- Timestamp:
- Jun 24, 2009, 5:09:21 PM (16 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
branches/samba-3.0/docs/htmldocs/Samba3-HOWTO/NetCommand.html
r158 r286 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 13. Remote and Local Management: The Net Command</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 3.2"><link rel="start" href="index.html" title="The Official Samba 3.2.x HOWTO and Reference Guide"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="prev" href="groupmapping.html" title="Chapter 12. Group Mapping: MS Windows and UNIX"><link rel="next" href="idmapper.html" title="Chapter 14. Identity Mapping (IDMAP)"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 13. Remote and Local Management: The Net Command</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="groupmapping.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="idmapper.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="NetCommand"></a>Chapter 13. Remote and Local Management: The Net Command</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Volker</span> <span class="surname">Lendecke</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:Volker.Lendecke@SerNet.DE">Volker.Lendecke@SerNet.DE</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Guenther</span> <span class="surname">Deschner</span></h3><div class="affiliation"><span class="orgname">SuSE<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:gd@suse.de">gd@suse.de</a>></code></p></div></div></div></div><div><p class="pubdate">May 9, 2005</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="NetCommand.html#id359824">Overview</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id360100">Administrative Tasks and Methods</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id360174">UNIX and Windows Group Management</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetCommand.html#id360324">Adding, Renaming, or Deletion of Group Accounts</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#grpmemshipchg">Manipulating Group Memberships</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#nestedgrpmgmgt">Nested Group Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="NetCommand.html#id361551">UNIX and Windows User Management</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetCommand.html#sbeuseraddn">Adding User Accounts</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id361746">Deletion of User Accounts</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id361791">Managing User Accounts</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id361853">User Mapping</a></span></dt></dl></dd><dt><span class="sect1"><a href="NetCommand.html#id361930">Administering User Rights and Privileges</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id362240">Managing Trust Relationships</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetCommand.html#id362252">Machine Trust Accounts</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id362590">Interdomain Trusts</a></span></dt></dl></dd><dt><span class="sect1"><a href="NetCommand.html#id362800">Managing Security Identifiers (SIDS)</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id363001">Share Management</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetCommand.html#id363043">Creating, Editing, and Removing Shares</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id363212">Creating and Changing Share ACLs</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id363239">Share, Directory, and File Migration</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id363774">Printer Migration</a></span></dt></dl></dd><dt><span class="sect1"><a href="NetCommand.html#id363992">Controlling Open Files</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id364009">Session and Connection Management</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id364068">Printers and ADS</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id364172">Manipulating the Samba Cache</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id364188">Managing IDMAP UID/SID Mappings</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetCommand.html#id364227">Creating an IDMAP Database Dump File</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id364258">Restoring the IDMAP Database Dump File</a></span></dt></dl></dd><dt><span class="sect1"><a href="NetCommand.html#netmisc1">Other Miscellaneous Operations</a></span></dt></dl></div><p>2 <a class="indexterm" name="id 359695"></a>3 <a class="indexterm" name="id 359702"></a>4 <a class="indexterm" name="id 359708"></a>5 <a class="indexterm" name="id 359715"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 13. Remote and Local Management: The Net Command</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.74.0"><link rel="home" href="index.html" title="The Official Samba 3.2.x HOWTO and Reference Guide"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="prev" href="groupmapping.html" title="Chapter 12. Group Mapping: MS Windows and UNIX"><link rel="next" href="idmapper.html" title="Chapter 14. Identity Mapping (IDMAP)"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 13. Remote and Local Management: The Net Command</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="groupmapping.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="idmapper.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="NetCommand"></a>Chapter 13. Remote and Local Management: The Net Command</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="orgname">Samba Team</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Volker</span> <span class="orgname">Samba Team</span> <span class="surname">Lendecke</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:Volker.Lendecke@SerNet.DE">Volker.Lendecke@SerNet.DE</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Guenther</span> <span class="orgname">SuSE</span> <span class="surname">Deschner</span></h3><div class="affiliation"><span class="orgname">SuSE<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:gd@suse.de">gd@suse.de</a>></code></p></div></div></div></div><div><p class="pubdate">May 9, 2005</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="NetCommand.html#id2598974">Overview</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id2599268">Administrative Tasks and Methods</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id2599349">UNIX and Windows Group Management</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetCommand.html#id2599508">Adding, Renaming, or Deletion of Group Accounts</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#grpmemshipchg">Manipulating Group Memberships</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#nestedgrpmgmgt">Nested Group Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="NetCommand.html#id2600870">UNIX and Windows User Management</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetCommand.html#sbeuseraddn">Adding User Accounts</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id2601082">Deletion of User Accounts</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id2601130">Managing User Accounts</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id2601198">User Mapping</a></span></dt></dl></dd><dt><span class="sect1"><a href="NetCommand.html#id2601282">Administering User Rights and Privileges</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id2601627">Managing Trust Relationships</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetCommand.html#id2601642">Machine Trust Accounts</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id2602011">Interdomain Trusts</a></span></dt></dl></dd><dt><span class="sect1"><a href="NetCommand.html#id2602245">Managing Security Identifiers (SIDS)</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id2602466">Share Management</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetCommand.html#id2602512">Creating, Editing, and Removing Shares</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id2602700">Creating and Changing Share ACLs</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id2602730">Share, Directory, and File Migration</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id2603353">Printer Migration</a></span></dt></dl></dd><dt><span class="sect1"><a href="NetCommand.html#id2603609">Controlling Open Files</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id2603628">Session and Connection Management</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id2603694">Printers and ADS</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id2603810">Manipulating the Samba Cache</a></span></dt><dt><span class="sect1"><a href="NetCommand.html#id2603827">Managing IDMAP UID/SID Mappings</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetCommand.html#id2603871">Creating an IDMAP Database Dump File</a></span></dt><dt><span class="sect2"><a href="NetCommand.html#id2603906">Restoring the IDMAP Database Dump File</a></span></dt></dl></dd><dt><span class="sect1"><a href="NetCommand.html#netmisc1">Other Miscellaneous Operations</a></span></dt></dl></div><p> 2 <a class="indexterm" name="id2598835"></a> 3 <a class="indexterm" name="id2598842"></a> 4 <a class="indexterm" name="id2598849"></a> 5 <a class="indexterm" name="id2598856"></a> 6 6 The <code class="literal">net</code> command is one of the new features of Samba-3 and is an attempt to provide a useful 7 7 tool for the majority of remote management operations necessary for common tasks. The <code class="literal">net</code> 8 8 tool is flexible by design and is intended for command-line use as well as for scripted control application. 