Changeset 599 for trunk/server/docs/htmldocs/Samba3-ByExample
- Timestamp:
- Jul 6, 2011, 8:21:13 PM (14 years ago)
- Location:
- trunk/server/docs/htmldocs/Samba3-ByExample
- Files:
-
- 27 edited
-
Big500users.html (modified) (54 diffs)
-
DMSMig.html (modified) (2 diffs)
-
DomApps.html (modified) (34 diffs)
-
ExNetworks.html (modified) (2 diffs)
-
HA.html (modified) (26 diffs)
-
RefSection.html (modified) (1 diff)
-
apa.html (modified) (27 diffs)
-
appendix.html (modified) (37 diffs)
-
ch14.html (modified) (7 diffs)
-
go01.html (modified) (4 diffs)
-
happy.html (modified) (167 diffs)
-
index.html (modified) (1 diff)
-
ix01.html (modified) (1 diff)
-
kerberos.html (modified) (67 diffs)
-
net2000users.html (modified) (61 diffs)
-
ntmigration.html (modified) (51 diffs)
-
nw4migration.html (modified) (30 diffs)
-
pr01.html (modified) (1 diff)
-
pr02.html (modified) (1 diff)
-
pr03.html (modified) (1 diff)
-
preface.html (modified) (11 diffs)
-
primer.html (modified) (30 diffs)
-
secure.html (modified) (80 diffs)
-
simple.html (modified) (50 diffs)
-
small.html (modified) (42 diffs)
-
unixclients.html (modified) (89 diffs)
-
upgrades.html (modified) (52 diffs)
Legend:
- Unmodified
- Added
- Removed
-
trunk/server/docs/htmldocs/Samba3-ByExample/Big500users.html
r414 r599 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 4. The 500-User Office</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 4.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="secure.html" title="Chapter 3. Secure Office Networking"><link rel="next" href="happy.html" title="Chapter 5. Making Happy Users"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 4. The 500-User Office</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="secure.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="happy.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="Big500users"></a>Chapter 4. The 500-User Office</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="Big500users.html#id2565229">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id2565274">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id2565373">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id2565409">Technical Issues</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2565612">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id2565635">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#ch5-dnshcp-setup">Installation of DHCP, DNS, and Samba Control Files</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2566362">Server Preparation: All Servers</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2566927">Server-Specific Preparation</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5-procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2570125">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id2570184">Questions and Answers</a></span></dt></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 4. The 500-User Office</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="secure.html" title="Chapter 3. Secure Office Networking"><link rel="next" href="happy.html" title="Chapter 5. Making Happy Users"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 4. The 500-User Office</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="secure.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="happy.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 4. The 500-User Office"><div class="titlepage"><div><div><h2 class="title"><a name="Big500users"></a>Chapter 4. The 500-User Office</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="Big500users.html#id336007">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id336038">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id336113">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id336141">Technical Issues</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id336318">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id336338">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#ch5-dnshcp-setup">Installation of DHCP, DNS, and Samba Control Files</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id337052">Server Preparation: All Servers</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id337568">Server-Specific Preparation</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5-procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id340544">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id340597">Questions and Answers</a></span></dt></dl></div><p> 2 2 The Samba-3 networking you explored in <a class="link" href="secure.html" title="Chapter 3. Secure Office Networking">“Secure Office Networking”</a> covers the finer points of 3 3 configuration of peripheral services such as DHCP and DNS, and WINS. You experienced … … 7 7 An analysis of the history of postings to the Samba mailing list easily demonstrates 8 8 that the two most prevalent Samba problem areas are 9 </p><div class="itemizedlist"><ul type="disc"><li><p>9 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 10 10 Defective resolution of a NetBIOS name to its IP address 11 </p></li><li ><p>11 </p></li><li class="listitem"><p> 12 12 Printing problems 13 13 </p></li></ul></div><p> … … 18 18 to make printing more complex for the administrator while making it easier for the user. 19 19 </p><p> 20 <a class="indexterm" name="id 2565165"></a>21 <a class="indexterm" name="id 2565172"></a>22 <a class="indexterm" name="id 2565178"></a>20 <a class="indexterm" name="id335954"></a> 21 <a class="indexterm" name="id335961"></a> 22 <a class="indexterm" name="id335967"></a> 23 23 <a class="link" href="secure.html" title="Chapter 3. Secure Office Networking">“Secure Office Networking”</a> demonstrates operation of a DHCP server and a DNS server 24 24 as well as a central WINS server. You validated the operation of these services and … … 42 42 You should take the opportunity to innovate and expand on the methods presented 43 43 here and explore them to the fullest. 44 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2565229"></a>Introduction</h2></div></div></div><p>44 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id336007"></a>Introduction</h2></div></div></div><p> 45 45 Business continues to go well for Abmas. Mr. Meany is driving your success and the 46 46 network continues to grow thanks to the hard work Christine has done. You recently … … 67 67 it is rolled out. Your strategy is to complete the new network so that it 68 68 is ready for operation when the old office moves into the new premises. 69 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2565274"></a>Assignment Tasks</h3></div></div></div><p>69 </p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id336038"></a>Assignment Tasks</h3></div></div></div><p> 70 70 The acquired business had 280 network users. The old Abmas building housed 71 71 220 network users in unbelievably cramped conditions. The network that … … 108 108 every four months. They automatically roll that out to each desktop system. 109 109 You must keep DirectPointe informed of all changes. 110 </p><p><a class="indexterm" name="id 2565345"></a>110 </p><p><a class="indexterm" name="id336088"></a> 111 111 The new network has a single Samba Primary Domain Controller (PDC) located in the 112 112 Network Operation Center (NOC). Buildings 1 and 2 each have a local server … … 116 116 Printing is based on raw pass-through facilities just as it has been used so far. 117 117 All printer drivers are installed on the desktop and notebook computers. 118 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2565373"></a>Dissection and Discussion</h2></div></div></div><p>119 <a class="indexterm" name="id 2565381"></a>118 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id336113"></a>Dissection and Discussion</h2></div></div></div><p> 119 <a class="indexterm" name="id336121"></a> 120 120 The example you are building in this chapter is of a network design that works, but this 121 121 does not make it a design that is recommended. As a general rule, there should be at least … … 128 128 controller. This is not a good omen for user satisfaction. You, of course, address this 129 129 very soon (see <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>). 130 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2565409"></a>Technical Issues</h3></div></div></div><p>130 </p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id336141"></a>Technical Issues</h3></div></div></div><p> 131 131 Stan has talked you into a horrible compromise, but it is addressed. Just make 132 132 certain that the performance of this network is well validated before going live. 133 133 </p><p> 134 134 Design decisions made in this design include the following: 135 </p><div class="itemizedlist"><ul type="disc"><li><p>136 <a class="indexterm" name="id 2565430"></a>137 <a class="indexterm" name="id 2565437"></a>138 <a class="indexterm" name="id 2565444"></a>135 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 136 <a class="indexterm" name="id336161"></a> 137 <a class="indexterm" name="id336168"></a> 138 <a class="indexterm" name="id336174"></a> 139 139 A single PDC is being implemented. This limitation is based on the choice not to 140 140 use LDAP. Many network administrators fear using LDAP because of the perceived 141 141 complexity of implementation and management of an LDAP-based backend for all user 142 142 identity management as well as to store network access credentials. 143 </p></li><li ><p>144 <a class="indexterm" name="id 2565461"></a>145 <a class="indexterm" name="id 2565468"></a>143 </p></li><li class="listitem"><p> 144 <a class="indexterm" name="id336188"></a> 145 <a class="indexterm" name="id336195"></a> 146 146 Because of the refusal to use an LDAP (ldapsam) passdb backend at this time, the 147 147 only choice that makes sense with 500 users is to use the tdbsam passwd backend. … … 152 152 machines periodically change the secret machine password. When this happens, there 153 153 is no mechanism to return the changed password to the PDC. 154 </p></li><li ><p>154 </p></li><li class="listitem"><p> 155 155 All domain user, group, and machine accounts are managed on the PDC. This makes 156 156 for a simple mode of operation but has to be balanced with network performance and 157 157 integrity of operations considerations. 158 </p></li><li ><p>159 <a class="indexterm" name="id 2565508"></a>158 </p></li><li class="listitem"><p> 159 <a class="indexterm" name="id336229"></a> 160 160 A single central WINS server is being used. The PDC is also the WINS server. 161 161 Any attempt to operate a routed network without a WINS server while using NetBIOS … … 164 164 normally located on the Windows XP Professional client in the 165 165 <code class="filename">C:\WINDOWS\SYSTEM32\ETC\DRIVERS</code> directory. 166 </p></li><li ><p>166 </p></li><li class="listitem"><p> 167 167 At this time the Samba WINS database cannot be replicated. That is 168 168 why a single WINS server is being implemented. This should work without a problem. 169 </p></li><li ><p>170 <a class="indexterm" name="id 2565545"></a>169 </p></li><li class="listitem"><p> 170 <a class="indexterm" name="id336261"></a> 171 171 BDCs make use of <code class="literal">winbindd</code> to provide 172 172 access to domain security credentials for file system access and object storage. 173 </p></li><li ><p>174 <a class="indexterm" name="id 2565564"></a>175 <a class="indexterm" name="id 2565574"></a>173 </p></li><li class="listitem"><p> 174 <a class="indexterm" name="id336279"></a> 175 <a class="indexterm" name="id336288"></a> 176 176 Configuration of Windows XP Professional clients is achieved using DHCP. Each 177 177 subnet has its own DHCP server. Backup DHCP serving is provided by one … … 179 179 all routers. The DHCP Relay agent must be programmed to pass DHCP Requests from the 180 180 network directed at the backup DHCP server. 181 </p></li><li ><p>181 </p></li><li class="listitem"><p> 182 182 All network users are granted the ability to print to any printer that is 183 183 network-attached. All printers are available from each server. Print jobs that … … 185 185 routed to the print spooler that is in control of that printer. The specific details 186 186 of how this might be done are demonstrated for one example only. 187 </p></li><li ><p>187 </p></li><li class="listitem"><p> 188 188 The network address and subnetmask chosen provide 1022 usable IP addresses in 189 189 each subnet. If in the future more addresses are required, it would make sense 190 190 to add further subnets rather than change addressing. 191 </p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2565612"></a>Political Issues</h3></div></div></div><p>191 </p></li></ul></div></div><div class="sect2" title="Political Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id336318"></a>Political Issues</h3></div></div></div><p> 192 192 This case gets close to the real world. You and I know the right way to implement 193 193 domain control. Politically, we have to navigate a minefield. In this case, the need is to … … 195 195 by having the real solution ready before it is needed. That real solution is presented in 196 196 <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>. 197 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2565635"></a>Implementation</h2></div></div></div><p>197 </p></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id336338"></a>Implementation</h2></div></div></div><p> 198 198 The following configuration process begins following installation of Red Hat Fedora Core2 on the 199 199 three servers shown in the network topology diagram in <a class="link" href="Big500users.html#chap05net" title="Figure 4.1. Network Topology 500 User Network Using tdbsam passdb backend.">“Network Topology 500 User Network Using tdbsam passdb backend.”</a>. You have 200 200 selected hardware that is appropriate to the task. 201 </p><div class="figure"><a name="chap05net"></a><p class="title"><b>Figure 4.1. Network Topology 500 User Network Using tdbsam passdb backend.</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap5-net.png" width="270" alt="Network Topology 500 User Network Using tdbsam passdb backend."></div></div></div><br class="figure-break"><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch5-dnshcp-setup"></a>Installation of DHCP, DNS, and Samba Control Files</h3></div></div></div><p>201 </p><div class="figure"><a name="chap05net"></a><p class="title"><b>Figure 4.1. Network Topology 500 User Network Using tdbsam passdb backend.</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap5-net.png" width="270" alt="Network Topology 500 User Network Using tdbsam passdb backend."></div></div></div><br class="figure-break"><div class="sect2" title="Installation of DHCP, DNS, and Samba Control Files"><div class="titlepage"><div><div><h3 class="title"><a name="ch5-dnshcp-setup"></a>Installation of DHCP, DNS, and Samba Control Files</h3></div></div></div><p> 202 202 Carefully install the configuration files into the correct locations as shown in 203 203 <a class="link" href="Big500users.html#ch5-filelocations" title="Table 4.1. Domain: MEGANET, File Locations for Servers">“Domain: MEGANET, File Locations for Servers”</a>. You should validate that the full file path is … … 206 206 The abbreviation shown in this table as <code class="constant">{VLN}</code> refers to 207 207 the directory location beginning with <code class="filename">/var/lib/named</code>. 208 </p><div class="table"><a name="ch5-filelocations"></a><p class="title"><b>Table 4.1. Domain: <code class="constant">MEGANET</code>, File Locations for Servers</b></p><div class="table-contents"><table summary="Domain: MEGANET, File Locations for Servers" border="1"><colgroup><col align="left"><col align="left"><col align="center"><col align="center"><col align="center"></colgroup><thead><tr><th colspan="2" align="center">File Information</th><th colspan="3" align="center">Server Name</th></tr><tr><th align="center">Source</th><th align="center">Target Location</th><th align="center">MASSIVE</th><th align="center">BLDG1</th><th align="center">BLDG2</th></tr></thead><tbody><tr><td align="left"><a class="link" href="Big500users.html#ch5-massivesmb" title="Example 4.1. Server: MASSIVE (PDC), File: /etc/samba/smb.conf">“Server: MASSIVE (PDC), File: /etc/samba/smb.conf”</a></td><td align="left"><code class="filename">/etc/samba/smb.conf</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-dc-common" title="Example 4.2. Server: MASSIVE (PDC), File: /etc/samba/dc-common.conf">“Server: MASSIVE (PDC), File: /etc/samba/dc-common.conf”</a></td><td align="left"><code class="filename">/etc/samba/dc-common.conf</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-commonsmb" title="Example 4.3. Common Samba Configuration File: /etc/samba/common.conf">“Common Samba Configuration File: /etc/samba/common.conf”</a></td><td align="left"><code class="filename">/etc/samba/common.conf</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-bldg1-smb" title="Example 4.4. Server: BLDG1 (Member), File: smb.conf">“Server: BLDG1 (Member), File: smb.conf”</a></td><td align="left"><code class="filename">/etc/samba/smb.conf</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-bldg2-smb" title="Example 4.5. Server: BLDG2 (Member), File: smb.conf">“Server: BLDG2 (Member), File: smb.conf”</a></td><td align="left"><code class="filename">/etc/samba/smb.conf</code></td><td align="center">No</td><td align="center">No</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-dommem-smb" title="Example 4.6. Common Domain Member Include File: dom-mem.conf">“Common Domain Member Include File: dom-mem.conf”</a></td><td align="left"><code class="filename">/etc/samba/dommem.conf</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#massive-dhcp" title="Example 4.7. Server: MASSIVE, File: dhcpd.conf">“Server: MASSIVE, File: dhcpd.conf”</a></td><td align="left"><code class="filename">/etc/dhcpd.conf</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#bldg1dhcp" title="Example 4.8. Server: BLDG1, File: dhcpd.conf">“Server: BLDG1, File: dhcpd.conf”</a></td><td align="left"><code class="filename">/etc/dhcpd.conf</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#bldg2dhcp" title="Example 4.9. Server: BLDG2, File: dhcpd.conf">“Server: BLDG2, File: dhcpd.conf”</a></td><td align="left"><code class="filename">/etc/dhcpd.conf</code></td><td align="center">No</td><td align="center">No</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#massive-nameda" title="Example 4.10. Server: MASSIVE, File: named.conf, Part: A">“Server: MASSIVE, File: named.conf, Part: A”</a></td><td align="left"><code class="filename">/etc/named.conf (part A)</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#massive-namedb" title="Example 4.11. Server: MASSIVE, File: named.conf, Part: B">“Server: MASSIVE, File: named.conf, Part: B”</a></td><td align="left"><code class="filename">/etc/named.conf (part B)</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#massive-namedc" title="Example 4.12. Server: MASSIVE, File: named.conf, Part: C">“Server: MASSIVE, File: named.conf, Part: C”</a></td><td align="left"><code class="filename">/etc/named.conf (part C)</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#abmasbizdns" title="Example 4.13. Forward Zone File: abmas.biz.hosts">“Forward Zone File: abmas.biz.hosts”</a></td><td align="left"><code class="filename">{VLN}/master/abmas.biz.hosts</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#abmasusdns" title="Example 4.14. Forward Zone File: abmas.biz.hosts">“Forward Zone File: abmas.biz.hosts”</a></td><td align="left"><code class="filename">{VLN}/master/abmas.us.hosts</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#bldg12nameda" title="Example 4.15. Servers: BLDG1/BLDG2, File: named.conf, Part: A">“Servers: BLDG1/BLDG2, File: named.conf, Part: A”</a></td><td align="left"><code class="filename">/etc/named.conf (part A)</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#bldg12namedb" title="Example 4.16. Servers: BLDG1/BLDG2, File: named.conf, Part: B">“Servers: BLDG1/BLDG2, File: named.conf, Part: B”</a></td><td align="left"><code class="filename">/etc/named.conf (part B)</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="appendix.html#loopback" title="Example 15.3. DNS Localhost Forward Zone File: /var/lib/named/localhost.zone">“DNS Localhost Forward Zone File: /var/lib/named/localhost.zone”</a></td><td align="left"><code class="filename">{VLN}/localhost.zone</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="appendix.html#dnsloopy" title="Example 15.4. DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone">“DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone”</a></td><td align="left"><code class="filename">{VLN}/127.0.0.zone</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="appendix.html#roothint" title="Example 15.5. DNS Root Name Server Hint File: /var/lib/named/root.hint">“DNS Root Name Server Hint File: /var/lib/named/root.hint”</a></td><td align="left"><code class="filename">{VLN}/root.hint</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr></tbody></table></div></div><br class="table-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2566362"></a>Server Preparation: All Servers</h3></div></div></div><p>208 </p><div class="table"><a name="ch5-filelocations"></a><p class="title"><b>Table 4.1. Domain: <code class="constant">MEGANET</code>, File Locations for Servers</b></p><div class="table-contents"><table summary="Domain: MEGANET, File Locations for Servers" border="1"><colgroup><col align="left"><col align="left"><col align="center"><col align="center"><col align="center"></colgroup><thead><tr><th colspan="2" align="center">File Information</th><th colspan="3" align="center">Server Name</th></tr><tr><th align="center">Source</th><th align="center">Target Location</th><th align="center">MASSIVE</th><th align="center">BLDG1</th><th align="center">BLDG2</th></tr></thead><tbody><tr><td align="left"><a class="link" href="Big500users.html#ch5-massivesmb" title="Example 4.1. Server: MASSIVE (PDC), File: /etc/samba/smb.conf">“Server: MASSIVE (PDC), File: /etc/samba/smb.conf”</a></td><td align="left"><code class="filename">/etc/samba/smb.conf</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-dc-common" title="Example 4.2. Server: MASSIVE (PDC), File: /etc/samba/dc-common.conf">“Server: MASSIVE (PDC), File: /etc/samba/dc-common.conf”</a></td><td align="left"><code class="filename">/etc/samba/dc-common.conf</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-commonsmb" title="Example 4.3. Common Samba Configuration File: /etc/samba/common.conf">“Common Samba Configuration File: /etc/samba/common.conf”</a></td><td align="left"><code class="filename">/etc/samba/common.conf</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-bldg1-smb" title="Example 4.4. Server: BLDG1 (Member), File: smb.conf">“Server: BLDG1 (Member), File: smb.conf”</a></td><td align="left"><code class="filename">/etc/samba/smb.conf</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-bldg2-smb" title="Example 4.5. Server: BLDG2 (Member), File: smb.conf">“Server: BLDG2 (Member), File: smb.conf”</a></td><td align="left"><code class="filename">/etc/samba/smb.conf</code></td><td align="center">No</td><td align="center">No</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#ch5-dommem-smb" title="Example 4.6. Common Domain Member Include File: dom-mem.conf">“Common Domain Member Include File: dom-mem.conf”</a></td><td align="left"><code class="filename">/etc/samba/dommem.conf</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#massive-dhcp" title="Example 4.7. Server: MASSIVE, File: dhcpd.conf">“Server: MASSIVE, File: dhcpd.conf”</a></td><td align="left"><code class="filename">/etc/dhcpd.conf</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#bldg1dhcp" title="Example 4.8. Server: BLDG1, File: dhcpd.conf">“Server: BLDG1, File: dhcpd.conf”</a></td><td align="left"><code class="filename">/etc/dhcpd.conf</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#bldg2dhcp" title="Example 4.9. Server: BLDG2, File: dhcpd.conf">“Server: BLDG2, File: dhcpd.conf”</a></td><td align="left"><code class="filename">/etc/dhcpd.conf</code></td><td align="center">No</td><td align="center">No</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#massive-nameda" title="Example 4.10. Server: MASSIVE, File: named.conf, Part: A">“Server: MASSIVE, File: named.conf, Part: A”</a></td><td align="left"><code class="filename">/etc/named.conf (part A)</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#massive-namedb" title="Example 4.11. Server: MASSIVE, File: named.conf, Part: B">“Server: MASSIVE, File: named.conf, Part: B”</a></td><td align="left"><code class="filename">/etc/named.conf (part B)</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#massive-namedc" title="Example 4.12. Server: MASSIVE, File: named.conf, Part: C">“Server: MASSIVE, File: named.conf, Part: C”</a></td><td align="left"><code class="filename">/etc/named.conf (part C)</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#abmasbizdns" title="Example 4.13. Forward Zone File: abmas.biz.hosts">“Forward Zone File: abmas.biz.hosts”</a></td><td align="left"><code class="filename">{VLN}/master/abmas.biz.hosts</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#abmasusdns" title="Example 4.14. Forward Zone File: abmas.biz.hosts">“Forward Zone File: abmas.biz.hosts”</a></td><td align="left"><code class="filename">{VLN}/master/abmas.us.hosts</code></td><td align="center">Yes</td><td align="center">No</td><td align="center">No</td></tr><tr><td align="left"><a class="link" href="Big500users.html#bldg12nameda" title="Example 4.15. Servers: BLDG1/BLDG2, File: named.conf, Part: A">“Servers: BLDG1/BLDG2, File: named.conf, Part: A”</a></td><td align="left"><code class="filename">/etc/named.conf (part A)</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="Big500users.html#bldg12namedb" title="Example 4.16. Servers: BLDG1/BLDG2, File: named.conf, Part: B">“Servers: BLDG1/BLDG2, File: named.conf, Part: B”</a></td><td align="left"><code class="filename">/etc/named.conf (part B)</code></td><td align="center">No</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="appendix.html#loopback" title="Example 15.3. DNS Localhost Forward Zone File: /var/lib/named/localhost.zone">“DNS Localhost Forward Zone File: /var/lib/named/localhost.zone”</a></td><td align="left"><code class="filename">{VLN}/localhost.zone</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="appendix.html#dnsloopy" title="Example 15.4. DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone">“DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone”</a></td><td align="left"><code class="filename">{VLN}/127.0.0.zone</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr><tr><td align="left"><a class="link" href="appendix.html#roothint" title="Example 15.5. DNS Root Name Server Hint File: /var/lib/named/root.hint">“DNS Root Name Server Hint File: /var/lib/named/root.hint”</a></td><td align="left"><code class="filename">{VLN}/root.hint</code></td><td align="center">Yes</td><td align="center">Yes</td><td align="center">Yes</td></tr></tbody></table></div></div><br class="table-break"></div><div class="sect2" title="Server Preparation: All Servers"><div class="titlepage"><div><div><h3 class="title"><a name="id337052"></a>Server Preparation: All Servers</h3></div></div></div><p> 209 209 The following steps apply to all servers. Follow each step carefully. 