example-break"><p> 1175 <a class="indexterm" name="id2588270"></a> 1176 <a class="indexterm" name="id2588277"></a> 1177 <a class="indexterm" name="id2588284"></a> 1178 <a class="indexterm" name="id2588291"></a> 1179 1179 In a large domain with many users, it is imperative to disable enumeration of users and groups. 1180 1180 For example, at a site that has 22,000 users in Active Directory the winbind-based user and … … 1186 1186 below. 1187 1187 </p><p> 1188 <a class="indexterm" name="id258833 5"></a>1189 <a class="indexterm" name="id25883 41"></a>1188 <a class="indexterm" name="id2588330"></a> 1189 <a class="indexterm" name="id2588336"></a> 1190 1190 The use of this tool requires configuration of NSS as per the native use of winbind. Edit the 1191 1191 <code class="filename">/etc/nsswitch.conf</code> so it has the following parameters: … … 1213 1213 </pre><p> 1214 1214 </p><p> 1215 <a class="indexterm" name="id25884 22"></a>1215 <a class="indexterm" name="id2588418"></a> 1216 1216 An invalid or failed join can be detected by executing: 1217 1217 </p><pre class="screen"> … … 1229 1229 </p></li><li><p> 1230 1230 Validate the operation of this configuration by executing: 1231 <a class="indexterm" name="id25884 90"></a>1231 <a class="indexterm" name="id2588485"></a> 1232 1232 </p><pre class="screen"> 1233 1233 <code class="prompt">root# </code> getent passwd administrator 1234 1234 administrator:x:1000:1013:Administrator:/home/BE/administrator:/bin/bash 1235 1235 </pre><p> 1236 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id25885 12"></a>IDMAP Storage in LDAP using Winbind</h4></div></div></div><p>1237 <a class="indexterm" name="id25885 20"></a>1238 <a class="indexterm" name="id258852 6"></a>1236 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2588507"></a>IDMAP Storage in LDAP using Winbind</h4></div></div></div><p> 1237 <a class="indexterm" name="id2588515"></a> 1238 <a class="indexterm" name="id2588522"></a> 1239 1239 The storage of IDMAP information in LDAP can be used with both NT4/Samba-3-style domains as well as 1240 1240 with ADS domains. OpenLDAP is a commonly used LDAP server for this purpose, although any standards-compliant … … 1243 1243 </p><p> 1244 1244 The example in <a class="link" href="unixclients.html#sbeunxa" title="Example 7.9. Typical ADS Style Domain smb.conf File">“Typical ADS Style Domain smb.conf File”</a> is for an ADS-style domain. 1245 </p><div class="example"><a name="sbeunxa"></a><p class="title"><b>Example 7.9. Typical ADS Style Domain <code class="filename">smb.conf</code> File</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id258858 6"></a><em class="parameter"><code>workgroup = SNOWSHOW</code></em></td></tr><tr><td><a class="indexterm" name="id2588598"></a><em class="parameter"><code>netbios name = GOODELF</code></em></td></tr><tr><td><a class="indexterm" name="id2588610"></a><em class="parameter"><code>realm = SNOWSHOW.COM</code></em></td></tr><tr><td><a class="indexterm" name="id2588621"></a><em class="parameter"><code>server string = Samba Server</code></em></td></tr><tr><td><a class="indexterm" name="id2588633"></a><em class="parameter"><code>security = ADS</code></em></td></tr><tr><td><a class="indexterm" name="id2588645"></a><em class="parameter"><code>log level = 1 ads:10 auth:10 sam:10 rpc:10</code></em></td></tr><tr><td><a class="indexterm" name="id2588657"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=SNOWSHOW,dc=COM</code></em></td></tr><tr><td><a class="indexterm" name="id2588669"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2588681"></a><em class="parameter"><code>ldap suffix = dc=SNOWSHOW,dc=COM</code></em></td></tr><tr><td><a class="indexterm" name="id2588693"></a><em class="parameter"><code>idmap backend = ldap:ldap://ldap.snowshow.com</code></em></td></tr><tr><td><a class="indexterm" name="id2588705"></a><em class="parameter"><code>idmap uid = 150000-550000</code></em></td></tr><tr><td><a class="indexterm" name="id2588717"></a><em class="parameter"><code>idmap gid = 150000-550000</code></em></td></tr><tr><td><a class="indexterm" name="id2588729"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id2588741"></a><em class="parameter"><code>winbind use default domain = Yes</code></em></td></tr></table></div></div><br class="example-break"><p>1246 <a class="indexterm" name="id258875 6"></a>1245 </p><div class="example"><a name="sbeunxa"></a><p class="title"><b>Example 7.9. Typical ADS Style Domain <code class="filename">smb.conf</code> File</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2588581"></a><em class="parameter"><code>workgroup = SNOWSHOW</code></em></td></tr><tr><td><a class="indexterm" name="id2588593"></a><em class="parameter"><code>netbios name = GOODELF</code></em></td></tr><tr><td><a class="indexterm" name="id2588605"></a><em class="parameter"><code>realm = SNOWSHOW.COM</code></em></td></tr><tr><td><a class="indexterm" name="id2588617"></a><em class="parameter"><code>server string = Samba Server</code></em></td></tr><tr><td><a class="indexterm" name="id2588629"></a><em class="parameter"><code>security = ADS</code></em></td></tr><tr><td><a class="indexterm" name="id2588640"></a><em class="parameter"><code>log level = 1 ads:10 auth:10 sam:10 rpc:10</code></em></td></tr><tr><td><a class="indexterm" name="id2588652"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=SNOWSHOW,dc=COM</code></em></td></tr><tr><td><a class="indexterm" name="id2588665"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2588677"></a><em class="parameter"><code>ldap suffix = dc=SNOWSHOW,dc=COM</code></em></td></tr><tr><td><a class="indexterm" name="id2588688"></a><em class="parameter"><code>idmap backend = ldap:ldap://ldap.snowshow.com</code></em></td></tr><tr><td><a class="indexterm" name="id2588701"></a><em class="parameter"><code>idmap uid = 150000-550000</code></em></td></tr><tr><td><a class="indexterm" name="id2588712"></a><em class="parameter"><code>idmap gid = 150000-550000</code></em></td></tr><tr><td><a class="indexterm" name="id2588724"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id2588736"></a><em class="parameter"><code>winbind use default domain = Yes</code></em></td></tr></table></div></div><br class="example-break"><p> 1246 <a class="indexterm" name="id2588751"></a> 1247 1247 In the case of an NT4 or Samba-3-style domain the <em class="parameter"><code>realm</code></em> is not used, and the 1248 1248 command used to join the domain is <code class="literal">net rpc join</code>. The above example also demonstrates … … 1250 1250 “<span class="quote">The Official Samba-3 HOWTO and Reference Guide, Second Edition</span>” (TOSHARG2). 1251 1251 </p><p> 1252 <a class="indexterm" name="id258878 7"></a>1253 <a class="indexterm" name="id258879 4"></a>1254 <a class="indexterm" name="id2588 801"></a>1252 <a class="indexterm" name="id2588783"></a> 1253 <a class="indexterm" name="id2588790"></a> 1254 <a class="indexterm" name="id2588797"></a> 1255 1255 Where MIT kerberos is installed (version 1.3.4 or later), edit the <code class="filename">/etc/krb5.conf</code> 1256 1256 file so it has the following contents: … … 1307 1307 </pre><p> 1308 1308 </p><p> 1309 <a class="indexterm" name="id258888 5"></a>1310 <a class="indexterm" name="id25888 92"></a>1309 <a class="indexterm" name="id2588881"></a> 1310 <a class="indexterm" name="id2588888"></a> 1311 1311 You will need the <a class="ulink" href="http://www.padl.com" target="_top">PADL</a> <code class="literal">nss_ldap</code> 1312 1312 tool set for this solution. Configure the <code class="filename">/etc/ldap.conf</code> file so it has … … 1371 1371 Start the <code class="literal">nmbd</code>, <code class="literal">winbind</code>, and <code class="literal">smbd</code> daemons in the order shown. 1372 1372 </p></li></ol></div><p> 1373 <a class="indexterm" name="id25890 92"></a>1373 <a class="indexterm" name="id2589088"></a> 1374 1374 Follow the diagnostic procedures shown earlier in this chapter to identify success or failure of the join. 1375 1375 In many cases a failure is indicated by a silent return to the command prompt with no indication of the 1376 1376 reason for failure. 1377 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id258910 6"></a>IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</h4></div></div></div><p>1378 <a class="indexterm" name="id258911 5"></a>1379 <a class="indexterm" name="id25891 21"></a>1377 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2589101"></a>IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</h4></div></div></div><p> 1378 <a class="indexterm" name="id2589110"></a> 1379 <a class="indexterm" name="id2589117"></a> 1380 1380 The use of this method is messy. The information provided in this section is for guidance only 1381 1381 and is very definitely not complete. This method does work; it is used in a number of large sites … … 1383 1383 </p><p> 1384 1384 An example <code class="filename">smb.conf</code> file is shown in <a class="link" href="unixclients.html#sbewinbindex" title="Example 7.10. ADS Membership Using RFC2307bis Identity Resolution smb.conf File">“ADS Membership Using RFC2307bis Identity Resolution smb.conf File”</a>. 