9 9 </p><p> 10 <a class="indexterm" name="id 359739"></a>11 <a class="indexterm" name="id 359746"></a>12 <a class="indexterm" name="id 359752"></a>13 <a class="indexterm" name="id 359759"></a>10 <a class="indexterm" name="id2598882"></a> 11 <a class="indexterm" name="id2598888"></a> 12 <a class="indexterm" name="id2598896"></a> 13 <a class="indexterm" name="id2598902"></a> 14 14 Originally introduced with the intent to mimic the Microsoft Windows command that has the same name, the 15 15 <code class="literal">net</code> command has morphed into a very powerful instrument that has become an essential part … … 23 23 A Samba-3 administrator cannot afford to gloss over this chapter because to do so will almost certainly cause 24 24 the infliction of self-induced pain, agony, and desperation. Be warned: this is an important chapter. 25 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id 359824"></a>Overview</h2></div></div></div><p>26 <a class="indexterm" name="id 359831"></a>27 <a class="indexterm" name="id 359838"></a>28 <a class="indexterm" name="id 359845"></a>29 <a class="indexterm" name="id 359851"></a>30 <a class="indexterm" name="id 359858"></a>31 <a class="indexterm" name="id 359864"></a>25 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2598974"></a>Overview</h2></div></div></div><p> 26 <a class="indexterm" name="id2598982"></a> 27 <a class="indexterm" name="id2598988"></a> 28 <a class="indexterm" name="id2598995"></a> 29 <a class="indexterm" name="id2599002"></a> 30 <a class="indexterm" name="id2599008"></a> 31 <a class="indexterm" name="id2599015"></a> 32 32 The tasks that follow the installation of a Samba-3 server, whether standalone or domain member, of a 33 33 domain controller (PDC or BDC) begins with the need to create administrative rights. Of course, the … … 36 36 the central domain authentication backend. 37 37 </p><p> 38 <a class="indexterm" name="id 359878"></a>39 <a class="indexterm" name="id 359885"></a>40 <a class="indexterm" name="id 359892"></a>41 <a class="indexterm" name="id 359899"></a>42 <a class="indexterm" name="id 359906"></a>43 <a class="indexterm" name="id 359912"></a>44 <a class="indexterm" name="id 359919"></a>45 <a class="indexterm" name="id 359925"></a>38 <a class="indexterm" name="id2599033"></a> 39 <a class="indexterm" name="id2599040"></a> 40 <a class="indexterm" name="id2599046"></a> 41 <a class="indexterm" name="id2599053"></a> 42 <a class="indexterm" name="id2599060"></a> 43 <a class="indexterm" name="id2599067"></a> 44 <a class="indexterm" name="id2599073"></a> 45 <a class="indexterm" name="id2599080"></a> 46 46 Regardless of the type of server being installed, local UNIX groups must be mapped to the Windows 47 47 networking domain global group accounts. Do you ask why? Because Samba always limits its access to … … 51 51 Samba. Such mappings are implemented using the <code class="literal">net</code> command. 52 52 </p><p> 53 <a class="indexterm" name="id 359946"></a>54 <a class="indexterm" name="id 359952"></a>55 <a class="indexterm" name="id 359959"></a>56 <a class="indexterm" name="id 359965"></a>57 <a class="indexterm" name="id 359972"></a>58 <a class="indexterm" name="id 359979"></a>59 <a class="indexterm" name="id 359986"></a>53 <a class="indexterm" name="id2599105"></a> 54 <a class="indexterm" name="id2599112"></a> 55 <a class="indexterm" name="id2599118"></a> 56 <a class="indexterm" name="id2599125"></a> 57 <a class="indexterm" name="id2599132"></a> 58 <a class="indexterm" name="id2599139"></a> 59 <a class="indexterm" name="id2599146"></a> 60 60 UNIX systems that are hosting a Samba-3 server that is running as a member (PDC, BDC, or DMS) must have 61 61 a machine security account in the domain authentication database (or directory). The creation of such 62 62 security (or trust) accounts is also handled using the <code class="literal">net</code> command. 63 63 </p><p> 64 <a class="indexterm" name="id 360004"></a>65 <a class="indexterm" name="id 360010"></a>66 <a class="indexterm" name="id 360017"></a>67 <a class="indexterm" name="id 360024"></a>68 <a class="indexterm" name="id 360030"></a>69 <a class="indexterm" name="id 360037"></a>70 <a class="indexterm" name="id 360044"></a>71 <a class="indexterm" name="id 360051"></a>72 <a class="indexterm" name="id 360058"></a>64 <a class="indexterm" name="id2599166"></a> 65 <a class="indexterm" name="id2599172"></a> 66 <a class="indexterm" name="id2599179"></a> 67 <a class="indexterm" name="id2599186"></a> 68 <a class="indexterm" name="id2599193"></a> 69 <a class="indexterm" name="id2599200"></a> 70 <a class="indexterm" name="id2599207"></a> 71 <a class="indexterm" name="id2599214"></a> 72 <a class="indexterm" name="id2599221"></a> 73 73 The establishment of interdomain trusts is achieved using the <code class="literal">net</code> command also, as 74 74 may a plethora of typical administrative duties such as user management, group management, share and 75 75 printer management, file and printer migration, security identifier management, and so on. 76 76 </p><p> 77 <a class="indexterm" name="id 360076"></a>78 <a class="indexterm" name="id 360082"></a>77 <a class="indexterm" name="id2599241"></a> 78 <a class="indexterm" name="id2599248"></a> 79 79 The overall picture should be clear now: the <code class="literal">net</code> command plays a central role 80 80 on the Samba-3 stage. This role will continue to be developed. The inclusion of this chapter is 81 81 evidence of its importance, one that has grown in complexity to the point that it is no longer considered 82 82 prudent to cover its use fully in the online UNIX man pages. 83 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id 360100"></a>Administrative Tasks and Methods</h2></div></div></div><p>84 <a class="indexterm" name="id 360108"></a>85 <a class="indexterm" name="id 360114"></a>86 <a class="indexterm" name="id 360121"></a>87 <a class="indexterm" name="id 360130"></a>83 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2599268"></a>Administrative Tasks and Methods</h2></div></div></div><p> 84 <a class="indexterm" name="id2599276"></a> 85 <a class="indexterm" name="id2599283"></a> 86 <a class="indexterm" name="id2599289"></a> 87 <a class="indexterm" name="id2599299"></a> 88 88 The basic operations of the <code class="literal">net</code> command are documented here. This documentation is not 89 89 exhaustive, and thus it is incomplete. Since the primary focus is on migration from Windows servers to a Samba … … 95 95 <code class="constant">rap</code> modes. Please refer to the man page for a more comprehensive overview of the 96 96 capabilities of this utility. 97 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id 360174"></a>UNIX and Windows Group Management</h2></div></div></div><p>98 <a class="indexterm" name="id 360182"></a>99 <a class="indexterm" name="id 360189"></a>100 <a class="indexterm" name="id 360198"></a>101 <a class="indexterm" name="id 360206"></a>102 <a class="indexterm" name="id 360215"></a>97 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2599349"></a>UNIX and Windows Group Management</h2></div></div></div><p> 98 <a class="indexterm" name="id2599357"></a> 99 <a class="indexterm" name="id2599364"></a> 100 <a class="indexterm" name="id2599373"></a> 101 <a class="indexterm" name="id2599382"></a> 102 <a class="indexterm" name="id2599390"></a> 103 103 As stated, the focus in most of this chapter is on use of the <code class="literal">net rpc</code> family of 104 104 operations that are supported by Samba. Most of them are supported by the <code class="literal">net ads</code> … … 107 107 earlier SMB servers. 108 108 </p><p> 109 <a class="indexterm" name="id 360246"></a>110 <a class="indexterm" name="id 360252"></a>111 <a class="indexterm" name="id 360259"></a>109 <a class="indexterm" name="id2599424"></a> 110 <a class="indexterm" name="id2599430"></a> 111 <a class="indexterm" name="id2599437"></a> 112 112 Samba's <code class="literal">net</code> tool implements sufficient capability to permit all common administrative 113 113 tasks to be completed from the command line. In this section each of the essential user and group management 114 114 facilities are explored. 