Ignore:
Timestamp:
Jan 15, 2010, 8:21:06 AM (16 years ago)
Author:
Herwig Bauernfeind
Message:

Update Samba 3.3 to 3.3.10 (docs)

File:
1 edited

Legend:

Unmodified
Added
Removed

  • branches/samba-3.3.x/docs/htmldocs/Samba3-ByExample/DomApps.html

    r274 r368  
    1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 12. Integrating Additional Services</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.74.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="kerberos.html" title="Chapter 11. Active Directory, Kerberos, and Security"><link rel="next" href="HA.html" title="Chapter 13. Performance, Reliability, and Availability"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 12. Integrating Additional Services</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="kerberos.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="HA.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="DomApps"></a>Chapter 12. Integrating Additional Services</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="DomApps.html#id2616172">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id2616202">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2616313">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id2616346">Technical Issues</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id2616502">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2616520">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id2618372">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2618432">Questions and Answers</a></span></dt></dl></div><p>
    2         <a class="indexterm" name="id2616122"></a>
    3         <a class="indexterm" name="id2616129"></a>
    4         <a class="indexterm" name="id2616136"></a>
    5         <a class="indexterm" name="id2616142"></a>
    6         <a class="indexterm" name="id2616149"></a>
     1<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 12. Integrating Additional Services</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="kerberos.html" title="Chapter 11. Active Directory, Kerberos, and Security"><link rel="next" href="HA.html" title="Chapter 13. Performance, Reliability, and Availability"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 12. Integrating Additional Services</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="kerberos.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="HA.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 12. Integrating Additional Services"><div class="titlepage"><div><div><h2 class="title"><a name="DomApps"></a>Chapter 12. Integrating Additional Services</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="DomApps.html#id2622230">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id2622261">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2622372">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id2622405">Technical Issues</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id2622561">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2622578">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id2624430">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2624491">Questions and Answers</a></span></dt></dl></div><p>
     2        <a class="indexterm" name="id2622181"></a>
     3        <a class="indexterm" name="id2622187"></a>
     4        <a class="indexterm" name="id2622194"></a>
     5        <a class="indexterm" name="id2622201"></a>
     6        <a class="indexterm" name="id2622208"></a>
    77        You've come a long way now. You have pretty much mastered Samba-3 for
    88        most uses it can be put to. Up until now, you have cast Samba-3 in the leading
    … …  
    1515        the latest Windows authentication technologies. Let's get started  this is
    1616        leading edge.
    17         </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2616172"></a>Introduction</h2></div></div></div><p>
     17        </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2622230"></a>Introduction</h2></div></div></div><p>
    1818        Abmas has continued its miraculous growth; indeed, nothing seems to be able
    1919        to stop its diversification into multiple (and seemingly unrelated) fields.
    … …  
    3131        gradually, taking over key services and easing the way to a full migration and,
    3232        therefore, integration into Abmas's existing business later.
    33         </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2616202"></a>Assignment Tasks</h3></div></div></div><p>
    34                 <a class="indexterm" name="id2616210"></a>
    35                 <a class="indexterm" name="id2616219"></a>
     33        </p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id2622261"></a>Assignment Tasks</h3></div></div></div><p>
     34                <a class="indexterm" name="id2622269"></a>
     35                <a class="indexterm" name="id2622278"></a>
    3636                You've promised the skeptical Abmas Snack Foods management team
    3737                that you can show them how Samba can ease itself and other Open Source
    … …  
    4040                acquisition). You have chosen Web proxying and caching as your proving ground.
    4141                </p><p>
    42                 <a class="indexterm" name="id2616238"></a>
    43                 <a class="indexterm" name="id2616245"></a>
     42                <a class="indexterm" name="id2622296"></a>
     43                <a class="indexterm" name="id2622303"></a>
    4444                Abmas Snack Foods has several thousand users housed at its head office
    4545                and multiple regional offices, plants, and warehouses. A high proportion of
    … …  
    5151                the earliest commercial users of Microsoft ISA.
    5252                </p><p>
    53                 <a class="indexterm" name="id2616275"></a>
    54                 <a class="indexterm" name="id2616282"></a>
    55                 <a class="indexterm" name="id2616289"></a>
     53                <a class="indexterm" name="id2622334"></a>
     54                <a class="indexterm" name="id2622341"></a>
     55                <a class="indexterm" name="id2622348"></a>
    5656                The team is not happy with ISA. Because it never lived up to its marketing promises,
    5757                it underperformed and had reliability problems. You have pounced on the opportunity
    … …  
    6464                This is a hands-on exercise. You build software applications so
    6565                that you obtain the functionality Abmas needs.