1385 </p><div class="example"><a name="sbewinbindex"></a><p class="title"><b>Example 7.10. ADS Membership Using RFC2307bis Identity Resolution <code class="filename">smb.conf</code> File</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id258918 4"></a><em class="parameter"><code>workgroup = BUBBAH</code></em></td></tr><tr><td><a class="indexterm" name="id2589196"></a><em class="parameter"><code>netbios name = MADMAX</code></em></td></tr><tr><td><a class="indexterm" name="id2589208"></a><em class="parameter"><code>realm = BUBBAH.COM</code></em></td></tr><tr><td><a class="indexterm" name="id2589219"></a><em class="parameter"><code>server string = Samba Server</code></em></td></tr><tr><td><a class="indexterm" name="id2589231"></a><em class="parameter"><code>security = ADS</code></em></td></tr><tr><td><a class="indexterm" name="id2589243"></a><em class="parameter"><code>idmap uid = 150000-550000</code></em></td></tr><tr><td><a class="indexterm" name="id2589255"></a><em class="parameter"><code>idmap gid = 150000-550000</code></em></td></tr><tr><td><a class="indexterm" name="id2589266"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id2589278"></a><em class="parameter"><code>winbind use default domain = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2589290"></a><em class="parameter"><code>winbind trusted domains only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2589303"></a><em class="parameter"><code>winbind nested groups = Yes</code></em></td></tr></table></div></div><br class="example-break"><p>1386 <a class="indexterm" name="id258931 8"></a>1385 </p><div class="example"><a name="sbewinbindex"></a><p class="title"><b>Example 7.10. ADS Membership Using RFC2307bis Identity Resolution <code class="filename">smb.conf</code> File</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2589180"></a><em class="parameter"><code>workgroup = BUBBAH</code></em></td></tr><tr><td><a class="indexterm" name="id2589191"></a><em class="parameter"><code>netbios name = MADMAX</code></em></td></tr><tr><td><a class="indexterm" name="id2589203"></a><em class="parameter"><code>realm = BUBBAH.COM</code></em></td></tr><tr><td><a class="indexterm" name="id2589215"></a><em class="parameter"><code>server string = Samba Server</code></em></td></tr><tr><td><a class="indexterm" name="id2589227"></a><em class="parameter"><code>security = ADS</code></em></td></tr><tr><td><a class="indexterm" name="id2589238"></a><em class="parameter"><code>idmap uid = 150000-550000</code></em></td></tr><tr><td><a class="indexterm" name="id2589250"></a><em class="parameter"><code>idmap gid = 150000-550000</code></em></td></tr><tr><td><a class="indexterm" name="id2589262"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id2589274"></a><em class="parameter"><code>winbind use default domain = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2589286"></a><em class="parameter"><code>winbind trusted domains only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2589298"></a><em class="parameter"><code>winbind nested groups = Yes</code></em></td></tr></table></div></div><br class="example-break"><p> 1386 <a class="indexterm" name="id2589313"></a> 1387 1387 The DMS must be joined to the domain using the usual procedure. Additionally, it is necessary 1388 1388 to build and install the PADL nss_ldap tool set. Be sure to build this tool set with the … … 1393 1393 </pre><p> 1394 1394 </p><p> 1395 <a class="indexterm" name="id258933 9"></a>1395 <a class="indexterm" name="id2589334"></a> 1396 1396 The following <code class="filename">/etc/nsswitch.conf</code> file contents are required: 1397 1397 </p><pre class="screen"> … … 1405 1405 </pre><p> 1406 1406 </p><p> 1407 <a class="indexterm" name="id25893 63"></a>1408 <a class="indexterm" name="id25893 70"></a>1407 <a class="indexterm" name="id2589358"></a> 1408 <a class="indexterm" name="id2589365"></a> 1409 1409 The <code class="filename">/etc/ldap.conf</code> file must be configured also. Refer to the PADL documentation 1410 1410 and source code for nss_ldap instructions. … … 1412 1412 The next step involves preparation on the ADS schema. This is briefly discussed in the remaining 1413 1413 part of this chapter. 1414 </p><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id25893 92"></a>IDMAP, Active Directory, and MS Services for UNIX 3.5</h5></div></div></div><p>1415 <a class="indexterm" name="id2589 400"></a>1414 </p><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2589387"></a>IDMAP, Active Directory, and MS Services for UNIX 3.5</h5></div></div></div><p> 1415 <a class="indexterm" name="id2589396"></a> 1416 1416 The Microsoft Windows Service for UNIX version 3.5 is available for free 1417 1417 <a class="ulink" href="http://www.microsoft.com/windows/sfu/" target="_top">download</a> 1418 1418 from the Microsoft Web site. You will need to download this tool and install it following 1419 1419 Microsoft instructions. 1420 </p></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id25894 20"></a>IDMAP, Active Directory, and AD4UNIX</h5></div></div></div><p>1420 </p></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2589415"></a>IDMAP, Active Directory, and AD4UNIX</h5></div></div></div><p> 1421 1421 Instructions for obtaining and installing the AD4UNIX tool set can be found from the 1422 1422 <a class="ulink" href="http://www.geekcomix.com/cgi-bin/classnotes/wiki.pl?LDAP01/An_Alternative_Approach" target="_top"> 1423 1423 Geekcomix</a> Web site. 1424 </p></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id25894 42"></a>UNIX/Linux Client Domain Member</h3></div></div></div><p><a class="indexterm" name="id2589450"></a>1424 </p></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2589438"></a>UNIX/Linux Client Domain Member</h3></div></div></div><p><a class="indexterm" name="id2589445"></a> 1425 1425 So far this chapter has been mainly concerned with the provision of file and print 1426 1426 services for domain member servers. However, an increasing number of UNIX/Linux … … 1428 1428 other than a single desktop user. The key demand for desktop systems is to be able 1429 1429 to log onto any UNIX/Linux or Windows desktop using the same network user credentials. 1430 </p><p><a class="indexterm" name="id258946 8"></a>1430 </p><p><a class="indexterm" name="id2589463"></a> 1431 1431 The ability to use a common set of user credential across a variety of network systems 1432 1432 is generally regarded as a single sign-on (SSO) solution. SSO systems are sold by a … … 1440 1440 </p></li><li><p> 1441 1441 Replacement authentication systems 1442 </p></li></ul></div><p><a class="indexterm" name="id25895 10"></a>1442 </p></li></ul></div><p><a class="indexterm" name="id2589505"></a> 1443 1443 There are really four solutions that provide integrated authentication and 1444 1444 user identity management facilities: … … 1465 1465 support via Samba-3. 1466 1466 </p><p> 1467 <a class="indexterm" name="id258958 9"></a>1467 <a class="indexterm" name="id2589584"></a> 1468 1468 On the other hand, if the authentication and identity resolution backend must be provided by 1469 1469 a Windows NT4-style domain or from an Active Directory Domain that does not have the Microsoft … … 1471 1471 situations now follows. 1472 1472 </p><p> 1473 <a class="indexterm" name="id258960 6"></a>1474 <a class="indexterm" name="id25896 13"></a>1475 <a class="indexterm" name="id25896 20"></a>1473 <a class="indexterm" name="id2589602"></a> 1474 <a class="indexterm" name="id2589608"></a> 1475 <a class="indexterm" name="id2589615"></a> 1476 1476 To permit users to log on to a Linux system using Windows network credentials, you need to 1477 1477 configure identity resolution (NSS) and PAM. This means that the basic steps include those … … 1480 1480 of shares and printers is generally less important. Often this allows the share specifications 1481 1481 to be entirely removed from the <code class="filename">smb.conf</code> file. That is obviously an administrator decision. 1482 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id25896 43"></a>NT4 Domain Member</h4></div></div></div><p>1482 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2589638"></a>NT4 Domain Member</h4></div></div></div><p> 1483 1483 The following steps provide a Linux system that users can log onto using 1484 1484 Windows NT4 (or Samba-3) domain network credentials: … … 1508 1508 Edit only one file at a time. Carefully validate its operation before attempting 1509 1509 to reboot the machine. 1510 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id258976 5"></a>ADS Domain Member</h4></div></div></div><p>1510 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2589761"></a>ADS Domain Member</h4></div></div></div><p> 1511 1511 This procedure should be followed to permit a Linux network client (workstation/desktop) 1512 1512 to permit users to log on using Microsoft Active Directory-based user credentials. … … 1588 1588 session sufficient /lib/security/$ISA/pam_unix.so 1589 1589 session sufficient /lib/security/$ISA/pam_winbind.so use_first_pass 1590 </pre></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id259001 7"></a>Key Points Learned</h3></div></div></div><p>1590 </pre></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2590012"></a>Key Points Learned</h3></div></div></div><p> 1591 1591 The addition of UNIX/Linux Samba servers and clients is a common requirement. In this chapter, you 1592 1592 learned how to integrate such servers so that the UID/GID mappings they use can be consistent … … 1608 1608 On NSS/PAM enabled UNIX/Linux systems, NSS is responsible for identity management 1609 1609 and PAM is responsible for authentication of logon credentials (username and password). 1610 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id25900 71"></a>Questions and Answers</h2></div></div></div><p>1610 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2590066"></a>Questions and Answers</h2></div></div></div><p> 1611 1611 The following questions were obtained from the mailing list and also from private discussions 1612 1612 with Windows network administrators. 1613 </p><div class="qandaset"><dl><dt> <a href="unixclients.html#id259008 9">1613 </p><div class="qandaset"><dl><dt> <a href="unixclients.html#id2590085"> 1614 1614 We use NIS for all UNIX accounts. Why do we need winbind? 1615 </a></dt><dt> <a href="unixclients.html#id2590 204">1615 </a></dt><dt> <a href="unixclients.html#id2590199"> 1616 1616 Our IT management people do not like LDAP but are looking at Microsoft Active Directory. 1617 1617 Which is better? 