115 115 </p><p> 116 <a class="indexterm" name="id 360276"></a>117 <a class="indexterm" name="id 360283"></a>118 <a class="indexterm" name="id 360292"></a>119 <a class="indexterm" name="id 360302"></a>116 <a class="indexterm" name="id2599457"></a> 117 <a class="indexterm" name="id2599463"></a> 118 <a class="indexterm" name="id2599473"></a> 119 <a class="indexterm" name="id2599482"></a> 120 120 Samba-3 recognizes two types of groups: <span class="emphasis"><em>domain groups</em></span> and <span class="emphasis"><em>local 121 121 groups</em></span>. Domain groups can contain (have as members) only domain user accounts. Local groups … … 124 124 The purpose of a local group is to permit file permission to be set for a group account that, like the 125 125 usual UNIX/Linux group, is persistent across redeployment of a Windows file server. 126 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 360324"></a>Adding, Renaming, or Deletion of Group Accounts</h3></div></div></div><p>126 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2599508"></a>Adding, Renaming, or Deletion of Group Accounts</h3></div></div></div><p> 127 127 Samba provides file and print services to Windows clients. The file system resources it makes available 128 128 to the Windows environment must, of necessity, be provided in a manner that is compatible with the … … 144 144 show how UNIX group members automatically pass-through to Windows group membership as soon as a logical 145 145 mapping has been created. 146 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id 360352"></a>Adding or Creating a New Group</h4></div></div></div><p>146 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2599550"></a>Adding or Creating a New Group</h4></div></div></div><p> 147 147 Before attempting to add a Windows group account, the currently available groups can be listed as shown 148 148 here: 149 <a class="indexterm" name="id 360361"></a>150 <a class="indexterm" name="id 360372"></a>149 <a class="indexterm" name="id2599560"></a> 150 <a class="indexterm" name="id2599571"></a> 151 151 </p><pre class="screen"> 152 152 <code class="prompt">root# </code> net rpc group list -Uroot%not24get … … 164 164 A Windows group account called “<span class="quote">SupportEngrs</span>” can be added by executing the following 165 165 command: 166 <a class="indexterm" name="id 360406"></a>166 <a class="indexterm" name="id2599607"></a> 167 167 </p><pre class="screen"> 168 168 <code class="prompt">root# </code> net rpc group add "SupportEngrs" -Uroot%not24get … … 184 184 </pre><p> 185 185 </p><p> 186 <a class="indexterm" name="id 360446"></a>187 <a class="indexterm" name="id 360453"></a>188 <a class="indexterm" name="id 360460"></a>186 <a class="indexterm" name="id2599650"></a> 187 <a class="indexterm" name="id2599657"></a> 188 <a class="indexterm" name="id2599664"></a> 189 189 The following demonstrates that the POSIX (UNIX/Linux system account) group has been created by calling 190 the <a class="link" href="smb.conf.5.html#ADDGROUPSCRIPT" >add group script = /opt/IDEALX/sbin/smbldap-groupadd -p "%g"</a> interface190 the <a class="link" href="smb.conf.5.html#ADDGROUPSCRIPT" target="_top">add group script = /opt/IDEALX/sbin/smbldap-groupadd -p "%g"</a> interface 191 191 script: 192 192 </p><pre class="screen"> … … 206 206 results in immediate mapping of the POSIX group that has been created to the Windows group account as shown 207 207 here: 208 <a class="indexterm" name="id 360499"></a>208 <a class="indexterm" name="id2599710"></a> 209 209 </p><pre class="screen"> 210 210 <code class="prompt">root# </code> net groupmap list … … 219 219 SupportEngrs (S-1-5-21-72630-4128915-11681869-3007) -> SupportEngrs 220 220 </pre><p> 221 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id 360532"></a>Mapping Windows Groups to UNIX Groups</h4></div></div></div><p>222 <a class="indexterm" name="id 360540"></a>223 <a class="indexterm" name="id 360547"></a>224 <a class="indexterm" name="id 360554"></a>225 <a class="indexterm" name="id 360560"></a>221 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2599751"></a>Mapping Windows Groups to UNIX Groups</h4></div></div></div><p> 222 <a class="indexterm" name="id2599759"></a> 223 <a class="indexterm" name="id2599766"></a> 224 <a class="indexterm" name="id2599773"></a> 225 <a class="indexterm" name="id2599780"></a> 226 226 Windows groups must be mapped to UNIX system (POSIX) groups so that file system access controls 227 227 can be asserted in a manner that is consistent with the methods appropriate to the operating 228 228 system that is hosting the Samba server. 229 229 </p><p> 230 <a class="indexterm" name="id 360572"></a>231 <a class="indexterm" name="id 360579"></a>232 <a class="indexterm" name="id 360586"></a>233 <a class="indexterm" name="id 360592"></a>230 <a class="indexterm" name="id2599794"></a> 231 <a class="indexterm" name="id2599801"></a> 232 <a class="indexterm" name="id2599807"></a> 233 <a class="indexterm" name="id2599814"></a> 234 234 All file system (file and directory) access controls, within the file system of a UNIX/Linux server that is 235 235 hosting a Samba server, are implemented using a UID/GID identity tuple. Samba does not in any way override … … 239 239 command does not call any RPC-functions here but directly accesses the passdb. 240 240 </p><p> 241 <a class="indexterm" name="id 360613"></a>242 <a class="indexterm" name="id 360620"></a>243 <a class="indexterm" name="id 360627"></a>244 <a class="indexterm" name="id 360633"></a>245 <a class="indexterm" name="id 360640"></a>246 <a class="indexterm" name="id 360647"></a>247 <a class="indexterm" name="id 360654"></a>241 <a class="indexterm" name="id2599839"></a> 242 <a class="indexterm" name="id2599846"></a> 243 <a class="indexterm" name="id2599853"></a> 244 <a class="indexterm" name="id2599860"></a> 245 <a class="indexterm" name="id2599867"></a> 246 <a class="indexterm" name="id2599874"></a> 247 <a class="indexterm" name="id2599881"></a> 248 248 Samba depends on default mappings for the <code class="constant">Domain Admins, Domain Users</code>, and 249 249 <code class="constant">Domain Guests</code> global groups. Additional groups may be added as shown in the … … 252 252 of creation of the mapping. 253 253 </p><p> 254 <a class="indexterm" name="id 360674"></a>255 <a class="indexterm" name="id 360686"></a>256 <a class="indexterm" name="id 360697"></a>254 <a class="indexterm" name="id2599904"></a> 255 <a class="indexterm" name="id2599916"></a> 256 <a class="indexterm" name="id2599927"></a> 257 257 The operations that are permitted include: <code class="constant">add</code>, <code class="constant">modify</code>, 258 258 and <code class="constant">delete</code>. An example of each operation is shown here. … … 291 291 treated as local to the individual Samba server. Local groups can be used with Samba to enable multiple 292 292 nested group support. 293 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id 360813"></a>Deleting a Group Account</h4></div></div></div><p>294 <a class="indexterm" name="id 360821"></a>293 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2600059"></a>Deleting a Group Account</h4></div></div></div><p> 294 <a class="indexterm" name="id2600067"></a> 295 295 A group account may be deleted by executing the following command: 296 296 </p><pre class="screen"> … … 299 299 </p><p> 300 300 Validation of the deletion is advisable. The same commands may be executed as shown above. 