- Timestamp:
- Mar 1, 2010, 3:05:48 PM (15 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
branches/samba-3.3.x/docs/htmldocs/Samba3-HOWTO/FastStart.html
r368 r411 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 2. Fast Start: Cure for Impatience</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 5.2"><link rel="home" href="index.html" title="The Official Samba 3.3.x HOWTO and Reference Guide"><link rel="up" href="introduction.html" title="Part I. General Installation"><link rel="prev" href="install.html" title="Chapter 1. How to Install and Test SAMBA"><link rel="next" href="type.html" title="Part II. Server Configuration Basics"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 2. Fast Start: Cure for Impatience</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="install.html">Prev</a> </td><th width="60%" align="center">Part I. General Installation</th><td width="20%" align="right"> <a accesskey="n" href="type.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 2. Fast Start: Cure for Impatience"><div class="titlepage"><div><div><h2 class="title"><a name="FastStart"></a>Chapter 2. Fast Start: Cure for Impatience</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="FastStart.html#id2560189">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="FastStart.html#id2560212">Description of Example Sites</a></span></dt><dt><span class="sect1"><a href="FastStart.html#id2560282">Worked Examples</a></span></dt><dd><dl><dt><span class="sect2"><a href="FastStart.html#id2560300">Standalone Server</a></span></dt><dt><span class="sect2"><a href="FastStart.html#id2562042">Domain Member Server</a></span></dt><dt><span class="sect2"><a href="FastStart.html#id2562885">Domain Controller</a></span></dt></dl></dd></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 2. Fast Start: Cure for Impatience</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.74.0"><link rel="home" href="index.html" title="The Official Samba 3.3.x HOWTO and Reference Guide"><link rel="up" href="introduction.html" title="Part I. General Installation"><link rel="prev" href="install.html" title="Chapter 1. How to Install and Test SAMBA"><link rel="next" href="type.html" title="Part II. Server Configuration Basics"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 2. Fast Start: Cure for Impatience</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="install.html">Prev</a> </td><th width="60%" align="center">Part I. General Installation</th><td width="20%" align="right"> <a accesskey="n" href="type.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="FastStart"></a>Chapter 2. Fast Start: Cure for Impatience</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="orgname">Samba Team</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="FastStart.html#id2554105">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="FastStart.html#id2554128">Description of Example Sites</a></span></dt><dt><span class="sect1"><a href="FastStart.html#id2554197">Worked Examples</a></span></dt><dd><dl><dt><span class="sect2"><a href="FastStart.html#id2554216">Standalone Server</a></span></dt><dt><span class="sect2"><a href="FastStart.html#id2555957">Domain Member Server</a></span></dt><dt><span class="sect2"><a href="FastStart.html#id2556800">Domain Controller</a></span></dt></dl></dd></dl></div><p> 2 2 When we first asked for suggestions for inclusion in the Samba HOWTO documentation, 3 3 someone wrote asking for example configurations and lots of them. That is remarkably … … 8 8 that has been requested. 9 9 </p><p> 10 The information in this chapter is very sparse compared with the book <span class="quote">“<span class="quote">Samba-3 by Example</span>”</span>11 that was written after the original version of this book was nearly complete. <span class="quote">“<span class="quote">Samba-3 by Example</span>”</span>10 The information in this chapter is very sparse compared with the book “<span class="quote">Samba-3 by Example</span>” 11 that was written after the original version of this book was nearly complete. “<span class="quote">Samba-3 by Example</span>” 12 12 was the result of feedback from reviewers during the final copy editing of the first edition. It 13 13 was interesting to see that reader feedback mirrored that given by the original reviewers. 14 14 In any case, a month and a half was spent in doing basic research to better understand what 15 new as well as experienced network administrators would best benefit from. The book <span class="quote">“<span class="quote">Samba-3 by Example</span>”</span>15 new as well as experienced network administrators would best benefit from. The book “<span class="quote">Samba-3 by Example</span>” 16 16 is the result of that research. What is presented in the few pages of this book is covered 17 far more comprehensively in the second edition of <span class="quote">“<span class="quote">Samba-3 by Example</span>”</span>. The second edition17 far more comprehensively in the second edition of “<span class="quote">Samba-3 by Example</span>”. The second edition 18 18 of both books will be released at the same time. 19 19 </p><p> 20 So in summary, the book <span class="quote">“<span class="quote">The Official Samba-3 HOWTO & Reference Guide</span>”</span>is intended21 as the equivalent of an auto mechanic's repair guide. The book <span class="quote">“<span class="quote">Samba-3 by Example</span>”</span>is the20 So in summary, the book “<span class="quote">The Official Samba-3 HOWTO & Reference Guide</span>” is intended 21 as the equivalent of an auto mechanic's repair guide. The book “<span class="quote">Samba-3 by Example</span>” is the 22 22 equivalent of the driver's guide that explains how to drive the car. If you want complete network 23 23 configuration examples, go to <a class="ulink" href="http://www.samba.org/samba/docs/Samba3-ByExample.pdf" target="_top">Samba-3 by 24 24 Example</a>. 25 </p><div class="sect1" title="Features and Benefits"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2560189"></a>Features and Benefits</h2></div></div></div><p>25 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2554105"></a>Features and Benefits</h2></div></div></div><p> 26 26 Samba needs very little configuration to create a basic working system. 27 27 In this chapter we progress from the simple to the complex, for each providing … … 33 33 requests for example configurations. All identities have been obscured to protect 34 34 the guilty, and any resemblance to unreal nonexistent sites is deliberate. 35 </p></div><div class="sect1" title="Description of Example Sites"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2560212"></a>Description of Example Sites</h2></div></div></div><p>35 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2554128"></a>Description of Example Sites</h2></div></div></div><p> 36 36 In the first set of configuration examples we consider the case of exceptionally simple system requirements. 37 37 There is a real temptation to make something that should require little effort much too complex. … … 54 54 or replace them entirely. These cover domain member servers as well as Samba domain control (PDC/BDC) and 55 55 finally describes in detail a large distributed network with branch offices in remote locations. 56 </p></div><div class="sect1" title="Worked Examples"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2560282"></a>Worked Examples</h2></div></div></div><p>56 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2554197"></a>Worked Examples</h2></div></div></div><p> 57 57 The configuration examples are designed to cover everything necessary to get Samba 58 58 running. They do not cover basic operating system platform configuration, which is … … 61 61 It is also assumed that Samba has been correctly installed, either by way of installation 62 62 of the packages that are provided by the operating system vendor or through other means. 63 </p><div class="sect2" title="Standalone Server"><div class="titlepage"><div><div><h3 class="title"><a name="id2560300"></a>Standalone Server</h3></div></div></div><p>64 <a class="indexterm" name="id25 60308"></a>63 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2554216"></a>Standalone Server</h3></div></div></div><p> 64 <a class="indexterm" name="id2554223"></a> 65 65 A standalone server implies no more than the fact that it is not a domain controller 66 66 and it does not participate in domain control. It can be a simple, workgroup-like … … 69 69 As the examples are developed, every attempt is made to progress the system toward greater capability, just as 70 70 one might expect would happen in a real business office as that office grows in size and its needs change. 71 </p><div class="sect3" title="Anonymous Read-Only Document Server"><div class="titlepage"><div><div><h4 class="title"><a name="anon-ro"></a>Anonymous Read-Only Document Server</h4></div></div></div><p>72 <a class="indexterm" name="id25 60339"></a>71 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="anon-ro"></a>Anonymous Read-Only Document Server</h4></div></div></div><p> 72 <a class="indexterm" name="id2554254"></a> 73 73 The purpose of this type of server is to make available to any user 74 74 any documents or files that are placed on the shared resource. The 75 75 shared resource could be a CD-ROM drive, a CD-ROM image, or a file 76 76 storage area. 77 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>77 </p><div class="itemizedlist"><ul type="disc"><li><p> 78 78 The file system share point will be <code class="filename">/export</code>. 