1618 </a></dt><dt> <a href="unixclients.html#id259028 8">1618 </a></dt><dt> <a href="unixclients.html#id2590284"> 1619 1619 We want to implement a Samba PDC, four Samba BDCs, and 10 Samba servers. Is it possible 1620 1620 to use NIS in place of LDAP? 1621 </a></dt><dt> <a href="unixclients.html#id259039 9">1621 </a></dt><dt> <a href="unixclients.html#id2590394"> 1622 1622 Are you suggesting that users should not log on to a domain member server? If so, why? 1623 </a></dt><dt> <a href="unixclients.html#id259052 7">1623 </a></dt><dt> <a href="unixclients.html#id2590522"> 1624 1624 We want to ensure that only users from our own domain plus from trusted domains can use our 1625 1625 Samba servers. In the smb.conf file on all servers, we have enabled the winbind … … 1627 1627 cannot access our servers, and users from Windows clients that are not domain members 1628 1628 can also access our servers. Is this a Samba bug? 1629 </a></dt><dt> <a href="unixclients.html#id2590 702">1629 </a></dt><dt> <a href="unixclients.html#id2590698"> 1630 1630 What are the benefits of using LDAP for my domain member servers? 1631 </a></dt><dt> <a href="unixclients.html#id259088 6">1631 </a></dt><dt> <a href="unixclients.html#id2590881"> 1632 1632 Is proper DNS operation necessary for Samba-3 plus LDAP? If so, what must I put into 1633 1633 my DNS configuration? 1634 </a></dt><dt> <a href="unixclients.html#id25910 44">1634 </a></dt><dt> <a href="unixclients.html#id2591039"> 1635 1635 Our Windows 2003 Server Active Directory domain runs with NetBIOS disabled. Can we 1636 1636 use Samba-3 with that configuration? 1637 </a></dt><dt> <a href="unixclients.html#id25910 62">1637 </a></dt><dt> <a href="unixclients.html#id2591057"> 1638 1638 When I tried to execute net ads join, I got no output. It did not work, so 1639 1639 I think that it failed. I then executed net rpc join and that worked fine. 1640 1640 That is okay, isn't it? 1641 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id259008 9"></a><a name="id2590091"></a></td><td align="left" valign="top"><p>1641 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2590085"></a><a name="id2590087"></a></td><td align="left" valign="top"><p> 1642 1642 We use NIS for all UNIX accounts. Why do we need winbind? 1643 1643 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 1644 <a class="indexterm" name="id2590 103"></a>1645 <a class="indexterm" name="id25901 10"></a>1646 <a class="indexterm" name="id259011 7"></a>1647 <a class="indexterm" name="id25901 24"></a>1648 <a class="indexterm" name="id25901 30"></a>1649 <a class="indexterm" name="id259013 7"></a>1644 <a class="indexterm" name="id2590099"></a> 1645 <a class="indexterm" name="id2590105"></a> 1646 <a class="indexterm" name="id2590112"></a> 1647 <a class="indexterm" name="id2590119"></a> 1648 <a class="indexterm" name="id2590126"></a> 1649 <a class="indexterm" name="id2590133"></a> 1650 1650 You can use NIS for your UNIX accounts. NIS does not store the Windows encrypted 1651 1651 passwords that need to be stored in one of the acceptable passdb backends. … … 1654 1654 SIDs from trusted domains to local UID/GID values. 1655 1655 </p><p> 1656 <a class="indexterm" name="id259016 4"></a>1657 <a class="indexterm" name="id25901 72"></a>1656 <a class="indexterm" name="id2590160"></a> 1657 <a class="indexterm" name="id2590167"></a> 1658 1658 On a domain member server, you effectively map Windows domain users to local users 1659 1659 that are in your NIS database by specifying the <em class="parameter"><code>winbind trusted domains … … 1663 1663 </p><p> 1664 1664 As a general rule, it is always a good idea to run winbind on all Samba servers. 1665 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2590 204"></a><a name="id2590206"></a></td><td align="left" valign="top"><p>1665 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2590199"></a><a name="id2590202"></a></td><td align="left" valign="top"><p> 1666 1666 Our IT management people do not like LDAP but are looking at Microsoft Active Directory. 1667 Which is better?<a class="indexterm" name="id25902 13"></a>1668 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id259022 7"></a><a class="indexterm" name="id2590238"></a><a class="indexterm" name="id2590246"></a>1667 Which is better?<a class="indexterm" name="id2590208"></a> 1668 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2590222"></a><a class="indexterm" name="id2590234"></a><a class="indexterm" name="id2590242"></a> 1669 1669 Microsoft Active Directory is an LDAP server that is intricately tied to a Kerberos 1670 1670 infrastructure. Most IT managers who object to LDAP do so because … … 1673 1673 devise the backup and recovery facilities in a site-dependent manner. LDAP servers 1674 1674 in general are seen as a high-energy, high-risk facility. 1675 </p><p><a class="indexterm" name="id259026 5"></a>1675 </p><p><a class="indexterm" name="id2590261"></a> 1676 1676 Microsoft Active Directory by comparison is easy to install and configure and 1677 1677 is supplied with all tools necessary to implement and manage the directory. For sites … … 1682 1682 consider the options. On the other hand, if management just wants a solution that works, 1683 1683 Microsoft Active Directory is a good solution. 1684 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id259028 8"></a><a name="id2590290"></a></td><td align="left" valign="top"><p>1684 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2590284"></a><a name="id2590286"></a></td><td align="left" valign="top"><p> 1685 1685 We want to implement a Samba PDC, four Samba BDCs, and 10 Samba servers. Is it possible 1686 1686 to use NIS in place of LDAP? 1687 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2590 302"></a><a class="indexterm" name="id2590310"></a><a class="indexterm" name="id2590318"></a><a class="indexterm" name="id2590326"></a><a class="indexterm" name="id2590334"></a><a class="indexterm" name="id2590342"></a><a class="indexterm" name="id2590349"></a>1687 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2590298"></a><a class="indexterm" name="id2590305"></a><a class="indexterm" name="id2590313"></a><a class="indexterm" name="id2590321"></a><a class="indexterm" name="id2590329"></a><a class="indexterm" name="id2590337"></a><a class="indexterm" name="id2590345"></a> 1688 1688 Yes, it is possible to use NIS in place of LDAP, but there may be problems with keeping 1689 1689 the Windows (SMB) encrypted passwords database correctly synchronized across the entire … … 1691 1691 membership secure account password. How can you keep changes that are on remote BDCs 1692 1692 synchronized on the PDC? 1693 </p><p><a class="indexterm" name="id259036 7"></a><a class="indexterm" name="id2590375"></a><a class="indexterm" name="id2590383"></a>1693 </p><p><a class="indexterm" name="id2590362"></a><a class="indexterm" name="id2590370"></a><a class="indexterm" name="id2590378"></a> 1694 1694 LDAP is a more elegant solution because it permits centralized storage and management 1695 1695 of all network identities (user, group, and machine accounts) together with all information 1696 1696 Samba needs to provide to network clients and their users. 1697 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id259039 9"></a><a name="id2590401"></a></td><td align="left" valign="top"><p>1697 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2590394"></a><a name="id2590397"></a></td><td align="left" valign="top"><p> 1698 1698 Are you suggesting that users should not log on to a domain member server? If so, why? 1699 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id25904 13"></a><a class="indexterm" name="id2590420"></a><a class="indexterm" name="id2590432"></a>1699 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2590408"></a><a class="indexterm" name="id2590416"></a><a class="indexterm" name="id2590427"></a> 1700 1700 Many UNIX administrators mock the model that the personal computer industry has adopted 1701 1701 as normative since the early days of Novell NetWare. The old … … 1703 1703 fears concerning the security and integrity of data. It was a simple and generally 1704 1704 effective measure to keep users away from servers, except through mapped drives. 1705 </p><p><a class="indexterm" name="id259045 7"></a><a class="indexterm" name="id2590465"></a><a class="indexterm" name="id2590473"></a><a class="indexterm" name="id2590480"></a><a class="indexterm" name="id2590488"></a>1705 </p><p><a class="indexterm" name="id2590452"></a><a class="indexterm" name="id2590460"></a><a class="indexterm" name="id2590468"></a><a class="indexterm" name="id2590476"></a><a class="indexterm" name="id2590484"></a> 1706 1706 UNIX administrators are fully correct in asserting that UNIX servers and workstations 1707 1707 are identical in terms of the software that is installed. They correctly assert that … … 1712 1712 Only then can one begin to appraise the best strategy and adopt a site-specific 1713 1713 policy that best protects the needs of users and of the organization alike. 1714 </p><p><a class="indexterm" name="id25905 10"></a>1714 </p><p><a class="indexterm" name="id2590506"></a> 1715 1715 From experience, it is my recommendation to keep general system-level logins to a 1716 1716 practical minimum and to eliminate them if possible. This should not be taken as a 1717 1717 hard rule, though. The better question is, what works best for the site? 1718 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id259052 7"></a><a name="id2590529"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2590532"></a><a class="indexterm" name="id2590540"></a><a class="indexterm" name="id2590552"></a><a class="indexterm" name="id2590560"></a>1718 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2590522"></a><a name="id2590524"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2590528"></a><a class="indexterm" name="id2590536"></a><a class="indexterm" name="id2590547"></a><a class="indexterm" name="id2590555"></a> 1719 1719 We want to ensure that only users from our own domain plus from trusted domains can use our 1720 1720 Samba servers. In the <code class="filename">smb.conf</code> file on all servers, we have enabled the <em class="parameter"><code>winbind … … 1722 1722 cannot access our servers, and users from Windows clients that are not domain members 1723 1723 can also access our servers. Is this a Samba bug? 1724 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id25905 93"></a><a class="indexterm" name="id2590600"></a><a class="indexterm" name="id2590608"></a><a class="indexterm" name="id2590616"></a><a class="indexterm" name="id2590624"></a><a class="indexterm" name="id2590632"></a>1724 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2590588"></a><a class="indexterm" name="id2590596"></a><a class="indexterm" name="id2590603"></a><a class="indexterm" name="id2590611"></a><a class="indexterm" name="id2590619"></a><a class="indexterm" name="id2590627"></a> 1725 1725 The manual page for this <em class="parameter"><code>winbind trusted domains only</code></em> parameter says, 1726 1726 “<span class="quote">This parameter is designed to allow Samba servers that are members of a Samba-controlled … … 1730 1730 of allocating a new UID for him or her.