301 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id 360851"></a>Rename Group Accounts</h4></div></div></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>301 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2600099"></a>Rename Group Accounts</h4></div></div></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 302 302 This command is not documented in the man pages; it is implemented in the source code, but it does not 303 303 work at this time. The example given documents, from the source code, how it should work. Watch the … … 307 307 demands can be if this simple request is ignored. The following command demonstrates how the Windows group 308 308 “<span class="quote">SupportEngrs</span>” can be renamed to “<span class="quote">CustomerSupport</span>”: 309 <a class="indexterm" name="id 360874"></a>309 <a class="indexterm" name="id2600128"></a> 310 310 </p><pre class="screen"> 311 311 <code class="prompt">root# </code> net rpc group rename SupportEngrs \ … … 350 350 group mapping, a member of the Windows group, an attempt to add this account again should fail. This is 351 351 demonstrated here: 352 <a class="indexterm" name="id 360986"></a>352 <a class="indexterm" name="id2600259"></a> 353 353 </p><pre class="screen"> 354 354 <code class="prompt">root# </code> net rpc group addmem "MIDEARTH\Engineers" ajt -Uroot%not24get … … 360 360 To permit the user <code class="constant">ajt</code> to be added using the <code class="literal">net rpc group</code> utility, 361 361 this account must first be removed. The removal and confirmation of its effect is shown here: 362 <a class="indexterm" name="id 361024"></a>362 <a class="indexterm" name="id2600301"></a> 363 363 </p><pre class="screen"> 364 364 <code class="prompt">root# </code> net rpc group delmem "MIDEARTH\Engineers" ajt -Uroot%not24get … … 384 384 the <code class="literal">net rpc group</code> utility. Note the this contents of the UNIX/Linux group was shown 385 385 four paragraphs earlier. The Windows (domain) group membership is shown here: 386 <a class="indexterm" name="id 361114"></a>386 <a class="indexterm" name="id2600398"></a> 387 387 </p><pre class="screen"> 388 388 <code class="prompt">root# </code> net rpc group members "Domain Users" -Uroot%not24get … … 441 441 <code class="prompt">root# </code> net rpc group delmem demo "DOM\jht" -Uroot%not24get 442 442 </pre><p> 443 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id 361277"></a>Managing Nest Groups on Workstations from the Samba Server</h4></div></div></div><p>443 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2600578"></a>Managing Nest Groups on Workstations from the Samba Server</h4></div></div></div><p> 444 444 Windows network administrators often ask on the Samba mailing list how it is possible to grant everyone 445 445 administrative rights on their own workstation. This is of course a very bad practice, but commonly done 446 446 to avoid user complaints. Here is how it can be done remotely from a Samba PDC or BDC: 447 <a class="indexterm" name="id 361288"></a>447 <a class="indexterm" name="id2600592"></a> 448 448 </p><pre class="screen"> 449 449 <code class="prompt">root# </code> net rpc group addmem "Administrators" "Domain Users" \ … … 453 453 This can be scripted, and can therefore be performed as a user logs onto the domain from a Windows 454 454 workstation. Here is a simple example that shows how this can be done. 455 </p><div class="procedure"><a name="id 361317"></a><p class="title"><b>Procedure 13.1. Automating User Addition to the Workstation Power Users Group</b></p><div class="example"><a name="autopoweruserscript"></a><p class="title"><b>Example 13.1. Script to Auto-add Domain Users to Workstation Power Users Group</b></p><div class="example-contents"><pre class="screen">455 </p><div class="procedure"><a name="id2600624"></a><p class="title"><b>Procedure 13.1. Automating User Addition to the Workstation Power Users Group</b></p><div class="example"><a name="autopoweruserscript"></a><p class="title"><b>Example 13.1. Script to Auto-add Domain Users to Workstation Power Users Group</b></p><div class="example-contents"><pre class="screen"> 456 456 #!/bin/bash 457 457 … … 460 460 461 461 exit 0 462 </pre></div></div><br class="example-break"><div class="example"><a name="magicnetlogon"></a><p class="title"><b>Example 13.2. A Magic Netlogon Share</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id 361466"></a><em class="parameter"><code>comment = Netlogon Share</code></em></td></tr><tr><td><a class="indexterm" name="id361477"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id361489"></a><em class="parameter"><code>root preexec = /etc/samba/scripts/autopoweruser.sh %U %m</code></em></td></tr><tr><td><a class="indexterm" name="id361501"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id361512"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr></table></div></div><br class="example-break"><ol type="1"><li><p>462 </pre></div></div><br class="example-break"><div class="example"><a name="magicnetlogon"></a><p class="title"><b>Example 13.2. A Magic Netlogon Share</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2600779"></a><em class="parameter"><code>comment = Netlogon Share</code></em></td></tr><tr><td><a class="indexterm" name="id2600791"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2600803"></a><em class="parameter"><code>root preexec = /etc/samba/scripts/autopoweruser.sh %U %m</code></em></td></tr><tr><td><a class="indexterm" name="id2600815"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2600826"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr></table></div></div><br class="example-break"><ol type="1"><li><p> 463 463 Create the script shown in <a class="link" href="NetCommand.html#autopoweruserscript" title="Example 13.1. Script to Auto-add Domain Users to Workstation Power Users Group">“Script to Auto-add Domain Users to Workstation Power Users Group”</a> and locate it in 464 464 the directory <code class="filename">/etc/samba/scripts</code>, named as <code class="filename">autopoweruser.sh</code>. 465 <a class="indexterm" name="id 361348"></a>466 <a class="indexterm" name="id 361359"></a>467 <a class="indexterm" name="id 361366"></a>465 <a class="indexterm" name="id2600655"></a> 466 <a class="indexterm" name="id2600667"></a> 467 <a class="indexterm" name="id2600674"></a> 468 468 </p></li><li><p> 469 469 Set the permissions on this script to permit it to be executed as part of the logon process: … … 485 485 for the use of this method is that it will guarantee that all users have appropriate rights on 486 486 the workstation. 487 </p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id 361551"></a>UNIX and Windows User Management</h2></div></div></div><p>488 <a class="indexterm" name="id 361559"></a>489 <a class="indexterm" name="id 361565"></a>490 <a class="indexterm" name="id 361572"></a>491 <a class="indexterm" name="id 361578"></a>492 <a class="indexterm" name="id 361585"></a>493 <a class="indexterm" name="id 361592"></a>494 <a class="indexterm" name="id 361599"></a>495 <a class="indexterm" name="id 361606"></a>487 </p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2600870"></a>UNIX and Windows User Management</h2></div></div></div><p> 488 <a class="indexterm" name="id2600878"></a> 489 <a class="indexterm" name="id2600885"></a> 490 <a class="indexterm" name="id2600892"></a> 491 <a class="indexterm" name="id2600898"></a> 492 <a class="indexterm" name="id2600905"></a> 493 <a class="indexterm" name="id2600912"></a> 494 <a class="indexterm" name="id2600919"></a> 495 <a class="indexterm" name="id2600926"></a> 496 496 Every Windows network user account must be translated to a UNIX/Linux user account. In actual fact, 497 497 the only account information the UNIX/Linux Samba server needs is a UID. The UID is available either … … 500 500 particular user will be allocated by <code class="literal">winbindd</code>. 501 501 </p><p> 502 Although this is not the appropriate place to discuss the <a class="link" href="smb.conf.5.html#USERNAMEMAP" >username map</a> facility,502 Although this is not the appropriate place to discuss the <a class="link" href="smb.conf.5.html#USERNAMEMAP" target="_top">username map</a> facility, 503 503 this interface is an important method of mapping a Windows user account to a UNIX account that has a 504 504 different name. Refer to the man page for the <code class="filename">smb.conf</code> file for more information regarding this … … 517 517 </p><p> 518 518 The following demonstrates the addition of an account to the server <code class="constant">FRODO</code>: 519 <a class="indexterm" name="id 361691"></a>520 <a class="indexterm" name="id 361702"></a>519 <a class="indexterm" name="id2601024"></a> 520 <a class="indexterm" name="id2601035"></a> 521 521 </p><pre class="screen"> 522 522 <code class="prompt">root# </code> net rpc user add jacko -S FRODO -Uroot%not24get … … 529 529 -S FRODO -Uroot%not24get 530 530 </pre><p> 531 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 361746"></a>Deletion of User Accounts</h3></div></div></div><p>531 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2601082"></a>Deletion of User Accounts</h3></div></div></div><p> 532 532 Deletion of a user account can be done using the following syntax: 533 533 </p><pre class="screen"> … … 535 535 </pre><p> 536 536 The following command will delete the user account <code class="constant">jacko</code>: 537 <a class="indexterm" name="id 361766"></a>537 <a class="indexterm" name="id2601104"></a> 538 538 </p><pre class="screen"> 539 539 <code class="prompt">root# </code> net rpc user delete jacko -Uroot%not24get 540 540 Deleted user account 541 541 </pre><p> 542 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 361791"></a>Managing User Accounts</h3></div></div></div><p>542 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2601130"></a>Managing User Accounts</h3></div></div></div><p> 543 543 Two basic user account operations are routinely used: change of password and querying which groups a user 544 544 is a member of. The change of password operation is shown in <a class="link" href="NetCommand.html#sbeuseraddn" title="Adding User Accounts">“Adding User Accounts”</a>. … … 546 546 The ability to query Windows group membership can be essential. Here is how a remote server may be 547 547 interrogated to find which groups a user is a member of: 548 <a class="indexterm" name="id 361811"></a>548 <a class="indexterm" name="id2601153"></a> 549 549 </p><pre class="screen"> 550 550 <code class="prompt">root# </code> net rpc user info jacko -S SAURON -Uroot%not24get … … 559 559 </p><p> 560 560 It is also possible to rename user accounts: 561 <a class="indexterm" name="id 361838"></a>oldusername newusername561 <a class="indexterm" name="id2601182"></a>oldusername newusername 562 562 Note that this operation does not yet work against Samba Servers. It is, however, possible to rename useraccounts on 563 563 Windows Servers. 