210 </p><div class="procedure" ><a name="id2566373"></a><p class="title"><b>Procedure 4.1. Server Preparation Steps</b></p><ol type="1"><li><p>210 </p><div class="procedure" title="Procedure 4.1. Server Preparation Steps"><a name="id337062"></a><p class="title"><b>Procedure 4.1. Server Preparation Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 211 211 Using the UNIX/Linux system tools, set the name of the server as shown in the network 212 212 topology diagram in <a class="link" href="Big500users.html#chap05net" title="Figure 4.1. Network Topology 500 User Network Using tdbsam passdb backend.">“Network Topology 500 User Network Using tdbsam passdb backend.”</a>. For SUSE Linux products, the tool … … 221 221 <code class="prompt">root# </code> hostname -f 222 222 </pre><p> 223 </p></li><li ><p>224 <a class="indexterm" name="id 2566437"></a>225 <a class="indexterm" name="id 2566444"></a>223 </p></li><li class="step" title="Step 2"><p> 224 <a class="indexterm" name="id337123"></a> 225 <a class="indexterm" name="id337130"></a> 226 226 Edit your <code class="filename">/etc/hosts</code> file to include the primary names and addresses 227 227 of all network interfaces that are on the host server. This is necessary so that during … … 230 230 CUPS print server is started before the DNS server (<code class="literal">named</code>), you 231 231 should also include an entry for the printers in the <code class="filename">/etc/hosts</code> file. 232 </p></li><li ><p>233 <a class="indexterm" name="id 2566483"></a>232 </p></li><li class="step" title="Step 3"><p> 233 <a class="indexterm" name="id337165"></a> 234 234 All DNS name resolution should be handled locally. To ensure that the server is configured 235 235 correctly to handle this, edit <code class="filename">/etc/resolv.conf</code> so it has the following … … 241 241 This instructs the name resolver function (when configured correctly) to ask the DNS server 242 242 that is running locally to resolve names to addresses. 243 </p></li><li ><p>244 <a class="indexterm" name="id 2566514"></a>245 <a class="indexterm" name="id 2566521"></a>243 </p></li><li class="step" title="Step 4"><p> 244 <a class="indexterm" name="id337193"></a> 245 <a class="indexterm" name="id337200"></a> 246 246 Add the <code class="constant">root</code> user to the password backend: 247 247 </p><pre class="screen"> … … 255 255 deleted. If for any reason the account is deleted, you may not be able to recreate this account 256 256 without considerable trouble. 257 </p></li><li ><p>258 <a class="indexterm" name="id 2566567"></a>259 <a class="indexterm" name="id 2566574"></a>257 </p></li><li class="step" title="Step 5"><p> 258 <a class="indexterm" name="id337241"></a> 259 <a class="indexterm" name="id337248"></a> 260 260 Create the username map file to permit the <code class="constant">root</code> account to be called 261 261 <code class="constant">Administrator</code> from the Windows network environment. To do this, create … … 283 283 #### 284 284 </pre><p> 285 </p></li><li ><p>285 </p></li><li class="step" title="Step 6"><p> 286 286 Configure all network-attached printers to have a fixed IP address. 287 </p></li><li ><p>287 </p></li><li class="step" title="Step 7"><p> 288 288 Create an entry in the DNS database on the server <code class="constant">MASSIVE</code> 289 289 in both the forward lookup database for the zone <code class="constant">abmas.biz.hosts</code> … … 291 291 located in. Example configuration files for similar zones were presented in <a class="link" href="secure.html" title="Chapter 3. Secure Office Networking">“Secure Office Networking”</a>, 292 292 <a class="link" href="secure.html#abmasbiz" title="Example 3.14. DNS Abmas.biz Forward Zone File">“DNS Abmas.biz Forward Zone File”</a> and <a class="link" href="secure.html#eth2zone" title="Example 3.13. DNS 192.168.2 Reverse Zone File">“DNS 192.168.2 Reverse Zone File”</a>. 293 </p></li><li ><p>293 </p></li><li class="step" title="Step 8"><p> 294 294 Follow the instructions in the printer manufacturer's manuals to permit printing 295 295 to port 9100. Use any other port the manufacturer specifies for direct mode, 296 296 raw printing. This allows the CUPS spooler to print using raw mode protocols. 297 <a class="indexterm" name="id 2566665"></a>298 <a class="indexterm" name="id 2566672"></a>299 </p></li><li ><p>300 <a class="indexterm" name="id 2566685"></a>297 <a class="indexterm" name="id337328"></a> 298 <a class="indexterm" name="id337335"></a> 299 </p></li><li class="step" title="Step 9"><p> 300 <a class="indexterm" name="id337348"></a> 301 301 Only on the server to which the printer is attached configure the CUPS Print 302 302 Queues as follows: … … 304 304 <code class="prompt">root# </code> lpadmin -p <em class="parameter"><code>printque</code></em> -v socket://<em class="parameter"><code>printer-name</code></em>.abmas.biz:9100 -E 305 305 </pre><p> 306 <a class="indexterm" name="id 2566720"></a>306 <a class="indexterm" name="id337382"></a> 307 307 This step creates the necessary print queue to use no assigned print filter. This 308 308 is ideal for raw printing, that is, printing without use of filters. 309 309 The name <em class="parameter"><code>printque</code></em> is the name you have assigned for 310 310 the particular printer. 311 </p></li><li ><p>311 </p></li><li class="step" title="Step 10"><p> 312 312 Print queues may not be enabled at creation. Make certain that the queues 313 313 you have just created are enabled by executing the following: … … 315 315 <code class="prompt">root# </code> /usr/bin/enable <em class="parameter"><code>printque</code></em> 316 316 </pre><p> 317 </p></li><li ><p>317 </p></li><li class="step" title="Step 11"><p> 318 318 Even though your print queue may be enabled, it is still possible that it 319 319 does not accept print jobs. A print queue services incoming printing … … 323 323 <code class="prompt">root# </code> /usr/bin/accept <em class="parameter"><code>printque</code></em> 324 324 </pre><p> 325 </p></li><li ><p>326 <a class="indexterm" name="id 2566799"></a>327 <a class="indexterm" name="id 2566806"></a>328 <a class="indexterm" name="id 2566813"></a>325 </p></li><li class="step" title="Step 12"><p> 326 <a class="indexterm" name="id337455"></a> 327 <a class="indexterm" name="id337461"></a> 328 <a class="indexterm" name="id337468"></a> 329 329 This step, as well as the next one, may be omitted where CUPS version 1.1.18 330 330 or later is in use. Although it does no harm to follow it anyway, and may … … 336 336 application/octet-stream application/vnd.cups-raw 0 - 337 337 </pre><p> 338 </p></li><li ><p>339 <a class="indexterm" name="id 2566849"></a>338 </p></li><li class="step" title="Step 13"><p> 339 <a class="indexterm" name="id337500"></a> 340 340 Edit the file <code class="filename">/etc/cups/mime.types</code> to uncomment the line: 341 341 </p><pre class="screen"> 342 342 application/octet-stream 343 343 </pre><p> 344 </p></li><li ><p>344 </p></li><li class="step" title="Step 14"><p> 345 345 Refer to the CUPS printing manual for instructions regarding how to configure 346 346 CUPS so that print queues that reside on CUPS servers on remote networks … … 348 348 on your CUPS server may automatically discover remotely installed printers and 349 349 may permit this functionality without requiring specific configuration. 350 </p></li><li ><p>350 </p></li><li class="step" title="Step 15"><p> 351 351 As part of the roll-out program, you need to configure the application's 352 352 server shares. This can be done once on the central server and may then be … … 355 355 <a class="link" href="secure.html#ch4appscfg" title="Application Share Configuration">“Application Share Configuration”</a> may help in your decisions to use an application 356 356 server facility. 357 </p></li></ol></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>357 </p></li></ol></div><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 358 358 Logon scripts that are run from a domain controller (PDC or BDC) are capable of using semi-intelligent 359 359 processes to automap Windows client drives to an application server that is nearest to the client. This 360 360 is considerably more difficult when a single PDC is used on a routed network. It can be done, but not 361 361 as elegantly as you see in the next chapter. 362 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2566927"></a>Server-Specific Preparation</h3></div></div></div><p>362 </p></div></div><div class="sect2" title="Server-Specific Preparation"><div class="titlepage"><div><div><h3 class="title"><a name="id337568"></a>Server-Specific Preparation</h3></div></div></div><p> 363 363 There are some steps that apply to particular server functionality only. Each step is critical 364 364 to correct server operation. The following step-by-step installation guidance will assist you 365 365 in working through the process of configuring the PDC and then both BDC's. 366 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2566940"></a>Configuration for Server: <code class="constant">MASSIVE</code></h4></div></div></div><p>366 </p><div class="sect3" title="Configuration for Server: MASSIVE"><div class="titlepage"><div><div><h4 class="title"><a name="id337579"></a>Configuration for Server: <code class="constant">MASSIVE</code></h4></div></div></div><p> 367 367 The steps presented here attempt to implement Samba installation in a generic manner. While 368 368 some steps are clearly specific to Linux, it should not be too difficult to apply them to 369 369 your platform of choice. 370 </p><div class="procedure" ><a name="id2566955"></a><p class="title"><b>Procedure 4.2. Primary Domain Controller Preparation</b></p><ol type="1"><li><p>371 <a class="indexterm" name="id 2566967"></a>372 <a class="indexterm" name="id 2566974"></a>370 </p><div class="procedure" title="Procedure 4.2. Primary Domain Controller Preparation"><a name="id337592"></a><p class="title"><b>Procedure 4.2. Primary Domain Controller Preparation</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 371 <a class="indexterm" name="id337603"></a> 372 <a class="indexterm" name="id337610"></a> 373 373 The host server acts as a router between the two internal network segments as well 374 374 as for all Internet access. This necessitates that IP forwarding be enabled. This can be … … 379 379 To ensure that your kernel is capable of IP forwarding during configuration, you may wish to execute 380 380 that command manually also. This setting permits the Linux system to act as a router. 381 </p></li><li ><p>381 </p></li><li class="step" title="Step 2"><p> 382 382 This server is dual hosted (i.e., has two network interfaces) one goes to the Internet 383 383 and the other to a local network that has a router that is the gateway to the remote networks. … … 397 397 startup files as follows: (SUSE) <code class="filename">/etc/rc.d/boot.local</code>, (Red Hat) 398 398 <code class="filename">/etc/rc.d/init.d/rc.local</code>. 399 </p></li><li ><p>400 <a class="indexterm" name="id 2567068"></a>399 </p></li><li class="step" title="Step 3"><p> 400 <a class="indexterm" name="id337688"></a> 401 401 The final step that must be completed is to edit the <code class="filename">/etc/nsswitch.conf</code> file. 402 402 This file controls the operation of the various resolver libraries that are part of the Linux … … 405 405 hosts: files dns wins 406 406 </pre><p> 407 </p></li><li ><p>408 <a class="indexterm" name="id 2567098"></a>407 </p></li><li class="step" title="Step 4"><p> 408 <a class="indexterm" name="id337715"></a> 409 409 Create and map Windows domain groups to UNIX groups. A sample script is provided in 410 410 <a class="link" href="Big500users.html#ch5-initgrps" title="Example 4.17. Initialize Groups Script, File: /etc/samba/initGrps.sh">“Initialize Groups Script, File: /etc/samba/initGrps.sh”</a>. Create a file containing this script. You called yours … … 412 412 and then execute the script. An example of the execution of this script as well as its 413 413 validation are shown in Section 4.3.2, Step 5. 414 </p></li><li ><p>415 <a class="indexterm" name="id 2567129"></a>416 <a class="indexterm" name="id 2567136"></a>417 <a class="indexterm" name="id 2567145"></a>414 </p></li><li class="step" title="Step 5"><p> 415 <a class="indexterm" name="id337743"></a> 416 <a class="indexterm" name="id337750"></a> 417 <a class="indexterm" name="id337759"></a> 418 418 For each user who needs to be given a Windows domain account, make an entry in the 419 419 <code class="filename">/etc/passwd</code> file as well as in the Samba password backend. … … 421 421 <code class="literal">smbpasswd</code> to create a domain user account. 422 422 </p><p> 423 <a class="indexterm" name="id 2567172"></a>424 <a class="indexterm" name="id 2567179"></a>425 <a class="indexterm" name="id 2567185"></a>423 <a class="indexterm" name="id337784"></a> 424 <a class="indexterm" name="id337790"></a> 425 <a class="indexterm" name="id337797"></a> 426 426 There are a number of tools for user management under UNIX, such as 427 427 <code class="literal">useradd</code>, <code class="literal">adduser</code>, as well as a plethora of custom 428 428 tools. With the tool of your choice, create a home directory for each user. 429 </p></li><li ><p>429 </p></li><li class="step" title="Step 6"><p> 430 430 Using the preferred tool for your UNIX system, add each user to the UNIX groups created 431 431 previously as necessary. File system access control is based on UNIX group membership. 432 </p></li><li ><p>432 </p></li><li class="step" title="Step 7"><p> 433 433 Create the directory mount point for the disk subsystem that is to be mounted to provide 434 434 data storage for company files, in this case, the mount point indicated in the <code class="filename">smb.conf</code> 435 435 file is <code class="filename">/data</code>. Format the file system as required and mount the formatted 436 436 file system partition using appropriate system tools. 437 </p></li><li ><p>438 <a class="indexterm" name="id 2567249"></a>437 </p></li><li class="step" title="Step 8"><p> 438 <a class="indexterm" name="id337856"></a> 439 439 Create the top-level file storage directories for data and applications as follows: 440 440 </p><pre class="screen"> … … 454 454 The <code class="filename">/apps</code> directory is the root of the <code class="constant">apps</code> share 455 455 that provides the application server infrastructure. 456 </p></li><li ><p>456 </p></li><li class="step" title="Step 9"><p> 457 457 The <code class="filename">smb.conf</code> file specifies an infrastructure to support roaming profiles and network 458 458 logon services. You can now create the file system infrastructure to provide the … … 475 475 <code class="prompt">root# </code> chmod ug+wrx,o+rx,-w /var/lib/samba/profiles/'username' 476 476 </pre><p> 477 </p></li><li ><p>478 <a class="indexterm" name="id 2567455"></a>479 <a class="indexterm" name="id 2567462"></a>477 </p></li><li class="step" title="Step 10"><p> 478 <a class="indexterm" name="id338048"></a> 479 <a class="indexterm" name="id338055"></a> 480 480 Create a logon script. It is important that each line is correctly terminated with 481 481 a carriage return and line-feed combination (i.e., DOS encoding). The following procedure … … 492 492 > /var/lib/samba/netlogon/scripts/logon.bat 493 493 </pre><p> 494 </p></li><li ><p>494 </p></li><li class="step" title="Step 11"><p> 495 495 There is one preparatory step without which you cannot have a working Samba network 496 496 environment. You must add an account for each network user. You can do this by executing … … 509 509 </pre><p> 510 510 You do, of course, use a valid user login ID in place of <em class="parameter"><code>username</code></em>. 511 </p></li><li ><p>511 </p></li><li class="step" title="Step 12"><p> 512 512 Follow the processes shown in <a class="link" href="Big500users.html#ch5-procstart" title="Process Startup Configuration">“Process Startup Configuration”</a> to start all services. 513 </p></li><li ><p>513 </p></li><li class="step" title="Step 13"><p> 514 514 Your server is ready for validation testing. Do not proceed with the steps in 515 515 <a class="link" href="Big500users.html#ch5-domsvrspec" title="Configuration Specific to Domain Member Servers: BLDG1, BLDG2">“Configuration Specific to Domain Member Servers: BLDG1, BLDG2”</a> until after the operation of the server has been 516 516 validated following the same methods as outlined in <a class="link" href="secure.html" title="Chapter 3. Secure Office Networking">“Secure Office Networking”</a>, <a class="link" href="secure.html#ch4valid" title="Validation">“Validation”</a>. 517 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="ch5-domsvrspec"></a>Configuration Specific to Domain Member Servers: <code class="constant">BLDG1, BLDG2</code></h4></div></div></div><p>517 </p></li></ol></div></div><div class="sect3" title="Configuration Specific to Domain Member Servers: BLDG1, BLDG2"><div class="titlepage"><div><div><h4 class="title"><a name="ch5-domsvrspec"></a>Configuration Specific to Domain Member Servers: <code class="constant">BLDG1, BLDG2</code></h4></div></div></div><p> 518 518 The following steps will guide you through the nuances of implementing BDCs for the broadcast 519 519 isolated network segments. Remember that if the target installation platform is not Linux, it may 520 520 be necessary to adapt some commands to the equivalent on the target platform. 521 </p><div class="procedure" ><a name="id2567648"></a><p class="title"><b>Procedure 4.3. Backup Domain Controller Configuration Steps</b></p><ol type="1"><li><p>522 <a class="indexterm" name="id 2567660"></a>521 </p><div class="procedure" title="Procedure 4.3. Backup Domain Controller Configuration Steps"><a name="id338227"></a><p class="title"><b>Procedure 4.3. Backup Domain Controller Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 522 <a class="indexterm" name="id338238"></a> 523 523 The final step that must be completed is to edit the <code class="filename">/etc/nsswitch.conf</code> file. 524 524 This file controls the operation of the various resolver libraries that are part of the Linux … … 529 529 hosts: files dns wins 530 530 </pre><p> 531 </p></li><li ><p>531 </p></li><li class="step" title="Step 2"><p> 532 532 Follow the steps outlined in <a class="link" href="Big500users.html#ch5-procstart" title="Process Startup Configuration">“Process Startup Configuration”</a> to start all services. Do not 533 533 start Samba at this time. Samba is controlled by the process called <code class="literal">smb</code>. 534 </p></li><li ><p>535 <a class="indexterm" name="id 2567712"></a>534 </p></li><li class="step" title="Step 3"><p> 535 <a class="indexterm" name="id338286"></a> 536 536 You must now attempt to join the domain member servers to the domain. The following 537 537 instructions should be executed to effect this: … … 539 539 <code class="prompt">root# </code> net rpc join 540 540 </pre><p> 541 </p></li><li ><p>542 <a class="indexterm" name="id 2567744"></a>541 </p></li><li class="step" title="Step 4"><p> 542 <a class="indexterm" name="id338316"></a> 543 543 You now start the Samba services by executing: 544 544 </p><pre class="screen"> 545 545 <code class="prompt">root# </code> service smb start 546 546 </pre><p> 547 </p></li><li ><p>547 </p></li><li class="step" title="Step 5"><p> 548 548 Your server is ready for validation testing. Do not proceed with the steps in 549 549 <a class="link" href="Big500users.html#ch5-domsvrspec" title="Configuration Specific to Domain Member Servers: BLDG1, BLDG2">“Configuration Specific to Domain Member Servers: BLDG1, BLDG2”</a> until after the operation of the server has been 550 550 validated following the same methods as outlined in <a class="link" href="secure.html#ch4valid" title="Validation">“Validation”</a>. 551 </p></li></ol></div></div></div><div class="example"><a name="ch5-massivesmb"></a><p class="title"><b>Example 4.1. Server: MASSIVE (PDC), File: <code class="filename">/etc/samba/smb.conf</code></b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2567829"></a><em class="parameter"><code>workgroup = MEGANET</code></em></td></tr><tr><td><a class="indexterm" name="id2567841"></a><em class="parameter"><code>netbios name = MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id2567853"></a><em class="parameter"><code>interfaces = eth1, lo</code></em></td></tr><tr><td><a class="indexterm" name="id2567865"></a><em class="parameter"><code>bind interfaces only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2567877"></a><em class="parameter"><code>passdb backend = tdbsam</code></em></td></tr><tr><td><a class="indexterm" name="id2567888"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2567900"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2567912"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2567924"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2567937"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2567949"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -G '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2567961"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2567974"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2567986"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2567998"></a><em class="parameter"><code>include = /etc/samba/dc-common.conf</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id2568019"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id2568030"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id2568042"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id2568063"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id2568074"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id2568086"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id2568107"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id2568119"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id2568130"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-dc-common"></a><p class="title"><b>Example 4.2. Server: MASSIVE (PDC), File: <code class="filename">/etc/samba/dc-common.conf</code></b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2568178"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id2568190"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id2568202"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2568214"></a><em class="parameter"><code>logon path = \%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2568226"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2568238"></a><em class="parameter"><code>logon home = \%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2568250"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2568261"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2568273"></a><em class="parameter"><code>include = /etc/samba/common.conf</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2568294"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2568306"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2568317"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2568329"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2568349"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2568361"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2568373"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2568385"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2568405"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2568417"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2568429"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2568440"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-commonsmb"></a><p class="title"><b>Example 4.3. Common Samba Configuration File: <code class="filename">/etc/samba/common.conf</code></b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2568485"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2568497"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2568508"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2568520"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2568532"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id2568543"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2568555"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2568567"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2568579"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2568590"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2568603"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id2568615"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id2568627"></a><em class="parameter"><code>utmp = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2568639"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2568651"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2568662"></a><em class="parameter"><code>veto files = /*.eml/*.nws/*.