</span>” This clearly suggests that you are trying 1731 1731 to use this parameter inappropriately. 1732 </p><p><a class="indexterm" name="id25906 73"></a>1732 </p><p><a class="indexterm" name="id2590669"></a> 1733 1733 A far better solution is to use the <em class="parameter"><code>valid users</code></em> by specifying 1734 1734 precisely the domain users and groups that should be permitted access to the shares. You could, … … 1739 1739 valid users = @"Domain Users", @"OTHERDOMAIN\Domain Users" 1740 1740 </pre><p> 1741 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2590 702"></a><a name="id2590704"></a></td><td align="left" valign="top"><p>1741 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2590698"></a><a name="id2590700"></a></td><td align="left" valign="top"><p> 1742 1742 What are the benefits of using LDAP for my domain member servers? 1743 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id259071 5"></a><a class="indexterm" name="id2590723"></a><a class="indexterm" name="id2590731"></a><a class="indexterm" name="id2590739"></a><a class="indexterm" name="id2590746"></a><a class="indexterm" name="id2590754"></a><a class="indexterm" name="id2590762"></a><a class="indexterm" name="id2590770"></a><a class="indexterm" name="id2590778"></a>1743 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2590711"></a><a class="indexterm" name="id2590718"></a><a class="indexterm" name="id2590726"></a><a class="indexterm" name="id2590734"></a><a class="indexterm" name="id2590742"></a><a class="indexterm" name="id2590750"></a><a class="indexterm" name="id2590758"></a><a class="indexterm" name="id2590766"></a><a class="indexterm" name="id2590773"></a> 1744 1744 The key benefit of using LDAP is that the UID of all users and the GID of all groups 1745 1745 are globally consistent on domain controllers as well as on domain member servers. 1746 1746 This means that it is possible to copy/replicate files across servers without 1747 1747 loss of identity. 1748 </p><p><a class="indexterm" name="id25907 94"></a><a class="indexterm" name="id2590802"></a><a class="indexterm" name="id2590810"></a><a class="indexterm" name="id2590818"></a><a class="indexterm" name="id2590826"></a><a class="indexterm" name="id2590834"></a><a class="indexterm" name="id2590845"></a><a class="indexterm" name="id2590853"></a>1748 </p><p><a class="indexterm" name="id2590789"></a><a class="indexterm" name="id2590797"></a><a class="indexterm" name="id2590805"></a><a class="indexterm" name="id2590813"></a><a class="indexterm" name="id2590821"></a><a class="indexterm" name="id2590829"></a><a class="indexterm" name="id2590840"></a><a class="indexterm" name="id2590848"></a> 1749 1749 When use is made of account identity resolution via winbind, even when an IDMAP backend 1750 1750 is stored in LDAP, the UID/GID on domain member servers is consistent, but differs … … 1753 1753 idmap uid/gid</code></em> in the <code class="filename">smb.conf</code> file. On domain controllers, the UID/GID is 1754 1754 that of the POSIX value assigned in the LDAP directory as part of the POSIX account information. 1755 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id259088 6"></a><a name="id2590888"></a></td><td align="left" valign="top"><p>1755 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2590881"></a><a name="id2590883"></a></td><td align="left" valign="top"><p> 1756 1756 Is proper DNS operation necessary for Samba-3 plus LDAP? If so, what must I put into 1757 1757 my DNS configuration? 1758 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id259089 9"></a><a class="indexterm" name="id2590910"></a><a class="indexterm" name="id2590922"></a><a class="indexterm" name="id2590929"></a><a class="indexterm" name="id2590937"></a><a class="indexterm" name="id2590945"></a><a class="indexterm" name="id2590953"></a>1758 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2590895"></a><a class="indexterm" name="id2590906"></a><a class="indexterm" name="id2590917"></a><a class="indexterm" name="id2590925"></a><a class="indexterm" name="id2590933"></a><a class="indexterm" name="id2590940"></a><a class="indexterm" name="id2590948"></a> 1759 1759 Samba depends on correctly functioning resolution of hostnames to their IP address. Samba 1760 1760 makes no direct DNS lookup calls, but rather redirects all name-to-address calls via the … … 1769 1769 If this fails to resolve, it attempts a DNS lookup, and if that fails, it tries a 1770 1770 WINS lookup. 1771 </p><p><a class="indexterm" name="id259100 8"></a><a class="indexterm" name="id2591016"></a><a class="indexterm" name="id2591023"></a>1771 </p><p><a class="indexterm" name="id2591003"></a><a class="indexterm" name="id2591011"></a><a class="indexterm" name="id2591019"></a> 1772 1772 The addition of the WINS-based name lookup makes sense only if NetBIOS over TCP/IP has 1773 1773 been enabled on all Windows clients. Where NetBIOS over TCP/IP has been disabled, DNS … … 1776 1776 case, the Windows 200x autoregisters all locator records it needs with its own DNS 1777 1777 server or servers. 1778 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id25910 44"></a><a name="id2591046"></a></td><td align="left" valign="top"><p>1778 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2591039"></a><a name="id2591041"></a></td><td align="left" valign="top"><p> 1779 1779 Our Windows 2003 Server Active Directory domain runs with NetBIOS disabled. Can we 1780 1780 use Samba-3 with that configuration? 1781 1781 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 1782 1782 Yes. 1783 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id25910 62"></a><a name="id2591064"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2591067"></a><a class="indexterm" name="id2591082"></a>1783 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2591057"></a><a name="id2591060"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2591063"></a><a class="indexterm" name="id2591077"></a> 1784 1784 When I tried to execute net ads join, I got no output. It did not work, so 1785 1785 I think that it failed. I then executed net rpc join and that worked fine. 1786 1786 That is okay, isn't it? 1787 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id259110 6"></a><a class="indexterm" name="id2591113"></a>1787 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id2591101"></a><a class="indexterm" name="id2591109"></a> 1788 1788 No. This is not okay. It means that your Samba-3 client has joined the ADS domain as 1789 1789 a Windows NT4 client, and Samba-3 will not be using Kerberos-based authentication. -
branches/samba-3.2.x/docs/htmldocs/Samba3-ByExample/upgrades.html
r204 r226 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 8. Updating Samba-3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="unixclients.html" title="Chapter 7. Adding Domain Member Servers and Clients"><link rel="next" href="ntmigration.html" title="Chapter 9. Migrating NT4 Domain to Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 8. Updating Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="unixclients.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="ntmigration.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="upgrades"></a>Chapter 8. Updating Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="upgrades.html#id25912 31">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id2591327">Cautions and Notes</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id2592656">Upgrading from Samba 1.x and 2.x to Samba-3</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2593024">Applicable to All Samba 2.x to Samba-3 Upgrades</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2593358">Samba-2.x with LDAP Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id2593539">Updating a Samba-3 Installation</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id2593650">Samba-3 to Samba-3 Updates on the Same Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2593853">Migrating Samba-3 to a New Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2594268">Migration of Samba Accounts to Active Directory</a></span></dt></dl></dd></dl></div><p>2 <a class="indexterm" name="id259114 6"></a>3 <a class="indexterm" name="id25911 53"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 8. Updating Samba-3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="unixclients.html" title="Chapter 7. Adding Domain Member Servers and Clients"><link rel="next" href="ntmigration.html" title="Chapter 9. Migrating NT4 Domain to Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 8. Updating Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="unixclients.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="ntmigration.