79 </p></li><li class="listitem"><p>79 </p></li><li><p> 80 80 All files will be owned by a user called Jack Baumbach. 81 81 Jack's login name will be <span class="emphasis"><em>jackb</em></span>. His password will be … … 83 83 using; do not use this in a production environment because 84 84 all readers of this document will know it. 85 </p></li></ul></div><div class="procedure" title="Procedure 2.1. Installation Procedure: Read-Only Server"><a name="id2560383"></a><p class="title"><b>Procedure 2.1. Installation Procedure: Read-Only Server</b></p><div class="example"><a name="anon-example"></a><p class="title"><b>Example 2.1. Anonymous Read-Only Server Configuration</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2560509"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2560519"></a><em class="parameter"><code>netbios name = HOBBIT</code></em></td></tr><tr><td><a class="indexterm" name="id2560530"></a><em class="parameter"><code>security = share</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[data]</code></em></td></tr><tr><td><a class="indexterm" name="id2560548"></a><em class="parameter"><code>comment = Data</code></em></td></tr><tr><td><a class="indexterm" name="id2560559"></a><em class="parameter"><code>path = /export</code></em></td></tr><tr><td><a class="indexterm" name="id2560569"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560580"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr></table></div></div><br class="example-break"><ol class="procedure" type="1"><li class="step" title="Step 1"><p>85 </p></li></ul></div><div class="procedure"><a name="id2554299"></a><p class="title"><b>Procedure 2.1. Installation Procedure: Read-Only Server</b></p><div class="example"><a name="anon-example"></a><p class="title"><b>Example 2.1. Anonymous Read-Only Server Configuration</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2554424"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2554435"></a><em class="parameter"><code>netbios name = HOBBIT</code></em></td></tr><tr><td><a class="indexterm" name="id2554445"></a><em class="parameter"><code>security = share</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[data]</code></em></td></tr><tr><td><a class="indexterm" name="id2554464"></a><em class="parameter"><code>comment = Data</code></em></td></tr><tr><td><a class="indexterm" name="id2554474"></a><em class="parameter"><code>path = /export</code></em></td></tr><tr><td><a class="indexterm" name="id2554485"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2554495"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr></table></div></div><br class="example-break"><ol type="1"><li><p> 86 86 Add user to system (with creation of the user's home directory): 87 87 </p><pre class="screen"> 88 88 <code class="prompt">root# </code><strong class="userinput"><code>useradd -c "Jack Baumbach" -m -g users -p m0r3pa1n jackb</code></strong> 89 89 </pre><p> 90 </p></li><li class="step" title="Step 2"><p>90 </p></li><li><p> 91 91 Create directory, and set permissions and ownership: 92 92 </p><pre class="screen"> … … 95 95 <code class="prompt">root# </code><strong class="userinput"><code>chown jackb.users /export</code></strong> 96 96 </pre><p> 97 </p></li><li class="step" title="Step 3"><p>97 </p></li><li><p> 98 98 Copy the files that should be shared to the <code class="filename">/export</code> 99 99 directory. 100 </p></li><li class="step" title="Step 4"><p>100 </p></li><li><p> 101 101 Install the Samba configuration file (<code class="filename">/etc/samba/smb.conf</code>) 102 102 as shown in <a class="link" href="FastStart.html#anon-example" title="Example 2.1. Anonymous Read-Only Server Configuration">Anonymous Read-Only Server Configuration</a>. 103 </p></li><li class="step" title="Step 5"><p>103 </p></li><li><p> 104 104 Test the configuration file by executing the following command: 105 105 </p><pre class="screen"> … … 137 137 guest only = Yes 138 138 </pre><p> 139 </p></li><li class="step" title="Step 6"><p>139 </p></li><li><p> 140 140 Start Samba using the method applicable to your operating system platform. The method that 141 141 should be used is platform dependent. Refer to <a class="link" href="compiling.html#startingSamba" title="Starting the smbd nmbd and winbindd">Starting Samba</a> 142 142 for further information regarding the starting of Samba. 143 </p></li><li class="step" title="Step 7"><p>143 </p></li><li><p> 144 144 Configure your MS Windows client for workgroup <span class="emphasis"><em>MIDEARTH</em></span>, 145 145 set the machine name to ROBBINS, reboot, wait a few (2 - 5) minutes, … … 152 152 The information above (following # Global parameters) provides the complete 153 153 contents of the <code class="filename">/etc/samba/smb.conf</code> file. 154 </p></div><div class="sect3" title="Anonymous Read-Write Document Server"><div class="titlepage"><div><div><h4 class="title"><a name="id2560716"></a>Anonymous Read-Write Document Server</h4></div></div></div><p>155 <a class="indexterm" name="id25 60724"></a>154 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2554632"></a>Anonymous Read-Write Document Server</h4></div></div></div><p> 155 <a class="indexterm" name="id2554640"></a> 156 156 We should view this configuration as a progression from the previous example. 157 157 The difference is that shared access is now forced to the user identity of jackb … … 170 170 </p><p> 171 171 The complete, modified <code class="filename">smb.conf</code> file is as shown in <a class="link" href="FastStart.html#anon-rw" title="Example 2.2. Modified Anonymous Read-Write smb.conf">“Modified Anonymous Read-Write smb.conf”</a>. 172 </p><div class="example"><a name="anon-rw"></a><p class="title"><b>Example 2.2. Modified Anonymous Read-Write smb.conf</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2560824"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2560834"></a><em class="parameter"><code>netbios name = HOBBIT</code></em></td></tr><tr><td><a class="indexterm" name="id2560844"></a><em class="parameter"><code>security = SHARE</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[data]</code></em></td></tr><tr><td><a class="indexterm" name="id2560863"></a><em class="parameter"><code>comment = Data</code></em></td></tr><tr><td><a class="indexterm" name="id2560874"></a><em class="parameter"><code>path = /export</code></em></td></tr><tr><td><a class="indexterm" name="id2560884"></a><em class="parameter"><code>force user = jackb</code></em></td></tr><tr><td><a class="indexterm" name="id2560894"></a><em class="parameter"><code>force group = users</code></em></td></tr><tr><td><a class="indexterm" name="id2560905"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2560915"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect3" title="Anonymous Print Server"><div class="titlepage"><div><div><h4 class="title"><a name="id2560928"></a>Anonymous Print Server</h4></div></div></div><p>173 <a class="indexterm" name="id25 60935"></a>172 </p><div class="example"><a name="anon-rw"></a><p class="title"><b>Example 2.2. Modified Anonymous Read-Write smb.conf</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2554739"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2554750"></a><em class="parameter"><code>netbios name = HOBBIT</code></em></td></tr><tr><td><a class="indexterm" name="id2554760"></a><em class="parameter"><code>security = SHARE</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[data]</code></em></td></tr><tr><td><a class="indexterm" name="id2554779"></a><em class="parameter"><code>comment = Data</code></em></td></tr><tr><td><a class="indexterm" name="id2554789"></a><em class="parameter"><code>path = /export</code></em></td></tr><tr><td><a class="indexterm" name="id2554800"></a><em class="parameter"><code>force user = jackb</code></em></td></tr><tr><td><a class="indexterm" name="id2554810"></a><em class="parameter"><code>force group = users</code></em></td></tr><tr><td><a class="indexterm" name="id2554820"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2554831"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2554843"></a>Anonymous Print Server</h4></div></div></div><p> 173 <a class="indexterm" name="id2554851"></a> 174 174 An anonymous print server serves two purposes: 175 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>175 </p><div class="itemizedlist"><ul type="disc"><li><p> 176 176 It allows printing to all printers from a single location. 