564 564 565 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 361853"></a>User Mapping</h3></div></div></div><p>566 <a class="indexterm" name="id 361860"></a>567 <a class="indexterm" name="id 361867"></a>568 <a class="indexterm" name="id 361874"></a>565 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2601198"></a>User Mapping</h3></div></div></div><p> 566 <a class="indexterm" name="id2601206"></a> 567 <a class="indexterm" name="id2601213"></a> 568 <a class="indexterm" name="id2601220"></a> 569 569 In some situations it is unavoidable that a user's Windows logon name will differ from the login ID 570 570 that user has on the Samba server. It is possible to create a special file on the Samba server that … … 582 582 <code class="constant">parsonsw</code>, and the Windows user account “<span class="quote">geeringm</span>” will be mapped to the 583 583 UNIX user <code class="constant">marygee</code>. 584 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id 361930"></a>Administering User Rights and Privileges</h2></div></div></div><p>585 <a class="indexterm" name="id 361938"></a>586 <a class="indexterm" name="id 361945"></a>587 <a class="indexterm" name="id 361952"></a>588 <a class="indexterm" name="id 361959"></a>589 <a class="indexterm" name="id 361966"></a>584 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2601282"></a>Administering User Rights and Privileges</h2></div></div></div><p> 585 <a class="indexterm" name="id2601290"></a> 586 <a class="indexterm" name="id2601297"></a> 587 <a class="indexterm" name="id2601304"></a> 588 <a class="indexterm" name="id2601311"></a> 589 <a class="indexterm" name="id2601318"></a> 590 590 With all versions of Samba earlier than 3.0.11 the only account on a Samba server that could 591 591 manage users, groups, shares, printers, and such was the <code class="constant">root</code> account. This caused … … 593 593 credentials for the most security-sensitive account on a UNIX/Linux system. 594 594 </p><p> 595 <a class="indexterm" name="id 361982"></a>596 <a class="indexterm" name="id 361989"></a>597 <a class="indexterm" name="id 361996"></a>598 <a class="indexterm" name="id 362003"></a>599 <a class="indexterm" name="id 362010"></a>595 <a class="indexterm" name="id2601337"></a> 596 <a class="indexterm" name="id2601344"></a> 597 <a class="indexterm" name="id2601351"></a> 598 <a class="indexterm" name="id2601358"></a> 599 <a class="indexterm" name="id2601365"></a> 600 600 New to Samba version 3.0.11 is the ability to delegate administrative privileges as necessary to either 601 601 a normal user or to groups of users. The significance of the administrative privileges is documented … … 633 633 The <code class="literal">net</code> command can be used to obtain the currently supported capabilities for rights 634 634 and privileges using this method: 635 <a class="indexterm" name="id 362073"></a>636 <a class="indexterm" name="id 362080"></a>637 <a class="indexterm" name="id 362087"></a>638 <a class="indexterm" name="id 362094"></a>639 <a class="indexterm" name="id 362100"></a>640 <a class="indexterm" name="id 362107"></a>641 <a class="indexterm" name="id 362114"></a>642 <a class="indexterm" name="id 362121"></a>643 <a class="indexterm" name="id 362128"></a>635 <a class="indexterm" name="id2601439"></a> 636 <a class="indexterm" name="id2601446"></a> 637 <a class="indexterm" name="id2601453"></a> 638 <a class="indexterm" name="id2601460"></a> 639 <a class="indexterm" name="id2601467"></a> 640 <a class="indexterm" name="id2601474"></a> 641 <a class="indexterm" name="id2601481"></a> 642 <a class="indexterm" name="id2601488"></a> 643 <a class="indexterm" name="id2601495"></a> 644 644 </p><pre class="screen"> 645 645 <code class="prompt">root# </code> net rpc rights list -U root%not24get … … 660 660 idea since members of this group are generally expected to be all-powerful. This assignment makes that 661 661 the reality: 662 <a class="indexterm" name="id 362165"></a>662 <a class="indexterm" name="id2601541"></a> 663 663 </p><pre class="screen"> 664 664 <code class="prompt">root# </code> net rpc rights grant "MIDEARTH\Domain Admins" \ … … 679 679 </p><p> 680 680 The following step permits validation of the changes just made: 681 <a class="indexterm" name="id 362211"></a>681 <a class="indexterm" name="id2601592"></a> 682 682 </p><pre class="screen"> 683 683 <code class="prompt">root# </code> net rpc rights list accounts -U root%not24get … … 713 713 SeDiskOperatorPrivilege 714 714 </pre><p> 715 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id 362240"></a>Managing Trust Relationships</h2></div></div></div><p>715 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2601627"></a>Managing Trust Relationships</h2></div></div></div><p> 716 716 There are essentially two types of trust relationships: the first is between domain controllers and domain 717 717 member machines (network clients), the second is between domains (called interdomain trusts). All 718 718 Samba servers that participate in domain security require a domain membership trust account, as do like 719 719 Windows NT/200x/XP workstations. 720 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 362252"></a>Machine Trust Accounts</h3></div></div></div><p>720 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2601642"></a>Machine Trust Accounts</h3></div></div></div><p> 721 721 The net command looks in the <code class="filename">smb.conf</code> file to obtain its own configuration settings. Thus, the following 722 722 command 'knows' which domain to join from the <code class="filename">smb.conf</code> file. 723 723 </p><p> 724 724 A Samba server domain trust account can be validated as shown in this example: 725 <a class="indexterm" name="id 362277"></a>725 <a class="indexterm" name="id2601669"></a> 726 726 </p><pre class="screen"> 727 727 <code class="prompt">root# </code> net rpc testjoin … … 736 736 </p><p> 737 737 The equivalent command for joining a Samba server to a Windows ADS domain is shown here: 738 <a class="indexterm" name="id 362312"></a>738 <a class="indexterm" name="id2601706"></a> 739 739 </p><pre class="screen"> 740 740 <code class="prompt">root# </code> net ads testjoin … … 751 751 The following demonstrates the process of creating a machine trust account in the target domain for the 752 752 Samba server from which the command is executed: 753 <a class="indexterm" name="id 362353"></a>753 <a class="indexterm" name="id2601752"></a> 754 754 </p><pre class="screen"> 755 755 <code class="prompt">root# </code> net rpc join -S FRODO -Uroot%not24get … … 766 766 purely as a workstation, in which case the S is replaced with a W (indicating a workstation account). The 767 767 following command can be used to affect this: 768 <a class="indexterm" name="id 362392"></a>768 <a class="indexterm" name="id2601796"></a> 769 769 </p><pre class="screen"> 770 770 <code class="prompt">root# </code> net rpc join member -S FRODO -Uroot%not24get … … 774 774 the type is deduced from the <code class="filename">smb.conf</code> file configuration. To specifically join as a PDC or BDC, the 775 775 command-line parameter will be <code class="constant">[PDC | BDC]</code>. For example: 776 <a class="indexterm" name="id 362429"></a>776 <a class="indexterm" name="id2601836"></a> 777 777 </p><pre class="screen"> 778 778 <code class="prompt">root# </code> net rpc join bdc -S FRODO -Uroot%not24get … … 782 782 </p><p> 783 783 The command to join a Samba server to a Windows ADS domain is shown here: 784 <a class="indexterm" name="id 362463"></a>784 <a class="indexterm" name="id2601872"></a> 785 785 </p><pre