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="upgrades"></a>Chapter 8. Updating Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="upgrades.html#id2591226">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id2591322">Cautions and Notes</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id2592651">Upgrading from Samba 1.x and 2.x to Samba-3</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2593019">Applicable to All Samba 2.x to Samba-3 Upgrades</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2593353">Samba-2.x with LDAP Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id2593535">Updating a Samba-3 Installation</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id2593645">Samba-3 to Samba-3 Updates on the Same Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2593848">Migrating Samba-3 to a New Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2594263">Migration of Samba Accounts to Active Directory</a></span></dt></dl></dd></dl></div><p> 2 <a class="indexterm" name="id2591142"></a> 3 <a class="indexterm" name="id2591148"></a> 4 4 It was a little difficult to select an appropriate title for this chapter. 5 5 From email messages on the Samba mailing lists it is clear that many people … … 8 8 installing a new Samba server to replace an older existing Samba server. 9 9 </p><p> 10 <a class="indexterm" name="id25911 70"></a>11 <a class="indexterm" name="id259117 6"></a>10 <a class="indexterm" name="id2591165"></a> 11 <a class="indexterm" name="id2591172"></a> 12 12 There has also been much talk about migration of Samba-3 from an smbpasswd 13 13 passdb backend to the use of the tdbsam or ldapsam facilities that are new … … 18 18 highlighted by an email posting that included the following neat remark: 19 19 </p><div class="blockquote"><blockquote class="blockquote"><p> 20 <a class="indexterm" name="id259119 8"></a>20 <a class="indexterm" name="id2591193"></a> 21 21 I like the “<span class="quote">net rpc vampire</span>” on NT4, but that to my surprise does 22 22 not seem to work against a Samba PDC and, if addressed in the Samba to Samba 23 23 context in either book, I could not find it. 24 24 </p></blockquote></div><p> 25 <a class="indexterm" name="id259121 9"></a>25 <a class="indexterm" name="id2591214"></a> 26 26 So in response to the significant request for these situations to be better 27 27 documented, this chapter has now been added. User contributions and documentation 28 28 of real-world experiences are a most welcome addition to this chapter. 29 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id25912 31"></a>Introduction</h2></div></div></div><p>30 <a class="indexterm" name="id259123 8"></a>31 <a class="indexterm" name="id259124 5"></a>32 <a class="indexterm" name="id25912 52"></a>29 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2591226"></a>Introduction</h2></div></div></div><p> 30 <a class="indexterm" name="id2591234"></a> 31 <a class="indexterm" name="id2591241"></a> 32 <a class="indexterm" name="id2591247"></a> 33 33 A Windows network administrator explained in an email what changes he was 34 34 planning to make and followed with the question: “<span class="quote">Anyone done this … … 45 45 productivity on them. 46 46 </p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p> 47 <a class="indexterm" name="id25912 83"></a>48 <a class="indexterm" name="id25912 90"></a>47 <a class="indexterm" name="id2591279"></a> 48 <a class="indexterm" name="id2591286"></a> 49 49 Samba makes it possible to upgrade and update configuration files, but it 50 50 is not possible to downgrade the configuration files. Please ensure that … … 52 52 in the rare event that this may be necessary. 53 53 </p></div><p> 54 <a class="indexterm" name="id259130 5"></a>55 <a class="indexterm" name="id25913 12"></a>54 <a class="indexterm" name="id2591300"></a> 55 <a class="indexterm" name="id2591307"></a> 56 56 It is prudent also to backup all data files on the server before attempting 57 57 to perform a major upgrade. Many administrators have experienced the consequences … … 60 60 the precautions taken were inadequate. If a backup was not needed, but was available, 61 61 caution was on the side of the victor. 62 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id259132 7"></a>Cautions and Notes</h3></div></div></div><p>62 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2591322"></a>Cautions and Notes</h3></div></div></div><p> 63 63 Someone once said, “<span class="quote">It is good to be sorry, but better never to need to be!</span>” 64 64 These are wise words of advice to those contemplating a Samba upgrade or update. 65 65 </p><p> 66 <a class="indexterm" name="id259134 4"></a>67 <a class="indexterm" name="id25913 51"></a>68 <a class="indexterm" name="id259135 8"></a>66 <a class="indexterm" name="id2591340"></a> 67 <a class="indexterm" name="id2591347"></a> 68 <a class="indexterm" name="id2591353"></a> 69 69 This is as good a time as any to define the terms <code class="constant">upgrade</code> and 70 70 <code class="constant">update</code>. The term <code class="constant">upgrade</code> refers to … … 74 74 is in development. 75 75 </p><p> 76 <a class="indexterm" name="id259138 5"></a>76 <a class="indexterm" name="id2591380"></a> 77 77 The term <code class="constant">update</code> refers to a minor version number installation 78 78 in place of one of the same generation. For example, updating from Samba 3.0.10 to 3.0.14 79 79 is an update. The move from Samba 2.0.7 to 3.0.14 is an upgrade. 80 80 </p><p> 81 <a class="indexterm" name="id2591 402"></a>81 <a class="indexterm" name="id2591398"></a> 82 82 While the use of these terms is an exercise in semantics, what needs to be realized 83 83 is that there are major functional differences between a Samba 2.x release and a Samba … … 91 91 noone can read it!</span>” While true, some documentation is an evil necessity. 92 92 It is hoped that this update to the documentation will avoid both extremes. 93 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id25914 31"></a>Security Identifiers (SIDs)</h4></div></div></div><p>94 <a class="indexterm" name="id259143 9"></a>95 <a class="indexterm" name="id259144 8"></a>96 <a class="indexterm" name="id259145 4"></a>97 <a class="indexterm" name="id25914 61"></a>98 <a class="indexterm" name="id259146 7"></a>99 <a class="indexterm" name="id259147 7"></a>93 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2591426"></a>Security Identifiers (SIDs)</h4></div></div></div><p> 94 <a class="indexterm" name="id2591434"></a> 95 <a class="indexterm" name="id2591443"></a> 96 <a class="indexterm" name="id2591450"></a> 97 <a class="indexterm" name="id2591456"></a> 98 <a class="indexterm" name="id2591463"></a> 99 <a class="indexterm" name="id2591472"></a> 100 100 Before the days of Windows NT and OS/2, every Windows and DOS networking client 101 101 that used the SMB protocols was an entirely autonomous entity. There was no concept … … 105 105 Windows NT 3.10. 106 106 </p><p> 107 <a class="indexterm" name="id259149 6"></a>108 <a class="indexterm" name="id2591 503"></a>109 <a class="indexterm" name="id25915 10"></a>110 <a class="indexterm" name="id259151 7"></a>111 <a class="indexterm" name="id25915 23"></a>112 <a class="indexterm" name="id25915 30"></a>107 <a class="indexterm" name="id2591492"></a> 108 <a class="indexterm" name="id2591499"></a> 109 <a class="indexterm" name="id2591505"></a> 110 <a class="indexterm" name="id2591512"></a> 111 <a class="indexterm" name="id2591518"></a> 112 <a class="indexterm" name="id2591525"></a> 113 113 Versions of Samba prior to 1.9 did not make use of a SID. Instead they make exclusive use 114 114 of the username that is embedded in the SessionSetUpAndX component of the connection 115 115 setup process between a Windows client and an SMB/CIFS server. 116 116 </p><p> 117 <a class="indexterm" name="id259154 7"></a>118 <a class="indexterm" name="id25915 53"></a>119 <a class="indexterm" name="id25915 60"></a>117 <a class="indexterm" name="id2591542"></a> 118 <a class="indexterm" name="id2591549"></a> 119 <a class="indexterm" name="id2591555"></a> 120 120 Around November 1997 support was added to Samba-1.9 to handle the Windows security 121 121 RPC-based protocols that implemented support for Samba to store a machine SID. This 122 122 information was stored in a file called <code class="filename">MACHINE.SID.</code> 123 123 </p><p> 124 <a class="indexterm" name="id259157 9"></a>125 <a class="indexterm" name="id259158 6"></a>126 <a class="indexterm" name="id25915 93"></a>124 <a class="indexterm" name="id2591575"></a> 125 <a class="indexterm" name="id2591582"></a> 126 <a class="indexterm" name="id2591588"></a> 127 127 Within the lifetime of the early Samba 2.x series, the machine SID information was 128 128 relocated into a tdb file called <code class="filename">secrets.tdb</code>, which is where … … 130 130 local machine and its role within a domain security context. 131 131 </p><p> 132 <a class="indexterm" name="id25916 14"></a>133 <a class="indexterm" name="id25916 23"></a>134 <a class="indexterm" name="id25916 32"></a>135 <a class="indexterm" name="id259163 9"></a>132 <a class="indexterm" name="id2591609"></a> 133 <a class="indexterm" name="id2591618"></a> 134 <a class="indexterm" name="id2591627"></a> 135 <a class="indexterm" name="id2591634"></a> 136 136 There are two types of SID, those pertaining to the machine itself and the domain to 137 137 which it may belong, and those pertaining to users and groups within the security … … 139 139 servers (DMS). 140 140 </p><p> 141 <a class="indexterm" name="id25916 54"></a>142 <a class="indexterm" name="id25916 60"></a>143 <a class="indexterm" name="id259166 7"></a>144 <a class="indexterm" name="id25916 74"></a>145 <a class="indexterm" name="id25916 81"></a>146 <a class="indexterm" name="id259168 7"></a>141 <a class="indexterm" name="id2591649"></a> 142 <a class="indexterm" name="id2591656"></a> 143 <a class="indexterm" name="id2591662"></a> 144 <a class="indexterm" name="id2591669"></a> 145 <a class="indexterm" name="id2591676"></a> 146 <a class="indexterm" name="id2591683"></a> 147 147 When the Samba <code class="literal">smbd</code> daemon is first started, if the <code class="filename">secrets.tdb</code> 148 148 file does not exist, it is created at the first client connection attempt. If this file does … … 154 154 (hostname) and domain name (workgroup), it will be different. 