Changeset 596 for trunk/server/docs/manpages/winbindd.8
- Timestamp:
- Jul 2, 2011, 3:35:33 PM (14 years ago)
- File:
-
- 1 edited
-
trunk/server/docs/manpages/winbindd.8 (modified) (40 diffs)
Legend:
- Unmodified
- Added
- Removed
-
trunk/server/docs/manpages/winbindd.8
r480 r596 1 '\" t 1 2 .\" Title: winbindd 2 3 .\" Author: [see the "AUTHOR" section] 3 .\" Generator: DocBook XSL Stylesheets v1.7 4.0<http://docbook.sf.net/>4 .\" Date: 0 6/18/20104 .\" Generator: DocBook XSL Stylesheets v1.75.2 <http://docbook.sf.net/> 5 .\" Date: 03/06/2011 5 6 .\" Manual: System Administration tools 6 7 .\" Source: Samba 3.5 7 8 .\" Language: English 8 9 .\" 9 .TH "WINBINDD" "8" "06/18/2010" "Samba 3\&.5" "System Administration tools" 10 .\" ----------------------------------------------------------------- 11 .\" * (re)Define some macros 12 .\" ----------------------------------------------------------------- 13 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 14 .\" toupper - uppercase a string (locale-aware) 15 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 16 .de toupper 17 .tr aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqQrRsStTuUvVwWxXyYzZ 18 \\$* 19 .tr aabbccddeeffgghhiijjkkllmmnnooppqqrrssttuuvvwwxxyyzz 20 .. 21 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 22 .\" SH-xref - format a cross-reference to an SH section 23 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 24 .de SH-xref 25 .ie n \{\ 26 .\} 27 .toupper \\$* 28 .el \{\ 29 \\$* 30 .\} 31 .. 32 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 33 .\" SH - level-one heading that works better for non-TTY output 34 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 35 .de1 SH 36 .\" put an extra blank line of space above the head in non-TTY output 37 .if t \{\ 38 .sp 1 39 .\} 40 .sp \\n[PD]u 41 .nr an-level 1 42 .set-an-margin 43 .nr an-prevailing-indent \\n[IN] 44 .fi 45 .in \\n[an-margin]u 46 .ti 0 47 .HTML-TAG ".NH \\n[an-level]" 48 .it 1 an-trap 49 .nr an-no-space-flag 1 50 .nr an-break-flag 1 51 \." make the size of the head bigger 52 .ps +3 53 .ft B 54 .ne (2v + 1u) 55 .ie n \{\ 56 .\" if n (TTY output), use uppercase 57 .toupper \\$* 58 .\} 59 .el \{\ 60 .nr an-break-flag 0 61 .\" if not n (not TTY), use normal case (not uppercase) 62 \\$1 63 .in \\n[an-margin]u 64 .ti 0 65 .\" if not n (not TTY), put a border/line under subheading 66 .sp -.6 67 \l'\n(.lu' 68 .\} 69 .. 70 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 71 .\" SS - level-two heading that works better for non-TTY output 72 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 73 .de1 SS 74 .sp \\n[PD]u 75 .nr an-level 1 76 .set-an-margin 77 .nr an-prevailing-indent \\n[IN] 78 .fi 79 .in \\n[IN]u 80 .ti \\n[SN]u 81 .it 1 an-trap 82 .nr an-no-space-flag 1 83 .nr an-break-flag 1 84 .ps \\n[PS-SS]u 85 \." make the size of the head bigger 86 .ps +2 87 .ft B 88 .ne (2v + 1u) 89 .if \\n[.$] \&\\$* 90 .. 91 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 92 .\" BB/BE - put background/screen (filled box) around block of text 93 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 94 .de BB 95 .if t \{\ 96 .sp -.5 97 .br 98 .in +2n 99 .ll -2n 100 .gcolor red 101 .di BX 102 .\} 103 .. 104 .de EB 105 .if t \{\ 106 .if "\\$2"adjust-for-leading-newline" \{\ 107 .sp -1 108 .\} 109 .br 110 .di 111 .in 112 .ll 113 .gcolor 114 .nr BW \\n(.lu-\\n(.i 115 .nr BH \\n(dn+.5v 116 .ne \\n(BHu+.5v 117 .ie "\\$2"adjust-for-leading-newline" \{\ 118 \M[\\$1]\h'1n'\v'+.5v'\D'P \\n(BWu 0 0 \\n(BHu -\\n(BWu 0 0 -\\n(BHu'\M[] 119 .\} 120 .el \{\ 121 \M[\\$1]\h'1n'\v'-.5v'\D'P \\n(BWu 0 0 \\n(BHu -\\n(BWu 0 0 -\\n(BHu'\M[] 122 .