{*}/</code></em></td></tr><tr><td><a class="indexterm" name="id2568674"></a><em class="parameter"><code>veto oplock files = /*.doc/*.xls/*.mdb/</code></em></td></tr><tr><td><a class="indexterm" name="id2568686"></a><em class="parameter"><code>include = </code></em></td></tr><tr><td># Share and Service Definitions are common to all servers</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2568711"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2568723"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2568734"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2568746"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2568758"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2568769"></a><em class="parameter"><code>default devmode = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2568781"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id2568802"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id2568814"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id2568825"></a><em class="parameter"><code>admin users = bjordan</code></em></td></tr><tr><td><a class="indexterm" name="id2568837"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-bldg1-smb"></a><p class="title"><b>Example 4.4. Server: BLDG1 (Member), File: smb.conf</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2568880"></a><em class="parameter"><code>workgroup = MEGANET</code></em></td></tr><tr><td><a class="indexterm" name="id2568891"></a><em class="parameter"><code>netbios name = BLDG1</code></em></td></tr><tr><td><a class="indexterm" name="id2568903"></a><em class="parameter"><code>include = /etc/samba/dom-mem.conf</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-bldg2-smb"></a><p class="title"><b>Example 4.5. Server: BLDG2 (Member), File: smb.conf</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2568946"></a><em class="parameter"><code>workgroup = MEGANET</code></em></td></tr><tr><td><a class="indexterm" name="id2568958"></a><em class="parameter"><code>netbios name = BLDG2</code></em></td></tr><tr><td><a class="indexterm" name="id2568970"></a><em class="parameter"><code>include = /etc/samba/dom-mem.conf</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-dommem-smb"></a><p class="title"><b>Example 4.6. Common Domain Member Include File: dom-mem.conf</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2569013"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id2569025"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id2569038"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2569049"></a><em class="parameter"><code>wins server = 172.16.0.1</code></em></td></tr><tr><td><a class="indexterm" name="id2569061"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2569073"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2569085"></a><em class="parameter"><code>include = /etc/samba/common.conf</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="massive-dhcp"></a><p class="title"><b>Example 4.7. Server: MASSIVE, File: dhcpd.conf</b></p><div class="example-contents"><pre class="screen">551 </p></li></ol></div></div></div><div class="example"><a name="ch5-massivesmb"></a><p class="title"><b>Example 4.1. Server: MASSIVE (PDC), File: <code class="filename">/etc/samba/smb.conf</code></b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id338398"></a><em class="parameter"><code>workgroup = MEGANET</code></em></td></tr><tr><td><a class="indexterm" name="id338409"></a><em class="parameter"><code>netbios name = MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id338421"></a><em class="parameter"><code>interfaces = eth1, lo</code></em></td></tr><tr><td><a class="indexterm" name="id338432"></a><em class="parameter"><code>bind interfaces only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id338444"></a><em class="parameter"><code>passdb backend = tdbsam</code></em></td></tr><tr><td><a class="indexterm" name="id338455"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id338467"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id338478"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id338490"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id338502"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id338514"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -G '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id338526"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id338538"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id338549"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id338560"></a><em class="parameter"><code>include = /etc/samba/dc-common.conf</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id338581"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id338593"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id338604"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id338624"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id338636"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id338648"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id338668"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id338680"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id338691"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-dc-common"></a><p class="title"><b>Example 4.2. Server: MASSIVE (PDC), File: <code class="filename">/etc/samba/dc-common.conf</code></b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id338738"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id338749"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id338761"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id338773"></a><em class="parameter"><code>logon path = \%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id338784"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id338796"></a><em class="parameter"><code>logon home = \%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id338807"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id338819"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id338830"></a><em class="parameter"><code>include = /etc/samba/common.conf</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id338851"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id338862"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id338874"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id338885"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id338906"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id338917"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id338929"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id338940"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id338961"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id338972"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id338984"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id338995"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-commonsmb"></a><p class="title"><b>Example 4.3. Common Samba Configuration File: <code class="filename">/etc/samba/common.conf</code></b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id339038"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id339050"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id339061"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id339073"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id339084"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id339096"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id339107"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id339119"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id339130"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id339142"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id339154"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id339165"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id339177"></a><em class="parameter"><code>utmp = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id339188"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id339200"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id339211"></a><em class="parameter"><code>veto files = /*.eml/*.nws/*.{*}/</code></em></td></tr><tr><td><a class="indexterm" name="id339223"></a><em class="parameter"><code>veto oplock files = /*.doc/*.xls/*.mdb/</code></em></td></tr><tr><td><a class="indexterm" name="id339235"></a><em class="parameter"><code>include = </code></em></td></tr><tr><td># Share and Service Definitions are common to all servers</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id339259"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id339270"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id339282"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id339293"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id339305"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id339316"></a><em class="parameter"><code>default devmode = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id339328"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id339348"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id339360"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id339371"></a><em class="parameter"><code>admin users = bjordan</code></em></td></tr><tr><td><a class="indexterm" name="id339383"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-bldg1-smb"></a><p class="title"><b>Example 4.4. Server: BLDG1 (Member), File: smb.conf</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id339425"></a><em class="parameter"><code>workgroup = MEGANET</code></em></td></tr><tr><td><a class="indexterm" name="id339436"></a><em class="parameter"><code>netbios name = BLDG1</code></em></td></tr><tr><td><a class="indexterm" name="id339448"></a><em class="parameter"><code>include = /etc/samba/dom-mem.conf</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-bldg2-smb"></a><p class="title"><b>Example 4.5. Server: BLDG2 (Member), File: smb.conf</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id339490"></a><em class="parameter"><code>workgroup = MEGANET</code></em></td></tr><tr><td><a class="indexterm" name="id339501"></a><em class="parameter"><code>netbios name = BLDG2</code></em></td></tr><tr><td><a class="indexterm" name="id339512"></a><em class="parameter"><code>include = /etc/samba/dom-mem.conf</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch5-dommem-smb"></a><p class="title"><b>Example 4.6. Common Domain Member Include File: dom-mem.conf</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id339555"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id339566"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id339578"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id339590"></a><em class="parameter"><code>wins server = 172.16.0.1</code></em></td></tr><tr><td><a class="indexterm" name="id339601"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id339613"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id339624"></a><em class="parameter"><code>include = /etc/samba/common.conf</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="massive-dhcp"></a><p class="title"><b>Example 4.7. Server: MASSIVE, File: dhcpd.conf</b></p><div class="example-contents"><pre class="screen"> 552 552 # Abmas Accounting Inc. 553 553 … … 898 898 net groupmap add ntgroup="Financial Services" unixgroup=finsrvcs type=d 899 899 net groupmap add ntgroup="Insurance Group" unixgroup=piops type=d 900 </pre></div></div><br class="example-break"><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch5-procstart"></a>Process Startup Configuration</h3></div></div></div><p>901 <a class="indexterm" name="id 2569434"></a>902 <a class="indexterm" name="id 2569441"></a>900 </pre></div></div><br class="example-break"><div class="sect2" title="Process Startup Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="ch5-procstart"></a>Process Startup Configuration</h3></div></div></div><p> 901 <a class="indexterm" name="id339909"></a> 902 <a class="indexterm" name="id339916"></a> 903 903 There are two essential steps to process startup configuration. A process 904 904 must be configured so that it is automatically restarted each time the server … … 909 909 necessary start or kill script is run. 910 910 </p><p> 911 <a class="indexterm" name="id 2569477"></a>911 <a class="indexterm" name="id339948"></a> 912 912 In the event that a service is provided not as a daemon but via the internetworking 913 913 super daemon (<code class="literal">inetd</code> or <code class="literal">xinetd</code>), then the <code class="literal">chkconfig</code> … … 919 919 are for a Red Hat Linux system, please adapt them to suit the target OS platform on which you 920 920 are installing Samba. 921 </p><div class="procedure" ><a name="id2569521"></a><p class="title"><b>Procedure 4.4. Process Startup Configuration Steps</b></p><ol type="1"><li><p>921 </p><div class="procedure" title="Procedure 4.4. Process Startup Configuration Steps"><a name="id339987"></a><p class="title"><b>Procedure 4.4. Process Startup Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 922 922 Use the standard system tool to configure each service to restart 923 923 automatically at every system reboot. For example, 924 <a class="indexterm" name="id 2569535"></a>924 <a class="indexterm" name="id340000"></a> 925 925 </p><pre class="screen"> 926 926 <code class="prompt">root# </code> chkconfig dhpc on … … 930 930 <code class="prompt">root# </code> chkconfig swat on 931 931 </pre><p> 932 </p></li><li ><p>933 <a class="indexterm" name="id 2569585"></a>934 <a class="indexterm" name="id 2569592"></a>935 <a class="indexterm" name="id 2569599"></a>932 </p></li><li class="step" title="Step 2"><p> 933 <a class="indexterm" name="id340049"></a> 934 <a class="indexterm" name="id340056"></a> 935 <a class="indexterm" name="id340062"></a> 936 936 Now start each service to permit the system to be validated. 937 937 Execute each of the following in the sequence shown: … … 944 944 <code class="prompt">root# </code> service swat restart 945 945 </pre><p> 946 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch5wincfg"></a>Windows Client Configuration</h3></div></div></div><p>946 </p></li></ol></div></div><div class="sect2" title="Windows Client Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="ch5wincfg"></a>Windows Client Configuration</h3></div></div></div><p> 947 947 The procedure for desktop client configuration for the network in this chapter is similar to 948 948 that used for the previous one. There are a few subtle changes that should be noted. 949 </p><div class="procedure" ><a name="id2569665"></a><p class="title"><b>Procedure 4.5. Windows Client Configuration Steps</b></p><ol type="1"><li><p>949 </p><div class="procedure" title="Procedure 4.5. Windows Client Configuration Steps"><a name="id340124"></a><p class="title"><b>Procedure 4.5. Windows Client Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 950 950 Install MS Windows XP Professional. During installation, configure the client to use DHCP for 951 951 TCP/IP protocol configuration. 952 <a class="indexterm" name="id 2569678"></a>953 <a class="indexterm" name="id 2569685"></a>952 <a class="indexterm" name="id340136"></a> 953 <a class="indexterm" name="id340142"></a> 954 954 DHCP configures all Windows clients to use the WINS Server address that has been defined 955 955 for the local subnet. 956 </p></li><li ><p>956 </p></li><li class="step" title="Step 2"><p> 957 957 Join the Windows domain <code class="constant">MEGANET</code>. Use the domain administrator 958 958 username <code class="constant">root</code> and the SMB password you assigned to this account. … … 961 961 Reboot the machine as prompted and then log on using the domain administrator account 962 962 (<code class="constant">root</code>). 963 </p></li><li ><p>963 </p></li><li class="step" title="Step 3"><p> 964 964 Verify that the server called <code class="constant">MEGANET</code> is visible in <span class="guimenu">My Network Places</span>, 965 965 that it is possible to connect to it and see the shares <span class="guimenuitem">accounts</span>, 966 966 <span class="guimenuitem">apps</span>, and <span class="guimenuitem">finsvcs</span>, 967 967 and that it is possible to open each share to reveal its contents. 968 </p></li><li ><p>968 </p></li><li class="step" title="Step 4"><p> 969 969 Create a drive mapping to the <code class="constant">apps</code> share on a server. At this time, it does 970 970 not particularly matter which application server is used. It is necessary to manually … … 972 972 installation. This step is avoided by the improvements to the design of the network configuration 973 973 in the next chapter. 974 </p></li><li ><p>974 </p></li><li class="step" title="Step 5"><p> 975 975 Perform an administrative installation of each application to be used. Select the options 976 976 that you wish to use. Of course, you choose to run applications over the network, correct? 977 </p></li><li ><p>977 </p></li><li class="step" title="Step 6"><p> 978 978 Now install all applications to be installed locally. Typical tools include Adobe Acrobat, 979 979 NTP-based time synchronization software, drivers for specific local devices such as fingerprint 980 980 scanners, and the like. Probably the most significant application to be locally installed 981 981 is antivirus software. 982 </p></li><li ><p>982 </p></li><li class="step" title="Step 7"><p> 983 983 Now install all four printers onto the staging system. The printers you install 984 984 include the accounting department HP LaserJet 6 and Minolta QMS Magicolor printers, and you 985 985 also configure use of the identical printers that are located in the financial services department. 986 986 Install printers on each machine using the following steps: 987 </p><div class="procedure" ><a name="id2569817"></a><p class="title"><b>Procedure 4.6. Steps to Install Printer Drivers on Windows Clients</b></p><ol type="1"><li><p>987 </p><div class="procedure" title="Procedure 4.6. Steps to Install Printer Drivers on Windows Clients"><a name="id340259"></a><p class="title"><b>Procedure 4.6. Steps to Install Printer Drivers on Windows Clients</b></p><ol class="procedure" type="1"><li class="step" title="Step 7.1"><p> 988 988 Click <span class="guimenu">Start</span> → <span class="guimenuitem">Settings</span> → <span class="guimenuitem">Printers</span>+<span class="guiicon">Add Printer</span>+<span class="guibutton">Next</span>. Do not click <span class="guimenuitem">Network printer</span>. 989 989 Ensure that <span class="guimenuitem">Local printer</span> is selected. 990 </p></li><li ><p>990 </p></li><li class="step" title="Step 7.2"><p> 991 991 Click <span class="guibutton">Next</span>. In the 992 992 <span class="guimenuitem">Manufacturer:</span> panel, select <code class="constant">HP</code>. 993 993 In the <span class="guimenuitem">Printers:</span> panel, select the printer called 994 994 <code class="constant">HP LaserJet 6</code>. Click <span class="guibutton">Next</span>. 995 </p></li><li ><p>995 </p></li><li class="step" title="Step 7.3"><p> 996 996 In the <span class="guimenuitem">Available ports:</span> panel, select 997 997 <code class="constant">FILE:</code>. Accept the default printer name by clicking 998 <span class="guibutton">Next</span>. When asked, “<span class="quote">Would you like to print a999 test page?</span>” , click <span class="guimenuitem">No</span>. Click998 <span class="guibutton">Next</span>. When asked, <span class="quote">“<span class="quote">Would you like to print a 999 test page?</span>”</span>, click <span class="guimenuitem">No</span>. Click 1000 1000 <span class="guibutton">Finish</span>. 1001 </p></li><li ><p>1001 </p></li><li class="step" title="Step 7.4"><p> 1002 1002 You may be prompted for the name of a file to print to. If so, close the 1003 1003 dialog panel. Right-click <span class="guiicon">HP LaserJet 6</span> → <span class="guimenuitem">Properties</span> → <span class="guisubmenu">Details (Tab)</span>+<span class="guibutton">Add Port</span>. 1004 </p></li><li ><p>1004 </p></li><li class="step" title="Step 7.5"><p> 1005 1005 In the <span class="guimenuitem">Network</span> panel, enter the name of 1006 1006 the print queue on the Samba server as follows: <code class="constant">\\BLDG1\hplj6a</code>. 1007 1007 Click <span class="guibutton">OK</span>+<span class="guibutton">OK</span> to complete the installation. 1008 </p></li><li ><p>1008 </p></li><li class="step" title="Step 7.6"><p> 1009 1009 Repeat the printer installation steps above for both HP LaserJet 6 printers 1010 1010 as well as for both QMS Magicolor laser printers. Remember to install all … … 1017 1017 configuration (as well as the applications server drive mapping) to the 1018 1018 server on the network segment on which the workstation is to be located. 1019 </p></li></ol></div></li><li ><p>1019 </p></li></ol></div></li><li class="step" title="Step 8"><p> 1020 1020 When you are satisfied that the staging systems are complete, use the appropriate procedure to 1021 1021 remove the client from the domain. Reboot the system, and then log on as the local administrator 1022 1022 and clean out all temporary files stored on the system. Before shutting down, use the disk 1023 1023 defragmentation tool so that the file system is in optimal condition before replication. 1024 </p></li><li ><p>1024 </p></li><li class="step" title="Step 9"><p> 1025 1025 Boot the workstation using the Norton (Symantec) Ghosting disk (or CD-ROM) and image the 1026 1026 machine to a network share on the server. 1027 </p></li><li ><p>1027 </p></li><li class="step" title="Step 10"><p> 1028 1028 You may now replicate the image using the appropriate Norton Ghost procedure to the target 1029 1029 machines. Make sure to use the procedure that ensures each machine has a unique 1030 1030 Windows security identifier (SID). When the installation of the disk image is complete, boot the PC. 1031 </p></li><li ><p>1031 </p></li><li class="step" title="Step 11"><p> 1032 1032 Log onto the machine as the local Administrator (the only option), and join the machine to 1033 1033 the domain following the procedure set out in <a class="link" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">“A Collection of Useful Tidbits”</a>, <a class="link" href="appendix.html#domjoin" title="Joining a Domain: Windows 200x/XP Professional">“Joining a Domain: Windows 200x/XP Professional”</a>. You must now set the … … 1035 1035 ready for the user to log on, provided you have created a network logon account for that 1036 1036 user, of course. 1037 </p></li><li ><p>1037 </p></li><li class="step" title="Step 12"><p> 1038 1038 Instruct all users to log onto the workstation using their assigned username and password. 1039 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2570125"></a>Key Points Learned</h3></div></div></div><p>1039 </p></li></ol></div></div><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id340544"></a>Key Points Learned</h3></div></div></div><p> 1040 1040 The network you have just deployed has been a valuable exercise in forced constraint. 1041 1041 You have deployed a network that works well, although you may soon start to see 1042 1042 performance problems, at which time the modifications demonstrated in <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a> 1043 1043 bring the network to life. The following key learning points were experienced: 1044 </p><div class="itemizedlist"><ul type="disc"><li><p>1044 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 1045 1045 The power of using <code class="filename">smb.conf</code> include files 1046 </p></li><li ><p>1046 </p></li><li class="listitem"><p> 1047 1047 Use of a single PDC over a routed network 1048 </p></li><li ><p>1048 </p></li><li class="listitem"><p> 1049 1049 Joining a Samba-3 domain member server to a Samba-3 domain 1050 </p></li><li ><p>1050 </p></li><li class="listitem"><p> 1051 1051 Configuration of winbind to use domain users and groups for Samba access 1052 1052 to resources on the domain member servers 1053 </p></li><li ><p>1053 </p></li><li class="listitem"><p> 1054 1054 The introduction of roaming profiles 1055 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2570184"></a>Questions and Answers</h2></div></div></div><p>1056 </p><div class="qandaset" ><dl><dt> <a href="Big500users.html#id2570200">1055 </p></li></ul></div></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id340597"></a>Questions and Answers</h2></div></div></div><p> 1056 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id340606"></a><dl><dt> <a href="Big500users.html#id340612"> 1057 1057 The example smb.conf files in this chapter make use of the include facility. 1058 1058 How may I get to see what the actual working smb.conf settings are? 1059 </a></dt><dt> <a href="Big500users.html#id 2570249">1059 </a></dt><dt> <a href="Big500users.html#id340660"> 1060 1060 Why does the include file common.conf have an empty include statement? 1061 </a></dt><dt> <a href="Big500users.html#id 2570311">1061 </a></dt><dt> <a href="Big500users.html#id340716"> 1062 1062 I accept that the simplest configuration necessary to do the job is the best. The use of tdbsam 1063 1063 passdb backend is much simpler than having to manage an LDAP-based ldapsam passdb backend. 1064 1064 I tried using rsync to replicate the passdb.tdb, and it seems to work fine! 1065 1065 So what is the problem? 1066 </a></dt><dt> <a href="Big500users.html#id 2570366">1066 </a></dt><dt> <a href="Big500users.html#id340766"> 1067 1067 You are using DHCP Relay enabled on the routers as well as a local DHCP server. Will this cause a clash? 1068 </a></dt><dt> <a href="Big500users.html#id 2570396">1068 </a></dt><dt> <a href="Big500users.html#id340791"> 1069 1069 How does the Windows client find the PDC? 1070 </a></dt><dt> <a href="Big500users.html#id 2570419">1070 </a></dt><dt> <a href="Big500users.html#id340811"> 1071 1071 Why did you enable IP forwarding (routing) only on the server called MASSIVE? 1072 </a></dt><dt> <a href="Big500users.html#id 2570450">1072 </a></dt><dt> <a href="Big500users.html#id340838"> 1073 1073 You did nothing special to implement roaming profiles. Why? 1074 </a></dt><dt> <a href="Big500users.html#id 2570469">1074 </a></dt><dt> <a href="Big500users.html#id340856"> 1075 1075 On the domain member computers, you configured winbind in the /etc/nsswitch.conf file. 1076 1076 You did not configure any PAM settings. Is this an omission? 