class="screen"> 786 786 <code class="prompt">root# </code> net ads join -UAdministrator%not24get … … 793 793 either. Inactive domain member accounts can be removed using any convenient tool. If necessary, the 794 794 machine account can be removed using the following <code class="literal">net</code> command: 795 <a class="indexterm" name="id 362499"></a>795 <a class="indexterm" name="id2601912"></a> 796 796 </p><pre class="screen"> 797 797 <code class="prompt">root# </code> net rpc user delete HERRING\$ -Uroot%not24get … … 803 803 A Samba-3 server that is a Windows ADS domain member can execute the following command to detach from the 804 804 domain: 805 <a class="indexterm" name="id 362528"></a>805 <a class="indexterm" name="id2601944"></a> 806 806 </p><pre class="screen"> 807 807 <code class="prompt">root# </code> net ads leave … … 810 810 Detailed information regarding an ADS domain can be obtained by a Samba DMS machine by executing the 811 811 following: 812 <a class="indexterm" name="id 362554"></a>812 <a class="indexterm" name="id2601972"></a> 813 813 </p><pre class="screen"> 814 814 <code class="prompt">root# </code> net ads status … … 817 817 Chapter 7 for more information regarding its use. This book may be obtained either in print or online from 818 818 the <a class="ulink" href="http://www.samba.org/samba/docs/Samba3-ByExample.pdf" target="_top">Samba-3 by Example</a>. 819 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 362590"></a>Interdomain Trusts</h3></div></div></div><p>819 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2602011"></a>Interdomain Trusts</h3></div></div></div><p> 820 820 Interdomain trust relationships form the primary mechanism by which users from one domain can be granted 821 821 access rights and privileges in another domain. 822 822 </p><p> 823 823 To discover what trust relationships are in effect, execute this command: 824 <a class="indexterm" name="id 362604"></a>824 <a class="indexterm" name="id2602026"></a> 825 825 </p><pre class="screen"> 826 826 <code class="prompt">root# </code> net rpc trustdom list -Uroot%not24get … … 838 838 create a trusted connection with this account. That means that the foreign domain is being trusted 839 839 to access resources in the local domain. This command creates the local trust account: 840 <a class="indexterm" name="id 362633"></a>840 <a class="indexterm" name="id2602060"></a> 841 841 </p><pre class="screen"> 842 842 <code class="prompt">root# </code> net rpc trustdom add DAMNATION f00db4r -Uroot%not24get … … 851 851 </p><p> 852 852 If the trusting domain is not capable of being reached, the following command will fail: 853 <a class="indexterm" name="id 362680"></a>853 <a class="indexterm" name="id2602111"></a> 854 854 </p><pre class="screen"> 855 855 <code class="prompt">root# </code> net rpc trustdom list -Uroot%not24get … … 877 877 the foreign account. In the process it creates a one-way trust to the resources on the remote domain. This 878 878 command achieves the objective of joining the trust relationship: 879 <a class="indexterm" name="id 362718"></a>879 <a class="indexterm" name="id2602155"></a> 880 880 </p><pre class="screen"> 881 881 <code class="prompt">root# </code> net rpc trustdom establish DAMNATION … … 898 898 Sometimes it is necessary to remove the ability for local users to access a foreign domain. The trusting 899 899 connection can be revoked as shown here: 900 <a class="indexterm" name="id 362760"></a>900 <a class="indexterm" name="id2602202"></a> 901 901 </p><pre class="screen"> 902 902 <code class="prompt">root# </code> net rpc trustdom revoke DAMNATION -Uroot%not24get … … 908 908 </pre><p> 909 909 910 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id 362800"></a>Managing Security Identifiers (SIDS)</h2></div></div></div><p>911 <a class="indexterm" name="id 362807"></a>912 <a class="indexterm" name="id 362814"></a>913 <a class="indexterm" name="id 362821"></a>914 <a class="indexterm" name="id 362828"></a>915 <a class="indexterm" name="id 362834"></a>910 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2602245"></a>Managing Security Identifiers (SIDS)</h2></div></div></div><p> 911 <a class="indexterm" name="id2602253"></a> 912 <a class="indexterm" name="id2602260"></a> 913 <a class="indexterm" name="id2602266"></a> 914 <a class="indexterm" name="id2602273"></a> 915 <a class="indexterm" name="id2602280"></a> 916 916 The basic security identifier that is used by all Windows networking operations is the Windows security 917 917 identifier (SID). All Windows network machines (servers and workstations), users, and groups are … … 919 919 are specific to the SID of the domain to which the user belongs. 920 920 </p><p> 921 <a class="indexterm" name="id 362848"></a>922 <a class="indexterm" name="id 362854"></a>923 <a class="indexterm" name="id 362861"></a>924 <a class="indexterm" name="id 362868"></a>921 <a class="indexterm" name="id2602297"></a> 922 <a class="indexterm" name="id2602303"></a> 923 <a class="indexterm" name="id2602310"></a> 924 <a class="indexterm" name="id2602317"></a> 925 925 It is truly prudent to store the machine and/or domain SID in a file for safekeeping. Why? Because 926 926 a change in hostname or in the domain (workgroup) name may result in a change in the SID. When you … … 930 930 First, do not forget to store the local SID in a file. It is a good idea to put this in the directory 931 931 in which the <code class="filename">smb.conf</code> file is also stored. Here is a simple action to achieve this: 932 <a class="indexterm" name="id 362889"></a>932 <a class="indexterm" name="id2602343"></a> 933 933 </p><pre class="screen"> 934 934 <code class="prompt">root# </code> net getlocalsid > /etc/samba/my-sid … … 946 946 file, simply copy the SID (the string of characters that begins with <code class="constant">S-1-5-21</code>) to 947 947 the command line shown here: 948 <a class="indexterm" name="id 362946"></a>948 <a class="indexterm" name="id2602405"></a> 949 949 </p><pre class="screen"> 950 950 <code class="prompt">root# </code> net setlocalsid S-1-5-21-1385457007-882775198-1210191635 … … 957 957 any potential namespace collision. Here is the way that the BDC SID can be synchronized to that 958 958 of the PDC (this is the default NT4 domain practice also): 959 <a class="indexterm" name="id 362974"></a>959 <a class="indexterm" name="id2602437"></a> 960 960 </p><pre class="screen"> 961 961 <code class="prompt">root# </code> net rpc getsid -S FRODO -Uroot%not24get … … 965 965 Usually it is not necessary to specify the target server (-S FRODO) or the administrator account 966 966 credentials (-Uroot%not24get). 967 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id 363001"></a>Share Management</h2></div></div></div><p>967 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2602466"></a>Share Management</h2></div></div></div><p> 968 968 Share management is central to all file serving operations. Typical share operations include: 969 969 </p><div class="itemizedlist"><ul type="disc"><li><p>Creation/change/deletion of shares</p></li><li><p>Setting/changing ACLs on shares</p></li><li><p>Moving shares from one server to another</p></li><li><p>Change of permissions of share contents</p></li></ul></div><p> 970 970 Each of these are dealt with here insofar as they involve the use of the <code class="literal">net</code> 971 971 command. Operations outside of this command are covered elsewhere in this document. 972 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 363043"></a>Creating, Editing, and Removing Shares</h3></div></div></div><p>972 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2602512"></a>Creating, Editing, and Removing Shares</h3></div></div></div><p> 973 973 A share can be added using the <code class="literal">net rpc share</code> command capabilities. 974 974 The target machine may be local or remote and is specified by the -S option. It must be noted 975 975 that the addition and deletion of shares using this tool depends on the availability of a suitable 976 976 interface script. The interface scripts Sambas <code class="literal">smbd</code> uses are called 977 <a class="link" href="smb.conf.5.html#ADDSHARECOMMAND" >add share command</a>, <a class="link" href="smb.conf.5.html#DELETESHARECOMMAND">delete share command</a> and978 <a class="link" href="smb.conf.5.html#CHANGESHARECOMMAND" >change share command</a> A set of example scripts are provided in the Samba source977 <a class="link" href="smb.conf.5.html#ADDSHARECOMMAND" target="_top">add share command</a>, <a class="link" href="smb.conf.5.html#DELETESHARECOMMAND" target="_top">delete share command</a> and 978 <a class="link" href="smb.conf.5.html#CHANGESHARECOMMAND" target="_top">change share command</a> A set of example scripts are provided in the Samba source 979 979 code tarball in the directory <code class="filename">~samba/examples/scripts</code>. 