\} 123 .in 0 124 .sp -.5v 125 .nf 126 .BX 127 .in 128 .sp .5v 129 .fi 130 .\} 131 .. 132 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 133 .\" BM/EM - put colored marker in margin next to block of text 134 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 135 .de BM 136 .if t \{\ 137 .br 138 .ll -2n 139 .gcolor red 140 .di BX 141 .\} 142 .. 143 .de EM 144 .if t \{\ 145 .br 146 .di 147 .ll 148 .gcolor 149 .nr BH \\n(dn 150 .ne \\n(BHu 151 \M[\\$1]\D'P -.75n 0 0 \\n(BHu -(\\n[.i]u - \\n(INu - .75n) 0 0 -\\n(BHu'\M[] 152 .in 0 153 .nf 154 .BX 155 .in 156 .fi 157 .\} 158 .. 10 .TH "WINBINDD" "8" "03/06/2011" "Samba 3\&.5" "System Administration tools" 159 11 .\" ----------------------------------------------------------------- 160 12 .\" * set default formatting … … 167 19 .\" * MAIN CONTENT STARTS HERE * 168 20 .\" ----------------------------------------------------------------- 169 .SH "N ame"21 .SH "NAME" 170 22 winbindd \- Name Service Switch daemon for resolving names from NT servers 171 .SH "Synopsis" 172 .fam C 23 .SH "SYNOPSIS" 173 24 .HP \w'\ 'u 174 \FCwinbindd\F[] [\-D] [\-F] [\-S] [\-i] [\-Y] [\-d\ <debug\ level>] [\-s\ <smb\ config\ file>] [\-n] 175 .fam 25 winbindd [\-D] [\-F] [\-S] [\-i] [\-Y] [\-d\ <debug\ level>] [\-s\ <smb\ config\ file>] [\-n] 176 26 .SH "DESCRIPTION" 177 27 .PP … … 180 30 suite\&. 181 31 .PP 182 \FCwinbindd\F[] 32 winbindd 183 33 is a daemon that provides a number of services to the Name Service Switch capability found in most modern C libraries, to arbitrary applications via PAM and 184 \FCntlm_auth\F[] 34 ntlm_auth 185 35 and to Samba itself\&. 186 36 .PP 187 37 Even if winbind is not used for nsswitch, it still provides a service to 188 \FCsmbd\F[],189 \FCntlm_auth\F[] 38 smbd, 39 ntlm_auth 190 40 and the 191 \FCpam_winbind\&.so\F[] 41 pam_winbind\&.so 192 42 PAM module, by managing connections to domain controllers\&. In this configuraiton the 193 43 \m[blue]\fBidmap uid\fR\m[] … … 197 47 .PP 198 48 The Name Service Switch allows user and system information to be obtained from different databases services such as NIS or DNS\&. The exact behaviour can be configured through the 199 \FC/etc/nsswitch\&.conf\F[] 49 /etc/nsswitch\&.conf 200 50 file\&. Users and groups are allocated as they are resolved to a range of user and group ids specified by the administrator of the Samba system\&. 201 51 .PP 202 52 The service provided by 203 \FCwinbindd\F[] 53 winbindd 204 54 is called `winbind\' and can be used to resolve user and group information from a Windows NT server\&. The service can also provide authentication services via an associated PAM module\&. 205 55 .PP 206 56 The 207 \FCpam_winbind\F[] 57 pam_winbind 208 58 module supports the 209 59 \fIauth\fR, … … 214 64 \fIaccount\fR 215 65 module simply performs a getpwnam() to verify that the system can obtain a uid for the user, as the domain controller has already performed access control\&. If the 216 \FClibnss_winbind\F[] 66 libnss_winbind 217 67 library has been correctly installed, or an alternate source of names configured, this should always succeed\&. 218 68 .PP … … 222 72 .RS 4 223 73 This feature is only available on IRIX\&. User information traditionally stored in the 224 \FChosts(5)\F[] 74 hosts(5) 225 75 file and used by 226 \FCgethostbyname(3)\F[] 76 gethostbyname(3) 227 77 functions\&. Names are resolved through the WINS server or by broadcast\&. 228 78 .RE … … 231 81 .RS 4 232 82 User information traditionally stored in the 233 \FCpasswd(5)\F[] 83 passwd(5) 234 84 file and used by 235 \FCgetpwent(3)\F[] 85 getpwent(3) 236 86 functions\&. 