    66                 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2616313"></a>Dissection and Discussion</h2></div></div></div><p>
     66                </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2622372"></a>Dissection and Discussion</h2></div></div></div><p>
    6767        The key requirements in this business example are straightforward. You are not required
    6868        to do anything new, just to replicate an existing system, not lose any existing features,
    6969        and improve performance. The key points are:
    70         </p><div class="itemizedlist"><ul type="disc"><li><p>
     70        </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
    7171                Internet access for most employees
    72                 </p></li><li><p>
     72                </p></li><li class="listitem"><p>
    7373                Distributed system to accommodate load and geographical distribution of users
    74                 </p></li><li><p>
     74                </p></li><li class="listitem"><p>
    7575                Seamless and transparent interoperability with the existing Active Directory domain
    76                 </p></li></ul></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2616346"></a>Technical Issues</h3></div></div></div><p>
    77                 <a class="indexterm" name="id2616354"></a>
    78                 <a class="indexterm" name="id2616361"></a>
    79                 <a class="indexterm" name="id2616368"></a>
    80                 <a class="indexterm" name="id2616374"></a>
    81                 <a class="indexterm" name="id2616381"></a>
    82                 <a class="indexterm" name="id2616388"></a>
    83                 <a class="indexterm" name="id2616395"></a>
    84                 <a class="indexterm" name="id2616402"></a>
    85                 <a class="indexterm" name="id2616409"></a>
    86                 <a class="indexterm" name="id2616416"></a>
    87                 <a class="indexterm" name="id2616423"></a>
    88                 <a class="indexterm" name="id2616430"></a>
    89                 <a class="indexterm" name="id2616439"></a><a class="indexterm" name="id2616445"></a>
     76                </p></li></ul></div><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id2622405"></a>Technical Issues</h3></div></div></div><p>
     77                <a class="indexterm" name="id2622413"></a>
     78                <a class="indexterm" name="id2622419"></a>
     79                <a class="indexterm" name="id2622426"></a>
     80                <a class="indexterm" name="id2622433"></a>
     81                <a class="indexterm" name="id2622440"></a>
     82                <a class="indexterm" name="id2622447"></a>
     83                <a class="indexterm" name="id2622454"></a>
     84                <a class="indexterm" name="id2622460"></a>
     85                <a class="indexterm" name="id2622468"></a>
     86                <a class="indexterm" name="id2622474"></a>
     87                <a class="indexterm" name="id2622481"></a>
     88                <a class="indexterm" name="id2622488"></a>
     89                <a class="indexterm" name="id2622498"></a><a class="indexterm" name="id2622503"></a>
    9090                Functionally, the user's Internet Explorer requests a browsing session with the
    9191                Squid proxy, for which it offers its AD authentication token. Squid hands off
    … …  
    100100                </p><p>
    101101                Enabling this consists of:
    102                 </p><div class="itemizedlist"><ul type="disc"><li><p>
     102                </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
    103103                        Preparing the necessary environment using preconfigured packages
    104                         </p></li><li><p>
     104                        </p></li><li class="listitem"><p>
    105105                        Setting up raw Kerberos authentication against the Active Directory domain
    106                         </p></li><li><p>
     106                        </p></li><li class="listitem"><p>
    107107                        Configuring, compiling, and then installing the supporting Samba-3 components
    108                         </p></li><li><p>
     108                        </p></li><li class="listitem"><p>
    109109                        Tying it all together
    110                         </p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2616502"></a>Political Issues</h3></div></div></div><p>
     110                        </p></li></ul></div></div><div class="sect2" title="Political Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id2622561"></a>Political Issues</h3></div></div></div><p>
    111111                You are a stranger in a strange land, and all eyes are upon you. Some would even like to see
    112112                you fail. For you to gain the trust of your newly acquired IT people, it is essential that your
    … …  
    114114                will the entrenched positions consider taking up your new way of doing things on a
    115115                wider scale.
    116                 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2616520"></a>Implementation</h2></div></div></div><p>
    117         <a class="indexterm" name="id2616528"></a>
     116                </p></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2622578"></a>Implementation</h2></div></div></div><p>
     117        <a class="indexterm" name="id2622586"></a>
    118118        First, your system needs to be prepared and in a known good state to proceed. This consists
    119119        of making sure that everything the system depends on is present and that everything that could
    … …  
    122122        they must be removed.
    123123        </p><p>
    124         <a class="indexterm" name="id2616545"></a>
     124        <a class="indexterm" name="id2622603"></a>
    125125        The following packages should be available on your Red Hat Linux system:
    126         </p><div class="itemizedlist"><ul type="disc"><li><p>
    127                 <a class="indexterm" name="id2616560"></a>
    128                 <a class="indexterm" name="id2616566"></a>
     126        </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
     127                <a class="indexterm" name="id2622618"></a>
     128                <a class="indexterm" name="id2622625"></a>
    129129                krb5-libs
    130                 </p></li><li><p>
     130                </p></li><li class="listitem"><p>
    131131                krb5-devel
    132                 </p></li><li><p>
     132                </p></li><li class="listitem"><p>
    133133                krb5-workstation
    134                 </p></li><li><p>
     134                </p></li><li class="listitem"><p>
    135135                krb5-server
    136                 </p></li><li><p>
     136                </p></li><li class="listitem"><p>
    137137                pam_krb5
    138138                </p></li></ul></div><p>
    139         <a class="indexterm" name="id2616597"></a>
     139        <a class="indexterm" name="id2622655"></a>
    140140        In the case of SUSE Linux, these packages are called:
    141         </p><div class="itemizedlist"><ul type="disc"><li><p>
     141        </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>
    142142                heimdal-lib
    143                 </p></li><li><p>
     143                </p></li><li class="listitem"><p>
    144144                heimdal-devel
    145                 </p></li><li><p>
    146                 <a class="indexterm" name="id2616621"></a>
     145                </p></li><li class="listitem"><p>
     146                <a class="indexterm" name="id2622680"></a>
    147147                heimdal
    148                 </p></li><li><p>
     148                </p></li><li class="listitem"><p>
    149149                pam_krb5
    150150                </p></li></ul></div><p>
    … …  
    152152        them from the vendor's installation media. Follow the administrative guide
    153153        for your Linux system to ensure that the packages are correctly updated.
    154         </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
    155         <a class="indexterm" name="id2616646"></a>
    156         <a class="indexterm" name="id2616653"></a>
    157         <a class="indexterm" name="id2616660"></a>
     154        </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
     155        <a class="indexterm" name="id2622705"></a>
     156        <a class="indexterm" name="id2622712"></a>
     157        <a class="indexterm" name="id2622719"></a>
    158158        If the requirement is for interoperation with MS Windows Server 2003, it
    159159        will be necessary to ensure that you are using MIT Kerberos version 1.3.1
    … …  
    161161        updating.
    162162        </p><p>
    163         <a class="indexterm" name="id2616674"></a>
    164         <a class="indexterm" name="id2616681"></a>
     163        <a class="indexterm" name="id2622733"></a>
     164        <a class="indexterm" name="id2622739"></a>
    165165        Heimdal 0.6 or later is required in the case of SUSE Linux. SUSE Enterprise
    166166        Linux Server 8 ships with Heimdal 0.4. SUSE 9 ships with the necessary version.
    167         </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch10-one"></a>Removal of Pre-Existing Conflicting RPMs</h3></div></div></div><p>
    168         <a class="indexterm" name="id2616704"></a>
     167        </p></div><div class="sect2" title="Removal of Pre-Existing Conflicting RPMs"><div class="titlepage"><div><div><h3 class="title"><a name="ch10-one"></a>Removal of Pre-Existing Conflicting RPMs</h3></div></div></div><p>
     168        <a class="indexterm" name="id2622762"></a>
    169169        If Samba and/or Squid RPMs are installed, they should be updated. You can
    170170        build both from source.