1077 </a></dt><dt> <a href="Big500users.html#id 2570501">1077 </a></dt><dt> <a href="Big500users.html#id340883"> 1078 1078 You are starting SWAT up on this example but have not discussed that anywhere. Why did you do this? 1079 </a></dt><dt> <a href="Big500users.html#id 2570543">1079 </a></dt><dt> <a href="Big500users.html#id340920"> 1080 1080 The domain controller has an auto-shutdown script. Isn't that dangerous? 1081 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2570200"></a><a name="id2570202"></a></td><td align="left" valign="top"><p>1081 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id340612"></a><a name="id340615"></a></td><td align="left" valign="top"><p> 1082 1082 The example <code class="filename">smb.conf</code> files in this chapter make use of the <em class="parameter"><code>include</code></em> facility. 1083 1083 How may I get to see what the actual working <code class="filename">smb.conf</code> settings are? … … 1087 1087 <code class="prompt">root# </code> testparm -s | less 1088 1088 </pre><p> 1089 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2570249"></a><a name="id2570251"></a></td><td align="left" valign="top"><p>1089 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id340660"></a><a name="id340662"></a></td><td align="left" valign="top"><p> 1090 1090 Why does the include file <code class="filename">common.conf</code> have an empty include statement? 1091 1091 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1100 1100 the include in place, even though the file it points to has already been included. This is a bug 1101 1101 that will be fixed at a future date. 1102 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2570311"></a><a name="id2570313"></a></td><td align="left" valign="top"><p>1102 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id340716"></a><a name="id340718"></a></td><td align="left" valign="top"><p> 1103 1103 I accept that the simplest configuration necessary to do the job is the best. The use of <em class="parameter"><code>tdbsam</code></em> 1104 1104 passdb backend is much simpler than having to manage an LDAP-based <em class="parameter"><code>ldapsam</code></em> passdb backend. … … 1110 1110 to log onto the network following a reboot and may have to rejoin the domain to recover network 1111 1111 access capability. 1112 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2570366"></a><a name="id2570368"></a></td><td align="left" valign="top"><p>1112 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id340766"></a><a name="id340769"></a></td><td align="left" valign="top"><p> 1113 1113 You are using DHCP Relay enabled on the routers as well as a local DHCP server. Will this cause a clash? 1114 1114 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1119 1119 The only exception to this rule is when the client makes a directed request from a specific DHCP server 1120 1120 for renewal of the lease it has. This means that under normal circumstances there is no risk of a clash. 1121 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2570396"></a><a name="id2570398"></a></td><td align="left" valign="top"><p>1121 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id340791"></a><a name="id340794"></a></td><td align="left" valign="top"><p> 1122 1122 How does the Windows client find the PDC? 1123 1123 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1126 1126 to register itself with the WINS server and to obtain enumeration of vital network information to 1127 1127 enable it to operate successfully. 1128 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2570419"></a><a name="id2570421"></a></td><td align="left" valign="top"><p>1128 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id340811"></a><a name="id340813"></a></td><td align="left" valign="top"><p> 1129 1129 Why did you enable IP forwarding (routing) only on the server called <code class="constant">MASSIVE</code>? 1130 1130 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1133 1133 Route table entries are needed to direct MASSIVE to send all traffic intended for the remote network 1134 1134 segments to the router that is its gateway to them. 1135 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2570450"></a><a name="id2570452"></a></td><td align="left" valign="top"><p>1135 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id340838"></a><a name="id340840"></a></td><td align="left" valign="top"><p> 1136 1136 You did nothing special to implement roaming profiles. Why? 1137 1137 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 1138 1138 Unless configured to do otherwise, the default behavior with Samba-3 and Windows XP Professional 1139 1139 clients is to use roaming profiles. 1140 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2570469"></a><a name="id2570471"></a></td><td align="left" valign="top"><p>1140 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id340856"></a><a name="id340858"></a></td><td align="left" valign="top"><p> 1141 1141 On the domain member computers, you configured winbind in the <code class="filename">/etc/nsswitch.conf</code> file. 1142 1142 You did not configure any PAM settings. Is this an omission? … … 1147 1147 to enable the use of winbind. Samba makes use only of the identity resolution facilities of the name 1148 1148 service switch (NSS). 1149 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2570501"></a><a name="id2570503"></a></td><td align="left" valign="top"><p>1149 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id340883"></a><a name="id340885"></a></td><td align="left" valign="top"><p> 1150 1150 You are starting SWAT up on this example but have not discussed that anywhere. Why did you do this? 1151 1151 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1156 1156 file but leaves in place a broken reference to the top-layer include file. SWAT was not designed to 1157 1157 handle this functionality gracefully. 1158 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2570543"></a><a name="id2570545"></a></td><td align="left" valign="top"><p>1158 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id340920"></a><a name="id340922"></a></td><td align="left" valign="top"><p> 1159 1159 The domain controller has an auto-shutdown script. Isn't that dangerous? 1160 1160 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> -
trunk/server/docs/htmldocs/Samba3-ByExample/DMSMig.html
r414 r599 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Part II. Domain Members, Updating Samba and Migration</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 4.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="net2000users.html" title="Chapter 6. A Distributed 2000-User Network"><link rel="next" href="unixclients.html" title="Chapter 7. Adding Domain Member Servers and Clients"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Part II. Domain Members, Updating Samba and Migration</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="net2000users.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="unixclients.html">Next</a></td></tr></table><hr></div><div class="part" lang="en"><div class="titlepage"><div><div><h1 class="title"><a name="DMSMig"></a>Part II. Domain Members, Updating Samba and Migration</h1></div></div></div><div class="partintro" lang="en"><div><div><div><h1 class="title"><a name="id2589087"></a>Domain Members, Updating Samba and Migration</h1></div></div></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Part II. Domain Members, Updating Samba and Migration</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="net2000users.html" title="Chapter 6. A Distributed 2000-User Network"><link rel="next" href="unixclients.html" title="Chapter 7. Adding Domain Member Servers and Clients"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Part II. Domain Members, Updating Samba and Migration</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="net2000users.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="unixclients.html">Next</a></td></tr></table><hr></div><div class="part" title="Part II. Domain Members, Updating Samba and Migration"><div class="titlepage"><div><div><h1 class="title"><a name="DMSMig"></a>Part II. Domain Members, Updating Samba and Migration</h1></div></div></div><div class="partintro" title="Domain Members, Updating Samba and Migration"><div><div><div><h1 class="title"><a name="id357819"></a>Domain Members, Updating Samba and Migration</h1></div></div></div><p> 2 2 This section <span class="emphasis"><em>Samba-3 by Example</em></span> covers two main topics: How to add 3 3 Samba Domain Member Servers and Samba Domain Member Clients to a Samba domain, the other … … 8 8 to a Samba or a Windows networking domain may also benefit by referring to the book 9 9 <span class="emphasis"><em>The Official Samba-3 HOWTO and Reference Guide.</em></span> 10 </p><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="chapter"><a href="unixclients.html">7. Adding Domain Member Servers and Clients</a></span></dt><dd><dl><dt><span class="sect1"><a href="unixclients.html#id 2589228">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id2589282">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id2589317">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id2589345">Technical Issues</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id2589994">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id2590094">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></span></dt><dt><span class="sect2"><a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></span></dt><dt><span class="sect2"><a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a></span></dt><dt><span class="sect2"><a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id2596343">UNIX/Linux Client Domain Member</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id2596918">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id2596972">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="upgrades.html">8. Updating Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="upgrades.html#id2598125">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id2598221">Cautions and Notes</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id2599550">Upgrading from Samba 1.x and 2.x to Samba-3</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2599919">Applicable to All Samba 2.x to Samba-3 Upgrades</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2600245">Samba-2.x with LDAP Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id2600427">Updating a Samba-3 Installation</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id2600542">Samba-3 to Samba-3 Updates on the Same Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2600746">Migrating Samba-3 to a New Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2601160">Migration of Samba Accounts to Active Directory</a></span></dt></dl></dd></dl></dd><dt><span class="chapter"><a href="ntmigration.html">9. Migrating NT4 Domain to Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="ntmigration.html#id2601332">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2601417">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2601472">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2601658">Technical Issues</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2601981">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2602007">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2602148">NT4 Migration Using LDAP Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2604606">NT4 Migration Using tdbsam Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2605013">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2605051">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="nw4migration.html">10. Migrating NetWare Server to Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="nw4migration.html#id2606026">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id2606137">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id2606228">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id2606305">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id2606495">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id2606504">NetWare Migration Using LDAP Backend</a></span></dt></dl></dd></dl></dd></dl></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="net2000users.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="unixclients.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 6. A Distributed 2000-User Network </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 7. Adding Domain Member Servers and Clients</td></tr></table></div></body></html>10 </p><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="chapter"><a href="unixclients.html">7. Adding Domain Member Servers and Clients</a></span></dt><dd><dl><dt><span class="sect1"><a href="unixclients.html#id357946">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id357994">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id358022">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id358046">Technical Issues</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id358646">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id358731">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></span></dt><dt><span class="sect2"><a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></span></dt><dt><span class="sect2"><a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a></span></dt><dt><span class="sect2"><a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id364506">UNIX/Linux Client Domain Member</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id365002">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id365047">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="upgrades.html">8. Updating Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="upgrades.html#id366117">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id366200">Cautions and Notes</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id367413">Upgrading from Samba 1.x and 2.x to Samba-3</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id368069">Samba-2.x with LDAP Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id368184">Updating a Samba-3 Installation</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id368281">Samba-3 to Samba-3 Updates on the Same Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id368465">Migrating Samba-3 to a New Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id368842">Migration of Samba Accounts to Active Directory</a></span></dt></dl></dd></dl></dd><dt><span class="chapter"><a href="ntmigration.html">9. Migrating NT4 Domain to Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="ntmigration.html#id368988">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id369064">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id369115">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id369276">Technical Issues</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id369580">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id369600">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id371918">NT4 Migration Using tdbsam Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id372263">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id372297">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="nw4migration.html">10. Migrating NetWare Server to Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="nw4migration.html#id373183">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id373282">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id373359">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id373431">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id373599">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id373608">NetWare Migration Using LDAP Backend</a></span></dt></dl></dd></dl></dd></dl></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="net2000users.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="unixclients.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 6. A Distributed 2000-User Network </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 7. Adding Domain Member Servers and Clients</td></tr></table></div></body></html> -
trunk/server/docs/htmldocs/Samba3-ByExample/DomApps.html
r414 r599 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 12. Integrating Additional Services</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 4.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="kerberos.html" title="Chapter 11. Active Directory, Kerberos, and Security"><link rel="next" href="HA.html" title="Chapter 13. Performance, Reliability, and Availability"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 12. Integrating Additional Services</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="kerberos.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="HA.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="DomApps"></a>Chapter 12. Integrating Additional Services</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="DomApps.html#id2616020">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id2616051">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2616160">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id2616193">Technical Issues</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id2616349">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2616373">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id2618225">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2618286">Questions and Answers</a></span></dt></dl></div><p>2 <a class="indexterm" name="id 2615971"></a>3 <a class="indexterm" name="id 2615977"></a>4 <a class="indexterm" name="id 2615984"></a>5 <a class="indexterm" name="id 2615991"></a>6 <a class="indexterm" name="id 2615998"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 12. Integrating Additional Services</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="kerberos.html" title="Chapter 11. Active Directory, Kerberos, and Security"><link rel="next" href="HA.html" title="Chapter 13. Performance, Reliability, and Availability"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 12. Integrating Additional Services</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="kerberos.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="HA.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 12. Integrating Additional Services"><div class="titlepage"><div><div><h2 class="title"><a name="DomApps"></a>Chapter 12. Integrating Additional Services</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="DomApps.html#id382225">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id382248">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id382338">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id382367">Technical Issues</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id382513">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id382530">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id384281">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id384336">Questions and Answers</a></span></dt></dl></div><p> 2 <a class="indexterm" name="id382181"></a> 3 <a class="indexterm" name="id382187"></a> 4 <a class="indexterm" name="id382194"></a> 5 <a class="indexterm" name="id382201"></a> 6 <a class="indexterm" name="id382208"></a> 7 7 You've come a long way now. You have pretty much mastered Samba-3 for 8 8 most uses it can be put to. Up until now, you have cast Samba-3 in the leading … … 15 15 the latest Windows authentication technologies. Let's get started this is 16 16 leading edge. 17 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2616020"></a>Introduction</h2></div></div></div><p>17 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id382225"></a>Introduction</h2></div></div></div><p> 18 18 Abmas has continued its miraculous growth; indeed, nothing seems to be able 19 19 to stop its diversification into multiple (and seemingly unrelated) fields. … … 31 31 gradually, taking over key services and easing the way to a full migration and, 32 32 therefore, integration into Abmas's existing business later. 33 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2616051"></a>Assignment Tasks</h3></div></div></div><p>34 <a class="indexterm" name="id 2616059"></a>35 <a class="indexterm" name="id 2616068"></a>33 </p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id382248"></a>Assignment Tasks</h3></div></div></div><p> 34 <a class="indexterm" name="id382256"></a> 35 <a class="indexterm" name="id382264"></a> 36 36 You've promised the skeptical Abmas Snack Foods management team 37 37 that you can show them how Samba can ease itself and other Open Source … … 40 40 acquisition). You have chosen Web proxying and caching as your proving ground. 41 41 </p><p> 42 <a class="indexterm" name="id 2616086"></a>43 <a class="indexterm" name="id 2616093"></a>42 <a class="indexterm" name="id382279"></a> 43 <a class="indexterm" name="id382286"></a> 44 44 Abmas Snack Foods has several thousand users housed at its head office 45 45 and multiple regional offices, plants, and warehouses. A high proportion of … … 51 51 the earliest commercial users of Microsoft ISA. 52 52 </p><p> 53 <a class="indexterm" name="id 2616114"></a>54 <a class="indexterm" name="id 2616121"></a>55 <a class="indexterm" name="id 2616128"></a>53 <a class="indexterm" name="id382301"></a> 54 <a class="indexterm" name="id382308"></a> 55 <a class="indexterm" name="id382315"></a> 56 56 The team is not happy with ISA. Because it never lived up to its marketing promises, 57 57 it underperformed and had reliability problems. You have pounced on the opportunity … … 64 64 This is a hands-on exercise. You build software applications so 65 65 that you obtain the functionality Abmas needs. 66 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2616160"></a>Dissection and Discussion</h2></div></div></div><p>66 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id382338"></a>Dissection and Discussion</h2></div></div></div><p> 67 67 The key requirements in this business example are straightforward. You are not required 68 68 to do anything new, just to replicate an existing system, not lose any existing features, 69 69 and improve performance. The key points are: 70 </p><div class="itemizedlist"><ul type="disc"><li><p>70 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 71 71 Internet access for most employees 72 </p></li><li ><p>72 </p></li><li class="listitem"><p> 73 73 Distributed system to accommodate load and geographical distribution of users 74 </p></li><li ><p>74 </p></li><li class="listitem"><p> 75 75 Seamless and transparent interoperability with the existing Active Directory domain 76 </p></li></ul></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2616193"></a>Technical Issues</h3></div></div></div><p>77 <a class="indexterm" name="id 2616201"></a>78 <a class="indexterm" name="id 2616208"></a>79 <a class="indexterm" name="id 2616215"></a>80 <a class="indexterm" name="id 2616221"></a>81 <a class="indexterm" name="id 2616228"></a>82 <a class="indexterm" name="id 2616235"></a>83 <a class="indexterm" name="id 2616242"></a>84 <a class="indexterm" name="id 2616249"></a>85 <a class="indexterm" name="id 2616256"></a>86 <a class="indexterm" name="id 2616263"></a>87 <a class="indexterm" name="id 2616270"></a>88 <a class="indexterm" name="id 2616277"></a>89 <a class="indexterm" name="id 2616286"></a><a class="indexterm" name="id2616292"></a>76 </p></li></ul></div><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id382367"></a>Technical Issues</h3></div></div></div><p> 77 <a class="indexterm" name="id382375"></a> 78 <a class="indexterm" name="id382381"></a> 79 <a class="indexterm" name="id382388"></a> 80 <a class="indexterm" name="id382395"></a> 81 <a class="indexterm" name="id382402"></a> 82 <a class="indexterm" name="id382409"></a> 83 <a class="indexterm" name="id382415"></a> 84 <a class="indexterm" name="id382422"></a> 85 <a class="indexterm" name="id382429"></a> 86 <a class="indexterm" name="id382436"></a> 87 <a class="indexterm" name="id382443"></a> 88 <a class="indexterm" name="id382450"></a> 89 <a class="indexterm" name="id382459"></a><a class="indexterm" name="id382464"></a> 90 90 Functionally, the user's Internet Explorer requests a browsing session with the 91 91 Squid proxy, for which it offers its AD authentication token. Squid hands off … … 100 100 </p><p> 101 101 Enabling this consists of: 102 </p><div class="itemizedlist"><ul type="disc"><li><p>102 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 103 103 Preparing the necessary environment using preconfigured packages 104 </p></li><li ><p>104 </p></li><li class="listitem"><p> 105 105 Setting up raw Kerberos authentication against the Active Directory domain 106 </p></li><li ><p>106 </p></li><li class="listitem"><p> 107 107 Configuring, compiling, and then installing the supporting Samba-3 components 108 </p></li><li ><p>108 </p></li><li class="listitem"><p> 109 109 Tying it all together 110 </p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2616349"></a>Political Issues</h3></div></div></div><p>110 </p></li></ul></div></div><div class="sect2" title="Political Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id382513"></a>Political Issues</h3></div></div></div><p> 111 111 You are a stranger in a strange land, and all eyes are upon you. Some would even like to see 112 112 you fail. For you to gain the trust of your newly acquired IT people, it is essential that your … … 114 114 will the entrenched positions consider taking up your new way of doing things on a 115 115 wider scale. 116 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2616373"></a>Implementation</h2></div></div></div><p>117 <a class="indexterm" name="id 2616381"></a>116 </p></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id382530"></a>Implementation</h2></div></div></div><p> 117 <a class="indexterm" name="id382538"></a> 118 118 First, your system needs to be prepared and in a known good state to proceed. This consists 119 119 of making sure that everything the system depends on is present and that everything that could … … 122 122 they must be removed. 