237 87 .RE … … 240 90 .RS 4 241 91 Group information traditionally stored in the 242 \FCgroup(5)\F[] 92 group(5) 243 93 file and used by 244 \FCgetgrent(3)\F[] 94 getgrent(3) 245 95 functions\&. 246 96 .RE 247 97 .PP 248 98 For example, the following simple configuration in the 249 \FC/etc/nsswitch\&.conf\F[] 99 /etc/nsswitch\&.conf 250 100 file can be used to initially resolve user and group information from 251 \FC/etc/passwd \F[] 101 /etc/passwd 252 102 and 253 \FC/etc/group\F[] 103 /etc/group 254 104 and then from the Windows NT server\&. 255 105 .sp … … 257 107 .RS 4 258 108 .\} 259 .fam C260 .ps -1261 109 .nf 262 .if t \{\263 .sp -1264 .\}265 .BB lightgray adjust-for-leading-newline266 .sp -1267 268 110 passwd: files winbind 269 111 group: files winbind … … 273 115 hosts: files dns wins 274 116 275 .EB lightgray adjust-for-leading-newline276 .if t \{\277 .sp 1278 .\}279 117 .fi 280 .fam281 .ps +1282 118 .if n \{\ 283 119 .RE … … 285 121 .PP 286 122 The following simple configuration in the 287 \FC/etc/nsswitch\&.conf\F[] 123 /etc/nsswitch\&.conf 288 124 file can be used to initially resolve hostnames from 289 \FC/etc/hosts\F[] 125 /etc/hosts 290 126 and then from the WINS server\&. 291 127 .sp … … 293 129 .RS 4 294 130 .\} 295 .fam C296 .ps -1297 131 .nf 298 .if t \{\299 .sp -1300 .\}301 .BB lightgray adjust-for-leading-newline302 .sp -1303 304 132 hosts: files wins 305 .EB lightgray adjust-for-leading-newline306 .if t \{\307 .sp 1308 .\}309 133 .fi 310 .fam311 .ps +1312 134 .if n \{\ 313 135 .RE … … 318 140 .RS 4 319 141 If specified, this parameter causes the server to operate as a daemon\&. That is, it detaches itself and runs in the background on the appropriate port\&. This switch is assumed if 320 \FCwinbindd\F[] 142 winbindd 321 143 is executed on the command line of a shell\&. 322 144 .RE … … 325 147 .RS 4 326 148 If specified, this parameter causes the main 327 \FCwinbindd\F[] 149 winbindd 328 150 process to not daemonize, i\&.e\&. double\-fork and disassociate with the terminal\&. Child processes are still created as normal to service each connection request, but the main process does not exit\&. This operation mode is suitable for running 329 \FCwinbindd\F[] 151 winbindd 330 152 under process supervisors such as 331 \FCsupervise\F[] 153 supervise 332 154 and 333 \FCsvscan\F[] 155 svscan 334 156 from Daniel J\&. Bernstein\'s 335 \FCdaemontools\F[] 157 daemontools 336 158 package, or the AIX process monitor\&. 337 159 .RE … … 340 162 .RS 4 341 163 If specified, this parameter causes 342 \FCwinbindd\F[] 164 winbindd 343 165 to log to standard output rather than a file\&. 344 166 .RE … … 356 178 \m[blue]\fB\%smb.conf.5.html#\fR\m[] 357 179 parameter in the 358 \FCsmb\&.conf\F[] 180 smb\&.conf 359 181 file\&. 360 182 .RE … … 368 190 .RS 4 369 191 The file specified contains the configuration details required by the server\&. The information in this file includes server\-specific information such as what printcap file to use, as well as descriptions of all the services that the server is to provide\&. See 370 \FCsmb\&.conf\F[] 192 smb\&.conf 371 193 for more information\&. The default configuration file name is determined at compile time\&. 372 194 .RE … … 387 209 .RS 4 388 210 Tells 389 \FCwinbindd\F[] 211 winbindd 390 212 to not become a daemon and detach from the current terminal\&. This option is used by developers when interactive debugging of 391 \FCwinbindd\F[] 213 winbindd 392 214 is required\&. 393 \FCwinbindd\F[] 215 winbindd 394 216 also logs to standard output, as if the 395 \ FC\-S\F[]217 \-S 396 218 parameter had been given\&. 