177 </p></li><li class="listitem"><p>177 </p></li><li><p> 178 178 It reduces network traffic congestion due to many users trying 179 179 to access a limited number of printers. … … 188 188 not want to have automatic driver download, so we disable it in the following 189 189 configuration. <a class="link" href="FastStart.html#anon-print" title="Example 2.3. Anonymous Print Server smb.conf">“Anonymous Print Server smb.conf”</a> is the resulting <code class="filename">smb.conf</code> file. 190 </p><div class="example"><a name="anon-print"></a><p class="title"><b>Example 2.3. Anonymous Print Server smb.conf</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2561012"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2561022"></a><em class="parameter"><code>netbios name = LUTHIEN</code></em></td></tr><tr><td><a class="indexterm" name="id2561033"></a><em class="parameter"><code>security = share</code></em></td></tr><tr><td><a class="indexterm" name="id2561043"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2561054"></a><em class="parameter"><code>disable spoolss = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561064"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2561075"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2561094"></a><em class="parameter"><code>comment = All Printers</code></em></td></tr><tr><td><a class="indexterm" name="id2561104"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2561115"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561125"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561135"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561146"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><p>190 </p><div class="example"><a name="anon-print"></a><p class="title"><b>Example 2.3. Anonymous Print Server smb.conf</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2554928"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2554938"></a><em class="parameter"><code>netbios name = LUTHIEN</code></em></td></tr><tr><td><a class="indexterm" name="id2554948"></a><em class="parameter"><code>security = share</code></em></td></tr><tr><td><a class="indexterm" name="id2554959"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2554969"></a><em class="parameter"><code>disable spoolss = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2554980"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2554991"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2555009"></a><em class="parameter"><code>comment = All Printers</code></em></td></tr><tr><td><a class="indexterm" name="id2555020"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2555030"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2555041"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2555051"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2555061"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><p> 191 191 The above configuration is not ideal. It uses no smart features, and it deliberately 192 192 presents a less than elegant solution. But it is basic, and it does print. Samba makes … … 200 200 CUPS. In such case, it could be set to the name of any file that contains a list 201 201 of printers that should be made available to Windows clients. 202 </p><div class="note" title="Note"style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>202 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 203 203 Windows users will need to install a local printer and then change the print 204 204 to device after installation of the drivers. The print to device can then be set to … … 207 207 Make sure that the directory <code class="filename">/var/spool/samba</code> is capable of being used 208 208 as intended. The following steps must be taken to achieve this: 209 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>209 </p><div class="itemizedlist"><ul type="disc"><li><p> 210 210 The directory must be owned by the superuser (root) user and group: 211 211 </p><pre class="screen"> 212 212 <code class="prompt">root# </code><strong class="userinput"><code>chown root.root /var/spool/samba</code></strong> 213 213 </pre><p> 214 </p></li><li class="listitem"><p>214 </p></li><li><p> 215 215 Directory permissions should be set for public read-write with the 216 216 sticky bit set as shown: … … 220 220 The purpose of setting the sticky bit is to prevent who does not own the temporary print file 221 221 from being able to take control of it with the potential for devious misuse. 222 </p></li></ul></div><div class="note" title="Note"style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>223 <a class="indexterm" name="id25 61256"></a>224 <a class="indexterm" name="id25 61264"></a>222 </p></li></ul></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 223 <a class="indexterm" name="id2555171"></a> 224 <a class="indexterm" name="id2555180"></a> 225 225 On CUPS-enabled systems there is a facility to pass raw data directly to the printer without 226 226 intermediate processing via CUPS print filters. Where use of this mode of operation is desired, 227 227 it is necessary to configure a raw printing device. It is also necessary to enable the raw mime 228 228 handler in the <code class="filename">/etc/mime.conv</code> and <code class="filename">/etc/mime.types</code> 229 files. Refer to <a class="link" href="CUPS-printing.html#cups-raw" title="Explicitly Enable “raw”Printing for application/octet-stream">“Explicitly Enable raw Printing for application/octet-stream”</a>.230 </p></div></div><div class="sect3" title="Secure Read-Write File and Print Server"><div class="titlepage"><div><div><h4 class="title"><a name="id2561292"></a>Secure Read-Write File and Print Server</h4></div></div></div><p>229 files. Refer to <a class="link" href="CUPS-printing.html#cups-raw" title="Explicitly Enable raw Printing for application/octet-stream">“Explicitly Enable raw Printing for application/octet-stream”</a>. 230 </p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2555208"></a>Secure Read-Write File and Print Server</h4></div></div></div><p> 231 231 We progress now from simple systems to a server that is slightly more complex. 232 232 </p><p> … … 251 251 added to the list of active passdb backends no matter whether it specified directly in Samba configuration 252 252 file or not. 253 </p><div class="procedure" title="Procedure 2.2. Installing the Secure Office Server"><a name="id2561362"></a><p class="title"><b>Procedure 2.2. Installing the Secure Office Server</b></p><div class="example"><a name="OfficeServer"></a><p class="title"><b>Example 2.4. Secure Office Server smb.conf</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2561458"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2561468"></a><em class="parameter"><code>netbios name = OLORIN</code></em></td></tr><tr><td><a class="indexterm" name="id2561478"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2561489"></a><em class="parameter"><code>disable spoolss = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561499"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2561510"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2561529"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2561539"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2561550"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2561560"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[public]</code></em></td></tr><tr><td><a class="indexterm" name="id2561579"></a><em class="parameter"><code>comment = Data</code></em></td></tr><tr><td><a class="indexterm" name="id2561589"></a><em class="parameter"><code>path = /export</code></em></td></tr><tr><td><a class="indexterm" name="id2561600"></a><em class="parameter"><code>force user = maryo</code></em></td></tr><tr><td><a class="indexterm" name="id2561610"></a><em class="parameter"><code>force group = users</code></em></td></tr><tr><td><a class="indexterm" name="id2561621"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2561639"></a><em class="parameter"><code>comment = All Printers</code></em></td></tr><tr><td><a class="indexterm" name="id2561650"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2561660"></a><em class="parameter"><code>printer admin = root, maryo</code></em></td></tr><tr><td><a class="indexterm" name="id2561671"></a><em class="parameter"><code>create mask = 0600</code></em></td></tr><tr><td><a class="indexterm" name="id2561681"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561691"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561702"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561712"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><ol class="procedure" type="1"><li class="step" title="Step 1"><p>254 <a class="indexterm" name="id25 61373"></a>253 </p><div class="procedure"><a name="id2555278"></a><p class="title"><b>Procedure 2.2. Installing the Secure Office Server</b></p><div class="example"><a name="OfficeServer"></a><p class="title"><b>Example 2.4. Secure Office Server smb.conf</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2555373"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2555384"></a><em class="parameter"><code>netbios name = OLORIN</code></em></td></tr><tr><td><a class="indexterm" name="id2555394"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2555404"></a><em class="parameter"><code>disable spoolss = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2555415"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2555426"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2555445"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2555455"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2555465"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2555476"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[public]</code></em></td></tr><tr><td><a class="indexterm" name="id2555495"></a><em class="parameter"><code>comment = Data</code></em></td></tr><tr><td><a class="indexterm" name="id2555505"></a><em class="parameter"><code>path = /export</code></em></td></tr><tr><td><a class="indexterm" name="id2555515"></a><em class="parameter"><code>force user = maryo</code></em></td></tr><tr><td><a class="indexterm" name="id2555526"></a><em class="parameter"><code>force group = users</code></em></td></tr><tr><td><a class="indexterm" name="id2555536"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2555555"></a><em class="parameter"><code>comment = All Printers</code></em></td></tr><tr><td><a class="indexterm" name="id2555565"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2555576"></a><em class="parameter"><code>printer admin = root, maryo</code></em></td></tr><tr><td><a class="indexterm" name="id2555586"></a><em class="parameter"><code>create mask = 0600</code></em></td></tr><tr><td><a class="indexterm" name="id2555597"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2555607"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2555617"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2555628"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><ol type="1"><li><p> 254 <a class="indexterm" name="id2555289"></a> 255 255 Add all users to the operating system: 256 256 </p><pre class="screen"> … … 259 259 <code class="prompt">root# </code><strong class="userinput"><code>useradd -c "Amed Sehkah" -m -g users -p secret ameds</code></strong> 260 260 </pre><p> 261 </p></li><li class="step" title="Step 2"><p>261 </p></li><li><p> 262 262 Configure the Samba <code class="filename">smb.conf</code> file as shown in <a class="link" href="FastStart.html#OfficeServer" title="Example 2.4. Secure Office Server smb.conf">“Secure Office Server smb.conf”</a>. 