    171171        </p><p>
    172         <a class="indexterm" name="id2616716"></a>
    173         <a class="indexterm" name="id2616722"></a>
    174         <a class="indexterm" name="id2616729"></a>
     172        <a class="indexterm" name="id2622774"></a>
     173        <a class="indexterm" name="id2622781"></a>
     174        <a class="indexterm" name="id2622787"></a>
    175175        Locating the packages to be un-installed can be achieved by running:
    176176</p><pre class="screen">
    … …  
    182182<code class="prompt">root# </code> rpm -e samba-common
    183183</pre><p>
    184         </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2616769"></a>Kerberos Configuration</h3></div></div></div><p>
    185         <a class="indexterm" name="id2616777"></a>
    186         <a class="indexterm" name="id2616784"></a>
    187         <a class="indexterm" name="id2616793"></a>
    188         <a class="indexterm" name="id2616800"></a>
     184        </p><div class="sect2" title="Kerberos Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="id2622828"></a>Kerberos Configuration</h3></div></div></div><p>
     185        <a class="indexterm" name="id2622836"></a>
     186        <a class="indexterm" name="id2622842"></a>
     187        <a class="indexterm" name="id2622852"></a>
     188        <a class="indexterm" name="id2622858"></a>
    189189        The systems Kerberos installation must be configured to communicate with
    190190        your primary Active Directory server (ADS KDC).
    … …  
    194194        unless you are using Windows 2003 servers.
    195195        </p><p>
    196         <a class="indexterm" name="id2616819"></a>
    197         <a class="indexterm" name="id2616825"></a>
    198         <a class="indexterm" name="id2616832"></a>
    199         <a class="indexterm" name="id2616839"></a>
    200         <a class="indexterm" name="id2616846"></a>
    201         <a class="indexterm" name="id2616855"></a>
    202         <a class="indexterm" name="id2616861"></a>
     196        <a class="indexterm" name="id2622877"></a>
     197        <a class="indexterm" name="id2622884"></a>
     198        <a class="indexterm" name="id2622891"></a>
     199        <a class="indexterm" name="id2622898"></a>
     200        <a class="indexterm" name="id2622904"></a>
     201        <a class="indexterm" name="id2622913"></a>
     202        <a class="indexterm" name="id2622920"></a>
    203203        Officially, neither MIT (1.3.4) nor Heimdal (0.63) Kerberos needs an <code class="filename">/etc/krb5.conf</code>
    204204        file in order to work correctly. All ADS domains automatically create SRV records in the
    … …  
    208208        specifying only a single KDC, even if there is more than one. Using the DNS lookup
    209209        allows the KRB5 libraries to use whichever KDCs are available.
    210         </p><div class="procedure"><a name="id2616896"></a><p class="title"><b>Procedure 12.1. Kerberos Configuration Steps</b></p><ol type="1"><li><p>
    211                 <a class="indexterm" name="id2616907"></a>
     210        </p><div class="procedure" title="Procedure 12.1. Kerberos Configuration Steps"><a name="id2622954"></a><p class="title"><b>Procedure 12.1. Kerberos Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>
     211                <a class="indexterm" name="id2622966"></a>
    212212                If you find the need to manually configure the <code class="filename">krb5.conf</code>, you should edit it
    213213                to have the contents shown in <a class="link" href="DomApps.html#ch10-krb5conf" title="Example 12.1. Kerberos Configuration File: /etc/krb5.conf">&#8220;Kerberos Configuration  File: /etc/krb5.conf&#8221;</a>. The final fully qualified path for this file
    214214                should be <code class="filename">/etc/krb5.conf</code>.
    215                 </p></li><li><p>
    216                 <a class="indexterm" name="id2616942"></a>
    217                 <a class="indexterm" name="id2616949"></a>
    218                 <a class="indexterm" name="id2616956"></a>
    219                 <a class="indexterm" name="id2616962"></a>
    220                 <a class="indexterm" name="id2616969"></a>
    221                 <a class="indexterm" name="id2616976"></a>
    222                 <a class="indexterm" name="id2616983"></a>
    223                 <a class="indexterm" name="id2616990"></a>
    224                 <a class="indexterm" name="id2616997"></a>
    225                 <a class="indexterm" name="id2617006"></a>
    226                 <a class="indexterm" name="id2617012"></a>
    227                 <a class="indexterm" name="id2617019"></a>
    228                 <a class="indexterm" name="id2617026"></a>
     215                </p></li><li class="step" title="Step 2"><p>
     216                <a class="indexterm" name="id2623000"></a>
     217                <a class="indexterm" name="id2623007"></a>
     218                <a class="indexterm" name="id2623014"></a>
     219                <a class="indexterm" name="id2623021"></a>
     220                <a class="indexterm" name="id2623028"></a>
     221                <a class="indexterm" name="id2623034"></a>
     222                <a class="indexterm" name="id2623041"></a>
     223                <a class="indexterm" name="id2623048"></a>
     224                <a class="indexterm" name="id2623055"></a>
     225                <a class="indexterm" name="id2623064"></a>
     226                <a class="indexterm" name="id2623071"></a>
     227                <a class="indexterm" name="id2623078"></a>
     228                <a class="indexterm" name="id2623085"></a>
    229229                The following gotchas often catch people out. Kerberos is case sensitive. Your realm must
    230                 be in UPPERCASE, or you will get an error: &#8220;<span class="quote">Cannot find KDC for requested realm while getting
    231                 initial credentials</span>&#8221;.  Kerberos is picky about time synchronization. The time
     230                be in UPPERCASE, or you will get an error: <span class="quote">&#8220;<span class="quote">Cannot find KDC for requested realm while getting
     231                initial credentials</span>&#8221;</span>.  Kerberos is picky about time synchronization. The time
    232232                according to your participating servers must be within 5 minutes or you get an error:
    233                 &#8220;<span class="quote">kinit(v5): Clock skew too great while getting initial credentials</span>&#8221;.