155 155 </p><p> 156 <a class="indexterm" name="id259173 7"></a>156 <a class="indexterm" name="id2591732"></a> 157 157 The SID is the key used by MS Windows networking for all networking operations. This means 158 158 that when the machine or domain SID changes, all security-encoded objects such as profiles … … 163 163 be restored to its previous value. 164 164 </p></div><p> 165 <a class="indexterm" name="id259175 8"></a>166 <a class="indexterm" name="id259176 5"></a>167 <a class="indexterm" name="id25917 72"></a>168 <a class="indexterm" name="id259177 8"></a>169 <a class="indexterm" name="id259178 5"></a>170 <a class="indexterm" name="id25917 92"></a>171 <a class="indexterm" name="id259179 9"></a>172 <a class="indexterm" name="id259180 6"></a>173 <a class="indexterm" name="id25918 13"></a>174 <a class="indexterm" name="id259181 9"></a>165 <a class="indexterm" name="id2591754"></a> 166 <a class="indexterm" name="id2591761"></a> 167 <a class="indexterm" name="id2591767"></a> 168 <a class="indexterm" name="id2591774"></a> 169 <a class="indexterm" name="id2591781"></a> 170 <a class="indexterm" name="id2591787"></a> 171 <a class="indexterm" name="id2591794"></a> 172 <a class="indexterm" name="id2591801"></a> 173 <a class="indexterm" name="id2591808"></a> 174 <a class="indexterm" name="id2591815"></a> 175 175 In Samba-3 on a domain controller (PDC or BDC), the domain name controls the domain 176 176 SID. On all prior versions the hostname (computer name, or NetBIOS name) controlled 177 177 the SID. On a standalone server the hostname still controls the SID. 178 178 </p><p> 179 <a class="indexterm" name="id25918 33"></a>180 <a class="indexterm" name="id25918 42"></a>179 <a class="indexterm" name="id2591829"></a> 180 <a class="indexterm" name="id2591838"></a> 181 181 The local machine SID can be backed up using this procedure (Samba-3): 182 182 </p><pre class="screen"> … … 201 201 This is not a reversible process it is a one-way upgrade. 202 202 </p><p> 203 <a class="indexterm" name="id25919 31"></a>203 <a class="indexterm" name="id2591926"></a> 204 204 In the course of the Samba 2.0.x series the <code class="literal">smbpasswd</code> was modified to 205 205 permit the domain SID to be captured to the <code class="filename">secrets.tdb</code> file by executing: … … 218 218 </pre><p> 219 219 </p><p> 220 <a class="indexterm" name="id259200 4"></a>221 <a class="indexterm" name="id25920 11"></a>220 <a class="indexterm" name="id2592000"></a> 221 <a class="indexterm" name="id2592006"></a> 222 222 Domain security information, which includes the domain SID, can be obtained from Samba-2.2.x 223 223 systems by executing: … … 238 238 case it is ever needed at a later date. 239 239 </p><p> 240 <a class="indexterm" name="id259205 8"></a>241 <a class="indexterm" name="id259206 5"></a>242 <a class="indexterm" name="id25920 72"></a>240 <a class="indexterm" name="id2592053"></a> 241 <a class="indexterm" name="id2592060"></a> 242 <a class="indexterm" name="id2592067"></a> 243 243 Take note that the domain SID is used extensively in Samba. Where LDAP is used for the 244 244 <em class="parameter"><code>passdb backend</code></em>, all user, group, and trust accounts are encoded … … 251 251 </pre><p> 252 252 </p><p> 253 <a class="indexterm" name="id259210 8"></a>254 <a class="indexterm" name="id25921 14"></a>255 <a class="indexterm" name="id25921 21"></a>253 <a class="indexterm" name="id2592103"></a> 254 <a class="indexterm" name="id2592109"></a> 255 <a class="indexterm" name="id2592116"></a> 256 256 When the domain SID has changed, roaming profiles cease to be functional. The recovery 257 257 of roaming profiles necessitates resetting of the domain portion of the user SID … … 262 262 addressed to the creator of the RPM package. The Samba Team do their best to make 263 263 available all the tools needed to manage a Samba-based Windows networking environment. 264 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id259215 8"></a>Change of hostname</h4></div></div></div><p>265 <a class="indexterm" name="id259216 6"></a>266 <a class="indexterm" name="id259217 5"></a>264 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2592154"></a>Change of hostname</h4></div></div></div><p> 265 <a class="indexterm" name="id2592161"></a> 266 <a class="indexterm" name="id2592171"></a> 267 267 Samba uses two methods by which the primary NetBIOS machine name (also known as a computer 268 268 name or the hostname) may be determined: If the <code class="filename">smb.conf</code> file contains a … … 278 278 is changed, be sure to reset the machine SID to the original setting. Otherwise 279 279 there may be serious interoperability and/or operational problems. 280 </p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id25922 24"></a>Change of Workgroup (Domain) Name</h4></div></div></div><p>281 <a class="indexterm" name="id25922 32"></a>280 </p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2592219"></a>Change of Workgroup (Domain) Name</h4></div></div></div><p> 281 <a class="indexterm" name="id2592227"></a> 282 282 The domain name of a Samba server is identical to the workgroup name and is 283 283 set in the <code class="filename">smb.conf</code> file using the <em class="parameter"><code>workgroup</code></em> parameter. 284 284 This has been consistent throughout the history of Samba and across all versions. 285 285 </p><p> 286 <a class="indexterm" name="id259225 7"></a>286 <a class="indexterm" name="id2592253"></a> 287 287 Be aware that when the workgroup name is changed, a new SID will be generated. 288 288 The old domain SID can be reset using the procedure outlined earlier in this chapter. … … 293 293 for network administrators. 294 294 </p><p> 295 <a class="indexterm" name="id259228 9"></a>295 <a class="indexterm" name="id2592284"></a> 296 296 The Samba 1.9.x <code class="filename">smb.conf</code> file may be found either in the <code class="filename">/etc</code> 297 297 directory or in <code class="filename">/usr/local/samba/lib</code>. … … 301 301 remains located also for Samba 3.0.x installations. 302 302 </p><p> 303 <a class="indexterm" name="id259233 5"></a>303 <a class="indexterm" name="id2592331"></a> 304 304 Samba 2.x introduced the <code class="filename">secrets.tdb</code> file that is also stored in the 305 305 <code class="filename">/etc/samba</code> directory, or in the <code class="filename">/usr/local/samba/lib</code> 306 306 directory subsystem. 307 307 </p><p> 308 <a class="indexterm" name="id259236 5"></a>308 <a class="indexterm" name="id2592360"></a> 309 309 The location at which <code class="literal">smbd</code> expects to find all configuration and control 310 310 files is determined at the time of compilation of Samba. For versions of Samba prior to … … 318 318 <code class="filename">/usr/local/samba/sbin</code>. 319 319 </p><p> 320 <a class="indexterm" name="id25924 23"></a>320 <a class="indexterm" name="id2592418"></a> 321 321 Samba-3 provides a neat new way to track the location of all control files as well as to 322 322 find the compile-time options used as the Samba package was built. Here is how the dark … … 349 349 </pre><p> 350 350 </p><p> 351 <a class="indexterm" name="id25924 60"></a>351 <a class="indexterm" name="id2592456"></a> 352 352 It is important that both the <code class="filename">smb.conf</code> file and the <code class="filename">secrets.tdb</code> 353 353 be backed up before attempting any upgrade. The <code class="filename">secrets.tdb</code> file … … 355 355 of Samba. A backup means that it is always possible to revert a failed or problematic 356 356 upgrade. 357 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id25924 90"></a>International Language Support</h4></div></div></div><p>358 <a class="indexterm" name="id259249 8"></a>359 <a class="indexterm" name="id259250 5"></a>360 <a class="indexterm" name="id25925 12"></a>361 <a class="indexterm" name="id259251 9"></a>357 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2592486"></a>International Language Support</h4></div></div></div><p> 358 <a class="indexterm" name="id2592494"></a> 359 <a class="indexterm" name="id2592501"></a> 360 <a class="indexterm" name="id2592508"></a> 361 <a class="indexterm" name="id2592514"></a> 362 362 Samba-2.x had no support for Unicode; instead, all national language character-set support in file names 363 363 was done using particular locale codepage mapping techniques. Samba-3 supports Unicode in file names, thus 364 364 providing true internationalization support. 365 365 </p><p> 366 <a class="indexterm" name="id25925 34"></a>366 <a class="indexterm" name="id2592529"></a> 367 367 Non-English users whose national language character set has special characters and who upgrade naively will 368 368 find that many files that have the special characters in the file name will see them garbled and jumbled up. … … 370 370 that was in use with Samba-2.x using an 8-bit encoding scheme. 371 371 </p><p> 372 <a class="indexterm" name="id25925 50"></a>372 <a class="indexterm" name="id2592546"></a> 373 373 Files that are created with Samba-3 will use UTF-8 encoding. Should the file system ever end up with a 374 374 mix of codepage (unix charset)-encoded file names and UTF-8-encoded file names, the mess will take some 375 375 effort to set straight. 376 376 </p><p> 377 <a class="indexterm" name="id259256 5"></a>377 <a class="indexterm" name="id2592560"></a> 378 378 A very helpful tool is available from Bjorn Jacke's <a class="ulink" href="http://j3e.de/linux/convmv/" target="_top">convmv</a> 379 379 work. Convmv is a tool that can be used to convert file and directory names from one encoding method to 380 380 another. The most common use for this tool is to convert locale-encoded files to UTF-8 Unicode encoding. 381 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id259258 4"></a>Updates and Changes in Idealx smbldap-tools</h4></div></div></div><p>381 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2592580"></a>Updates and Changes in Idealx smbldap-tools</h4></div></div></div><p> 382 382 The smbldap-tools have been maturing rapidly over the past year. With maturation comes change. 