263 </p></li><li class="step" title="Step 3"><p>263 </p></li><li><p> 264 264 Initialize the Microsoft Windows password database with the new users: 265 265 </p><pre class="screen"> … … 284 284 Added user ameds. 285 285 </pre><p> 286 </p></li><li class="step" title="Step 4"><p>286 </p></li><li><p> 287 287 Install printer using the CUPS Web interface. Make certain that all 288 288 printers that will be shared with Microsoft Windows clients are installed 289 289 as raw printing devices. 290 </p></li><li class="step" title="Step 5"><p>290 </p></li><li><p> 291 291 Start Samba using the operating system administrative interface. 292 292 Alternately, this can be done manually by executing: 293 <a class="indexterm" name="id25 61832"></a>294 <a class="indexterm" name="id25 61839"></a>295 <a class="indexterm" name="id25 61845"></a>296 <a class="indexterm" name="id25 61853"></a>293 <a class="indexterm" name="id2555748"></a> 294 <a class="indexterm" name="id2555754"></a> 295 <a class="indexterm" name="id2555760"></a> 296 <a class="indexterm" name="id2555769"></a> 297 297 </p><pre class="screen"> 298 298 <code class="prompt">root# </code><strong class="userinput"><code> nmbd; smbd;</code></strong> … … 301 301 maintaining control can add the <code class="constant">-D</code> flag to coerce them to start 302 302 up in daemon mode. 303 </p></li><li class="step" title="Step 6"><p>303 </p></li><li><p> 304 304 Configure the <code class="filename">/export</code> directory: 305 305 </p><pre class="screen"> … … 308 308 <code class="prompt">root# </code><strong class="userinput"><code>chmod u=rwx,g=rwx,o-rwx /export</code></strong> 309 309 </pre><p> 310 </p></li><li class="step" title="Step 7"><p>310 </p></li><li><p> 311 311 Check that Samba is running correctly: 312 312 </p><pre class="screen"> … … 335 335 Connection to olorin failed 336 336 </pre><p> 337 </p></li><li class="step" title="Step 8"><p>337 </p></li><li><p> 338 338 Connect to OLORIN as maryo: 339 339 </p><pre class="screen"> … … 359 359 explore slightly more complex examples. For the remainder of this chapter we abbreviate 360 360 instructions, since there are previous examples. 361 </p></div></div><div class="sect2" title="Domain Member Server"><div class="titlepage"><div><div><h3 class="title"><a name="id2562042"></a>Domain Member Server</h3></div></div></div><p>362 <a class="indexterm" name="id25 62049"></a>361 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2555957"></a>Domain Member Server</h3></div></div></div><p> 362 <a class="indexterm" name="id2555965"></a> 363 363 In this instance we consider the simplest server configuration we can get away with 364 364 to make an accounting department happy. Let's be warned, the users are accountants and they … … 391 391 access to all areas. Users must have a private home share for personal work-related files 392 392 and for materials not related to departmental operations. 393 </p><div class="sect3" title="Example Configuration"><div class="titlepage"><div><div><h4 class="title"><a name="id2562116"></a>Example Configuration</h4></div></div></div><p>393 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2556032"></a>Example Configuration</h4></div></div></div><p> 394 394 The server <span class="emphasis"><em>valinor</em></span> will be a member server of the company domain. 395 395 Accounting will have only a local server. User accounts will be on the domain controllers, 396 396 as will desktop profiles and all network policy files. 397 </p><div class="procedure"><div class="example"><a name="fast-member-server"></a><p class="title"><b>Example 2.5. Member Server smb.conf (Globals)</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2562190"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2562200"></a><em class="parameter"><code>netbios name = VALINOR</code></em></td></tr><tr><td><a class="indexterm" name="id2562210"></a><em class="parameter"><code>security = DOMAIN</code></em></td></tr><tr><td><a class="indexterm" name="id2562221"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2562231"></a><em class="parameter"><code>disable spoolss = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2562242"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2562253"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2562263"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2562273"></a><em class="parameter"><code>winbind use default domain = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2562284"></a><em class="parameter"><code>printing = cups</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="fast-memberserver-shares"></a><p class="title"><b>Example 2.6. Member Server smb.conf (Shares and Services)</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2562318"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2562328"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2562339"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2562349"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[spytfull]</code></em></td></tr><tr><td><a class="indexterm" name="id2562368"></a><em class="parameter"><code>comment = Accounting Application Only</code></em></td></tr><tr><td><a class="indexterm" name="id2562379"></a><em class="parameter"><code>path = /export/spytfull</code></em></td></tr><tr><td><a class="indexterm" name="id2562389"></a><em class="parameter"><code>valid users = @Accounts</code></em></td></tr><tr><td><a class="indexterm" name="id2562400"></a><em class="parameter"><code>admin users = maryo</code></em></td></tr><tr><td><a class="indexterm" name="id2562410"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[public]</code></em></td></tr><tr><td><a class="indexterm" name="id2562429"></a><em class="parameter"><code>comment = Data</code></em></td></tr><tr><td><a class="indexterm" name="id2562439"></a><em class="parameter"><code>path = /export/public</code></em></td></tr><tr><td><a class="indexterm" name="id2562450"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2562469"></a><em class="parameter"><code>comment = All Printers</code></em></td></tr><tr><td><a class="indexterm" name="id2562479"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2562489"></a><em class="parameter"><code>printer admin = root, maryo</code></em></td></tr><tr><td><a class="indexterm" name="id2562500"></a><em class="parameter"><code>create mask = 0600</code></em></td></tr><tr><td><a class="indexterm" name="id2562510"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2562521"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2562531"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2562541"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><ol class="procedure" type="1"><li class="step" title="Step 1"><p>397 </p><div class="procedure"><div class="example"><a name="fast-member-server"></a><p class="title"><b>Example 2.5. Member Server smb.conf (Globals)</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2556105"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2556116"></a><em class="parameter"><code>netbios name = VALINOR</code></em></td></tr><tr><td><a class="indexterm" name="id2556126"></a><em class="parameter"><code>security = DOMAIN</code></em></td></tr><tr><td><a class="indexterm" name="id2556136"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2556147"></a><em class="parameter"><code>disable spoolss = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2556157"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2556168"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2556179"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2556189"></a><em class="parameter"><code>winbind use default domain = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2556200"></a><em class="parameter"><code>printing = cups</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="fast-memberserver-shares"></a><p class="title"><b>Example 2.6. Member Server smb.conf (Shares and Services)</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2556233"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2556244"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2556254"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2556265"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[spytfull]</code></em></td></tr><tr><td><a class="indexterm" name="id2556283"></a><em class="parameter"><code>comment = Accounting Application Only</code></em></td></tr><tr><td><a class="indexterm" name="id2556295"></a><em class="parameter"><code>path = /export/spytfull</code></em></td></tr><tr><td><a