397 219 .RE … … 409 231 .PP 410 232 Users and groups on a Windows NT server are assigned a security id (SID) which is globally unique when the user or group is created\&. To convert the Windows NT user or group into a unix user or group, a mapping between SIDs and unix user and group ids is required\&. This is one of the jobs that 411 \FC winbindd\F[] 233 winbindd 412 234 performs\&. 413 235 .PP … … 418 240 .PP 419 241 Configuration of the 420 \FCwinbindd\F[] 242 winbindd 421 243 daemon is done through configuration parameters in the 422 244 \fBsmb.conf\fR(5) … … 559 381 .PP 560 382 In 561 \FC/etc/nsswitch\&.conf\F[] 383 /etc/nsswitch\&.conf 562 384 put the following: 563 385 .sp … … 565 387 .RS 4 566 388 .\} 567 .fam C568 .ps -1569 389 .nf 570 .if t \{\571 .sp -1572 .\}573 .BB lightgray adjust-for-leading-newline574 .sp -1575 576 390 passwd: files winbind 577 391 group: files winbind 578 .EB lightgray adjust-for-leading-newline579 .if t \{\580 .sp 1581 .\}582 392 .fi 583 .fam584 .ps +1585 393 .if n \{\ 586 394 .RE … … 588 396 .PP 589 397 In 590 \FC/etc/pam\&.d/*\F[] 398 /etc/pam\&.d/* 591 399 replace the 592 400 \fI auth\fR … … 596 404 .RS 4 597 405 .\} 598 .fam C599 .ps -1600 406 .nf 601 .if t \{\602 .sp -1603 .\}604 .BB lightgray adjust-for-leading-newline605 .sp -1606 607 407 auth required /lib/security/pam_securetty\&.so 608 408 auth required /lib/security/pam_nologin\&.so … … 610 410 auth required /lib/security/pam_unix\&.so \e 611 411 use_first_pass shadow nullok 612 .EB lightgray adjust-for-leading-newline613 .if t \{\614 .sp 1615 .\}616 412 .fi 617 .fam 618 .ps +1 619 .if n \{\ 620 .RE 621 .\} 622 .sp 623 .if n \{\ 624 .sp 625 .\} 626 .RS 4 627 .BM yellow 413 .if n \{\ 414 .RE 415 .\} 416 .sp 417 .if n \{\ 418 .sp 419 .\} 420 .RS 4 628 421 .it 1 an-trap 629 422 .nr an-no-space-flag 1 … … 637 430 The PAM module pam_unix has recently replaced the module pam_pwdb\&. Some Linux systems use the module pam_unix2 in place of pam_unix\&. 638 431 .sp .5v 639 .EM yellow640 432 .RE 641 433 .PP … … 648 440 Now replace the account lines with this: 649 441 .PP 650 \FCaccount required /lib/security/pam_winbind\&.so \F[] 442 account required /lib/security/pam_winbind\&.so 651 443 .PP 652 444 The next step is to join the domain\&. To do that use the 653 \FCnet\F[] 445 net 654 446 program like this: 655 447 .PP 656 \FCnet join \-S PDC \-U Administrator\F[] 448 net join \-S PDC \-U Administrator 657 449 .PP 658 450 The username after the … … 661 453 .PP 662 454 Next copy 663 \FClibnss_winbind\&.so\F[] 455 libnss_winbind\&.so 664 456 to 665 \FC/lib\F[] 457 /lib 666 458 and 667 \FCpam_winbind\&.so \F[] 459 pam_winbind\&.so 668 460 to 669 \FC/lib/security\F[]\&. A symbolic link needs to be made from670 \FC/lib/libnss_winbind\&.so\F[] 461 /lib/security\&. A symbolic link needs to be made from 462 /lib/libnss_winbind\&.so 671 463 to 672 \FC/lib/libnss_winbind\&.so\&.2\F[]\&. If you are using an older version of glibc then the target of the link should be673 \FC/lib/libnss_winbind\&.so\&.1\F[]\&.464 /lib/libnss_winbind\&.so\&.2\&. If you are using an older version of glibc then the target of the link should be 465 /lib/libnss_winbind\&.so\&.1\&. 674 466 .PP 675 467 Finally, setup a … … 680 472 .RS 4 681 473 .\} 682 .fam C683 .ps -1684 474 .nf 685 .if t \{\686 .sp -1687 .\}688 .BB lightgray adjust-for-leading-newline689 .sp -1690 691 475 [global] 692 476 winbind separator = + … … 699 483 security = domain 700 484 password server = * 701 .EB lightgray adjust-for-leading-newline702 .if t \{\703 .sp 1704 .