980 980 </p><p> … … 983 983 file system is the directory <code class="filename">/data</code>. The command that can be executed to perform the 984 984 addition of this share is shown here: 985 <a class="indexterm" name="id 363126"></a>985 <a class="indexterm" name="id2602608"></a> 986 986 </p><pre class="screen"> 987 987 <code class="prompt">root# </code> net rpc share add Bulge=/data -S MERLIN -Uroot%not24get … … 1004 1004 Often it is desirable also to permit a share to be removed using a command-line tool. 1005 1005 The following step permits the share that was previously added to be removed: 1006 <a class="indexterm" name="id 363174"></a>1006 <a class="indexterm" name="id2602659"></a> 1007 1007 </p><pre class="screen"> 1008 1008 <code class="prompt">root# </code> net rpc share delete Bulge -S MERLIN -Uroot%not24get … … 1020 1020 kyocera 1021 1021 </pre><p> 1022 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 363212"></a>Creating and Changing Share ACLs</h3></div></div></div><p>1022 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2602700"></a>Creating and Changing Share ACLs</h3></div></div></div><p> 1023 1023 At this time the <code class="literal">net</code> tool cannot be used to manage ACLs on Samba shares. In MS Windows 1024 1024 language this is called Share Permissions. … … 1027 1027 or using the Computer Management MMC snap-in. Neither is covered here, 1028 1028 but see <a class="link" href="AccessControls.html" title="Chapter 16. File, Directory, and Share Access Controls">“File, Directory, and Share Access Controls”</a>. 1029 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 363239"></a>Share, Directory, and File Migration</h3></div></div></div><p>1030 <a class="indexterm" name="id 363247"></a>1029 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2602730"></a>Share, Directory, and File Migration</h3></div></div></div><p> 1030 <a class="indexterm" name="id2602738"></a> 1031 1031 Shares and files can be migrated in the same manner as user, machine, and group accounts. 1032 1032 It is possible to preserve access control settings (ACLs) as well as security settings … … 1065 1065 Printer settings may not be fully or may be incorrectly migrated. This might in particular happen 1066 1066 when migrating a Windows 2003 print server to Samba. 1067 </p></li></ol></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id 363329"></a>Share Migration</h4></div></div></div><p>1067 </p></li></ol></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2602840"></a>Share Migration</h4></div></div></div><p> 1068 1068 The <code class="literal">net rpc share migrate</code> command operation permits the migration of plain 1069 1069 share stanzas. A stanza contains the parameters within which a file or print share are defined. … … 1092 1092 large list of available shares on the system that is being migrated can be limited using the 1093 1093 <em class="parameter"><code>--exclude</code></em> switch. For example: 1094 <a class="indexterm" name="id 363427"></a>1094 <a class="indexterm" name="id2602953"></a> 1095 1095 </p><pre class="screen"> 1096 1096 <code class="prompt">root# </code> net rpc share migrate shares myshare\ … … 1105 1105 to validate that the migrated accounts (on the Samba server) have the needed rights and privileges. 1106 1106 This can be done as shown here: 1107 <a class="indexterm" name="id 363475"></a>1107 <a class="indexterm" name="id2603008"></a> 1108 1108 </p><pre class="screen"> 1109 1109 <code class="prompt">root# </code> net rpc right list accounts -Uroot%not24get … … 1111 1111 The steps taken so far perform only the migration of shares. Directories and directory contents 1112 1112 are not migrated by the steps covered up to this point. 1113 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id 363501"></a>File and Directory Migration</h4></div></div></div><p>1113 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2603036"></a>File and Directory Migration</h4></div></div></div><p> 1114 1114 Everything covered to this point has been done in preparation for the migration of file and directory 1115 1115 data. For many people preparation is potentially boring and the real excitement only begins when file … … 1157 1157 the possibility of files that are owned only by a group. Group-alone file ownership is not possible under 1158 1158 UNIX/Linux. Errors in migrating group-owned files can be avoided by using the <code class="filename">smb.conf</code> file 1159 <a class="link" href="smb.conf.5.html#FORCEUNKNOWNACLUSER" >force unknown acl user = yes</a> parameter. This facility will1159 <a class="link" href="smb.conf.5.html#FORCEUNKNOWNACLUSER" target="_top">force unknown acl user = yes</a> parameter. This facility will 1160 1160 automatically convert group-owned files into correctly user-owned files on the Samba server. 1161 1161 </p><p> 1162 1162 An example for migration of files from a machine called <code class="constant">nt4box</code> to the Samba server 1163 1163 from which the process will be handled is shown here: 1164 <a class="indexterm" name="id 363645"></a>1164 <a class="indexterm" name="id2603211"></a> 1165 1165 </p><pre class="screen"> 1166 1166 <code class="prompt">root# </code> net rpc share migrate files -S nt4box --acls \ … … 1171 1171 <code class="constant">nt4box</code> to the Samba server from which migration is initiated. Files that are group-owned 1172 1172 will be owned by the user account <code class="constant">administrator</code>. 1173 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id 363682"></a>Share-ACL Migration</h4></div></div></div><p>1173 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2603251"></a>Share-ACL Migration</h4></div></div></div><p> 1174 1174 It is possible to have share-ACLs (security descriptors) that won't allow you, even as Administrator, to 1175 1175 copy any files or directories into it. Therefor the migration of the share-ACLs has been put into a separate 1176 1176 function: 1177 <a class="indexterm" name="id 363692"></a>1177 <a class="indexterm" name="id2603263"></a> 1178 1178 </p><pre class="screen"> 1179 1179 <code class="prompt">root# </code> net rpc share migrate security -S nt4box -U administrator%secret … … 1181 1181 </p><p> 1182 1182 This command will only copy the share-ACL of each share on nt4box to your local samba-system. 1183 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id 363721"></a>Simultaneous Share and File Migration</h4></div></div></div><p>1183 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2603294"></a>Simultaneous Share and File Migration</h4></div></div></div><p> 1184 1184 The operating mode shown here is just a combination of the previous three. It first migrates 1185 1185 share definitions and then all shared files and directories and finally migrates the share-ACLs: … … 1190 1190 </p><p> 1191 1191 An example of simultaneous migration is shown here: 1192 <a class="indexterm" name="id 363742"></a>1192 <a class="indexterm" name="id2603319"></a> 1193 1193 </p><pre class="screen"> 1194 1194 <code class="prompt">root# </code> net rpc share migrate all -S w2k3server -U administrator%secret 1195 1195 </pre><p> 1196 1196 This will generate a complete server clone of the <em class="parameter"><code>w2k3server</code></em> server. 1197 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 363774"></a>Printer Migration</h3></div></div></div><p>1197 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2603353"></a>Printer Migration</h3></div></div></div><p> 1198 1198 The installation of a new server, as with the migration to a new network environment, often is similar to 1199 1199 building a house; progress is very rapid from the laying of foundations up to the stage at which … … 1220 1220 to the operating system in order to create the underlying printers. The call-out is implemented 1221 1221 by way of an interface script that can be specified by the <code class="filename">smb.conf</code> file parameter 1222 <a class="link" href="smb.conf.5.html#" ></a>. This script is essential to the migration process.1222 <a class="link" href="smb.conf.5.html#" target="_top"></a>. This script is essential to the migration process. 