class="indexterm" name="id2556305"></a><em class="parameter"><code>valid users = @Accounts</code></em></td></tr><tr><td><a class="indexterm" name="id2556315"></a><em class="parameter"><code>admin users = maryo</code></em></td></tr><tr><td><a class="indexterm" name="id2556326"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[public]</code></em></td></tr><tr><td><a class="indexterm" name="id2556345"></a><em class="parameter"><code>comment = Data</code></em></td></tr><tr><td><a class="indexterm" name="id2556355"></a><em class="parameter"><code>path = /export/public</code></em></td></tr><tr><td><a class="indexterm" name="id2556365"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2556384"></a><em class="parameter"><code>comment = All Printers</code></em></td></tr><tr><td><a class="indexterm" name="id2556395"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2556405"></a><em class="parameter"><code>printer admin = root, maryo</code></em></td></tr><tr><td><a class="indexterm" name="id2556415"></a><em class="parameter"><code>create mask = 0600</code></em></td></tr><tr><td><a class="indexterm" name="id2556426"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2556436"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2556447"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2556457"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><ol type="1"><li><p> 398 398 Do not add users to the UNIX/Linux server; all of this will run off the 399 399 central domain. 400 </p></li><li class="step" title="Step 2"><p>400 </p></li><li><p> 401 401 Configure <code class="filename">smb.conf</code> according to <a class="link" href="FastStart.html#fast-member-server" title="Example 2.5. Member Server smb.conf (Globals)">Member server smb.conf 402 402 (globals)</a> and <a class="link" href="FastStart.html#fast-memberserver-shares" title="Example 2.6. Member Server smb.conf (Shares and Services)">Member server smb.conf (shares 403 403 and services)</a>. 404 </p></li><li class="step" title="Step 3"><p>405 <a class="indexterm" name="id25 62558"></a>404 </p></li><li><p> 405 <a class="indexterm" name="id2556474"></a> 406 406 Join the domain. Note: Do not start Samba until this step has been completed! 407 407 </p><pre class="screen"> … … 409 409 Joined domain MIDEARTH. 410 410 </pre><p> 411 </p></li><li class="step" title="Step 4"><p>411 </p></li><li><p> 412 412 Make absolutely certain that you disable (shut down) the <code class="literal">nscd</code> 413 413 daemon on any system on which <code class="literal">winbind</code> is configured to run. 414 </p></li><li class="step" title="Step 5"><p>414 </p></li><li><p> 415 415 Start Samba following the normal method for your operating system platform. 416 416 If you wish to do this manually, execute as root: 417 <a class="indexterm" name="id25 62610"></a>418 <a class="indexterm" name="id25 62617"></a>419 <a class="indexterm" name="id25 62623"></a>420 <a class="indexterm" name="id25 62629"></a>421 <a class="indexterm" name="id25 62638"></a>422 <a class="indexterm" name="id25 62646"></a>417 <a class="indexterm" name="id2556526"></a> 418 <a class="indexterm" name="id2556532"></a> 419 <a class="indexterm" name="id2556538"></a> 420 <a class="indexterm" name="id2556545"></a> 421 <a class="indexterm" name="id2556553"></a> 422 <a class="indexterm" name="id2556562"></a> 423 423 </p><pre class="screen"> 424 424 <code class="prompt">root# </code><strong class="userinput"><code>nmbd; smbd; winbindd;</code></strong> 425 425 </pre><p> 426 </p></li><li class="step" title="Step 6"><p>426 </p></li><li><p> 427 427 Configure the name service switch (NSS) control file on your system to resolve user and group names 428 428 via winbind. Edit the following lines in <code class="filename">/etc/nsswitch.conf</code>: … … 432 432 hosts: files dns winbind 433 433 </pre><p> 434 </p></li><li class="step" title="Step 7"><p>434 </p></li><li><p> 435 435 Set the password for <code class="literal">wbinfo</code> to use: 436 436 </p><pre class="screen"> 437 437 <code class="prompt">root# </code><strong class="userinput"><code>wbinfo --set-auth-user=root%'bigsecret'</code></strong> 438 438 </pre><p> 439 </p></li><li class="step" title="Step 8"><p>439 </p></li><li><p> 440 440 Validate that domain user and group credentials can be correctly resolved by executing: 441 441 </p><pre class="screen"> … … 454 454 MIDEARTH\Accounts 455 455 </pre><p> 456 </p></li><li class="step" title="Step 9"><p>456 </p></li><li><p> 457 457 Check that <code class="literal">winbind</code> is working. The following demonstrates correct 458 458 username resolution via the <code class="literal">getent</code> system utility: … … 461 461 maryo:x:15000:15003:Mary Orville:/home/MIDEARTH/maryo:/bin/false 462 462 </pre><p> 463 </p></li><li class="step" title="Step 10"><p>463 </p></li><li><p> 464 464 A final test that we have this under control might be reassuring: 465 465 </p><pre class="screen"> … … 473 473 <code class="prompt">root# </code><strong class="userinput"><code>rm /export/a_file</code></strong> 474 474 </pre><p> 475 </p></li><li class="step" title="Step 11"><p>475 </p></li><li><p> 476 476 Configuration is now mostly complete, so this is an opportune time 477 477 to configure the directory structure for this site: … … 481 481 <code class="prompt">root# </code><strong class="userinput"><code>chown maryo.Accounts /export/{spytfull,public}</code></strong> 482 482 </pre><p> 483 </p></li></ol></div></div></div><div class="sect2" title="Domain Controller"><div class="titlepage"><div><div><h3 class="title"><a name="id2562885"></a>Domain Controller</h3></div></div></div><p>484 <a class="indexterm" name="id25 62892"></a>483 </p></li></ol></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2556800"></a>Domain Controller</h3></div></div></div><p> 484 <a class="indexterm" name="id2556808"></a> 485 485 For the remainder of this chapter the focus is on the configuration of domain control. 486 486 The examples that follow are for two implementation strategies. Remember, our objective is … … 499 499 authentication services. The following are symptoms of an under-resourced domain control 500 500 environment: 501 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>501 </p><div class="itemizedlist"><ul type="disc"><li><p> 502 502 Domain logons intermittently fail. 503 </p></li><li class="listitem"><p>503 </p></li><li><p> 504 504 File access on a domain member server intermittently fails, giving a permission denied 505 505 error message. … … 514 514 the contents of the database, except by external means (i.e., there is no self-contained protocol 515 515 in Samba-3 for Security Account Manager database [SAM] replication). 516 </p><div class="note" title="Note"style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>516 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 517 517 If you need more than one domain controller, do not use a tdbsam authentication backend. 518 </p></div><div class="sect3" title="Example: Engineering Office"><div class="titlepage"><div><div><h4 class="title"><a name="id2562964"></a>Example: Engineering Office</h4></div></div></div><p>518 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2556880"></a>Example: Engineering Office</h4></div></div></div><p> 519 519 The engineering office network server we present here is designed to demonstrate use 520 520 of the new tdbsam password backend. The tdbsam 521 521 facility is new to Samba-3. It is designed to provide many user and machine account controls 522 522 that are possible with Microsoft Windows NT4. It is safe to use this in smaller networks. 523 </p><div class="procedure"><div class="example"><a name="fast-engoffice-global"></a><p class="title"><b>Example 2.7. Engineering Office smb.conf (globals)</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2563034"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2563044"></a><em class="parameter"><code>netbios name = FRODO</code></em></td></tr><tr><td><a class="indexterm" name="id2563055"></a><em class="parameter"><code>passdb backend = tdbsam</code></em></td></tr><tr><td><a class="indexterm" name="id2563065"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2563076"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m %u</code></em></td></tr><tr><td><a class="indexterm" name="id2563087"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r %u</code></em></td></tr><tr><td><a class="indexterm" name="id2563098"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd %g</code></em></td></tr><tr><td><a class="indexterm" name="id2563109"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel %g</code></em></td></tr><tr><td><a class="indexterm" name="id2563120"></a><em class="parameter"><code>add user to group script = /usr/sbin/groupmod -A %u %g</code></em></td></tr><tr><td><a class="indexterm" name="id2563132"></a><em class="parameter"><code>delete user from group script = /usr/sbin/groupmod -R %u %g</code></em></td></tr><tr><td><a class="indexterm" name="id2563144"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody %u</code></em></td></tr><tr><td># Note: The following specifies the default logon script.