     233                <span class="quote">&#8220;<span class="quote">kinit(v5): Clock skew too great while getting initial credentials</span>&#8221;</span>.
    234234                Clock skew limits are, in fact, configurable in the Kerberos protocols (the default is
    235235                5 minutes). A better solution is to implement NTP throughout your server network.
    … …  
    241241                NetBIOS name. If Kerberos cannot do this reverse lookup, you will get a local error
    242242                when you try to join the realm.
    243                 </p></li><li><p>
    244                 <a class="indexterm" name="id2617070"></a>
     243                </p></li><li class="step" title="Step 3"><p>
     244                <a class="indexterm" name="id2623129"></a>
    245245                You are now ready to test your installation by issuing the command:
    246246</p><pre class="screen">
    … …  
    262262        kdc = w2k3s.london.abmas.biz
    263263        }
    264 </pre></div></div><br class="example-break"><p><a class="indexterm" name="id2617135"></a>
     264</pre></div></div><br class="example-break"><p><a class="indexterm" name="id2623194"></a>
    265265        The command
    266266</p><pre class="screen">
    … …  
    268268</pre><p>
    269269        shows the Kerberos tickets cached by the system.
    270         </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2617158"></a>Samba Configuration</h4></div></div></div><p>
    271         <a class="indexterm" name="id2617166"></a>
     270        </p><div class="sect3" title="Samba Configuration"><div class="titlepage"><div><div><h4 class="title"><a name="id2623217"></a>Samba Configuration</h4></div></div></div><p>
     271        <a class="indexterm" name="id2623225"></a>
    272272        Samba must be configured to correctly use Active Directory. Samba-3 must be used, since it
    273273        has the necessary components to interface with Active Directory.
    274         </p><div class="procedure"><a name="id2617177"></a><p class="title"><b>Procedure 12.2. Securing Samba-3 With ADS Support Steps</b></p><ol type="1"><li><p>
    275                 <a class="indexterm" name="id2617188"></a>
    276                 <a class="indexterm" name="id2617195"></a>
    277                 <a class="indexterm" name="id2617202"></a>
    278                 <a class="indexterm" name="id2617209"></a>
    279                 <a class="indexterm" name="id2617216"></a>
     274        </p><div class="procedure" title="Procedure 12.2. Securing Samba-3 With ADS Support Steps"><a name="id2623235"></a><p class="title"><b>Procedure 12.2. Securing Samba-3 With ADS Support Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>
     275                <a class="indexterm" name="id2623247"></a>
     276                <a class="indexterm" name="id2623254"></a>
     277                <a class="indexterm" name="id2623261"></a>
     278                <a class="indexterm" name="id2623268"></a>
     279                <a class="indexterm" name="id2623275"></a>
    280280                Download the latest stable Samba-3 for Red Hat Linux from the official Samba Team
    281281                <a class="ulink" href="http://ftp.samba.org" target="_top">FTP site.</a> The official Samba Team
    … …  
    283283                needed, and are linked against MIT KRB5 version 1.3.1 and therefore are ready for use.
    284284                </p><p>
    285                 <a class="indexterm" name="id2617242"></a>
    286                 <a class="indexterm" name="id2617249"></a>
     285                <a class="indexterm" name="id2623301"></a>
     286                <a class="indexterm" name="id2623308"></a>
    287287                The necessary, validated RPM packages for SUSE Linux may be obtained from
    288288                the <a class="ulink" href="ftp://ftp.sernet.de/pub/samba" target="_top">SerNet</a> FTP site that
    … …  
    290290                <code class="literal">ntlm_auth</code> tool, and are statically linked
    291291                against suitably patched Heimdal 0.6 libraries.
    292                 </p></li><li><p>
     292                </p></li><li class="step" title="Step 2"><p>
    293293                Using your favorite editor, change the <code class="filename">/etc/samba/smb.conf</code>
    294294                file so it has contents similar to the example shown in <a class="link" href="DomApps.html#ch10-smbconf" title="Example 12.2. Samba Configuration File: /etc/samba/smb.conf">&#8220;Samba Configuration  File: /etc/samba/smb.conf&#8221;</a>.
    295                 </p></li><li><p>
    296                 <a class="indexterm" name="id2617301"></a>
    297                 <a class="indexterm" name="id2617307"></a>
    298                 <a class="indexterm" name="id2617314"></a>i
    299                 <a class="indexterm" name="id2617326"></a>
    300                 <a class="indexterm" name="id2617332"></a>
     295                </p></li><li class="step" title="Step 3"><p>
     296                <a class="indexterm" name="id2623359"></a>
     297                <a class="indexterm" name="id2623366"></a>
     298                <a class="indexterm" name="id2623373"></a>i
     299                <a class="indexterm" name="id2623384"></a>
     300                <a class="indexterm" name="id2623391"></a>
    301301                Next you need to create a computer account in the Active Directory.
    302302                This sets up the trust relationship needed for other clients to
    303303                authenticate to the Samba server with an Active Directory Kerberos ticket.