1223 1223 A suitable example script may be obtained from the <code class="filename">$SAMBA_SOURCES/examples/scripts</code> 1224 1224 directory. Take note that this script must be customized to suit the operating system environment … … 1232 1232 Printer migration from a Windows print server (NT4 or 200x) is shown. This instruction causes the 1233 1233 printer share to be created together with the underlying print queue: 1234 <a class="indexterm" name="id 363887"></a>1234 <a class="indexterm" name="id2603494"></a> 1235 1235 </p><pre class="screen"> 1236 1236 net rpc printer MIGRATE PRINTERS [printer] [misc. options] [targets] … … 1238 1238 Printer drivers can be migrated from the Windows print server to the Samba server using this 1239 1239 command-line instruction: 1240 <a class="indexterm" name="id 363905"></a>1240 <a class="indexterm" name="id2603514"></a> 1241 1241 </p><pre class="screen"> 1242 1242 net rpc printer MIGRATE DRIVERS [printer] [misc. options] [targets] 1243 1243 </pre><p> 1244 1244 Printer forms can be migrated with the following operation: 1245 <a class="indexterm" name="id 363923"></a>1245 <a class="indexterm" name="id2603533"></a> 1246 1246 </p><pre class="screen"> 1247 1247 net rpc printer MIGRATE FORMS [printer] [misc. options] [targets] 1248 1248 </pre><p> 1249 1249 Printer security settings (ACLs) can be migrated from the Windows server to the Samba server using this command: 1250 <a class="indexterm" name="id 363941"></a>1250 <a class="indexterm" name="id2603553"></a> 1251 1251 </p><pre class="screen"> 1252 1252 net rpc printer MIGRATE SECURITY [printer] [misc. options] [targets] … … 1254 1254 Printer configuration settings include factors such as paper size and default paper orientation. 1255 1255 These can be migrated from the Windows print server to the Samba server with this command: 1256 <a class="indexterm" name="id 363960"></a>1256 <a class="indexterm" name="id2603575"></a> 1257 1257 </p><pre class="screen"> 1258 1258 net rpc printer MIGRATE SETTINGS [printer] [misc. options] [targets] … … 1264 1264 net rpc printer MIGRATE ALL [printer] [misc. options] [targets] 1265 1265 </pre><p> 1266 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id 363992"></a>Controlling Open Files</h2></div></div></div><p>1266 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2603609"></a>Controlling Open Files</h2></div></div></div><p> 1267 1267 The man page documents the <code class="literal">net file</code> function suite, which provides the tools to 1268 1268 close open files using either RAP or RPC function calls. Please refer to the man page for specific 1269 1269 usage information. 1270 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id 364009"></a>Session and Connection Management</h2></div></div></div><p>1270 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2603628"></a>Session and Connection Management</h2></div></div></div><p> 1271 1271 The session management interface of the <code class="literal">net session</code> command uses the old RAP 1272 1272 method to obtain the list of connections to the Samba server, as shown here: 1273 <a class="indexterm" name="id 364024"></a>1273 <a class="indexterm" name="id2603644"></a> 1274 1274 </p><pre class="screen"> 1275 1275 <code class="prompt">root# </code> net rap session -S MERLIN -Uroot%not24get … … 1286 1286 <code class="prompt">root# </code> net rap session close marvel -Uroot%not24get 1287 1287 </pre><p> 1288 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id 364068"></a>Printers and ADS</h2></div></div></div><p>1288 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2603694"></a>Printers and ADS</h2></div></div></div><p> 1289 1289 When Samba-3 is used within an MS Windows ADS environment, printers shared via Samba will not be browseable 1290 1290 until they have been published to the ADS domain. Information regarding published printers may be obtained 1291 1291 from the ADS server by executing the <code class="literal">net ads print info</code> command following this syntax: 1292 <a class="indexterm" name="id 364085"></a>1292 <a class="indexterm" name="id2603713"></a> 1293 1293 </p><pre class="screen"> 1294 1294 net ads printer info <printer_name> <server_name> -Uadministrator%secret … … 1298 1298 </p><p> 1299 1299 To publish (make available) a printer to ADS, execute the following command: 1300 <a class="indexterm" name="id 364107"></a>1300 <a class="indexterm" name="id2603738"></a> 1301 1301 </p><pre class="screen"> 1302 1302 net ads printer publish <printer_name> -Uadministrator%secret … … 1305 1305 </p><p> 1306 1306 Removal of a Samba printer from ADS is achieved by executing this command: 1307 <a class="indexterm" name="id 364130"></a>1307 <a class="indexterm" name="id2603764"></a> 1308 1308 </p><pre class="screen"> 1309 1309 net ads printer remove <printer_name> -Uadministrator%secret … … 1311 1311 </p><p> 1312 1312 A generic search (query) can also be made to locate a printer across the entire ADS domain by executing: 1313 <a class="indexterm" name="id 364152"></a>1313 <a class="indexterm" name="id2603788"></a> 1314 1314 </p><pre class="screen"> 1315 1315 net ads printer search <printer_name> -Uadministrator%secret 1316 1316 </pre><p> 1317 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id 364172"></a>Manipulating the Samba Cache</h2></div></div></div><p>1317 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2603810"></a>Manipulating the Samba Cache</h2></div></div></div><p> 1318 1318 Please refer to the <code class="literal">net</code> command man page for information regarding cache management. 1319 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id 364188"></a>Managing IDMAP UID/SID Mappings</h2></div></div></div><p>1319 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2603827"></a>Managing IDMAP UID/SID Mappings</h2></div></div></div><p> 1320 1320 The IDMAP UID to SID, and SID to UID, mappings that are created by <code class="literal">winbindd</code> can be 1321 1321 backed up to a text file. The text file can be manually edited, although it is highly recommended that … … 1328 1328 Winbind must be shut down to dump the IDMAP file. Before restoring a dump file, shut down 1329 1329 <code class="literal">winbindd</code> and delete the old <code class="filename">winbindd_idmap.tdb</code> file. 1330 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 364227"></a>Creating an IDMAP Database Dump File</h3></div></div></div><p>1330 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2603871"></a>Creating an IDMAP Database Dump File</h3></div></div></div><p> 1331 1331 The IDMAP database can be dumped to a text file as shown here: 1332 1332 </p><pre class="screen"> … … 1338 1338 net idmap dump /var/lib/samba/winbindd_idmap.tdb > idmap_dump.txt 1339 1339 </pre><p> 1340 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id 364258"></a>Restoring the IDMAP Database Dump File</h3></div></div></div><p>1340 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2603906"></a>Restoring the IDMAP Database Dump File</h3></div></div></div><p> 1341 1341 The IDMAP dump file can be restored using the following command: 1342 1342 </p><pre class="screen"> 1343 net idmap restore <full_path_and_tdb_filename> < dumpfile.txt1343 net idmap restore idmap_dump.txt 1344 1344 </pre><p> 1345 1345 Where the Samba run-time tdb files are stored in the <code class="filename">/var/lib/samba</code> directory … … 1351 1351 The following command is useful for obtaining basic statistics regarding a Samba domain. This command does 1352 1352 not work with current Windows XP Professional clients. 1353 <a class="indexterm" name="id 364303"></a>1353 <a class="indexterm" name="id2603956"></a> 1354 1354 </p><pre class="screen"> 1355 1355 <code class="prompt">root# </code> net rpc info … … 1364 1364 Another useful tool is the <code class="literal">net time</code> tool set. This tool may be used to query the 1365 1365 current time on the target server as shown here: 1366 <a class="indexterm" name="id 364337"></a>1366 <a class="indexterm" name="id2603992"></a> 1367 1367 </p><pre class="screen"> 1368 1368 <code class="prompt">root# </code> net time -S SAURON … … 1372 1372 <code class="literal">/bin/time</code>, it is a good idea to obtain the time from the target server in a format 1373 1373 that is ready to be passed through. This may be done by executing: 1374 <a class="indexterm" name="id 364366"></a>1374 <a class="indexterm" name="id2604024"></a> 1375 1375 </p><pre class="screen"> 1376 1376 <code class="prompt">root# </code> net time system -S FRODO … … 1378 1378 </pre><p> 1379 1379 The time can be set on a target server by executing: 1380 <a class="indexterm" name="id 364390"></a>1380 <a class="indexterm" name="id2604048"></a> 1381 1381 </p><pre class="screen"> 1382 1382 <code class="prompt">root# </code> net time set -S MAGGOT -U Administrator%not24get … … 1384 1384 </pre><p> 1385 1385 It is possible to obtain the time zone of a server by executing the following command against it: 1386 <a class="indexterm" name="id 364414"></a>1386 <a class="indexterm" name="id2604074"></a> 1387 1387 </p><pre class="screen"> 1388 1388 <code class="prompt">root# </code> net time zone -S SAURON
Note:
See TracChangeset
for help on using the changeset viewer.