</td></tr><tr><td># Per user logon scripts can be specified in the user account using pdbedit </td></tr><tr><td><a class="indexterm" name="id2563165"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td># This sets the default profile path. Set per user paths with pdbedit</td></tr><tr><td><a class="indexterm" name="id2563180"></a><em class="parameter"><code>logon path = \\%L\Profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2563191"></a><em class="parameter"><code>logon drive = H:</code></em></td></tr><tr><td><a class="indexterm" name="id2563202"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2563212"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2563223"></a><em class="parameter"><code>os level = 35</code></em></td></tr><tr><td><a class="indexterm" name="id2563233"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2563243"></a><em class="parameter"><code>domain master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2563254"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2563264"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2563275"></a><em class="parameter"><code>printing = cups</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="fast-engoffice-shares"></a><p class="title"><b>Example 2.8. Engineering Office smb.conf (shares and services)</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2563308"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2563318"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2563329"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2563339"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td># Printing auto-share (makes printers available thru CUPS)</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2563362"></a><em class="parameter"><code>comment = All Printers</code></em></td></tr><tr><td><a class="indexterm" name="id2563373"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2563383"></a><em class="parameter"><code>printer admin = root, maryo</code></em></td></tr><tr><td><a class="indexterm" name="id2563393"></a><em class="parameter"><code>create mask = 0600</code></em></td></tr><tr><td><a class="indexterm" name="id2563404"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2563414"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2563425"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id2563443"></a><em class="parameter"><code>comment = Printer Drivers Share</code></em></td></tr><tr><td><a class="indexterm" name="id2563454"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2563466"></a><em class="parameter"><code>write list = maryo, root</code></em></td></tr><tr><td><a class="indexterm" name="id2563476"></a><em class="parameter"><code>printer admin = maryo, root</code></em></td></tr><tr><td># Needed to support domain logons</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2563499"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2563510"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2563521"></a><em class="parameter"><code>admin users = root, maryo</code></em></td></tr><tr><td><a class="indexterm" name="id2563531"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2563542"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td># For profiles to work, create a user directory under the path</td></tr><tr><td># shown. i.e., mkdir -p /var/lib/samba/profiles/maryo</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[Profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2563569"></a><em class="parameter"><code>comment = Roaming Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2563580"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2563591"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2563602"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td># Other resource (share/printer) definitions would follow below.</td></tr></table></div></div><br class="example-break"><ol class="procedure" type="1"><li class="step" title="Step 1"><p>523 </p><div class="procedure"><div class="example"><a name="fast-engoffice-global"></a><p class="title"><b>Example 2.7. Engineering Office smb.conf (globals)</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2556950"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2556960"></a><em class="parameter"><code>netbios name = FRODO</code></em></td></tr><tr><td><a class="indexterm" name="id2556970"></a><em class="parameter"><code>passdb backend = tdbsam</code></em></td></tr><tr><td><a class="indexterm" name="id2556981"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2556991"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m %u</code></em></td></tr><tr><td><a class="indexterm" name="id2557002"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r %u</code></em></td></tr><tr><td><a class="indexterm" name="id2557014"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd %g</code></em></td></tr><tr><td><a class="indexterm" name="id2557025"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel %g</code></em></td></tr><tr><td><a class="indexterm" name="id2557036"></a><em class="parameter"><code>add user to group script = /usr/sbin/groupmod -A %u %g</code></em></td></tr><tr><td><a class="indexterm" name="id2557048"></a><em class="parameter"><code>delete user from group script = /usr/sbin/groupmod -R %u %g</code></em></td></tr><tr><td><a class="indexterm" name="id2557060"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody %u</code></em></td></tr><tr><td># Note: The following specifies the default logon script.</td></tr><tr><td># Per user logon scripts can be specified in the user account using pdbedit </td></tr><tr><td><a class="indexterm" name="id2557080"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td># This sets the default profile path. Set per user paths with pdbedit</td></tr><tr><td><a class="indexterm" name="id2557096"></a><em class="parameter"><code>logon path = \\%L\Profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2557107"></a><em class="parameter"><code>logon drive = H:</code></em></td></tr><tr><td><a class="indexterm" name="id2557117"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2557128"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557138"></a><em class="parameter"><code>os level = 35</code></em></td></tr><tr><td><a class="indexterm" name="id2557149"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557159"></a><em class="parameter"><code>domain master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557169"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2557180"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2557190"></a><em class="parameter"><code>printing = cups</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="fast-engoffice-shares"></a><p class="title"><b>Example 2.8. Engineering Office smb.conf (shares and services)</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2557224"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2557234"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2557244"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2557255"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td># Printing auto-share (makes printers available thru CUPS)</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2557278"></a><em class="parameter"><code>comment = All Printers</code></em></td></tr><tr><td><a class="indexterm" name="id2557288"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2557299"></a><em class="parameter"><code>printer admin = root, maryo</code></em></td></tr><tr><td><a class="indexterm" name="id2557309"></a><em class="parameter"><code>create mask = 0600</code></em></td></tr><tr><td><a class="indexterm" name="id2557319"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557330"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557340"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id2557359"></a><em class="parameter"><code>comment = Printer Drivers Share</code></em></td></tr><tr><td><a class="indexterm" name="id2557370"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2557381"></a><em class="parameter"><code>write list = maryo, root</code></em></td></tr><tr><td><a class="indexterm" name="id2557392"></a><em class="parameter"><code>printer admin = maryo, root</code></em></td></tr><tr><td># Needed to support domain logons</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2557414"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2557425"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2557436"></a><em class="parameter"><code>admin users = root, maryo</code></em></td></tr><tr><td><a class="indexterm" name="id2557447"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557457"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td># For profiles to work, create a user directory under the path</td></tr><tr><td># shown. i.e., mkdir -p /var/lib/samba/profiles/maryo</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[Profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2557485"></a><em class="parameter"><code>comment = Roaming Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2557496"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2557507"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2557517"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td># Other resource (share/printer) definitions would follow below.</td></tr></table></div></div><br class="example-break"><ol type="1"><li><p> 524 524 A working PDC configuration using the tdbsam 525 525 password backend can be found in <a class="link" href="FastStart.html#fast-engoffice-global" title="Example 2.7. Engineering Office smb.conf (globals)">Engineering Office smb.conf 526 526 (globals)</a> together with <a class="link" href="FastStart.html#fast-engoffice-shares" title="Example 2.8. Engineering Office smb.conf (shares and services)">Engineering Office smb.conf 527 527 (shares and services)</a>: 528 <a class="indexterm" name="id25 63005"></a>529 </p></li><li class="step" title="Step 2"><p>528 <a class="indexterm" name="id2556920"></a> 529 </p></li><li><p> 530 530 Create UNIX group accounts as needed using a suitable operating system tool: 531 531 </p><pre class="screen"> … … 535 535 <code class="prompt">root# </code><strong class="userinput"><code>groupadd qateam</code></strong> 536 536 </pre><p> 537 </p></li><li class="step" title="Step 3"><p>537 </p></li><li><p> 538 538 Create user accounts on the system using the appropriate tool 539 539 provided with the operating system. Make sure all user home directories … … 541 541 on files, directories, printers, and as required for use in the Samba 542 542 environment. 