123 123 </p><p> 124 <a class="indexterm" name="id 2616398"></a>124 <a class="indexterm" name="id382552"></a> 125 125 The following packages should be available on your Red Hat Linux system: 126 </p><div class="itemizedlist"><ul type="disc"><li><p>127 <a class="indexterm" name="id 2616413"></a>128 <a class="indexterm" name="id 2616420"></a>126 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 127 <a class="indexterm" name="id382566"></a> 128 <a class="indexterm" name="id382572"></a> 129 129 krb5-libs 130 </p></li><li ><p>130 </p></li><li class="listitem"><p> 131 131 krb5-devel 132 </p></li><li ><p>132 </p></li><li class="listitem"><p> 133 133 krb5-workstation 134 </p></li><li ><p>134 </p></li><li class="listitem"><p> 135 135 krb5-server 136 </p></li><li ><p>136 </p></li><li class="listitem"><p> 137 137 pam_krb5 138 138 </p></li></ul></div><p> 139 <a class="indexterm" name="id 2616450"></a>139 <a class="indexterm" name="id382602"></a> 140 140 In the case of SUSE Linux, these packages are called: 141 </p><div class="itemizedlist"><ul type="disc"><li><p>141 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 142 142 heimdal-lib 143 </p></li><li ><p>143 </p></li><li class="listitem"><p> 144 144 heimdal-devel 145 </p></li><li ><p>146 <a class="indexterm" name="id 2616475"></a>145 </p></li><li class="listitem"><p> 146 <a class="indexterm" name="id382625"></a> 147 147 heimdal 148 </p></li><li ><p>148 </p></li><li class="listitem"><p> 149 149 pam_krb5 150 150 </p></li></ul></div><p> … … 152 152 them from the vendor's installation media. Follow the administrative guide 153 153 for your Linux system to ensure that the packages are correctly updated. 154 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>155 <a class="indexterm" name="id 2616500"></a>156 <a class="indexterm" name="id 2616507"></a>157 <a class="indexterm" name="id 2616514"></a>154 </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 155 <a class="indexterm" name="id382648"></a> 156 <a class="indexterm" name="id382655"></a> 157 <a class="indexterm" name="id382662"></a> 158 158 If the requirement is for interoperation with MS Windows Server 2003, it 159 159 will be necessary to ensure that you are using MIT Kerberos version 1.3.1 … … 161 161 updating. 162 162 </p><p> 163 <a class="indexterm" name="id 2616528"></a>164 <a class="indexterm" name="id 2616534"></a>163 <a class="indexterm" name="id382673"></a> 164 <a class="indexterm" name="id382680"></a> 165 165 Heimdal 0.6 or later is required in the case of SUSE Linux. SUSE Enterprise 166 166 Linux Server 8 ships with Heimdal 0.4. SUSE 9 ships with the necessary version. 167 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch10-one"></a>Removal of Pre-Existing Conflicting RPMs</h3></div></div></div><p>168 <a class="indexterm" name="id 2616557"></a>167 </p></div><div class="sect2" title="Removal of Pre-Existing Conflicting RPMs"><div class="titlepage"><div><div><h3 class="title"><a name="ch10-one"></a>Removal of Pre-Existing Conflicting RPMs</h3></div></div></div><p> 168 <a class="indexterm" name="id382701"></a> 169 169 If Samba and/or Squid RPMs are installed, they should be updated. You can 170 170 build both from source. 171 171 </p><p> 172 <a class="indexterm" name="id 2616569"></a>173 <a class="indexterm" name="id 2616576"></a>174 <a class="indexterm" name="id 2616582"></a>172 <a class="indexterm" name="id382712"></a> 173 <a class="indexterm" name="id382719"></a> 174 <a class="indexterm" name="id382725"></a> 175 175 Locating the packages to be un-installed can be achieved by running: 176 176 </p><pre class="screen"> … … 182 182 <code class="prompt">root# </code> rpm -e samba-common 183 183 </pre><p> 184 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2616622"></a>Kerberos Configuration</h3></div></div></div><p>185 <a class="indexterm" name="id 2616630"></a>186 <a class="indexterm" name="id 2616637"></a>187 <a class="indexterm" name="id 2616647"></a>188 <a class="indexterm" name="id 2616653"></a>184 </p><div class="sect2" title="Kerberos Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="id382764"></a>Kerberos Configuration</h3></div></div></div><p> 185 <a class="indexterm" name="id382771"></a> 186 <a class="indexterm" name="id382778"></a> 187 <a class="indexterm" name="id382787"></a> 188 <a class="indexterm" name="id382794"></a> 189 189 The systems Kerberos installation must be configured to communicate with 190 190 your primary Active Directory server (ADS KDC). … … 194 194 unless you are using Windows 2003 servers. 195 195 </p><p> 196 <a class="indexterm" name="id 2616672"></a>197 <a class="indexterm" name="id 2616679"></a>198 <a class="indexterm" name="id 2616686"></a>199 <a class="indexterm" name="id 2616692"></a>200 <a class="indexterm" name="id 2616699"></a>201 <a class="indexterm" name="id 2616708"></a>202 <a class="indexterm" name="id 2616715"></a>196 <a class="indexterm" name="id382810"></a> 197 <a class="indexterm" name="id382817"></a> 198 <a class="indexterm" name="id382824"></a> 199 <a class="indexterm" name="id382830"></a> 200 <a class="indexterm" name="id382837"></a> 201 <a class="indexterm" name="id382846"></a> 202 <a class="indexterm" name="id382853"></a> 203 203 Officially, neither MIT (1.3.4) nor Heimdal (0.63) Kerberos needs an <code class="filename">/etc/krb5.conf</code> 204 204 file in order to work correctly. All ADS domains automatically create SRV records in the … … 208 208 specifying only a single KDC, even if there is more than one. Using the DNS lookup 209 209 allows the KRB5 libraries to use whichever KDCs are available. 210 </p><div class="procedure" ><a name="id2616749"></a><p class="title"><b>Procedure 12.1. Kerberos Configuration Steps</b></p><ol type="1"><li><p>211 <a class="indexterm" name="id 2616760"></a>210 </p><div class="procedure" title="Procedure 12.1. Kerberos Configuration Steps"><a name="id382882"></a><p class="title"><b>Procedure 12.1. Kerberos Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 211 <a class="indexterm" name="id382893"></a> 212 212 If you find the need to manually configure the <code class="filename">krb5.conf</code>, you should edit it 213 213 to have the contents shown in <a class="link" href="DomApps.html#ch10-krb5conf" title="Example 12.1. Kerberos Configuration File: /etc/krb5.conf">“Kerberos Configuration File: /etc/krb5.conf”</a>. The final fully qualified path for this file 214 214 should be <code class="filename">/etc/krb5.conf</code>. 215 </p></li><li ><p>216 <a class="indexterm" name="id 2616795"></a>217 <a class="indexterm" name="id 2616802"></a>218 <a class="indexterm" name="id 2616809"></a>219 <a class="indexterm" name="id 2616816"></a>220 <a class="indexterm" name="id 2616822"></a>221 <a class="indexterm" name="id 2616829"></a>222 <a class="indexterm" name="id 2616836"></a>223 <a class="indexterm" name="id 2616843"></a>224 <a class="indexterm" name="id 2616850"></a>225 <a class="indexterm" name="id 2616859"></a>226 <a class="indexterm" name="id 2616866"></a>227 <a class="indexterm" name="id 2616873"></a>228 <a class="indexterm" name="id 2616880"></a>215 </p></li><li class="step" title="Step 2"><p> 216 <a class="indexterm" name="id382926"></a> 217 <a class="indexterm" name="id382933"></a> 218 <a class="indexterm" name="id382940"></a> 219 <a class="indexterm" name="id382947"></a> 220 <a class="indexterm" name="id382953"></a> 221 <a class="indexterm" name="id382960"></a> 222 <a class="indexterm" name="id382967"></a> 223 <a class="indexterm" name="id382974"></a> 224 <a class="indexterm" name="id382981"></a> 225 <a class="indexterm" name="id382990"></a> 226 <a class="indexterm" name="id382996"></a> 227 <a class="indexterm" name="id383003"></a> 228 <a class="indexterm" name="id383010"></a> 229 229 The following gotchas often catch people out. Kerberos is case sensitive. Your realm must 230 be in UPPERCASE, or you will get an error: “<span class="quote">Cannot find KDC for requested realm while getting231 initial credentials</span>” . Kerberos is picky about time synchronization. The time230 be in UPPERCASE, or you will get an error: <span class="quote">“<span class="quote">Cannot find KDC for requested realm while getting 231 initial credentials</span>”</span>. Kerberos is picky about time synchronization. The time 232 232 according to your participating servers must be within 5 minutes or you get an error: 233 “<span class="quote">kinit(v5): Clock skew too great while getting initial credentials</span>”.233 <span class="quote">“<span class="quote">kinit(v5): Clock skew too great while getting initial credentials</span>”</span>. 234 234 Clock skew limits are, in fact, configurable in the Kerberos protocols (the default is 235 235 5 minutes). A better solution is to implement NTP throughout your server network. … … 241 241 NetBIOS name. If Kerberos cannot do this reverse lookup, you will get a local error 242 242 when you try to join the realm. 243 </p></li><li ><p>244 <a class="indexterm" name="id 2616924"></a>243 </p></li><li class="step" title="Step 3"><p> 244 <a class="indexterm" name="id383045"></a> 245 245 You are now ready to test your installation by issuing the command: 246 246 </p><pre class="screen"> … … 262 262 kdc = w2k3s.london.abmas.biz 263 263 } 264 </pre></div></div><br class="example-break"><p><a class="indexterm" name="id 2616989"></a>264 </pre></div></div><br class="example-break"><p><a class="indexterm" name="id383105"></a> 265 265 The command 266 266 </p><pre class="screen"> … … 268 268 </pre><p> 269 269 shows the Kerberos tickets cached by the system. 270 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2617012"></a>Samba Configuration</h4></div></div></div><p>271 <a class="indexterm" name="id 2617020"></a>270 </p><div class="sect3" title="Samba Configuration"><div class="titlepage"><div><div><h4 class="title"><a name="id383127"></a>Samba Configuration</h4></div></div></div><p> 271 <a class="indexterm" name="id383135"></a> 272 272 Samba must be configured to correctly use Active Directory. Samba-3 must be used, since it 273 273 has the necessary components to interface with Active Directory. 274 </p><div class="procedure" ><a name="id2617030"></a><p class="title"><b>Procedure 12.2. Securing Samba-3 With ADS Support Steps</b></p><ol type="1"><li><p>275 <a class="indexterm" name="id 2617042"></a>276 <a class="indexterm" name="id 2617049"></a>277 <a class="indexterm" name="id 2617056"></a>278 <a class="indexterm" name="id 2617063"></a>279 <a class="indexterm" name="id 2617070"></a>274 </p><div class="procedure" title="Procedure 12.2. Securing Samba-3 With ADS Support Steps"><a name="id383144"></a><p class="title"><b>Procedure 12.2. Securing Samba-3 With ADS Support Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 275 <a class="indexterm" name="id383156"></a> 276 <a class="indexterm" name="id383162"></a> 277 <a class="indexterm" name="id383169"></a> 278 <a class="indexterm" name="id383176"></a> 279 <a class="indexterm" name="id383183"></a> 280 280 Download the latest stable Samba-3 for Red Hat Linux from the official Samba Team 281 281 <a class="ulink" href="http://ftp.samba.org" target="_top">FTP site.</a> The official Samba Team … … 283 283 needed, and are linked against MIT KRB5 version 1.3.1 and therefore are ready for use. 284 284 </p><p> 285 <a class="indexterm" name="id 2617096"></a>286 <a class="indexterm" name="id 2617103"></a>285 <a class="indexterm" name="id383207"></a> 286 <a class="indexterm" name="id383213"></a> 287 287 The necessary, validated RPM packages for SUSE Linux may be obtained from 288 288 the <a class="ulink" href="ftp://ftp.sernet.de/pub/samba" target="_top">SerNet</a> FTP site that … … 290 290 <code class="literal">ntlm_auth</code> tool, and are statically linked 291 291 against suitably patched Heimdal 0.6 libraries. 292 </p></li><li ><p>292 </p></li><li class="step" title="Step 2"><p> 293 293 Using your favorite editor, change the <code class="filename">/etc/samba/smb.conf</code> 294 294 file so it has contents similar to the example shown in <a class="link" href="DomApps.html#ch10-smbconf" title="Example 12.2. Samba Configuration File: /etc/samba/smb.conf">“Samba Configuration File: /etc/samba/smb.conf”</a>. 295 </p></li><li ><p>296 <a class="indexterm" name="id 2617154"></a>297 <a class="indexterm" name="id 2617161"></a>298 <a class="indexterm" name="id 2617168"></a>i299 <a class="indexterm" name="id 2617179"></a>300 <a class="indexterm" name="id 2617186"></a>295 </p></li><li class="step" title="Step 3"><p> 296 <a class="indexterm" name="id383261"></a> 297 <a class="indexterm" name="id383268"></a> 298 <a class="indexterm" name="id383274"></a>i 299 <a class="indexterm" name="id383286"></a> 300 <a class="indexterm" name="id383293"></a> 301 301 Next you need to create a computer account in the Active Directory. 302 302 This sets up the trust relationship needed for other clients to 303 303 authenticate to the Samba server with an Active Directory Kerberos ticket. 304 This is done with the “<span class="quote">net ads join -U [Administrator%Password]</span>”304 This is done with the <span class="quote">“<span class="quote">net ads join -U [Administrator%Password]</span>”</span> 305 305 command, as follows: 306 306 </p><pre class="screen"> 307 307 <code class="prompt">root# </code> net ads join -U administrator%vulcon 308 308 </pre><p> 309 </p></li><li ><p>310 <a class="indexterm" name="id 2617220"></a>311 <a class="indexterm" name="id 2617227"></a>312 <a class="indexterm" name="id 2617234"></a>313 <a class="indexterm" name="id 2617240"></a>314 <a class="indexterm" name="id 2617247"></a>309 </p></li><li class="step" title="Step 4"><p> 310 <a class="indexterm" name="id383324"></a> 311 <a class="indexterm" name="id383331"></a> 312 <a class="indexterm" name="id383337"></a> 313 <a class="indexterm" name="id383344"></a> 314 <a class="indexterm" name="id383351"></a> 315 315 Your new Samba binaries must be started in the standard manner as is applicable 316 316 to the platform you are running on. Alternatively, start your Active Directory-enabled Samba with the following commands: … … 320 320 <code class="prompt">root# </code> winbindd -D 321 321 </pre><p> 322 </p></li><li ><p>323 <a class="indexterm" name="id 2617288"></a>324 <a class="indexterm" name="id 2617295"></a>325 <a class="indexterm" name="id 2617304"></a>326 <a class="indexterm" name="id 2617311"></a>327 <a class="indexterm" name="id 2617318"></a>322 </p></li><li class="step" title="Step 5"><p> 323 <a class="indexterm" name="id383390"></a> 324 <a class="indexterm" name="id383396"></a> 325 <a class="indexterm" name="id383406"></a> 326 <a class="indexterm" name="id383412"></a> 327 <a class="indexterm" name="id383419"></a> 328 328 We now need to test that Samba is communicating with the Active 329 329 Directory domain; most specifically, we want to see whether winbind … … 357 357 </pre><p> 358 358 This enumerates all the groups in your Active Directory tree. 359 </p></li><li ><p>360 <a class="indexterm" name="id 2617382"></a>361 <a class="indexterm" name="id 2617389"></a>359 </p></li><li class="step" title="Step 6"><p> 360 <a class="indexterm" name="id383476"></a> 361 <a class="indexterm" name="id383483"></a> 362 362 Squid uses the <code class="literal">ntlm_auth</code> helper build with Samba-3. 363 363 You may test <code class="literal">ntlm_auth</code> with the command: … … 370 370 <code class="prompt">root# </code> NT_STATUS_OK: Success (0x0) 371 371 </pre><p> 372 </p></li><li ><p>373 <a class="indexterm" name="id 2617441"></a>374 <a class="indexterm" name="id 2617448"></a>375 <a class="indexterm" name="id 2617455"></a>376 <a class="indexterm" name="id 2617462"></a>377 <a class="indexterm" name="id 2617468"></a>378 <a class="indexterm" name="id 2617475"></a>379 <a class="indexterm" name="id 2617482"></a>380 <a class="indexterm" name="id 2617489"></a>372 </p></li><li class="step" title="Step 7"><p> 373 <a class="indexterm" name="id383533"></a> 374 <a class="indexterm" name="id383540"></a> 375 <a class="indexterm" name="id383547"></a> 376 <a class="indexterm" name="id383553"></a> 377 <a class="indexterm" name="id383560"></a> 378 <a class="indexterm" name="id383567"></a> 379 <a class="indexterm" name="id383574"></a> 380 <a class="indexterm" name="id383581"></a> 381 381 The <code class="literal">ntlm_auth</code> helper, when run from a command line as the user 382 “<span class="quote">root</span>”, authenticates against your Active Directory domain (with382 <span class="quote">“<span class="quote">root</span>”</span>, authenticates against your Active Directory domain (with 383 383 the aid of winbind). It manages this by reading from the winbind privileged pipe. 384 Squid is running with the permissions of user “<span class="quote">squid</span>”and group385 “<span class="quote">squid</span>”and is not able to do this unless we make a vital change.384 Squid is running with the permissions of user <span class="quote">“<span class="quote">squid</span>”</span> and group 385 <span class="quote">“<span class="quote">squid</span>”</span> and is not able to do this unless we make a vital change. 386 386 Squid cannot read from the winbind privilege pipe unless you change the 387 387 permissions of its directory. This is the single biggest cause of failure in the … … 396 396 <code class="prompt">root# </code> chmod 750 /var/lib/samba/winbindd_privileged 397 397 </pre><p> 398 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2617564"></a>NSS Configuration</h4></div></div></div><p>399 <a class="indexterm" name="id 2617572"></a>400 <a class="indexterm" name="id 2617578"></a>401 <a class="indexterm" name="id 2617585"></a>398 </p></li></ol></div></div><div class="sect3" title="NSS Configuration"><div class="titlepage"><div><div><h4 class="title"><a name="id383649"></a>NSS Configuration</h4></div></div></div><p> 399 <a class="indexterm" name="id383656"></a> 400 <a class="indexterm" name="id383663"></a> 401 <a class="indexterm" name="id383670"></a> 402 402 For Squid to benefit from Samba-3, NSS must be updated to allow winbind as a valid route to user authentication. 403 403 </p><p> 404 404 Edit your <code class="filename">/etc/nsswitch.conf</code> file so it has the parameters shown 405 405 in <a class="link" href="DomApps.html#ch10-etcnsscfg" title="Example 12.3. NSS Configuration File Extract File: /etc/nsswitch.conf">“NSS Configuration File Extract File: /etc/nsswitch.conf”</a>. 406 </p><div class="example"><a name="ch10-smbconf"></a><p class="title"><b>Example 12.2. Samba Configuration File: <code class="filename">/etc/samba/smb.conf</code></b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2617643"></a><em class="parameter"><code>workgroup = LONDON</code></em></td></tr><tr><td><a class="indexterm" name="id2617655"></a><em class="parameter"><code>netbios name = W2K3S</code></em></td></tr><tr><td><a class="indexterm" name="id2617667"></a><em class="parameter"><code>realm = LONDON.ABMAS.BIZ</code></em></td></tr><tr><td><a class="indexterm" name="id2617679"></a><em class="parameter"><code>security = ads</code></em></td></tr><tr><td><a class="indexterm" name="id2617690"></a><em class="parameter"><code>encrypt passwords = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2617702"></a><em class="parameter"><code>password server = w2k3s.london.abmas.biz</code></em></td></tr><tr><td># separate domain and username with '/', like DOMAIN/username</td></tr><tr><td><a class="indexterm" name="id2617719"></a><em class="parameter"><code>winbind separator = /</code></em></td></tr><tr><td># use UIDs from 10000 to 20000 for domain users</td></tr><tr><td><a class="indexterm" name="id2617735"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td># use GIDs from 10000 to 20000 for domain groups</td></tr><tr><td><a class="indexterm" name="id2617750"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td># allow enumeration of winbind users and groups</td></tr><tr><td><a class="indexterm" name="id2617766"></a><em class="parameter"><code>winbind enum users = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2617778"></a><em class="parameter"><code>winbind enum groups = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2617790"></a><em class="parameter"><code>winbind user default domain = yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch10-etcnsscfg"></a><p class="title"><b>Example 12.3. NSS Configuration File Extract File: <code class="filename">/etc/nsswitch.conf</code></b></p><div class="example-contents"><pre class="screen">406 </p><div class="example"><a name="ch10-smbconf"></a><p class="title"><b>Example 12.2. Samba Configuration File: <code class="filename">/etc/samba/smb.conf</code></b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id383726"></a><em class="parameter"><code>workgroup = LONDON</code></em></td></tr><tr><td><a class="indexterm" name="id383737"></a><em class="parameter"><code>netbios name = W2K3S</code></em></td></tr><tr><td><a class="indexterm" name="id383749"></a><em class="parameter"><code>realm = LONDON.ABMAS.BIZ</code></em></td></tr><tr><td><a class="indexterm" name="id383760"></a><em class="parameter"><code>security = ads</code></em></td></tr><tr><td><a class="indexterm" name="id383772"></a><em class="parameter"><code>encrypt passwords = yes</code></em></td></tr><tr><td><a class="indexterm" name="id383783"></a><em class="parameter"><code>password server = w2k3s.london.abmas.biz</code></em></td></tr><tr><td># separate domain and username with '/', like DOMAIN/username</td></tr><tr><td><a class="indexterm" name="id383799"></a><em class="parameter"><code>winbind separator = /</code></em></td></tr><tr><td># use UIDs from 10000 to 20000 for domain users</td></tr><tr><td><a class="indexterm" name="id383814"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td># use GIDs from 10000 to 20000 for domain groups</td></tr><tr><td><a class="indexterm" name="id383829"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td># allow enumeration of winbind users and groups</td></tr><tr><td><a class="indexterm" name="id383844"></a><em class="parameter"><code>winbind enum users = yes</code></em></td></tr><tr><td><a class="indexterm" name="id383856"></a><em class="parameter"><code>winbind enum groups = yes</code></em></td></tr><tr><td><a class="indexterm" name="id383868"></a><em class="parameter"><code>winbind user default domain = yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch10-etcnsscfg"></a><p class="title"><b>Example 12.3. NSS Configuration File Extract File: <code class="filename">/etc/nsswitch.conf</code></b></p><div class="example-contents"><pre class="screen"> 407 407 passwd: files winbind 408 408 shadow: files 409 409 group: files winbind 410 </pre></div></div><br class="example-break"></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2617829"></a>Squid Configuration</h4></div></div></div><p>411 <a class="indexterm" name="id 2617837"></a>412 <a class="indexterm" name="id 2617844"></a>410 </pre></div></div><br class="example-break"></div><div class="sect3" title="Squid Configuration"><div class="titlepage"><div><div><h4 class="title"><a name="id383905"></a>Squid Configuration</h4></div></div></div><p> 411 <a class="indexterm" name="id383913"></a> 412 <a class="indexterm" name="id383920"></a> 413 413 Squid must be configured correctly to interact with the Samba-3 414 414 components that handle Active Directory authentication. 415 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2617859"></a>Configuration</h3></div></div></div></div><div class="procedure"><a name="id2617864"></a><p class="title"><b>Procedure 12.3. Squid Configuration Steps</b></p><ol type="1"><li><p>416 <a class="indexterm" name="id 2617876"></a>417 <a class="indexterm" name="id 2617882"></a>418 <a class="indexterm" name="id 2617890"></a>415 </p></div></div><div class="sect2" title="Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="id383934"></a>Configuration</h3></div></div></div></div><div class="procedure" title="Procedure 12.3. Squid Configuration Steps"><a name="id383939"></a><p class="title"><b>Procedure 12.3. Squid Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 416 <a class="indexterm" name="id383950"></a> 417 <a class="indexterm" name="id383957"></a> 418 <a class="indexterm" name="id383965"></a> 419 419 If your Linux distribution is SUSE Linux 9, the version of Squid 420 420 supplied is already enabled to use the winbind helper agent. You 421 421 can therefore omit the steps that would build the Squid binary 422 422 programs. 423 </p></li><li ><p>424 <a class="indexterm" name="id 2617908"></a>425 <a class="indexterm" name="id 2617914"></a>426 <a class="indexterm" name="id 2617921"></a>427 <a class="indexterm" name="id 2617928"></a>428 <a class="indexterm" name="id 2617935"></a>423 </p></li><li class="step" title="Step 2"><p> 424 <a class="indexterm" name="id383980"></a> 425 <a class="indexterm" name="id383987"></a> 426 <a class="indexterm" name="id383994"></a> 427 <a class="indexterm" name="id384001"></a> 428 <a class="indexterm" name="id384007"></a> 429 429 Squid, by default, runs as the user <code class="constant">nobody</code>. You need to 430 430 add a system user <code class="constant">squid</code> and a system group … … 433 433 <code class="constant">squid</code> user in <code class="filename">/etc/passwd</code> 434 434 and a <code class="constant">squid</code> group in <code class="filename">/etc/group</code> if these aren't there already. 435 </p></li><li ><p>436 <a class="indexterm" name="id 2617982"></a>437 <a class="indexterm" name="id 2617989"></a>435 </p></li><li class="step" title="Step 3"><p> 436 <a class="indexterm" name="id384053"></a> 437 <a class="indexterm" name="id384060"></a> 438 438 You now need to change the permissions on Squid's <code class="constant">var</code> 439 439 directory. Enter the following command: … … 441 441 <code class="prompt">root# </code> chown -R squid /var/cache/squid 442 442 </pre><p> 443 </p></li><li ><p>444 <a class="indexterm" name="id 2618020"></a>445 <a class="indexterm" name="id 2618027"></a>443 </p></li><li class="step" title="Step 4"><p> 444 <a class="indexterm" name="id384089"></a> 445 <a class="indexterm" name="id384096"></a> 446 446 Squid must also have control over its logging. Enter the following commands: 447 447 </p><pre class="screen"> … … 449 449 <code class="prompt">root# </code> chmod 770 /var/log/squid 450 450 </pre><p> 451 </p></li><li ><p>451 </p></li><li class="step" title="Step 5"><p> 452 452 Finally, Squid must be able to write to its disk cache! 