    304                 This is done with the &#8220;<span class="quote">net ads join -U [Administrator%Password]</span>&#8221;
     304                This is done with the <span class="quote">&#8220;<span class="quote">net ads join -U [Administrator%Password]</span>&#8221;</span>
    305305                command, as follows:
    306306</p><pre class="screen">
    307307<code class="prompt">root# </code> net ads join -U administrator%vulcon
    308308</pre><p>
    309                 </p></li><li><p>
    310                 <a class="indexterm" name="id2617367"></a>
    311                 <a class="indexterm" name="id2617373"></a>
    312                 <a class="indexterm" name="id2617380"></a>
    313                 <a class="indexterm" name="id2617387"></a>
    314                 <a class="indexterm" name="id2617394"></a>
     309                </p></li><li class="step" title="Step 4"><p>
     310                <a class="indexterm" name="id2623425"></a>
     311                <a class="indexterm" name="id2623432"></a>
     312                <a class="indexterm" name="id2623439"></a>
     313                <a class="indexterm" name="id2623446"></a>
     314                <a class="indexterm" name="id2623452"></a>
    315315                Your new Samba binaries must be started in the standard manner as is applicable
    316316                to the platform you are running on. Alternatively, start your Active Directory-enabled Samba with the following commands:
    … …  
    320320<code class="prompt">root# </code> winbindd -D
    321321</pre><p>
    322                 </p></li><li><p>
    323                 <a class="indexterm" name="id2617435"></a>
    324                 <a class="indexterm" name="id2617441"></a>
    325                 <a class="indexterm" name="id2617451"></a>
    326                 <a class="indexterm" name="id2617458"></a>
    327                 <a class="indexterm" name="id2617464"></a>
     322                </p></li><li class="step" title="Step 5"><p>
     323                <a class="indexterm" name="id2623493"></a>
     324                <a class="indexterm" name="id2623500"></a>
     325                <a class="indexterm" name="id2623509"></a>
     326                <a class="indexterm" name="id2623516"></a>
     327                <a class="indexterm" name="id2623523"></a>
    328328                We now need to test that Samba is communicating with the Active
    329329                Directory domain; most specifically, we want to see whether winbind
    … …  
    357357</pre><p>
    358358                This enumerates all the groups in your Active Directory tree.
    359                 </p></li><li><p>
    360                 <a class="indexterm" name="id2617528"></a>
    361                 <a class="indexterm" name="id2617535"></a>
     359                </p></li><li class="step" title="Step 6"><p>
     360                <a class="indexterm" name="id2623587"></a>
     361                <a class="indexterm" name="id2623594"></a>
    362362                Squid uses the <code class="literal">ntlm_auth</code> helper build with Samba-3.
    363363                You may test <code class="literal">ntlm_auth</code> with the command:
    … …  
    370370<code class="prompt">root# </code> NT_STATUS_OK: Success (0x0)
    371371</pre><p>
    372                 </p></li><li><p>
    373                 <a class="indexterm" name="id2617588"></a>
    374                 <a class="indexterm" name="id2617594"></a>
    375                 <a class="indexterm" name="id2617601"></a>
    376                 <a class="indexterm" name="id2617608"></a>
    377                 <a class="indexterm" name="id2617615"></a>
    378                 <a class="indexterm" name="id2617622"></a>
    379                 <a class="indexterm" name="id2617629"></a>
    380                 <a class="indexterm" name="id2617635"></a>
     372                </p></li><li class="step" title="Step 7"><p>
     373                <a class="indexterm" name="id2623646"></a>
     374                <a class="indexterm" name="id2623653"></a>
     375                <a class="indexterm" name="id2623660"></a>
     376                <a class="indexterm" name="id2623667"></a>
     377                <a class="indexterm" name="id2623674"></a>
     378                <a class="indexterm" name="id2623680"></a>
     379                <a class="indexterm" name="id2623687"></a>
     380                <a class="indexterm" name="id2623694"></a>
    381381                The <code class="literal">ntlm_auth</code> helper, when run from a command line as the user
    382                 &#8220;<span class="quote">root</span>&#8221;, authenticates against your Active Directory domain (with
     382                <span class="quote">&#8220;<span class="quote">root</span>&#8221;</span>, authenticates against your Active Directory domain (with
    383383                the aid of winbind). It manages this by reading from the winbind privileged pipe.
    384                 Squid is running with the permissions of user &#8220;<span class="quote">squid</span>&#8221; and group
    385                 &#8220;<span class="quote">squid</span>&#8221; and is not able to do this unless we make a vital change.
     384                Squid is running with the permissions of user <span class="quote">&#8220;<span class="quote">squid</span>&#8221;</span> and group
     385                <span class="quote">&#8220;<span class="quote">squid</span>&#8221;</span> and is not able to do this unless we make a vital change.
    386386                Squid cannot read from the winbind privilege pipe unless you change the
    387387                permissions of its directory. This is the single biggest cause of failure in the
    … …  
    396396<code class="prompt">root# </code> chmod 750 /var/lib/samba/winbindd_privileged
    397397</pre><p>
    398                 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2617710"></a>NSS Configuration</h4></div></div></div><p>
    399         <a class="indexterm" name="id2617718"></a>
    400         <a class="indexterm" name="id2617725"></a>
    401         <a class="indexterm" name="id2617732"></a>
     398                </p></li></ol></div></div><div class="sect3" title="NSS Configuration"><div class="titlepage"><div><div><h4 class="title"><a name="id2623769"></a>NSS Configuration</h4></div></div></div><p>
     399        <a class="indexterm" name="id2623777"></a>
     400        <a class="indexterm" name="id2623783"></a>
     401        <a class="indexterm" name="id2623790"></a>
    402402        For Squid to benefit from Samba-3, NSS must be updated to allow winbind as a valid route to user authentication.
    403403        </p><p>
    404404        Edit your <code class="filename">/etc/nsswitch.conf</code> file so it has the parameters shown
    405405        in <a class="link" href="DomApps.html#ch10-etcnsscfg" title="Example 12.3. NSS Configuration File Extract File: /etc/nsswitch.conf">&#8220;NSS Configuration File Extract  File: /etc/nsswitch.conf&#8221;</a>.