543 </p></li><li class="step" title="Step 4"><p>544 <a class="indexterm" name="id25 63684"></a>545 <a class="indexterm" name="id25 63693"></a>543 </p></li><li><p> 544 <a class="indexterm" name="id2557600"></a> 545 <a class="indexterm" name="id2557608"></a> 546 546 Assign each of the UNIX groups to NT groups by executing this shell script 547 547 (You could name the script <code class="filename">initGroups.sh</code>): … … 560 560 net groupmap add ntgroup="QA Team" unixgroup=qateam type=d 561 561 </pre><p> 562 </p></li><li class="step" title="Step 5"><p>562 </p></li><li><p> 563 563 Create the <code class="filename">scripts</code> directory for use in the 564 564 <em class="parameter"><code>[NETLOGON]</code></em> share: … … 571 571 The above configuration provides a functional PDC 572 572 system to which must be added file shares and printers as required. 573 </p></div><div class="sect3" title="A Big Organization"><div class="titlepage"><div><div><h4 class="title"><a name="id2563764"></a>A Big Organization</h4></div></div></div><p>573 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2557679"></a>A Big Organization</h4></div></div></div><p> 574 574 In this section we finally get to review in brief a Samba-3 configuration that 575 575 uses a Lightweight Directory Access (LDAP)-based authentication backend. The … … 577 577 and Backup Domain Control (BDC), as well as to enable a higher degree of 578 578 scalability to meet the needs of a very distributed environment. 579 </p><div class="sect4" title="The Primary Domain Controller"><div class="titlepage"><div><div><h5 class="title"><a name="id2563779"></a>The Primary Domain Controller</h5></div></div></div><p>579 </p><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2557694"></a>The Primary Domain Controller</h5></div></div></div><p> 580 580 This is an example of a minimal configuration to run a Samba-3 PDC 581 581 using an LDAP authentication backend. It is assumed that the operating system … … 588 588 <code class="filename">/usr/share/doc/packages/sambaXXXXXX/examples/LDAP/smbldap-tools</code> directory. 589 589 Idealx scripts version <code class="constant">smbldap-tools-0.9.1</code> are known to work well. 590 </p><div class="procedure"><div class="example"><a name="fast-ldap"></a><p class="title"><b>Example 2.9. LDAP backend smb.conf for PDC</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2564005"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2564016"></a><em class="parameter"><code>netbios name = FRODO</code></em></td></tr><tr><td><a class="indexterm" name="id2564026"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id2564037"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2564048"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2564059"></a><em class="parameter"><code>add user script = /usr/local/sbin/smbldap-useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2564070"></a><em class="parameter"><code>delete user script = /usr/local/sbin/smbldap-userdel %u</code></em></td></tr><tr><td><a class="indexterm" name="id2564082"></a><em class="parameter"><code>add group script = /usr/local/sbin/smbldap-groupadd -p '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2564093"></a><em class="parameter"><code>delete group script = /usr/local/sbin/smbldap-groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2564105"></a><em class="parameter"><code>add user to group script = /usr/local/sbin/smbldap-groupmod -m '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2564116"></a><em class="parameter"><code>delete user from group script = /usr/local/sbin/smbldap-groupmod -x '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2564129"></a><em class="parameter"><code>set primary group script = /usr/local/sbin/smbldap-usermod -g '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2564141"></a><em class="parameter"><code>add machine script = /usr/local/sbin/smbldap-useradd -w '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2564152"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2564163"></a><em class="parameter"><code>logon path = \\%L\Profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2564174"></a><em class="parameter"><code>logon drive = H:</code></em></td></tr><tr><td><a class="indexterm" name="id2564185"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2564195"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2564206"></a><em class="parameter"><code>os level = 35</code></em></td></tr><tr><td><a class="indexterm" name="id2564216"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2564226"></a><em class="parameter"><code>domain master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2564237"></a><em class="parameter"><code>ldap suffix = dc=quenya,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2564248"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2564259"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2564270"></a><em class="parameter"><code>ldap group suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2564281"></a><em class="parameter"><code>ldap idmap suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2564292"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=quenya,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2564303"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id2564314"></a><em class="parameter"><code>ldap passwd sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2564324"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2564334"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2564345"></a><em class="parameter"><code>printing = cups</code></em></td></tr></table></div></div><br class="example-break"><ol class="procedure" type="1"><li class="step" title="Step 1"><p>590 </p><div class="procedure"><div class="example"><a name="fast-ldap"></a><p class="title"><b>Example 2.9. LDAP backend smb.conf for PDC</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2557921"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2557931"></a><em class="parameter"><code>netbios name = FRODO</code></em></td></tr><tr><td><a class="indexterm" name="id2557942"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id2557953"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2557964"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2557974"></a><em class="parameter"><code>add user script = /usr/local/sbin/smbldap-useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2557986"></a><em class="parameter"><code>delete user script = /usr/local/sbin/smbldap-userdel %u</code></em></td></tr><tr><td><a class="indexterm" name="id2557997"></a><em class="parameter"><code>add group script = /usr/local/sbin/smbldap-groupadd -p '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2558009"></a><em class="parameter"><code>delete group script = /usr/local/sbin/smbldap-groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2558020"></a><em class="parameter"><code>add user to group script = /usr/local/sbin/smbldap-groupmod -m '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2558032"></a><em class="parameter"><code>delete user from group script = /usr/local/sbin/smbldap-groupmod -x '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2558044"></a><em class="parameter"><code>set primary group script = /usr/local/sbin/smbldap-usermod -g '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2558056"></a><em class="parameter"><code>add machine script = /usr/local/sbin/smbldap-useradd -w '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2558068"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2558079"></a><em class="parameter"><code>logon path = \\%L\Profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2558090"></a><em class="parameter"><code>logon drive = H:</code></em></td></tr><tr><td><a class="indexterm" name="id2558100"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2558111"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2558121"></a><em class="parameter"><code>os level = 35</code></em></td></tr><tr><td><a class="indexterm" name="id2558132"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2558142"></a><em class="parameter"><code>domain master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2558152"></a><em class="parameter"><code>ldap suffix = dc=quenya,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2558163"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2558174"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2558186"></a><em class="parameter"><code>ldap group suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2558197"></a><em class="parameter"><code>ldap idmap suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2558208"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=quenya,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2558219"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id2558229"></a><em class="parameter"><code>ldap passwd sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2558240"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2558250"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2558260"></a><em class="parameter"><code>printing = cups</code></em></td></tr></table></div></div><br class="example-break"><ol type="1"><li><p> 591 591 Obtain from the Samba sources <code class="filename">~/examples/LDAP/samba.schema</code> 592 592 and copy it to the <code class="filename">/etc/openldap/schema/</code> directory. 