453 453 Enter the following commands: … … 456 456 <code class="prompt">root# </code> chmod 770 /var/cache/squid 457 457 </pre><p> 458 </p></li><li ><p>459 <a class="indexterm" name="id 2618087"></a>458 </p></li><li class="step" title="Step 6"><p> 459 <a class="indexterm" name="id384153"></a> 460 460 The <code class="filename">/etc/squid/squid.conf</code> file must be edited to include the lines from 461 461 <a class="link" href="DomApps.html#etcsquidcfg" title="Example 12.4. Squid Configuration File Extract /etc/squid.conf [ADMINISTRATIVE PARAMETERS Section]">“Squid Configuration File Extract /etc/squid.conf [ADMINISTRATIVE PARAMETERS Section]”</a> and <a class="link" href="DomApps.html#etcsquid2" title="Example 12.5. Squid Configuration File extract File: /etc/squid.conf [AUTHENTICATION PARAMETERS Section]">“Squid Configuration File extract File: /etc/squid.conf [AUTHENTICATION PARAMETERS Section]”</a>. 462 </p></li><li ><p>463 <a class="indexterm" name="id 2618121"></a>462 </p></li><li class="step" title="Step 7"><p> 463 <a class="indexterm" name="id384186"></a> 464 464 You must create Squid's cache directories before it may be run. Enter the following command: 465 465 </p><pre class="screen"> 466 466 <code class="prompt">root# </code> squid -z 467 467 </pre><p> 468 </p></li><li ><p>468 </p></li><li class="step" title="Step 8"><p> 469 469 Finally, start Squid and enjoy transparent Active Directory authentication. 470 470 Enter the following command: … … 488 488 acl AuthorizedUsers proxy_auth REQUIRED 489 489 http_access allow all AuthorizedUsers 490 </pre></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2618225"></a>Key Points Learned</h3></div></div></div><p>491 <a class="indexterm" name="id 2618233"></a>492 <a class="indexterm" name="id 2618240"></a>493 <a class="indexterm" name="id 2618247"></a>494 <a class="indexterm" name="id 2618254"></a>495 <a class="indexterm" name="id 2618266"></a>490 </pre></div></div><br class="example-break"></div><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id384281"></a>Key Points Learned</h3></div></div></div><p> 491 <a class="indexterm" name="id384289"></a> 492 <a class="indexterm" name="id384296"></a> 493 <a class="indexterm" name="id384303"></a> 494 <a class="indexterm" name="id384310"></a> 495 <a class="indexterm" name="id384321"></a> 496 496 Microsoft Windows networking protocols permeate the spectrum of technologies that Microsoft 497 497 Windows clients use, even when accessing traditional services such as Web browsers. Depending … … 500 500 the cookie-based authentication regime used by all competing browsers. It is Samba's implementation 501 501 of NTLMSSP that makes it attractive to implement the solution that has been demonstrated in this chapter. 502 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2618286"></a>Questions and Answers</h2></div></div></div><p>503 <a class="indexterm" name="id 2618294"></a>504 <a class="indexterm" name="id 2618301"></a>505 <a class="indexterm" name="id 2618308"></a>506 <a class="indexterm" name="id 2618314"></a>502 </p></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id384336"></a>Questions and Answers</h2></div></div></div><p> 503 <a class="indexterm" name="id384344"></a> 504 <a class="indexterm" name="id384351"></a> 505 <a class="indexterm" name="id384358"></a> 506 <a class="indexterm" name="id384365"></a> 507 507 The development of the <code class="literal">ntlm_auth</code> module was first discussed in many Open Source circles 508 508 in 2002. At the SambaXP conference in Goettingen, Germany, Mr. Francesco Chemolli demonstrated the use of … … 516 516 comments were made with respect to questions regarding the performance of this installation: 517 517 </p><div class="blockquote"><blockquote class="blockquote"><p> 518 [In our] EXTREMELY optimized environment . . . [the] performance impact is almost [nothing]. The “<span class="quote">almost</span>”518 [In our] EXTREMELY optimized environment . . . [the] performance impact is almost [nothing]. The <span class="quote">“<span class="quote">almost</span>”</span> 519 519 part is due to the brain damage of the ntlm-over-http protocol definition. Suffice to say that its worst-case 520 520 scenario triples the number of hits needed to perform the same transactions versus basic or digest auth[entication]. … … 523 523 Make certain that your Squid proxy server is equipped with sufficient memory to permit all proxy operations to run 524 524 out of memory without invoking the overheads involved in the use of memory that has to be swapped to disk. 525 </p><div class="qandaset" ><dl><dt> <a href="DomApps.html#id2618392">525 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id384423"></a><dl><dt> <a href="DomApps.html#id384430"> 526 526 What does Samba have to do with Web proxy serving? 527 </a></dt><dt> <a href="DomApps.html#id 2618558">527 </a></dt><dt> <a href="DomApps.html#id384585"> 528 528 What other services does Samba provide? 529 </a></dt><dt> <a href="DomApps.html#id 2618701">529 </a></dt><dt> <a href="DomApps.html#id384721"> 530 530 Does use of Samba (ntlm_auth) improve the performance of Squid? 531 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2618392"></a><a name="id2618394"></a></td><td align="left" valign="top"><p>531 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id384430"></a><a name="id384432"></a></td><td align="left" valign="top"><p> 532 532 What does Samba have to do with Web proxy serving? 533 533 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 534 <a class="indexterm" name="id 2618406"></a>535 <a class="indexterm" name="id 2618413"></a>536 <a class="indexterm" name="id 2618420"></a>537 <a class="indexterm" name="id 2618429"></a>538 <a class="indexterm" name="id 2618436"></a>534 <a class="indexterm" name="id384443"></a> 535 <a class="indexterm" name="id384450"></a> 536 <a class="indexterm" name="id384457"></a> 537 <a class="indexterm" name="id384466"></a> 538 <a class="indexterm" name="id384473"></a> 539 539 To provide transparent interoperability between Windows clients and the network services 540 540 that are used from them, Samba had to develop tools and facilities that deliver that feature. The benefit … … 542 542 module is basically a wrapper around authentication code from the core of the Samba project. 543 543 </p><p> 544 <a class="indexterm" name="id 2618458"></a>545 <a class="indexterm" name="id 2618465"></a>546 <a class="indexterm" name="id 2618474"></a>547 <a class="indexterm" name="id 2618483"></a>548 <a class="indexterm" name="id 2618492"></a>549 <a class="indexterm" name="id 2618499"></a>550 <a class="indexterm" name="id 2618506"></a>551 <a class="indexterm" name="id 2618513"></a>552 <a class="indexterm" name="id 2618520"></a>544 <a class="indexterm" name="id384492"></a> 545 <a class="indexterm" name="id384499"></a> 546 <a class="indexterm" name="id384508"></a> 547 <a class="indexterm" name="id384517"></a> 548 <a class="indexterm" name="id384526"></a> 549 <a class="indexterm" name="id384533"></a> 550 <a class="indexterm" name="id384540"></a> 551 <a class="indexterm" name="id384546"></a> 552 <a class="indexterm" name="id384553"></a> 553 553 The <code class="literal">ntlm_auth</code> module supports basic plain-text authentication and NTLMSSP 554 554 protocols. This module makes it possible for Web and FTP proxy requests to be authenticated without … … 558 558 also. 559 559 </p><p> 560 <a class="indexterm" name="id 2618544"></a>560 <a class="indexterm" name="id384574"></a> 561 561 The short answer is that by adding a wrapper around key authentication components of Samba, other 562 562 projects (like Squid) can benefit from the labors expended in meeting user interoperability needs. 563 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2618558"></a><a name="id2618560"></a></td><td align="left" valign="top"><p>563 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id384585"></a><a name="id384588"></a></td><td align="left" valign="top"><p> 564 564 What other services does Samba provide? 565 565 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 566 <a class="indexterm" name="id 2618572"></a>567 <a class="indexterm" name="id 2618579"></a>568 <a class="indexterm" name="id 2618586"></a>569 <a class="indexterm" name="id 2618592"></a>570 <a class="indexterm" name="id 2618599"></a>566 <a class="indexterm" name="id384599"></a> 567 <a class="indexterm" name="id384606"></a> 568 <a class="indexterm" name="id384612"></a> 569 <a class="indexterm" name="id384619"></a> 570 <a class="indexterm" name="id384626"></a> 571 571 Samba-3 is a file and print server. The core components that provide this functionality are <code class="literal">smbd</code>, 572 572 <code class="literal">nmbd</code>, and the identity resolver daemon, <code class="literal">winbindd</code>. 573 573 </p><p> 574 <a class="indexterm" name="id 2618630"></a>575 <a class="indexterm" name="id 2618636"></a>574 <a class="indexterm" name="id384655"></a> 575 <a class="indexterm" name="id384662"></a> 576 576 Samba-3 is an SMB/CIFS client. The core component that provides this is called <code class="literal">smbclient</code>. 577 577 </p><p> 578 <a class="indexterm" name="id 2618654"></a>579 <a class="indexterm" name="id 2618661"></a>580 <a class="indexterm" name="id 2618668"></a>581 <a class="indexterm" name="id 2618674"></a>582 <a class="indexterm" name="id 2618681"></a>578 <a class="indexterm" name="id384679"></a> 579 <a class="indexterm" name="id384685"></a> 580 <a class="indexterm" name="id384692"></a> 581 <a class="indexterm" name="id384699"></a> 582 <a class="indexterm" name="id384706"></a> 583 583 Samba-3 includes a number of helper tools, plug-in modules, utilities, and test and validation facilities. 584 584 Samba-3 includes glue modules that help provide interoperability between MS Windows clients and UNIX/Linux … … 587 587 to permit identity resolution via SMB/CIFS servers (Windows NT4/200x, Samba, and a host of other commercial 588 588 server products). 589 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2618701"></a><a name="id2618703"></a></td><td align="left" valign="top"><p>589 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id384721"></a><a name="id384723"></a></td><td align="left" valign="top"><p> 590 590 Does use of Samba (<code class="literal">ntlm_auth</code>) improve the performance of Squid? 591 591 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> -
trunk/server/docs/htmldocs/Samba3-ByExample/ExNetworks.html
r414 r599 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Part I. Example Network Configurations</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 4.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="preface.html" title="Preface"><link rel="next" href="simple.html" title="Chapter 1. No-Frills Samba Servers"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Part I. Example Network Configurations</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="preface.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="simple.html">Next</a></td></tr></table><hr></div><div class="part" lang="en"><div class="titlepage"><div><div><h1 class="title"><a name="ExNetworks"></a>Part I. Example Network Configurations</h1></div></div></div><div class="partintro" lang="en"><div><div><div><h1 class="title"><a name="id2550769"></a>Example Network Configurations</h1></div></div></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Part I. Example Network Configurations</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="preface.html" title="Preface"><link rel="next" href="simple.html" title="Chapter 1. No-Frills Samba Servers"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Part I. Example Network Configurations</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="preface.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="simple.html">Next</a></td></tr></table><hr></div><div class="part" title="Part I. Example Network Configurations"><div class="titlepage"><div><div><h1 class="title"><a name="ExNetworks"></a>Part I. Example Network Configurations</h1></div></div></div><div class="partintro" title="Example Network Configurations"><div><div><div><h1 class="title"><a name="id323031"></a>Example Network Configurations</h1></div></div></div><p> 2 2 This section of <span class="emphasis"><em>Samba-3 by Example</em></span> provides example network 3 3 configurations that can be copied, or modified as needed, and deployed as-is. … … 21 21 <a class="ulink" href="http://www.samba.org/samba/support/" target="_top">support</a> pages from 22 22 the Samba web site. 23 </p><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="chapter"><a href="simple.html">1. No-Frills Samba Servers</a></span></dt><dd><dl><dt><span class="sect1"><a href="simple.html#id 2550843">Introduction</a></span></dt><dt><span class="sect1"><a href="simple.html#id2550883">Assignment Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="simple.html#id2550925">Drafting Office</a></span></dt><dt><span class="sect2"><a href="simple.html#id2551634">Charity Administration Office</a></span></dt><dt><span class="sect2"><a href="simple.html#AccountingOffice">Accounting Office</a></span></dt></dl></dd><dt><span class="sect1"><a href="simple.html#id2554969">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="small.html">2. Small Office Networking</a></span></dt><dd><dl><dt><span class="sect1"><a href="small.html#id2555439">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2555462">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2555522">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2555570">Technical Issues</a></span></dt><dt><span class="sect2"><a href="small.html#id2555768">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2555790">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2557337">Validation</a></span></dt><dt><span class="sect2"><a href="small.html#id2557985">Notebook Computers: A Special Case</a></span></dt><dt><span class="sect2"><a href="small.html#id2558010">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2558084">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="secure.html">3. Secure Office Networking</a></span></dt><dd><dl><dt><span class="sect1"><a href="secure.html#id2558563">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id2558614">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2558848">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id2558863">Technical Issues</a></span></dt><dt><span class="sect2"><a href="secure.html#id2559289">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2559329">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#ch4bsc">Basic System Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id2560183">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4ptrcfg">Printer Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4valid">Validation</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4appscfg">Application Share Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id2564645">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2564707">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="Big500users.html">4. The 500-User Office</a></span></dt><dd><dl><dt><span class="sect1"><a href="Big500users.html#id2565229">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id2565274">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id2565373">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id2565409">Technical Issues</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2565612">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id2565635">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#ch5-dnshcp-setup">Installation of DHCP, DNS, and Samba Control Files</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2566362">Server Preparation: All Servers</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2566927">Server-Specific Preparation</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5-procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2570125">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id2570184">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="happy.html">5. Making Happy Users</a></span></dt><dd><dl><dt><span class="sect1"><a href="happy.html#id2571022">Regarding LDAP Directories and Windows Computer Accounts</a></span></dt><dt><span class="sect1"><a href="happy.html#id2571164">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id2571262">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2571399">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id2571856">Technical Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id2573730">Political Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id2573745">Installation Checklist</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2573925">Samba Server Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbeidealx">Install and Configure Idealx smbldap-tools Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id2576821">LDAP Initialization and Creation of User and Group Accounts</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-ptrcfg">Printer Configuration</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a></span></dt><dt><span class="sect1"><a href="happy.html#id2580771">Miscellaneous Server Preparation Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id2580791">Configuring Directory Share Point Roots</a></span></dt><dt><span class="sect2"><a href="happy.html#id2580886">Configuring Profile Directories</a></span></dt><dt><span class="sect2"><a href="happy.html#id2581130">Preparation of Logon Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id2581241">Assigning User Rights and Privileges</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2581375">Windows Client Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></span></dt><dt><span class="sect2"><a href="happy.html#id2582129">Configuration of MS Outlook to Relocate PST File</a></span></dt><dt><span class="sect2"><a href="happy.html#id2582445">Configure Delete Cached Profiles on Logout</a></span></dt><dt><span class="sect2"><a href="happy.html#id2582625">Uploading Printer Drivers to Samba Servers</a></span></dt><dt><span class="sect2"><a href="happy.html#id2583127">Software Installation</a></span></dt><dt><span class="sect2"><a href="happy.html#id2583163">Roll-out Image Creation</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2583197">Key Points Learned</a></span></dt><dt><span class="sect1"><a href="happy.html#id2583303">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="net2000users.html">6. A Distributed 2000-User Network</a></span></dt><dd><dl><dt><span class="sect1"><a href="net2000users.html#id2583726">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id2583756">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id2583824">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id2584098">Technical Issues</a></span></dt><dt><span class="sect2"><a href="net2000users.html#id2585046">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id2585064">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id2588223">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id2588370">Questions and Answers</a></span></dt></dl></dd></dl></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="preface.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="simple.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Preface </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 1. No-Frills Samba Servers</td></tr></table></div></body></html>23 </p><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="chapter"><a href="simple.html">1. No-Frills Samba Servers</a></span></dt><dd><dl><dt><span class="sect1"><a href="simple.html#id323089">Introduction</a></span></dt><dt><span class="sect1"><a href="simple.html#id323120">Assignment Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="simple.html#id323158">Drafting Office</a></span></dt><dt><span class="sect2"><a href="simple.html#id323803">Charity Administration Office</a></span></dt><dt><span class="sect2"><a href="simple.html#AccountingOffice">Accounting Office</a></span></dt></dl></dd><dt><span class="sect1"><a href="simple.html#id326925">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="small.html">2. Small Office Networking</a></span></dt><dd><dl><dt><span class="sect1"><a href="small.html#id327308">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id327326">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id327371">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id327416">Technical Issues</a></span></dt><dt><span class="sect2"><a href="small.html#id327588">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id327606">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id329058">Validation</a></span></dt><dt><span class="sect2"><a href="small.html#id329633">Notebook Computers: A Special Case</a></span></dt><dt><span class="sect2"><a href="small.html#id329652">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id329716">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="secure.html">3. Secure Office Networking</a></span></dt><dd><dl><dt><span class="sect1"><a href="secure.html#id330143">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id330177">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id330386">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id330398">Technical Issues</a></span></dt><dt><span class="sect2"><a href="secure.html#id330742">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id330776">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#ch4bsc">Basic System Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id331530">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4ptrcfg">Printer Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4valid">Validation</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4appscfg">Application Share Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id335513">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id335566">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="Big500users.html">4. The 500-User Office</a></span></dt><dd><dl><dt><span class="sect1"><a href="Big500users.html#id336007">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id336038">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id336113">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id336141">Technical Issues</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id336318">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id336338">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#ch5-dnshcp-setup">Installation of DHCP, DNS, and Samba Control Files</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id337052">Server Preparation: All Servers</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id337568">Server-Specific Preparation</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5-procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id340544">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id340597">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="happy.html">5. Making Happy Users</a></span></dt><dd><dl><dt><span class="sect1"><a href="happy.html#id341339">Regarding LDAP Directories and Windows Computer Accounts</a></span></dt><dt><span class="sect1"><a href="happy.html#id341463">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id341540">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id341668">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id342070">Technical Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id343725">Political Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id343737">Installation Checklist</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id343908">Samba Server Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbeidealx">Install and Configure Idealx smbldap-tools Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-ptrcfg">Printer Configuration</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a></span></dt><dt><span class="sect1"><a href="happy.html#id350178">Miscellaneous Server Preparation Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id350194">Configuring Directory Share Point Roots</a></span></dt><dt><span class="sect2"><a href="happy.html#id350283">Configuring Profile Directories</a></span></dt><dt><span class="sect2"><a href="happy.html#id350512">Preparation of Logon Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id350609">Assigning User Rights and Privileges</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id350723">Windows Client Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></span></dt><dt><span class="sect2"><a href="happy.html#id351441">Configuration of MS Outlook to Relocate PST File</a></span></dt><dt><span class="sect2"><a href="happy.html#id351724">Configure Delete Cached Profiles on Logout</a></span></dt><dt><span class="sect2"><a href="happy.html#id351896">Uploading Printer Drivers to Samba Servers</a></span></dt><dt><span class="sect2"><a href="happy.html#id352365">Software Installation</a></span></dt><dt><span class="sect2"><a href="happy.html#id352391">Roll-out Image Creation</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id352420">Key Points Learned</a></span></dt><dt><span class="sect1"><a href="happy.html#id352508">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="net2000users.html">6. A Distributed 2000-User Network</a></span></dt><dd><dl><dt><span class="sect1"><a href="net2000users.html#id352846">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id352871">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id352928">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id353175">Technical Issues</a></span></dt><dt><span class="sect2"><a href="net2000users.html#id353997">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id354011">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id357027">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id357166">Questions and Answers</a></span></dt></dl></dd></dl></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="preface.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="simple.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Preface </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 1. No-Frills Samba Servers</td></tr></table></div></body></html> -