383 383 The location of the <code class="filename">smbldap.conf</code> and the <code class="filename">smbldap_bind.conf</code> … … 393 393 current release should note that the information stored under <code class="constant">NextFreeUnixId</code> 394 394 must now be relocated to the DIT object <code class="constant">sambaDomainName</code>. 395 </p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id259265 6"></a>Upgrading from Samba 1.x and 2.x to Samba-3</h2></div></div></div><p>395 </p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2592651"></a>Upgrading from Samba 1.x and 2.x to Samba-3</h2></div></div></div><p> 396 396 Sites that are being upgraded from Samba-2 (or earlier versions) to Samba-3 397 397 may experience little difficulty or may require a lot of effort, depending … … 406 406 Where it is necessary to upgrade an old Samba installation to Samba-3, 407 407 the following procedure can be followed: 408 </p><div class="procedure"><a name="id25926 94"></a><p class="title"><b>Procedure 8.1. Upgrading from a Pre-Samba-3 Version</b></p><ol type="1"><li><p>409 <a class="indexterm" name="id259270 5"></a>410 <a class="indexterm" name="id25927 12"></a>411 <a class="indexterm" name="id259271 8"></a>408 </p><div class="procedure"><a name="id2592689"></a><p class="title"><b>Procedure 8.1. Upgrading from a Pre-Samba-3 Version</b></p><ol type="1"><li><p> 409 <a class="indexterm" name="id2592700"></a> 410 <a class="indexterm" name="id2592707"></a> 411 <a class="indexterm" name="id2592714"></a> 412 412 Stop Samba. This can be done using the appropriate system tool 413 413 that is particular for each operating system or by executing the … … 424 424 back it up to a safe location. 425 425 </p></li><li><p> 426 <a class="indexterm" name="id2592 800"></a>427 <a class="indexterm" name="id259280 7"></a>428 <a class="indexterm" name="id25928 14"></a>429 <a class="indexterm" name="id25928 21"></a>426 <a class="indexterm" name="id2592795"></a> 427 <a class="indexterm" name="id2592802"></a> 428 <a class="indexterm" name="id2592809"></a> 429 <a class="indexterm" name="id2592816"></a> 430 430 Find the location of the lock directory. This is the directory 431 431 in which Samba stores all its tdb control files. The default … … 438 438 tdb files to a safe location. 439 439 </p></li><li><p> 440 <a class="indexterm" name="id259285 9"></a>440 <a class="indexterm" name="id2592854"></a> 441 441 It is now safe to upgrade the Samba installation. On Linux systems 442 442 it is not necessary to remove the Samba RPMs because a simple … … 457 457 Do not change the workgroup name. 458 458 </p></li><li><p> 459 <a class="indexterm" name="id259291 4"></a>459 <a class="indexterm" name="id2592910"></a> 460 460 Execute the <code class="literal">testparm</code> to validate the <code class="filename">smb.conf</code> file. 461 461 This process will flag any parameters that are no longer supported. … … 469 469 <code class="prompt">root# </code> testparm -s smb.conf.master > smb.conf 470 470 </pre><p> 471 <a class="indexterm" name="id25929 72"></a>471 <a class="indexterm" name="id2592967"></a> 472 472 The resulting <code class="filename">smb.conf</code> file will be stripped of all comments 473 473 and of all nonconforming configuration settings. 474 474 </p></li><li><p> 475 <a class="indexterm" name="id25929 93"></a>475 <a class="indexterm" name="id2592988"></a> 476 476 It is now safe to start Samba using the appropriate system tool. 477 477 Alternately, it is possible to just execute <code class="literal">nmbd</code>, 478 478 <code class="literal">smbd</code>, and <code class="literal">winbindd</code> for the command 479 479 line while logged in as the root user. 480 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id25930 24"></a>Applicable to All Samba 2.x to Samba-3 Upgrades</h3></div></div></div><p>481 <a class="indexterm" name="id25930 32"></a>482 <a class="indexterm" name="id259303 9"></a>483 <a class="indexterm" name="id259304 6"></a>480 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2593019"></a>Applicable to All Samba 2.x to Samba-3 Upgrades</h3></div></div></div><p> 481 <a class="indexterm" name="id2593028"></a> 482 <a class="indexterm" name="id2593034"></a> 483 <a class="indexterm" name="id2593041"></a> 484 484 Samba 2.x servers that were running as a domain controller (PDC) 485 485 require changes to the configuration of the scripting interface … … 487 487 users, groups, and trust accounts (machines and interdomain). 488 488 </p><p> 489 <a class="indexterm" name="id25930 60"></a>489 <a class="indexterm" name="id2593056"></a> 490 490 The following parameters are new to Samba-3 and should be correctly configured. 491 491 Please refer to <a class="link" href="secure.html" title="Chapter 3. Secure Office Networking">“Secure Office Networking”</a> through <a class="link" href="2000users.html" title="Chapter 6. A Distributed 2000-User Network">“A Distributed 2000-User Network”</a> 492 492 in this book for examples of use of the new parameters shown here: 493 <a class="indexterm" name="id25930 81"></a>494 <a class="indexterm" name="id259308 8"></a>495 <a class="indexterm" name="id259309 5"></a>496 <a class="indexterm" name="id2593 102"></a>497 <a class="indexterm" name="id259310 9"></a>498 <a class="indexterm" name="id259311 6"></a>499 <a class="indexterm" name="id25931 23"></a>493 <a class="indexterm" name="id2593077"></a> 494 <a class="indexterm" name="id2593083"></a> 495 <a class="indexterm" name="id2593090"></a> 496 <a class="indexterm" name="id2593097"></a> 497 <a class="indexterm" name="id2593104"></a> 498 <a class="indexterm" name="id2593112"></a> 499 <a class="indexterm" name="id2593119"></a> 500 500 </p><p> 501 501 </p><table class="simplelist" border="0" summary="Simple list"><tr><td><p>add group script</p></td></tr><tr><td><p>add machine script</p></td></tr><tr><td><p>add user to group script</p></td></tr><tr><td><p>delete group script</p></td></tr><tr><td><p>delete user from group script</p></td></tr><tr><td><p>passdb backend</p></td></tr><tr><td><p>set primary group script</p></td></tr></table><p> 502 502 </p><p> 503 <a class="indexterm" name="id259317 5"></a>504 <a class="indexterm" name="id25931 82"></a>503 <a class="indexterm" name="id2593171"></a> 504 <a class="indexterm" name="id2593178"></a> 505 505 The <em class="parameter"><code>add machine script</code></em> functionality was previously 506 506 handled by the <em class="parameter"><code>add user script</code></em>, which in Samba-3 is 507 507 used exclusively to add user accounts. 508 508 </p><p> 509 <a class="indexterm" name="id259320 6"></a>510 <a class="indexterm" name="id25932 13"></a>511 <a class="indexterm" name="id25932 20"></a>512 <a class="indexterm" name="id259322 7"></a>513 <a class="indexterm" name="id25932 34"></a>514 <a class="indexterm" name="id25932 41"></a>515 <a class="indexterm" name="id259324 7"></a>516 <a class="indexterm" name="id259325 4"></a>517 <a class="indexterm" name="id25932 61"></a>509 <a class="indexterm" name="id2593202"></a> 510 <a class="indexterm" name="id2593209"></a> 511 <a class="indexterm" name="id2593216"></a> 512 <a class="indexterm" name="id2593222"></a> 513 <a class="indexterm" name="id2593229"></a> 514 <a class="indexterm" name="id2593236"></a> 515 <a class="indexterm" name="id2593243"></a> 516 <a class="indexterm" name="id2593250"></a> 517 <a class="indexterm" name="id2593256"></a> 518 518 Where the <em class="parameter"><code>passdb backend</code></em> used is either <code class="constant">smbpasswd</code> 519 519 (the default) or the new <code class="constant">tdbsam</code>, the system interface scripts … … 522 522 <code class="literal">groupmod</code>, <code class="literal">groupdel</code>, and so on. 523 523 </p><p> 524 <a class="indexterm" name="id25933 22"></a>525 <a class="indexterm" name="id259332 8"></a>526 <a class="indexterm" name="id259333 5"></a>524 <a class="indexterm" name="id2593317"></a> 525 <a class="indexterm" name="id2593324"></a> 526 <a class="indexterm" name="id2593331"></a> 527 527 Where the <em class="parameter"><code>passdb backend</code></em> makes use of an LDAP directory, 528 528 it is necessary either to use the <code class="constant">smbldap-tools</code> provided 529 529 by Idealx or to use an alternate toolset provided by a third 530 530 party or else home-crafted to manage the LDAP directory accounts. 531 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id259335 8"></a>Samba-2.x with LDAP Support</h3></div></div></div><p>531 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2593353"></a>Samba-2.x with LDAP Support</h3></div></div></div><p> 532 532 Samba version 2.x could be compiled for use either with or without LDAP. 533 533 The LDAP control settings in the <code class="filename">smb.conf</code> file in this old version are … … 539 539 of all files to the correct locations. 540 540 </p><p> 541 <a class="indexterm" name="id25933 92"></a>542 <a class="indexterm" name="id259339 9"></a>541 <a class="indexterm" name="id2593388"></a> 542 <a class="indexterm" name="id2593394"></a> 543 543 The Samba SAM schema required for Samba-3 is significantly different from that 544 544 used with Samba 2.x. This means that the LDAP directory must be updated … … 695 695 the DN's with quotation marks. 696 696 </pre><p> 697 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id259353 9"></a>Updating a Samba-3 Installation</h2></div></div></div><p>697 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2593535"></a>Updating a Samba-3 Installation</h2></div></div></div><p> 698 698 The key concern in this section is to deal with the changes that have been 699 699 affected in Samba-3 between the Samba-3.0.0 release and the current update. … … 701 701 taken to update Samba-3 versions. 