\}705 485 .fi 706 .fam707 .ps +1708 486 .if n \{\ 709 487 .RE … … 711 489 .PP 712 490 Now start winbindd and you should find that your user and group database is expanded to include your NT users and groups, and that you can login to your unix box as a domain user, using the DOMAIN+user syntax for the username\&. You may wish to use the commands 713 \FCgetent passwd\F[] 491 getent passwd 714 492 and 715 \FCgetent group \F[] 493 getent group 716 494 to confirm the correct operation of winbindd\&. 717 495 .SH "NOTES" 718 496 .PP 719 497 The following notes are useful when configuring and running 720 \FCwinbindd\F[]:498 winbindd: 721 499 .PP 722 500 \fBnmbd\fR(8) 723 501 must be running on the local machine for 724 \FCwinbindd\F[] 502 winbindd 725 503 to work\&. 726 504 .PP … … 728 506 .PP 729 507 If more than one UNIX machine is running 730 \FCwinbindd\F[], then in general the user and groups ids allocated by winbindd will not be the same\&. The user and group ids will only be valid for the local machine, unless a shared508 winbindd, then in general the user and groups ids allocated by winbindd will not be the same\&. The user and group ids will only be valid for the local machine, unless a shared 731 509 \m[blue]\fBidmap backend\fR\m[] 732 510 is configured\&. … … 736 514 .PP 737 515 The following signals can be used to manipulate the 738 \FCwinbindd\F[] 516 winbindd 739 517 daemon\&. 740 518 .PP … … 749 527 .RS 4 750 528 The SIGUSR2 signal will cause 751 \FC winbindd\F[] 529 winbindd 752 530 to write status information to the winbind log file\&. 753 531 .sp … … 756 534 .SH "FILES" 757 535 .PP 758 \FC/etc/nsswitch\&.conf(5)\F[] 536 /etc/nsswitch\&.conf(5) 759 537 .RS 4 760 538 Name service switch configuration file\&. … … 764 542 .RS 4 765 543 The UNIX pipe over which clients communicate with the 766 \FCwinbindd\F[] 544 winbindd 767 545 program\&. For security reasons, the winbind client will only attempt to connect to the winbindd daemon if both the 768 \FC/tmp/\&.winbindd\F[] 546 /tmp/\&.winbindd 769 547 directory and 770 \FC/tmp/\&.winbindd/pipe\F[] 548 /tmp/\&.winbindd/pipe 771 549 file are owned by root\&. 772 550 .RE … … 775 553 .RS 4 776 554 The UNIX pipe over which \'privileged\' clients communicate with the 777 \FCwinbindd\F[] 555 winbindd 778 556 program\&. For security reasons, access to some winbindd functions \- like those needed by the 779 \FCntlm_auth\F[] 557 ntlm_auth 780 558 utility \- is restricted\&. By default, only users in the \'root\' group will get this access, however the administrator may change the group permissions on $LOCKDIR/winbindd_privileged to allow programs like \'squid\' to use ntlm_auth\&. Note that the winbind client will only attempt to connect to the winbindd daemon if both the 781 \FC$LOCKDIR/winbindd_privileged\F[] 559 $LOCKDIR/winbindd_privileged 782 560 directory and 783 \FC$LOCKDIR/winbindd_privileged/pipe\F[] 561 $LOCKDIR/winbindd_privileged/pipe 784 562 file are owned by root\&. 785 563 .RE … … 795 573 \fI\-\-with\-lockdir\fR 796 574 option\&. This directory is by default 797 \FC/usr/local/samba/var/locks \F[]\&.575 /usr/local/samba/var/locks\&. 798 576 .RE 799 577 .PP … … 807 585 .SH "SEE ALSO" 808 586 .PP 809 \FCnsswitch\&.conf(5)\F[],587 nsswitch\&.conf(5), 810 588 \fBsamba\fR(7), 811 589 \fBwbinfo\fR(1), … … 817 595 The original Samba software and related utilities were created by Andrew Tridgell\&. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed\&. 818 596 .PP 819 \FCwbinfo\F[] 597 wbinfo 820 598 and 821 \FCwinbindd\F[] 599 winbindd 822 600 were written by Tim Potter\&. 823 601 .PP
Note:
See TracChangeset
for help on using the changeset viewer.