trunk/server/docs/htmldocs/Samba3-ByExample/HA.html
r414 r599 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 13. Performance, Reliability, and Availability</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 4.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="DomApps.html" title="Chapter 12. Integrating Additional Services"><link rel="next" href="ch14.html" title="Chapter 14. Samba Support"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 13. Performance, Reliability, and Availability</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="DomApps.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="ch14.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="HA"></a>Chapter 13. Performance, Reliability, and Availability</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="HA.html#id2618805">Introduction</a></span></dt><dt><span class="sect1"><a href="HA.html#id2618892">Dissection and Discussion</a></span></dt><dt><span class="sect1"><a href="HA.html#id2619366">Guidelines for Reliable Samba Operation</a></span></dt><dd><dl><dt><span class="sect2"><a href="HA.html#id2619393">Name Resolution</a></span></dt><dt><span class="sect2"><a href="HA.html#id2619868">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="HA.html#id2620205">Use and Location of BDCs</a></span></dt><dt><span class="sect2"><a href="HA.html#id2620281">Use One Consistent Version of MS Windows Client</a></span></dt><dt><span class="sect2"><a href="HA.html#id2620303">For Scalability, Use SAN-Based Storage on Samba Servers</a></span></dt><dt><span class="sect2"><a href="HA.html#id2620352">Distribute Network Load with MSDFS</a></span></dt><dt><span class="sect2"><a href="HA.html#id2620407">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></span></dt><dt><span class="sect2"><a href="HA.html#id2620452">Hardware Problems</a></span></dt><dt><span class="sect2"><a href="HA.html#id2620600">Large Directories</a></span></dt></dl></dd><dt><span class="sect1"><a href="HA.html#id2620704">Key Points Learned</a></span></dt></dl></div><p>2 <a class="indexterm" name="id 2618767"></a>3 <a class="indexterm" name="id 2618774"></a>4 <a class="indexterm" name="id 2618780"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 13. Performance, Reliability, and Availability</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="DomApps.html" title="Chapter 12. Integrating Additional Services"><link rel="next" href="ch14.html" title="Chapter 14. Samba Support"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 13. Performance, Reliability, and Availability</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="DomApps.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="ch14.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 13. Performance, Reliability, and Availability"><div class="titlepage"><div><div><h2 class="title"><a name="HA"></a>Chapter 13. Performance, Reliability, and Availability</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="HA.html#id384815">Introduction</a></span></dt><dt><span class="sect1"><a href="HA.html#id384892">Dissection and Discussion</a></span></dt><dt><span class="sect1"><a href="HA.html#id385344">Guidelines for Reliable Samba Operation</a></span></dt><dd><dl><dt><span class="sect2"><a href="HA.html#id385369">Name Resolution</a></span></dt><dt><span class="sect2"><a href="HA.html#id385810">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="HA.html#id386110">Use and Location of BDCs</a></span></dt><dt><span class="sect2"><a href="HA.html#id386178">Use One Consistent Version of MS Windows Client</a></span></dt><dt><span class="sect2"><a href="HA.html#id386195">For Scalability, Use SAN-Based Storage on Samba Servers</a></span></dt><dt><span class="sect2"><a href="HA.html#id386240">Distribute Network Load with MSDFS</a></span></dt><dt><span class="sect2"><a href="HA.html#id386291">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></span></dt><dt><span class="sect2"><a href="HA.html#id386332">Hardware Problems</a></span></dt><dt><span class="sect2"><a href="HA.html#id386465">Large Directories</a></span></dt></dl></dd><dt><span class="sect1"><a href="HA.html#id386548">Key Points Learned</a></span></dt></dl></div><p> 2 <a class="indexterm" name="id384782"></a> 3 <a class="indexterm" name="id384788"></a> 4 <a class="indexterm" name="id384795"></a> 5 5 Well, you have reached one of the last chapters of this book. It is customary to attempt 6 6 to wrap up the theme and contents of a book in what is generally regarded as the … … 11 11 </p><div class="blockquote"><table border="0" width="100%" cellspacing="0" cellpadding="0" class="blockquote" summary="Block quote"><tr><td width="10%" valign="top"> </td><td width="80%" valign="top"><p> 12 12 In a world so full of noise, how can the sparrow be heard? 13 </p></td><td width="10%" valign="top"> </td></tr><tr><td width="10%" valign="top"> </td><td colspan="2" align="right" valign="top">--<span class="attribution">Anonymous</span></td></tr></table></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2618805"></a>Introduction</h2></div></div></div><p>14 <a class="indexterm" name="id 2618813"></a>13 </p></td><td width="10%" valign="top"> </td></tr><tr><td width="10%" valign="top"> </td><td colspan="2" align="right" valign="top">--<span class="attribution">Anonymous</span></td></tr></table></div><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id384815"></a>Introduction</h2></div></div></div><p> 14 <a class="indexterm" name="id384822"></a> 15 15 The sparrow is a small bird whose sounds are drowned out by the noise of the busy 16 16 world it lives in. Likewise, the simple steps that can be taken to improve the … … 21 21 custom tools and methods. Only passing comments are offered concerning these methods. 22 22 </p><p> 23 <a class="indexterm" name="id 2618833"></a>24 <a class="indexterm" name="id 2618840"></a>25 <a class="indexterm" name="id 2618847"></a>23 <a class="indexterm" name="id384837"></a> 24 <a class="indexterm" name="id384844"></a> 25 <a class="indexterm" name="id384851"></a> 26 26 <a class="ulink" href="http://www.google.com/search?hl=en&lr=&ie=ISO-8859-1&q=samba+cluster&btnG=Google+Search" target="_top">A search</a> 27 for “<span class="quote">samba cluster</span>” produced 71,600 hits. And a search for “<span class="quote">highly available samba</span>”28 and “<span class="quote">highly available windows</span>”produced an amazing number of references.27 for <span class="quote">“<span class="quote">samba cluster</span>”</span> produced 71,600 hits. And a search for <span class="quote">“<span class="quote">highly available samba</span>”</span> 28 and <span class="quote">“<span class="quote">highly available windows</span>”</span> produced an amazing number of references. 29 29 It is clear from the resources on the Internet that Windows file and print services 30 30 availability, reliability, and scalability are of vital interest to corporate network users. 31 31 </p><p> 32 <a class="indexterm" name="id 2618880"></a>32 <a class="indexterm" name="id384882"></a> 33 33 So without further background, you can review a checklist of simple steps that 34 34 can be taken to ensure acceptable network performance while keeping costs of ownership 35 35 well under control. 36 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2618892"></a>Dissection and Discussion</h2></div></div></div><p>37 <a class="indexterm" name="id 2618900"></a>38 <a class="indexterm" name="id 2618907"></a>36 </p></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id384892"></a>Dissection and Discussion</h2></div></div></div><p> 37 <a class="indexterm" name="id384899"></a> 38 <a class="indexterm" name="id384906"></a> 39 39 If it is your purpose to get the best mileage out of your Samba servers, there is one rule that 40 40 must be obeyed. If you want the best, keep your implementation as simple as possible. You may … … 45 45 complex ones. 46 46 </p><p> 47 <a class="indexterm" name="id 2618929"></a>48 <a class="indexterm" name="id 2618936"></a>47 <a class="indexterm" name="id384924"></a> 48 <a class="indexterm" name="id384931"></a> 49 49 Problems reported by users fall into three categories: configurations that do not work, those 50 50 that have broken behavior, and poor performance. The term <span class="emphasis"><em>broken behavior</em></span> … … 55 55 and at other times not listing them even though the machines are in use on the network. 56 56 </p><p> 57 <a class="indexterm" name="id 2618964"></a>58 <a class="indexterm" name="id 2618970"></a>59 <a class="indexterm" name="id 2618977"></a>60 <a class="indexterm" name="id 2618984"></a>61 <a class="indexterm" name="id 2618991"></a>62 <a class="indexterm" name="id 2618998"></a>57 <a class="indexterm" name="id384953"></a> 58 <a class="indexterm" name="id384960"></a> 59 <a class="indexterm" name="id384966"></a> 60 <a class="indexterm" name="id384973"></a> 61 <a class="indexterm" name="id384980"></a> 62 <a class="indexterm" name="id384987"></a> 63 63 A significant number of reports concern problems with the <code class="literal">smbfs</code> file system 64 64 driver that is part of the Linux kernel, not part of Samba. Users continue to interpret that … … 71 71 Samba and are really foreign to it. 72 72 </p><p> 73 <a class="indexterm" name="id 2619058"></a>73 <a class="indexterm" name="id385043"></a> 74 74 The new project, <code class="literal">cifsfs</code>, is destined to replace <code class="literal">smbfs</code>. 75 75 It, too, is not part of Samba, even though one of the Samba Team members is a prime mover in … … 77 77 </p><p> 78 78 Table 13.1 lists typical causes of: 79 </p><div class="itemizedlist"><ul type="disc"><li><p>Not Working (NW)</p></li><li><p>Broken Behavior (BB)</p></li><li><p>Poor Performance (PP)</p></li></ul></div><div class="table"><a name="ProbList"></a><p class="title"><b>Table 13.1. Effect of Common Problems</b></p><div class="table-contents"><table summary="Effect of Common Problems" border="1"><colgroup><col align="left"><col align="center"><col align="center"><col align="center"></colgroup><thead><tr><th align="left"><p>Problem</p></th><th align="center"><p>NW</p></th><th align="center"><p>BB</p></th><th align="center"><p>PP</p></th></tr></thead><tbody><tr><td align="left"><p>File locking</p></td><td align="center"><p>-</p></td><td align="center"><p>X</p></td><td align="center"><p>-</p></td></tr><tr><td align="left"><p>Hardware problems</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td></tr><tr><td align="left"><p>Incorrect authentication</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td><td align="center"><p>-</p></td></tr><tr><td align="left"><p>Incorrect configuration</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td></tr><tr><td align="left"><p>LDAP problems</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td><td align="center"><p>-</p></td></tr><tr><td align="left"><p>Name resolution</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td></tr><tr><td align="left"><p>Printing problems</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td><td align="center"><p>-</p></td></tr><tr><td align="left"><p>Slow file transfer</p></td><td align="center"><p>-</p></td><td align="center"><p>-</p></td><td align="center"><p>X</p></td></tr><tr><td align="left"><p>Winbind problems</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td><td align="center"><p>-</p></td></tr></tbody></table></div></div><br class="table-break"><p>80 <a class="indexterm" name="id 2619352"></a>79 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Not Working (NW)</p></li><li class="listitem"><p>Broken Behavior (BB)</p></li><li class="listitem"><p>Poor Performance (PP)</p></li></ul></div><div class="table"><a name="ProbList"></a><p class="title"><b>Table 13.1. Effect of Common Problems</b></p><div class="table-contents"><table summary="Effect of Common Problems" border="1"><colgroup><col align="left"><col align="center"><col align="center"><col align="center"></colgroup><thead><tr><th align="left"><p>Problem</p></th><th align="center"><p>NW</p></th><th align="center"><p>BB</p></th><th align="center"><p>PP</p></th></tr></thead><tbody><tr><td align="left"><p>File locking</p></td><td align="center"><p>-</p></td><td align="center"><p>X</p></td><td align="center"><p>-</p></td></tr><tr><td align="left"><p>Hardware problems</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td></tr><tr><td align="left"><p>Incorrect authentication</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td><td align="center"><p>-</p></td></tr><tr><td align="left"><p>Incorrect configuration</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td></tr><tr><td align="left"><p>LDAP problems</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td><td align="center"><p>-</p></td></tr><tr><td align="left"><p>Name resolution</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td></tr><tr><td align="left"><p>Printing problems</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td><td align="center"><p>-</p></td></tr><tr><td align="left"><p>Slow file transfer</p></td><td align="center"><p>-</p></td><td align="center"><p>-</p></td><td align="center"><p>X</p></td></tr><tr><td align="left"><p>Winbind problems</p></td><td align="center"><p>X</p></td><td align="center"><p>X</p></td><td align="center"><p>-</p></td></tr></tbody></table></div></div><br class="table-break"><p> 80 <a class="indexterm" name="id385333"></a> 81 81 It is obvious to all that the first requirement (as a matter of network hygiene) is to eliminate 82 82 problems that affect basic network operation. This book has provided sufficient working examples 83 83 to help you to avoid all these problems. 84 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2619366"></a>Guidelines for Reliable Samba Operation</h2></div></div></div><p>85 <a class="indexterm" name="id 2619374"></a>86 <a class="indexterm" name="id 2619381"></a>84 </p></div><div class="sect1" title="Guidelines for Reliable Samba Operation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id385344"></a>Guidelines for Reliable Samba Operation</h2></div></div></div><p> 85 <a class="indexterm" name="id385352"></a> 86 <a class="indexterm" name="id385359"></a> 87 87 Your objective is to provide a network that works correctly, can grow at all times, is resilient 88 88 at times of extreme demand, and can scale to meet future needs. The following subject areas provide 89 89 pointers that can help you today. 90 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2619393"></a>Name Resolution</h3></div></div></div><p>90 </p><div class="sect2" title="Name Resolution"><div class="titlepage"><div><div><h3 class="title"><a name="id385369"></a>Name Resolution</h3></div></div></div><p> 91 91 There are three basic current problem areas: bad hostnames, routed networks, and network collisions. 92 92 These are covered in the following discussion. 93 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2619404"></a>Bad Hostnames</h4></div></div></div><p>94 <a class="indexterm" name="id 2619412"></a>95 <a class="indexterm" name="id 2619421"></a>96 <a class="indexterm" name="id 2619428"></a>97 <a class="indexterm" name="id 2619435"></a>98 <a class="indexterm" name="id 2619442"></a>93 </p><div class="sect3" title="Bad Hostnames"><div class="titlepage"><div><div><h4 class="title"><a name="id385379"></a>Bad Hostnames</h4></div></div></div><p> 94 <a class="indexterm" name="id385387"></a> 95 <a class="indexterm" name="id385396"></a> 96 <a class="indexterm" name="id385403"></a> 97 <a class="indexterm" name="id385409"></a> 98 <a class="indexterm" name="id385416"></a> 99 99 When configured as a DHCP client, a number of Linux distributions set the system hostname 100 100 to <code class="constant">localhost</code>. If the parameter <em class="parameter"><code>netbios name</code></em> is not … … 108 108 correctly. 109 109 </p><p> 110 <a class="indexterm" name="id 2619497"></a>110 <a class="indexterm" name="id385465"></a> 111 111 A few sites have tried to name Windows clients and Samba servers with a name that begins 112 112 with the digits 1-9. This does not work either because it may result in the client or 113 113 server attempting to use that name as an IP address. 114 114 </p><p> 115 <a class="indexterm" name="id 2619511"></a>116 <a class="indexterm" name="id 2619520"></a>115 <a class="indexterm" name="id385477"></a> 116 <a class="indexterm" name="id385486"></a> 117 117 A Samba server called <code class="constant">FRED</code> in a NetBIOS domain called <code class="constant">COLLISION</code> 118 118 in a network environment that is part of the fully-qualified Internet domain namespace known … … 122 122 attempts to resolve <code class="constant">fred.parrots.com.parrots.com</code>, which most likely 123 123 fails given that you probably do not have this in your DNS namespace. 124 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>125 <a class="indexterm" name="id 2619564"></a>126 <a class="indexterm" name="id 2619573"></a>127 <a class="indexterm" name="id 2619580"></a>124 </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 125 <a class="indexterm" name="id385526"></a> 126 <a class="indexterm" name="id385536"></a> 127 <a class="indexterm" name="id385542"></a> 128 128 An Active Directory realm called <code class="constant">collision.parrots.com</code> is perfectly okay, 129 129 although it too must be capable of being resolved via DNS, something that functions correctly 130 130 if Windows 200x ADS has been properly installed and configured. 131 </p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2619596"></a>Routed Networks</h4></div></div></div><p>132 <a class="indexterm" name="id 2619604"></a>133 <a class="indexterm" name="id 2619611"></a>134 <a class="indexterm" name="id 2619620"></a>131 </p></div></div><div class="sect3" title="Routed Networks"><div class="titlepage"><div><div><h4 class="title"><a name="id385556"></a>Routed Networks</h4></div></div></div><p> 132 <a class="indexterm" name="id385564"></a> 133 <a class="indexterm" name="id385571"></a> 134 <a class="indexterm" name="id385580"></a> 135 135 NetBIOS networks (Windows networking with NetBIOS over TCP/IP enabled) makes extensive use 136 136 of UDP-based broadcast traffic, as you saw during the exercises in <a class="link" href="primer.html" title="Chapter 16. Networking Primer">“Networking Primer”</a>. 137 137 </p><p> 138 <a class="indexterm" name="id 2619640"></a>139 <a class="indexterm" name="id 2619647"></a>140 <a class="indexterm" name="id 2619653"></a>138 <a class="indexterm" name="id385598"></a> 139 <a class="indexterm" name="id385605"></a> 140 <a class="indexterm" name="id385612"></a> 141 141 UDP broadcast traffic is not forwarded by routers. This means that NetBIOS broadcast-based 142 142 networking cannot function across routed networks (i.e., multi-subnet networks) unless 143 143 special provisions are made: 144 </p><div class="itemizedlist"><ul type="disc"><li><p>145 <a class="indexterm" name="id 2619670"></a>146 <a class="indexterm" name="id 2619677"></a>147 <a class="indexterm" name="id 2619684"></a>144 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 145 <a class="indexterm" name="id385627"></a> 146 <a class="indexterm" name="id385634"></a> 147 <a class="indexterm" name="id385641"></a> 148 148 Either install on every Windows client an LMHOSTS file (located in the directory 149 149 <code class="filename">C:\windows\system32\drivers\etc</code>). It is also necessary to … … 151 151 and <em class="parameter"><code>remote browse sync</code></em>. For more information, refer to the online 152 152 manual page for the <code class="filename">smb.conf</code> file. 153 </p></li><li ><p>154 <a class="indexterm" name="id 2619730"></a>153 </p></li><li class="listitem"><p> 154 <a class="indexterm" name="id385684"></a> 155 155 Or configure Samba as a WINS server, and configure all network clients to use that 156 156 WINS server in their TCP/IP configuration. 157 </p></li></ul></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>158 <a class="indexterm" name="id 2619747"></a>159 <a class="indexterm" name="id 2619756"></a>157 </p></li></ul></div><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 158 <a class="indexterm" name="id385700"></a> 159 <a class="indexterm" name="id385709"></a> 160 160 The use of DNS is not an acceptable substitute for WINS. DNS does not store specific 161 161 information regarding NetBIOS networking particulars that get stored in the WINS 162 162 name resolution database and that Windows clients require and depend on. 163 </p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2619769"></a>Network Collisions</h4></div></div></div><p>164 <a class="indexterm" name="id 2619777"></a>165 <a class="indexterm" name="id 2619786"></a>166 <a class="indexterm" name="id 2619795"></a>167 <a class="indexterm" name="id 2619802"></a>163 </p></div></div><div class="sect3" title="Network Collisions"><div class="titlepage"><div><div><h4 class="title"><a name="id385720"></a>Network Collisions</h4></div></div></div><p> 164 <a class="indexterm" name="id385727"></a> 165 <a class="indexterm" name="id385737"></a> 166 <a class="indexterm" name="id385746"></a> 167 <a class="indexterm" name="id385753"></a> 168 168 Excessive network activity causes NetBIOS network timeouts. Timeouts may result in 169 169 blue screen of death (BSOD) experiences. High collision rates may be caused by excessive … … 174 174 in <a class="link" href="primer.html" title="Chapter 16. Networking Primer">“Networking Primer”</a>. 175 175 </p><p> 176 <a class="indexterm" name="id 2619831"></a>177 <a class="indexterm" name="id 2619838"></a>178 <a class="indexterm" name="id 2619845"></a>176 <a class="indexterm" name="id385778"></a> 177 <a class="indexterm" name="id385784"></a> 178 <a class="indexterm" name="id385791"></a> 179 179 Under no circumstances should the facility be supported by many routers, known as <code class="constant">NetBIOS 180 180 forwarding</code>, unless you know exactly what you are doing. Inappropriate use of this … … 184 184 less than 15 KB/sec. After the NetBIOS forwarding was turned off, file transfer performance 185 185 immediately returned to 11 MB/sec. 186 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2619868"></a>Samba Configuration</h3></div></div></div><p>186 </p></div></div><div class="sect2" title="Samba Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="id385810"></a>Samba Configuration</h3></div></div></div><p> 187 187 As a general rule, the contents of the <code class="filename">smb.conf</code> file should be kept as simple as possible. 188 188 No parameter should be specified unless you know it is essential to operation. 189 189 </p><p> 190 <a class="indexterm" name="id 2619888"></a>191 <a class="indexterm" name="id 2619895"></a>192 <a class="indexterm" name="id 2619902"></a>190 <a class="indexterm" name="id385828"></a> 191 <a class="indexterm" name="id385835"></a> 192 <a class="indexterm" name="id385842"></a> 193 193 Many UNIX administrators like to fully document the settings in the <code class="filename">smb.conf</code> file. This is a 194 194 bad idea because it adds content to the file. The <code class="filename">smb.conf</code> file is re-read by every <code class="literal">smbd</code> … … 198 198 It is recommended to keep a fully documented <code class="filename">smb.conf</code> file on hand, and then to operate Samba only 199 199 with an optimized file. 200 </p><p><a class="indexterm" name="id 2619952"></a>200 </p><p><a class="indexterm" name="id385888"></a> 201 201 The preferred way to maintain a documented file is to call it something like <code class="filename">smb.conf.master</code>. 202 202 You can generate the optimized file by executing: … … 224 224 Press enter to see a dump of your service definitions 225 225 </pre><p> 226 <a class="indexterm" name="id 2620011"></a>226 <a class="indexterm" name="id385939"></a> 227 227 You now, of course, press the enter key to complete the command, or else abort it by pressing Ctrl-C. 228 228 The important thing to note is the noted Server role, as well as warning messages. Noted configuration … … 234 234 </pre><p> 235 235 </p><p> 236 <a class="indexterm" name="id 2620039"></a>237 <a class="indexterm" name="id 2620046"></a>238 <a class="indexterm" name="id 2620053"></a>236 <a class="indexterm" name="id385960"></a> 237 <a class="indexterm" name="id385967"></a> 238 <a class="indexterm" name="id385974"></a> 239 239 There are two parameters that can cause severe network performance degradation: <em class="parameter"><code>socket options</code></em> 240 240 and <em class="parameter"><code>socket address</code></em>. The <em class="parameter"><code>socket options</code></em> parameter was often necessary … … 242 242 this parameter being set. Do not use either parameter unless it has been proven necessary to use them. 243 243 </p><p> 244 <a class="indexterm" name="id 2620087"></a>245 <a class="indexterm" name="id 2620094"></a>246 <a class="indexterm" name="id 2620101"></a>247 <a class="indexterm" name="id 2620108"></a>244 <a class="indexterm" name="id386005"></a> 245 <a class="indexterm" name="id386012"></a> 246 <a class="indexterm" name="id386018"></a> 247 <a class="indexterm" name="id386025"></a> 248 248 Another <code class="filename">smb.conf</code> parameter that may cause severe network performance degradation is the 249 249 <em class="parameter"><code>strict sync</code></em> parameter. Do not use this at all. There is no good reason … … 252 252 degrade network performance, so do not set it; if you must, do so with caution. 