    406         </p><div class="example"><a name="ch10-smbconf"></a><p class="title"><b>Example 12.2. Samba Configuration  File: <code class="filename">/etc/samba/smb.conf</code></b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2617790"></a><em class="parameter"><code>workgroup = LONDON</code></em></td></tr><tr><td><a class="indexterm" name="id2617802"></a><em class="parameter"><code>netbios name = W2K3S</code></em></td></tr><tr><td><a class="indexterm" name="id2617813"></a><em class="parameter"><code>realm = LONDON.ABMAS.BIZ</code></em></td></tr><tr><td><a class="indexterm" name="id2617825"></a><em class="parameter"><code>security = ads</code></em></td></tr><tr><td><a class="indexterm" name="id2617837"></a><em class="parameter"><code>encrypt passwords = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2617849"></a><em class="parameter"><code>password server = w2k3s.london.abmas.biz</code></em></td></tr><tr><td># separate domain and username with '/', like DOMAIN/username</td></tr><tr><td><a class="indexterm" name="id2617865"></a><em class="parameter"><code>winbind separator = /</code></em></td></tr><tr><td># use UIDs from 10000 to 20000 for domain users</td></tr><tr><td><a class="indexterm" name="id2617881"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td># use GIDs from 10000 to 20000 for domain groups</td></tr><tr><td><a class="indexterm" name="id2617897"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td># allow enumeration of winbind users and groups</td></tr><tr><td><a class="indexterm" name="id2617913"></a><em class="parameter"><code>winbind enum users = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2617925"></a><em class="parameter"><code>winbind enum groups = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2617937"></a><em class="parameter"><code>winbind user default domain = yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch10-etcnsscfg"></a><p class="title"><b>Example 12.3. NSS Configuration File Extract  File: <code class="filename">/etc/nsswitch.conf</code></b></p><div class="example-contents"><pre class="screen">
     406        </p><div class="example"><a name="ch10-smbconf"></a><p class="title"><b>Example 12.2. Samba Configuration  File: <code class="filename">/etc/samba/smb.conf</code></b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2623848"></a><em class="parameter"><code>workgroup = LONDON</code></em></td></tr><tr><td><a class="indexterm" name="id2623860"></a><em class="parameter"><code>netbios name = W2K3S</code></em></td></tr><tr><td><a class="indexterm" name="id2623872"></a><em class="parameter"><code>realm = LONDON.ABMAS.BIZ</code></em></td></tr><tr><td><a class="indexterm" name="id2623884"></a><em class="parameter"><code>security = ads</code></em></td></tr><tr><td><a class="indexterm" name="id2623895"></a><em class="parameter"><code>encrypt passwords = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2623907"></a><em class="parameter"><code>password server = w2k3s.london.abmas.biz</code></em></td></tr><tr><td># separate domain and username with '/', like DOMAIN/username</td></tr><tr><td><a class="indexterm" name="id2623924"></a><em class="parameter"><code>winbind separator = /</code></em></td></tr><tr><td># use UIDs from 10000 to 20000 for domain users</td></tr><tr><td><a class="indexterm" name="id2623940"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td># use GIDs from 10000 to 20000 for domain groups</td></tr><tr><td><a class="indexterm" name="id2623956"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td># allow enumeration of winbind users and groups</td></tr><tr><td><a class="indexterm" name="id2623971"></a><em class="parameter"><code>winbind enum users = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2623983"></a><em class="parameter"><code>winbind enum groups = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2623995"></a><em class="parameter"><code>winbind user default domain = yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch10-etcnsscfg"></a><p class="title"><b>Example 12.3. NSS Configuration File Extract  File: <code class="filename">/etc/nsswitch.conf</code></b></p><div class="example-contents"><pre class="screen">
    407407passwd: files winbind
    408408shadow: files
    409409group: files winbind
    410 </pre></div></div><br class="example-break"></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2617976"></a>Squid Configuration</h4></div></div></div><p>
    411         <a class="indexterm" name="id2617983"></a>
    412         <a class="indexterm" name="id2617990"></a>
     410</pre></div></div><br class="example-break"></div><div class="sect3" title="Squid Configuration"><div class="titlepage"><div><div><h4 class="title"><a name="id2624034"></a>Squid Configuration</h4></div></div></div><p>
     411        <a class="indexterm" name="id2624042"></a>
     412        <a class="indexterm" name="id2624049"></a>
    413413        Squid must be configured correctly to interact with the Samba-3
    414414        components that handle Active Directory authentication.
    415         </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2618005"></a>Configuration</h3></div></div></div></div><div class="procedure"><a name="id2618011"></a><p class="title"><b>Procedure 12.3. Squid Configuration Steps</b></p><ol type="1"><li><p>
    416                 <a class="indexterm" name="id2618022"></a>
    417                 <a class="indexterm" name="id2618029"></a>
    418                 <a class="indexterm" name="id2618037"></a>
     415        </p></div></div><div class="sect2" title="Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="id2624064"></a>Configuration</h3></div></div></div></div><div class="procedure" title="Procedure 12.3. Squid Configuration Steps"><a name="id2624069"></a><p class="title"><b>Procedure 12.3. Squid Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p>
     416                <a class="indexterm" name="id2624081"></a>
     417                <a class="indexterm" name="id2624088"></a>
     418                <a class="indexterm" name="id2624095"></a>
    419419                If your Linux distribution is SUSE Linux 9, the version of Squid
    420420                supplied is already enabled to use the winbind helper agent. You
    421421                can therefore omit the steps that would build the Squid binary
    422422                programs.
    423                 </p></li><li><p>
    424                 <a class="indexterm" name="id2618054"></a>
    425                 <a class="indexterm" name="id2618061"></a>
    426                 <a class="indexterm" name="id2618068"></a>
    427                 <a class="indexterm" name="id2618074"></a>
    428                 <a class="indexterm" name="id2618081"></a>
     423                </p></li><li class="step" title="Step 2"><p>
     424                <a class="indexterm" name="id2624113"></a>
     425                <a class="indexterm" name="id2624119"></a>
     426                <a class="indexterm" name="id2624126"></a>
     427                <a class="indexterm" name="id2624133"></a>
     428                <a class="indexterm" name="id2624140"></a>
    429429                Squid, by default, runs as the user <code class="constant">nobody</code>. You need to
    430430                add a system user <code class="constant">squid</code> and a system group
    … …  
    433433                <code class="constant">squid</code> user in <code class="filename">/etc/passwd</code>
    434434                and a <code class="constant">squid</code> group in <code class="filename">/etc/group</code> if these aren't there already.