593 </p></li><li class="step" title="Step 2"><p>593 </p></li><li><p> 594 594 Set up the LDAP server. This example is suitable for OpenLDAP 2.1.x. 595 595 The <code class="filename">/etc/openldap/slapd.conf</code> file. 596 <a class="indexterm" name="id25 63848"></a>596 <a class="indexterm" name="id2557763"></a> 597 597 <span style="color: red"><title>Example slapd.conf File</title></span> 598 598 </p><pre class="screen"> … … 628 628 index default sub 629 629 </pre><p> 630 </p></li><li class="step" title="Step 3"><p>630 </p></li><li><p> 631 631 Create the following file <code class="filename">initdb.ldif</code>: 632 <a class="indexterm" name="id25 63892"></a>632 <a class="indexterm" name="id2557807"></a> 633 633 </p><pre class="programlisting"> 634 634 # Organization for SambaXP Demo … … 661 661 # The password for above is 'mordonL8' 662 662 </pre><p> 663 </p></li><li class="step" title="Step 4"><p>663 </p></li><li><p> 664 664 Load the initial data above into the LDAP database: 665 665 </p><pre class="screen"> 666 666 <code class="prompt">root# </code><strong class="userinput"><code>slapadd -v -l initdb.ldif</code></strong> 667 667 </pre><p> 668 </p></li><li class="step" title="Step 5"><p>668 </p></li><li><p> 669 669 Start the LDAP server using the appropriate tool or method for 670 670 the operating system platform on which it is installed. 671 </p></li><li class="step" title="Step 6"><p>671 </p></li><li><p> 672 672 Install the Idealx script files in the <code class="filename">/usr/local/sbin</code> directory, 673 673 then configure the smbldap_conf.pm file to match your system configuration. 674 </p></li><li class="step" title="Step 7"><p>674 </p></li><li><p> 675 675 The <code class="filename">smb.conf</code> file that drives this backend can be found in example <a class="link" href="FastStart.html#fast-ldap" title="Example 2.9. LDAP backend smb.conf for PDC">LDAP backend smb.conf for PDC</a>. Add additional stanzas 676 676 as required. 677 </p></li><li class="step" title="Step 8"><p>677 </p></li><li><p> 678 678 Add the LDAP password to the <code class="filename">secrets.tdb</code> file so Samba can update 679 679 the LDAP database: … … 681 681 <code class="prompt">root# </code><strong class="userinput"><code>smbpasswd -w mordonL8</code></strong> 682 682 </pre><p> 683 </p></li><li class="step" title="Step 9"><p>683 </p></li><li><p> 684 684 Add users and groups as required. Users and groups added using Samba tools 685 685 will automatically be added to both the LDAP backend and the operating 686 686 system as required. 687 </p></li></ol></div></div><div class="sect4" title="Backup Domain Controller"><div class="titlepage"><div><div><h5 class="title"><a name="id2564396"></a>Backup Domain Controller</h5></div></div></div><p>687 </p></li></ol></div></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2558311"></a>Backup Domain Controller</h5></div></div></div><p> 688 688 <a class="link" href="FastStart.html#fast-bdc" title="Example 2.10. Remote LDAP BDC smb.conf">“Remote LDAP BDC smb.conf”</a> shows the example configuration for the BDC. Note that 689 689 the <code class="filename">smb.conf</code> file does not specify the smbldap-tools scripts they are 690 690 not needed on a BDC. Add additional stanzas for shares and printers as required. 691 </p><div class="procedure"><div class="example"><a name="fast-bdc"></a><p class="title"><b>Example 2.10. Remote LDAP BDC smb.conf</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2564467"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2564477"></a><em class="parameter"><code>netbios name = GANDALF</code></em></td></tr><tr><td><a class="indexterm" name="id2564488"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://frodo.quenya.org</code></em></td></tr><tr><td><a class="indexterm" name="id2564499"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2564510"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2564520"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2564531"></a><em class="parameter"><code>logon path = \\%L\Profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2564542"></a><em class="parameter"><code>logon drive = H:</code></em></td></tr><tr><td><a class="indexterm" name="id2564552"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2564563"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2564573"></a><em class="parameter"><code>os level = 33</code></em></td></tr><tr><td><a class="indexterm" name="id2564584"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2564594"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id2564604"></a><em class="parameter"><code>ldap suffix = dc=quenya,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2564616"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2564627"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2564638"></a><em class="parameter"><code>ldap group suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2564649"></a><em class="parameter"><code>ldap idmap suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2564660"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=quenya,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2564671"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id2564681"></a><em class="parameter"><code>ldap passwd sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2564692"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2564702"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2564713"></a><em class="parameter"><code>printing = cups</code></em></td></tr></table></div></div><br class="example-break"><ol class="procedure" type="1"><li class="step" title="Step 1"><p>691 </p><div class="procedure"><div class="example"><a name="fast-bdc"></a><p class="title"><b>Example 2.10. Remote LDAP BDC smb.conf</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2558383"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2558393"></a><em class="parameter"><code>netbios name = GANDALF</code></em></td></tr><tr><td><a class="indexterm" name="id2558403"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://frodo.quenya.org</code></em></td></tr><tr><td><a class="indexterm" name="id2558415"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2558425"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2558436"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2558447"></a><em class="parameter"><code>logon path = \\%L\Profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2558458"></a><em class="parameter"><code>logon drive = H:</code></em></td></tr><tr><td><a class="indexterm" name="id2558468"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2558478"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2558489"></a><em class="parameter"><code>os level = 33</code></em></td></tr><tr><td><a class="indexterm" name="id2558499"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2558510"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id2558520"></a><em class="parameter"><code>ldap suffix = dc=quenya,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2558531"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2558542"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2558553"></a><em class="parameter"><code>ldap group suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2558564"></a><em class="parameter"><code>ldap idmap suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2558575"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=quenya,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2558587"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id2558597"></a><em class="parameter"><code>ldap passwd sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2558607"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2558618"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2558628"></a><em class="parameter"><code>printing = cups</code></em></td></tr></table></div></div><br class="example-break"><ol type="1"><li><p> 692 692 Decide if the BDC should have its own LDAP server or not. If the BDC is to be 693 693 the LDAP server, change the following <code class="filename">smb.conf</code> as indicated. The default 694 694 configuration in <a class="link" href="FastStart.html#fast-bdc" title="Example 2.10. Remote LDAP BDC smb.conf">Remote LDAP BDC smb.conf</a> 695 695 uses a central LDAP server. 696 </p></li><li class="step" title="Step 2"><p>696 </p></li><li><p> 697 697 Configure the NETLOGON and PROFILES directory as for the PDC in <a class="link" href="FastStart.html#fast-bdc" title="Example 2.10. Remote LDAP BDC smb.conf">“Remote LDAP BDC smb.conf”</a>. 698 698 </p></li></ol></div></div></div></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="install.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="introduction.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="type.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 1. How to Install and Test SAMBA </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Part II. Server Configuration Basics</td></tr></table></div></body></html>
Note:
See TracChangeset
for help on using the changeset viewer.