702 702 </p><p> 703 <a class="indexterm" name="id259355 5"></a>703 <a class="indexterm" name="id2593551"></a> 704 704 The information in <a class="link" href="upgrades.html#sbeug1" title="Location of config files">“Location of config files”</a> would not be necessary if every 705 705 person who has ever produced Samba executable (binary) files could agree on … … 707 707 Clearly, such agreement is further away than a pipedream. 708 708 </p><p> 709 <a class="indexterm" name="id25935 81"></a>709 <a class="indexterm" name="id2593576"></a> 710 710 Vendors and packagers who produce Samba binary installable packages do not, 711 711 as a rule, use the default paths used by the Samba-Team for the location of … … 720 720 effect. 721 721 </p><p> 722 <a class="indexterm" name="id259361 5"></a>722 <a class="indexterm" name="id2593610"></a> 723 723 The best advice for those lacking in code compilation experience is to use 724 724 only vendor (or Samba-Team) provided binary packages. The Samba packages … … 726 726 that are compatible with the original OS vendor's practices. 727 727 </p><p> 728 <a class="indexterm" name="id25936 30"></a>729 <a class="indexterm" name="id259363 7"></a>728 <a class="indexterm" name="id2593625"></a> 729 <a class="indexterm" name="id2593632"></a> 730 730 If you are not sure whether a binary package complies with the OS 731 731 vendor's practices, it is better to ask the package maintainer via … … 733 733 Alternately, just diagnose the paths specified by the binary files following 734 734 the procedure outlined above. 735 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id25936 50"></a>Samba-3 to Samba-3 Updates on the Same Server</h3></div></div></div><p>735 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2593645"></a>Samba-3 to Samba-3 Updates on the Same Server</h3></div></div></div><p> 736 736 The guidance in this section deals with updates to an existing 737 737 Samba-3 server installation. 738 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id25936 61"></a>Updating from Samba Versions Earlier than 3.0.5</h4></div></div></div><p>738 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2593656"></a>Updating from Samba Versions Earlier than 3.0.5</h4></div></div></div><p> 739 739 With the provision that the binary Samba-3 package has been built 740 740 with the same path and feature settings as the existing Samba-3 … … 743 743 and without need to change either the <code class="filename">smb.conf</code> file or, where 744 744 used, the LDAP schema. 745 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id25936 83"></a>Updating from Samba Versions between 3.0.6 and 3.0.10</h4></div></div></div><p>746 <a class="indexterm" name="id25936 92"></a>747 <a class="indexterm" name="id259369 9"></a>745 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2593679"></a>Updating from Samba Versions between 3.0.6 and 3.0.10</h4></div></div></div><p> 746 <a class="indexterm" name="id2593687"></a> 747 <a class="indexterm" name="id2593694"></a> 748 748 When updating versions of Samba-3 prior to 3.0.6 to 3.0.6 through 3.0.10, 749 749 it is necessary only to update the LDAP schema (where LDAP is used). … … 751 751 update. 752 752 </p><p> 753 <a class="indexterm" name="id259371 5"></a>754 <a class="indexterm" name="id25937 22"></a>755 <a class="indexterm" name="id259372 9"></a>753 <a class="indexterm" name="id2593710"></a> 754 <a class="indexterm" name="id2593717"></a> 755 <a class="indexterm" name="id2593724"></a> 756 756 Samba-3.0.6 introduced the ability to remember the last <span class="emphasis"><em>n</em></span> number 757 757 of passwords a user has used. This information will work only with … … 760 760 </p><p> 761 761 After updating the LDAP schema, do not forget to re-index the LDAP database. 762 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id25937 62"></a>Updating from Samba Versions after 3.0.6 to a Current Release</h4></div></div></div><p>763 <a class="indexterm" name="id25937 70"></a>762 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2593757"></a>Updating from Samba Versions after 3.0.6 to a Current Release</h4></div></div></div><p> 763 <a class="indexterm" name="id2593766"></a> 764 764 Samba-3.0.8 introduced changes in how the <em class="parameter"><code>username map</code></em> 765 765 behaves. It also included a change in behavior of <code class="literal">winbindd</code>. … … 767 767 from versions prior to 3.0.8 to a current version. 768 768 </p><p> 769 <a class="indexterm" name="id2593 802"></a>769 <a class="indexterm" name="id2593797"></a> 770 770 In Samba-3.0.11 a new privileges interface was implemented. Please 771 771 refer to <a class="link" href="happy.html#sbehap-ppc" title="Addition of Machines to the Domain">“Addition of Machines to the Domain”</a> for information regarding this new … … 789 789 back to searching the 'ldap suffix' in some cases. 790 790 </pre><p> 791 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id25938 53"></a>Migrating Samba-3 to a New Server</h3></div></div></div><p>791 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2593848"></a>Migrating Samba-3 to a New Server</h3></div></div></div><p> 792 792 The two most likely candidates for replacement of a server are 793 793 domain member servers and domain controllers. Each needs to be 794 794 handled slightly differently. 795 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id259386 5"></a>Replacing a Domain Member Server</h4></div></div></div><p>796 <a class="indexterm" name="id25938 73"></a>795 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2593860"></a>Replacing a Domain Member Server</h4></div></div></div><p> 796 <a class="indexterm" name="id2593868"></a> 797 797 Replacement of a domain member server should be done 798 798 using the same procedure as outlined in <a class="link" href="unixclients.html" title="Chapter 7. Adding Domain Member Servers and Clients">“Adding Domain Member Servers and Clients”</a>. … … 803 803 change its SID and will necessitate rejoining to the domain. 804 804 </p><p> 805 <a class="indexterm" name="id259389 9"></a>806 <a class="indexterm" name="id259390 5"></a>807 <a class="indexterm" name="id25939 12"></a>808 <a class="indexterm" name="id259391 9"></a>809 <a class="indexterm" name="id259392 6"></a>810 <a class="indexterm" name="id25939 32"></a>805 <a class="indexterm" name="id2593894"></a> 806 <a class="indexterm" name="id2593900"></a> 807 <a class="indexterm" name="id2593907"></a> 808 <a class="indexterm" name="id2593914"></a> 809 <a class="indexterm" name="id2593921"></a> 810 <a class="indexterm" name="id2593928"></a> 811 811 Following a change of hostname (NetBIOS name) it is a good idea on all servers 812 812 to shut down the Samba <code class="literal">smbd</code>, <code class="literal">nmbd</code>, and … … 818 818 change, but can persist for a longer period of time. 819 819 </p><p> 820 <a class="indexterm" name="id25939 80"></a>821 <a class="indexterm" name="id259398 6"></a>822 <a class="indexterm" name="id25939 93"></a>823 <a class="indexterm" name="id259 4000"></a>820 <a class="indexterm" name="id2593975"></a> 821 <a class="indexterm" name="id2593982"></a> 822 <a class="indexterm" name="id2593988"></a> 823 <a class="indexterm" name="id2593995"></a> 824 824 If the old domain member server had local accounts, it is necessary to create 825 825 on the new domain member server the same accounts with the same UID and GID … … 832 832 account entries to the new target server. 833 833 </p><p> 834 <a class="indexterm" name="id259404 8"></a>834 <a class="indexterm" name="id2594044"></a> 835 835 Where the user accounts for both UNIX and Samba are stored in LDAP, the new 836 836 target server must be configured to use the <code class="literal">nss_ldap</code> tool set. 837 837 This will automatically ensure that the appropriate user entities are 838 838 available on the new server. 839 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id259406 7"></a>Replacing a Domain Controller</h4></div></div></div><p>840 <a class="indexterm" name="id259407 5"></a>839 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2594062"></a>Replacing a Domain Controller</h4></div></div></div><p> 840 <a class="indexterm" name="id2594071"></a> 841 841 In the past, people who replaced a Windows NT4 domain controller typically 842 842 installed a new server, created printers and file shares on it, then migrate across … … 891 891 should correctly pick up the original SID and preserve all other settings. It is 892 892 sound advice to validate this before turning the system over to users. 893 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id259426 8"></a>Migration of Samba Accounts to Active Directory</h3></div></div></div><p>893 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2594263"></a>Migration of Samba Accounts to Active Directory</h3></div></div></div><p> 894 894 Yes, it works. The Windows ADMT tool can be used to migrate Samba accounts 895 895 to MS Active Directory. There are a few pitfalls to be aware of: 896 </p><div class="procedure"><a name="id25942 80"></a><p class="title"><b>Procedure 8.2. Migration to Active Directory</b></p><ol type="1"><li><p>896 </p><div class="procedure"><a name="id2594275"></a><p class="title"><b>Procedure 8.2. Migration to Active Directory</b></p><ol type="1"><li><p> 897 897 Administrator password must be THE SAME on the Samba server, 898 898 the 2003 ADS, and the local Administrator account on the workstations. … … 915 915 workstations won't be migrated to the new domain. 916 916 </p></li><li><p> 917 <a class="indexterm" name="id259434 6"></a>917 <a class="indexterm" name="id2594341"></a> 918 918 When migrating machines, always test first (using ADMT's test mode) 919 919 and satisfy all errors before committing the migration. Note that the … … 923 923 a test. 924 924 </p></li></ol></div><p> 925 <a class="indexterm" name="id25943 63"></a>925 <a class="indexterm" name="id2594358"></a> 926 926 There are some significant benefits of using the ADMT, besides just 927 927 migrating user accounts. ADMT can be found on the Windows 2003 CD.
Note:
See TracChangeset
for help on using the changeset viewer.