    435                 </p></li><li><p>
    436                 <a class="indexterm" name="id2618129"></a>
    437                 <a class="indexterm" name="id2618136"></a>
     435                </p></li><li class="step" title="Step 3"><p>
     436                <a class="indexterm" name="id2624187"></a>
     437                <a class="indexterm" name="id2624194"></a>
    438438                You now need to change the permissions on Squid's <code class="constant">var</code>
    439439                directory.  Enter the following command:
    … …  
    441441<code class="prompt">root# </code> chown -R squid /var/cache/squid
    442442</pre><p>
    443                 </p></li><li><p>
    444                 <a class="indexterm" name="id2618167"></a>
    445                 <a class="indexterm" name="id2618173"></a>
     443                </p></li><li class="step" title="Step 4"><p>
     444                <a class="indexterm" name="id2624225"></a>
     445                <a class="indexterm" name="id2624232"></a>
    446446                Squid must also have control over its logging. Enter the following commands:
    447447</p><pre class="screen">
    … …  
    449449<code class="prompt">root# </code> chmod 770 /var/log/squid
    450450</pre><p>
    451                 </p></li><li><p>
     451                </p></li><li class="step" title="Step 5"><p>
    452452                Finally, Squid must be able to write to its disk cache!
    453453                Enter the following commands:
    … …  
    456456<code class="prompt">root# </code> chmod 770 /var/cache/squid
    457457</pre><p>
    458                 </p></li><li><p>
    459                 <a class="indexterm" name="id2618233"></a>
     458                </p></li><li class="step" title="Step 6"><p>
     459                <a class="indexterm" name="id2624292"></a>
    460460                The <code class="filename">/etc/squid/squid.conf</code> file must be edited to include the lines from
    461461                <a class="link" href="DomApps.html#etcsquidcfg" title="Example 12.4. Squid Configuration File Extract /etc/squid.conf [ADMINISTRATIVE PARAMETERS Section]">&#8220;Squid Configuration File Extract  /etc/squid.conf [ADMINISTRATIVE PARAMETERS Section]&#8221;</a> and <a class="link" href="DomApps.html#etcsquid2" title="Example 12.5. Squid Configuration File extract File: /etc/squid.conf [AUTHENTICATION PARAMETERS Section]">&#8220;Squid Configuration File extract  File: /etc/squid.conf [AUTHENTICATION PARAMETERS Section]&#8221;</a>.
    462                 </p></li><li><p>
    463                 <a class="indexterm" name="id2618267"></a>
     462                </p></li><li class="step" title="Step 7"><p>
     463                <a class="indexterm" name="id2624326"></a>
    464464                You must create Squid's cache directories before it may be run.  Enter the following command:
    465465</p><pre class="screen">
    466466<code class="prompt">root# </code> squid -z
    467467</pre><p>
    468                 </p></li><li><p>
     468                </p></li><li class="step" title="Step 8"><p>
    469469                Finally, start Squid and enjoy transparent Active Directory authentication.
    470470                Enter the following command:
    … …  
    488488        acl AuthorizedUsers proxy_auth REQUIRED
    489489        http_access allow all AuthorizedUsers
    490 </pre></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2618372"></a>Key Points Learned</h3></div></div></div><p>
    491                 <a class="indexterm" name="id2618380"></a>
    492                 <a class="indexterm" name="id2618387"></a>
    493                 <a class="indexterm" name="id2618394"></a>
    494                 <a class="indexterm" name="id2618401"></a>
    495                 <a class="indexterm" name="id2618412"></a>
     490</pre></div></div><br class="example-break"></div><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id2624430"></a>Key Points Learned</h3></div></div></div><p>
     491                <a class="indexterm" name="id2624438"></a>
     492                <a class="indexterm" name="id2624445"></a>
     493                <a class="indexterm" name="id2624452"></a>
     494                <a class="indexterm" name="id2624459"></a>
     495                <a class="indexterm" name="id2624471"></a>
    496496                Microsoft Windows networking protocols permeate the spectrum of technologies that Microsoft
    497497                Windows clients use, even when accessing traditional services such as Web browsers. Depending
    … …  
    500500                the cookie-based authentication regime used by all competing browsers. It is Samba's implementation
    501501                of NTLMSSP that makes it attractive to implement the solution that has been demonstrated in this chapter.
    502                 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2618432"></a>Questions and Answers</h2></div></div></div><p>
    503         <a class="indexterm" name="id2618440"></a>
    504         <a class="indexterm" name="id2618447"></a>
    505         <a class="indexterm" name="id2618454"></a>
    506         <a class="indexterm" name="id2618461"></a>
     502                </p></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2624491"></a>Questions and Answers</h2></div></div></div><p>
     503        <a class="indexterm" name="id2624499"></a>
     504        <a class="indexterm" name="id2624506"></a>
     505        <a class="indexterm" name="id2624513"></a>
     506        <a class="indexterm" name="id2624520"></a>
    507507        The development of the <code class="literal">ntlm_auth</code> module was first discussed in many Open Source circles
    508508        in 2002. At the SambaXP conference in Goettingen, Germany, Mr. Francesco Chemolli demonstrated the use of
    … …  
    516516        comments were made with respect to questions regarding the performance of this installation:
    517517        </p><div class="blockquote"><blockquote class="blockquote"><p>
    518         [In our] EXTREMELY optimized environment . . . [the] performance impact is almost [nothing]. The &#8220;<span class="quote">almost</span>&#8221;
     518        [In our] EXTREMELY optimized environment . . . [the] performance impact is almost [nothing]. The <span class="quote">&#8220;<span class="quote">almost</span>&#8221;</span>
    519519        part is due to the brain damage of the ntlm-over-http protocol definition. Suffice to say that its worst-case
    520520        scenario triples the number of hits needed to perform the same transactions versus basic or digest auth[entication].
    … …  
    523523        Make certain that your Squid proxy server is equipped with sufficient memory to permit all proxy operations to run
    524524        out of memory without invoking the overheads involved in the use of memory that has to be swapped to disk.
    525         </p><div class="qandaset"><dl><dt> <a href="DomApps.html#id2618546">
     525        </p><div class="qandaset" title="Frequently Asked Questions"><a name="id2624598"></a><dl><dt> <a href="DomApps.html#id2624605">
    526526                What does Samba have to do with Web proxy serving?
    527                 </a></dt><dt> <a href="DomApps.html#id2618712">
     527                </a></dt><dt> <a href="DomApps.html#id2624771">
    528528                What other services does Samba provide?
    529                 </a></dt><dt> <a href="DomApps.html#id2618855">
     529                </a></dt><dt> <a href="DomApps.html#id2624914">
    530530                Does use of Samba (ntlm_auth) improve the performance of Squid?
    531                 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2618546"></a><a name="id2618548"></a></td><td align="left" valign="top"><p>
     531                </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id2624605"></a><a name="id2624607"></a></td><td align="left" valign="top"><p>
    532532                What does Samba have to do with Web proxy serving?
    533533                </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
    534                 <a class="indexterm" name="id2618560"></a>
    535                 <a class="indexterm" name="id2618567"></a>
    536                 <a class="indexterm" name="id2618574"></a>
    537                 <a class="indexterm" name="id2618583"></a>
    538                 <a class="indexterm" name="id2618590"></a>
     534                <a class="indexterm" name="id2624619"></a>
     535                <a class="indexterm" name="id2624626"></a>
     536                <a class="indexterm" name="id2624633"></a>
     537                <a class="indexterm" name="id2624642"></a>
     538                <a class="indexterm" name="id2624649"></a>
    539539                To provide transparent interoperability between Windows clients and the network services
    540540                that are used from them, Samba had to develop tools and facilities that deliver that feature. The benefit
    … …  
    542542                module is basically a wrapper around authentication code from the core of the Samba project.
    543543                </p><p>
    544                 <a class="indexterm" name="id2618612"></a>
    545                 <a class="indexterm" name="id2618619"></a>
    546                 <a class="indexterm" name="id2618629"></a>
    547                 <a class="indexterm" name="id2618638"></a>
    548                 <a class="indexterm" name="id2618646"></a>
    549                 <a class="indexterm" name="id2618653"></a>
    550                 <a class="indexterm" name="id2618660"></a>
    551                 <a class="indexterm" name="id2618667"></a>
    552                 <a class="indexterm" name="id2618674"></a>
     544                <a class="indexterm" name="id2624671"></a>
     545                <a class="indexterm" name="id2624678"></a>
     546                <a class="indexterm" name="id2624687"></a>
     547                <a class="indexterm" name="id2624696"></a>
     548                <a class="indexterm" name="id2624705"></a>
     549                <a class="indexterm" name="id2624712"></a>
     550                <a class="indexterm" name="id2624719"></a>
     551                <a class="indexterm" name="id2624726"></a>
     552                <a class="indexterm" name="id2624733"></a>
    553553                The <code class="literal">ntlm_auth</code> module supports basic plain-text authentication and NTLMSSP
    554554                protocols. This module makes it possible for Web and FTP proxy requests to be authenticated without
    … …  
    558558                also.
    559559                </p><p>
    560                 <a class="indexterm" name="id2618699"></a>
     560                <a class="indexterm" name="id2624757"></a>
    561561                The short answer is that by adding a wrapper around key authentication components of Samba, other
    562562                projects (like Squid) can benefit from the labors expended in meeting user interoperability needs.
    563                 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2618712"></a><a name="id2618714"></a></td><td align="left" valign="top"><p>
     563                </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2624771"></a><a name="id2624773"></a></td><td align="left" valign="top"><p>
    564564                What other services does Samba provide?
    565565                </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
    566                 <a class="indexterm" name="id2618726"></a>
    567                 <a class="indexterm" name="id2618733"></a>
    568                 <a class="indexterm" name="id2618740"></a>
    569                 <a class="indexterm" name="id2618746"></a>
    570                 <a class="indexterm" name="id2618753"></a>
     566                <a class="indexterm" name="id2624784"></a>
     567                <a class="indexterm" name="id2624791"></a>
     568                <a class="indexterm" name="id2624798"></a>
     569                <a class="indexterm" name="id2624805"></a>
     570                <a class="indexterm" name="id2624812"></a>
    571571                Samba-3 is a file and print server. The core components that provide this functionality are <code class="literal">smbd</code>,
    572572                <code class="literal">nmbd</code>, and the identity resolver daemon, <code class="literal">winbindd</code>.
    573573                </p><p>
    574                 <a class="indexterm" name="id2618784"></a>
    575                 <a class="indexterm" name="id2618791"></a>
     574                <a class="indexterm" name="id2624842"></a>
     575                <a class="indexterm" name="id2624849"></a>
    576576                Samba-3 is an SMB/CIFS client. The core component that provides this is called <code class="literal">smbclient</code>.
    577577                </p><p>
    578                 <a class="indexterm" name="id2618808"></a>
    579                 <a class="indexterm" name="id2618815"></a>
    580                 <a class="indexterm" name="id2618822"></a>
    581                 <a class="indexterm" name="id2618828"></a>
    582                 <a class="indexterm" name="id2618835"></a>
     578                <a class="indexterm" name="id2624867"></a>
     579                <a class="indexterm" name="id2624873"></a>
     580                <a class="indexterm" name="id2624880"></a>
     581                <a class="indexterm" name="id2624887"></a>
     582                <a class="indexterm" name="id2624894"></a>
    583583                Samba-3 includes a number of helper tools, plug-in modules, utilities, and test and validation facilities.
    584584                Samba-3 includes glue modules that help provide interoperability between MS Windows clients and UNIX/Linux
    … …  
    587587                to permit identity resolution via SMB/CIFS servers (Windows NT4/200x, Samba, and a host of other commercial
    588588                server products).
    589                 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2618855"></a><a name="id2618858"></a></td><td align="left" valign="top"><p>
     589                </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id2624914"></a><a name="id2624916"></a></td><td align="left" valign="top"><p>
    590590                Does use of Samba (<code class="literal">ntlm_auth</code>) improve the performance of Squid?
    591591                </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p>
Note: See TracChangeset for help on using the changeset viewer.