253 253 </p><p> 254 <a class="indexterm" name="id 2620149"></a>255 <a class="indexterm" name="id 2620156"></a>256 <a class="indexterm" name="id 2620163"></a>257 <a class="indexterm" name="id 2620170"></a>254 <a class="indexterm" name="id386064"></a> 255 <a class="indexterm" name="id386071"></a> 256 <a class="indexterm" name="id386078"></a> 257 <a class="indexterm" name="id386085"></a> 258 258 Finally, many network administrators deliberately disable opportunistic locking support. While this 259 259 does not degrade Samba performance, it significantly degrades Windows client performance because … … 263 263 oplock support for operations that are tolerant of it. See <a class="link" href="appendix.html#ch12dblck" title="Shared Data Integrity">“Shared Data Integrity”</a> for more 264 264 information. 265 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2620205"></a>Use and Location of BDCs</h3></div></div></div><p>266 <a class="indexterm" name="id 2620213"></a>267 <a class="indexterm" name="id 2620220"></a>268 <a class="indexterm" name="id 2620226"></a>269 <a class="indexterm" name="id 2620233"></a>270 <a class="indexterm" name="id 2620240"></a>265 </p></div><div class="sect2" title="Use and Location of BDCs"><div class="titlepage"><div><div><h3 class="title"><a name="id386110"></a>Use and Location of BDCs</h3></div></div></div><p> 266 <a class="indexterm" name="id386118"></a> 267 <a class="indexterm" name="id386125"></a> 268 <a class="indexterm" name="id386131"></a> 269 <a class="indexterm" name="id386138"></a> 270 <a class="indexterm" name="id386145"></a> 271 271 On a network segment where there is a PDC and a BDC, the BDC carries the bulk of the network logon 272 272 processing. If the BDC is a heavily loaded server, the PDC carries a greater proportion of … … 276 276 and is undesirable. 277 277 </p><p> 278 <a class="indexterm" name="id 2620258"></a>279 <a class="indexterm" name="id 2620265"></a>278 <a class="indexterm" name="id386159"></a> 279 <a class="indexterm" name="id386166"></a> 280 280 As a general guide, instead of adding domain member servers to a network, you would be better advised 281 281 to add BDCs until there are fewer than 30 Windows clients per BDC. Beyond that ratio, you should add 282 282 domain member servers. This practice ensures that there are always sufficient domain controllers 283 283 to handle logon requests and authentication traffic. 284 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2620281"></a>Use One Consistent Version of MS Windows Client</h3></div></div></div><p>284 </p></div><div class="sect2" title="Use One Consistent Version of MS Windows Client"><div class="titlepage"><div><div><h3 class="title"><a name="id386178"></a>Use One Consistent Version of MS Windows Client</h3></div></div></div><p> 285 285 Every network client has its own peculiarities. From a management perspective, it is easier to deal 286 286 with one version of MS Windows that is maintained to a consistent update level than it is to deal … … 290 290 have necessitated special handling from the Samba server end. If you want to remain sane, keep you 291 291 client workstation configurations consistent. 292 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2620303"></a>For Scalability, Use SAN-Based Storage on Samba Servers</h3></div></div></div><p>293 <a class="indexterm" name="id 2620311"></a>294 <a class="indexterm" name="id 2620318"></a>292 </p></div><div class="sect2" title="For Scalability, Use SAN-Based Storage on Samba Servers"><div class="titlepage"><div><div><h3 class="title"><a name="id386195"></a>For Scalability, Use SAN-Based Storage on Samba Servers</h3></div></div></div><p> 293 <a class="indexterm" name="id386203"></a> 294 <a class="indexterm" name="id386210"></a> 295 295 Many SAN-based storage systems permit more than one server to share a common data store. 296 296 Use of a shared SAN data store means that you do not need to use time- and resource-hungry data 297 297 synchronization techniques. 298 298 </p><p> 299 <a class="indexterm" name="id 2620332"></a>300 <a class="indexterm" name="id 2620339"></a>299 <a class="indexterm" name="id386222"></a> 300 <a class="indexterm" name="id386229"></a> 301 301 The use of a collection of relatively low-cost front-end Samba servers that are coupled to 302 302 a shared backend SAN data store permits load distribution while containing costs below that 303 303 of installing and managing a complex clustering facility. 304 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2620352"></a>Distribute Network Load with MSDFS</h3></div></div></div><p>305 <a class="indexterm" name="id 2620360"></a>306 <a class="indexterm" name="id 2620367"></a>304 </p></div><div class="sect2" title="Distribute Network Load with MSDFS"><div class="titlepage"><div><div><h3 class="title"><a name="id386240"></a>Distribute Network Load with MSDFS</h3></div></div></div><p> 305 <a class="indexterm" name="id386248"></a> 306 <a class="indexterm" name="id386255"></a> 307 307 Microsoft DFS (distributed file system) technology has been implemented in Samba. MSDFS permits 308 308 data to be accessed from a single share and yet to actually be distributed across multiple actual … … 310 310 implementation of an MSDFS installation. 311 311 </p><p> 312 <a class="indexterm" name="id 2620386"></a>313 <a class="indexterm" name="id 2620395"></a>312 <a class="indexterm" name="id386271"></a> 313 <a class="indexterm" name="id386280"></a> 314 314 The combination of multiple backend servers together with a front-end server and use of MSDFS 315 315 can achieve almost the same as you would obtain with a clustered Samba server. 316 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2620407"></a>Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</h3></div></div></div><p>317 <a class="indexterm" name="id 2620415"></a>318 <a class="indexterm" name="id 2620422"></a>319 <a class="indexterm" name="id 2620429"></a>316 </p></div><div class="sect2" title="Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth"><div class="titlepage"><div><div><h3 class="title"><a name="id386291"></a>Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</h3></div></div></div><p> 317 <a class="indexterm" name="id386299"></a> 318 <a class="indexterm" name="id386306"></a> 319 <a class="indexterm" name="id386313"></a> 320 320 Consider using <code class="literal">rsync</code> to replicate data across the WAN during times 321 321 of low utilization. Users can then access the replicated data store rather than needing to do so … … 324 324 implementation if you choose to permit modification and return replication of the modified file; 325 325 otherwise, you may inadvertently overwrite important data. 326 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2620452"></a>Hardware Problems</h3></div></div></div><p>327 <a class="indexterm" name="id 2620460"></a>328 <a class="indexterm" name="id 2620467"></a>329 <a class="indexterm" name="id 2620474"></a>330 <a class="indexterm" name="id 2620481"></a>331 <a class="indexterm" name="id 2620490"></a>332 <a class="indexterm" name="id 2620499"></a>326 </p></div><div class="sect2" title="Hardware Problems"><div class="titlepage"><div><div><h3 class="title"><a name="id386332"></a>Hardware Problems</h3></div></div></div><p> 327 <a class="indexterm" name="id386340"></a> 328 <a class="indexterm" name="id386346"></a> 329 <a class="indexterm" name="id386353"></a> 330 <a class="indexterm" name="id386360"></a> 331 <a class="indexterm" name="id386369"></a> 332 <a class="indexterm" name="id386378"></a> 333 333 Networking hardware prices have fallen sharply over the past 5 years. A surprising number 334 334 of Samba networking problems over this time have been traced to defective network interface 335 335 cards (NICs) or defective HUBs, switches, and cables. 336 336 </p><p> 337 <a class="indexterm" name="id 2620516"></a>337 <a class="indexterm" name="id386393"></a> 338 338 Not surprising is the fact that network administrators do not like to be shown to have made 339 339 a bad decision. Money saved in buying low-cost hardware may result in high costs incurred 340 340 in corrective action. 341 341 </p><p> 342 <a class="indexterm" name="id 2620530"></a>343 <a class="indexterm" name="id 2620537"></a>344 <a class="indexterm" name="id 2620544"></a>345 <a class="indexterm" name="id 2620550"></a>346 <a class="indexterm" name="id 2620557"></a>342 <a class="indexterm" name="id386405"></a> 343 <a class="indexterm" name="id386412"></a> 344 <a class="indexterm" name="id386418"></a> 345 <a class="indexterm" name="id386425"></a> 346 <a class="indexterm" name="id386432"></a> 347 347 Defective NICs, HUBs, and switches may appear as intermittent network access problems, intermittent 348 348 or persistent data corruption, slow network throughput, low performance, or even as BSOD … … 353 353 Defective hardware problems may take patience and persistence before the real cause can be discovered. 354 354 </p><p> 355 <a class="indexterm" name="id 2620581"></a>355 <a class="indexterm" name="id386450"></a> 356 356 Networking hardware defects can significantly impact perceived Samba performance, but defective 357 357 RAID controllers as well as SCSI and IDE hard disk controllers have also been known to impair Samba server … … 360 360 administrator until the entire server was replaced. While you may well think that this would never 361 361 happen to you, experience shows that given the right (unfortunate) circumstances, this can happen to anyone. 362 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2620600"></a>Large Directories</h3></div></div></div><p>362 </p></div><div class="sect2" title="Large Directories"><div class="titlepage"><div><div><h3 class="title"><a name="id386465"></a>Large Directories</h3></div></div></div><p> 363 363 There exist applications that create or manage directories containing many thousands of files. Such 364 364 applications typically generate many small files (less than 100 KB). At the best of times, under UNIX, … … 400 400 as specified in the <code class="filename">smb.conf</code> stanza. This means that smbd will not be able to find lower case 401 401 filenames with these settings. Note, this is done on a per-share basis. 402 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2620704"></a>Key Points Learned</h2></div></div></div><p>402 </p></div></div><div class="sect1" title="Key Points Learned"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id386548"></a>Key Points Learned</h2></div></div></div><p> 403 403 This chapter has touched in broad sweeps on a number of simple steps that can be taken 404 404 to ensure that your Samba network is resilient, scalable, and reliable, and that it … … 409 409 her an even break. 410 410 </p><p> 411 <a class="indexterm" name="id 2620725"></a>411 <a class="indexterm" name="id386565"></a> 412 412 Last, but not least, you should not only keep the network design simple, but also be sure it is 413 413 well documented. This book may serve as your pattern for documenting every -
trunk/server/docs/htmldocs/Samba3-ByExample/RefSection.html
r414 r599 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Part III. Reference Section</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 4.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="nw4migration.html" title="Chapter 10. Migrating NetWare Server to Samba-3"><link rel="next" href="kerberos.html" title="Chapter 11. Active Directory, Kerberos, and Security"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Part III. Reference Section</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="nw4migration.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="kerberos.html">Next</a></td></tr></table><hr></div><div class="part" lang="en"><div class="titlepage"><div><div><h1 class="title"><a name="RefSection"></a>Part III. Reference Section</h1></div></div></div><div class="partintro" lang="en"><div><div><div><h1 class="title"><a name="id2610399"></a>Reference Section</h1></div></div></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Part III. Reference Section</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="nw4migration.html" title="Chapter 10. Migrating NetWare Server to Samba-3"><link rel="next" href="kerberos.html" title="Chapter 11. Active Directory, Kerberos, and Security"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Part III. Reference Section</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="nw4migration.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="kerberos.html">Next</a></td></tr></table><hr></div><div class="part" title="Part III. Reference Section"><div class="titlepage"><div><div><h1 class="title"><a name="RefSection"></a>Part III. Reference Section</h1></div></div></div><div class="partintro" title="Reference Section"><div><div><div><h1 class="title"><a name="id377046"></a>Reference Section</h1></div></div></div><p> 2 2 This section <span class="emphasis"><em>Samba-3 by Example</em></span> provides important reference material 3 3 that may help you to solve network performance issues, to answer some of the critiques 4 4 published regarding Samba, or just to gain a more broad understanding of how Samba can 5 5 play in a Windows networking world. 6 </p><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="chapter"><a href="kerberos.html">11. Active Directory, Kerberos, and Security</a></span></dt><dd><dl><dt><span class="sect1"><a href="kerberos.html#id 2610496">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2611138">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id2611154">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2611545">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#ch10expl">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2613169">Share Access Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2613518">Share Definition Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2614131">Share Point Directory and File Permissions</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2614530">Managing Windows 200x ACLs</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2615257">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id2615391">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="DomApps.html">12. Integrating Additional Services</a></span></dt><dd><dl><dt><span class="sect1"><a href="DomApps.html#id2616020">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id2616051">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2616160">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id2616193">Technical Issues</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id2616349">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2616373">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id2618225">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2618286">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="HA.html">13. Performance, Reliability, and Availability</a></span></dt><dd><dl><dt><span class="sect1"><a href="HA.html#id2618805">Introduction</a></span></dt><dt><span class="sect1"><a href="HA.html#id2618892">Dissection and Discussion</a></span></dt><dt><span class="sect1"><a href="HA.html#id2619366">Guidelines for Reliable Samba Operation</a></span></dt><dd><dl><dt><span class="sect2"><a href="HA.html#id2619393">Name Resolution</a></span></dt><dt><span class="sect2"><a href="HA.html#id2619868">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="HA.html#id2620205">Use and Location of BDCs</a></span></dt><dt><span class="sect2"><a href="HA.html#id2620281">Use One Consistent Version of MS Windows Client</a></span></dt><dt><span class="sect2"><a href="HA.html#id2620303">For Scalability, Use SAN-Based Storage on Samba Servers</a></span></dt><dt><span class="sect2"><a href="HA.html#id2620352">Distribute Network Load with MSDFS</a></span></dt><dt><span class="sect2"><a href="HA.html#id2620407">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></span></dt><dt><span class="sect2"><a href="HA.html#id2620452">Hardware Problems</a></span></dt><dt><span class="sect2"><a href="HA.html#id2620600">Large Directories</a></span></dt></dl></dd><dt><span class="sect1"><a href="HA.html#id2620704">Key Points Learned</a></span></dt></dl></dd><dt><span class="chapter"><a href="ch14.html">14. Samba Support</a></span></dt><dd><dl><dt><span class="sect1"><a href="ch14.html#id2620874">Free Support</a></span></dt><dt><span class="sect1"><a href="ch14.html#id2621092">Commercial Support</a></span></dt></dl></dd><dt><span class="chapter"><a href="appendix.html">15. A Collection of Useful Tidbits</a></span></dt><dd><dl><dt><span class="sect1"><a href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></span></dt><dt><span class="sect1"><a href="appendix.html#id2621811">Samba System File Location</a></span></dt><dt><span class="sect1"><a href="appendix.html#id2622232">Starting Samba</a></span></dt><dt><span class="sect1"><a href="appendix.html#id2622592">DNS Configuration Files</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id2622604">The Forward Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2622652">The Reverse Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2622792">DNS Root Server Hint File</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id2622851">Initialization of the LDAP Database</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#id2623411">The LDAP Account Manager</a></span></dt><dt><span class="sect1"><a href="appendix.html#id2624406">IDEALX Management Console</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12dblck">Shared Data Integrity</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id2624881">Microsoft Access</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2625028">Act! Database Sharing</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2625113">Opportunistic Locking Controls</a></span></dt></dl></dd></dl></dd><dt><span class="chapter"><a href="primer.html">16. Networking Primer</a></span></dt><dd><dl><dt><span class="sect1"><a href="primer.html#id2625280">Requirements and Notes</a></span></dt><dt><span class="sect1"><a href="primer.html#id2625441">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id2625502">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#id2625618">Exercises</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id2625744">Single-Machine Broadcast Activity</a></span></dt><dt><span class="sect2"><a href="primer.html#secondmachine">Second Machine Startup Broadcast Interaction</a></span></dt><dt><span class="sect2"><a href="primer.html#id2626892">Simple Windows Client Connection Characteristics</a></span></dt><dt><span class="sect2"><a href="primer.html#id2627394">Windows 200x/XP Client Interaction with Samba-3</a></span></dt><dt><span class="sect2"><a href="primer.html#id2627962">Conclusions to Exercises</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01conc">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id2628077">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01qa">Questions and Answers</a></span></dt></dl></dd><dt><span class="appendix"><a href="apa.html">A.7 GNUGeneral Public License version 38 </a></span></dt><dd><dl><dt><span class="bridgehead"><a href="apa.html#id 2628743">A.6 </p><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="chapter"><a href="kerberos.html">11. Active Directory, Kerberos, and Security</a></span></dt><dd><dl><dt><span class="sect1"><a href="kerberos.html#id377126">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id377710">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id377723">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id378089">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#ch10expl">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id379573">Share Access Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id379908">Share Definition Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id380465">Share Point Directory and File Permissions</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id380830">Managing Windows 200x ACLs</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id381514">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id381636">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="DomApps.html">12. Integrating Additional Services</a></span></dt><dd><dl><dt><span class="sect1"><a href="DomApps.html#id382225">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id382248">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id382338">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id382367">Technical Issues</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id382513">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id382530">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id384281">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id384336">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="HA.html">13. Performance, Reliability, and Availability</a></span></dt><dd><dl><dt><span class="sect1"><a href="HA.html#id384815">Introduction</a></span></dt><dt><span class="sect1"><a href="HA.html#id384892">Dissection and Discussion</a></span></dt><dt><span class="sect1"><a href="HA.html#id385344">Guidelines for Reliable Samba Operation</a></span></dt><dd><dl><dt><span class="sect2"><a href="HA.html#id385369">Name Resolution</a></span></dt><dt><span class="sect2"><a href="HA.html#id385810">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="HA.html#id386110">Use and Location of BDCs</a></span></dt><dt><span class="sect2"><a href="HA.html#id386178">Use One Consistent Version of MS Windows Client</a></span></dt><dt><span class="sect2"><a href="HA.html#id386195">For Scalability, Use SAN-Based Storage on Samba Servers</a></span></dt><dt><span class="sect2"><a href="HA.html#id386240">Distribute Network Load with MSDFS</a></span></dt><dt><span class="sect2"><a href="HA.html#id386291">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></span></dt><dt><span class="sect2"><a href="HA.html#id386332">Hardware Problems</a></span></dt><dt><span class="sect2"><a href="HA.html#id386465">Large Directories</a></span></dt></dl></dd><dt><span class="sect1"><a href="HA.html#id386548">Key Points Learned</a></span></dt></dl></dd><dt><span class="chapter"><a href="ch14.html">14. Samba Support</a></span></dt><dd><dl><dt><span class="sect1"><a href="ch14.html#id386696">Free Support</a></span></dt><dt><span class="sect1"><a href="ch14.html#id386894">Commercial Support</a></span></dt></dl></dd><dt><span class="chapter"><a href="appendix.html">15. A Collection of Useful Tidbits</a></span></dt><dd><dl><dt><span class="sect1"><a href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></span></dt><dt><span class="sect1"><a href="appendix.html#id387559">Samba System File Location</a></span></dt><dt><span class="sect1"><a href="appendix.html#id387952">Starting Samba</a></span></dt><dt><span class="sect1"><a href="appendix.html#id388254">DNS Configuration Files</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id388264">The Forward Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id388308">The Reverse Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id388408">DNS Root Server Hint File</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id388463">Initialization of the LDAP Database</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#id388919">The LDAP Account Manager</a></span></dt><dt><span class="sect1"><a href="appendix.html#id389839">IDEALX Management Console</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12dblck">Shared Data Integrity</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id390270">Microsoft Access</a></span></dt><dt><span class="sect2"><a href="appendix.html#id390409">Act! Database Sharing</a></span></dt><dt><span class="sect2"><a href="appendix.html#id390484">Opportunistic Locking Controls</a></span></dt></dl></dd></dl></dd><dt><span class="chapter"><a href="primer.html">16. Networking Primer</a></span></dt><dd><dl><dt><span class="sect1"><a href="primer.html#id390627">Requirements and Notes</a></span></dt><dt><span class="sect1"><a href="primer.html#id390763">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id390813">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#id390920">Exercises</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id391033">Single-Machine Broadcast Activity</a></span></dt><dt><span class="sect2"><a href="primer.html#secondmachine">Second Machine Startup Broadcast Interaction</a></span></dt><dt><span class="sect2"><a href="primer.html#id392130">Simple Windows Client Connection Characteristics</a></span></dt><dt><span class="sect2"><a href="primer.html#id392597">Windows 200x/XP Client Interaction with Samba-3</a></span></dt><dt><span class="sect2"><a href="primer.html#id393121">Conclusions to Exercises</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01conc">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id393223">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01qa">Questions and Answers</a></span></dt></dl></dd><dt><span class="appendix"><a href="apa.html">A. 7 <acronym class="acronym">GNU</acronym> General Public License version 3 8 </a></span></dt><dd><dl><dt><span class="bridgehead"><a href="apa.html#id393828">A. 9 9 Preamble 10 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2628888">A.10 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393937">A. 11 11 TERMS AND CONDITIONS 12 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2628892">A.12 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393940">A. 13 13 0. Definitions. 14 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2628984">A.14 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394004">A. 15 15 1. Source Code. 16 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629082">A.16 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394066">A. 17 17 2. Basic Permissions. 18 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629122">A.18 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394094">A. 19 19 3. Protecting Users’ Legal Rights From Anti-Circumvention Law. 20 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629154">A.20 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394116">A. 21 21 4. Conveying Verbatim Copies. 22 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629181">A.22 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394135">A. 23 23 5. Conveying Modified Source Versions. 24 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629277">A.24 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394207">A. 25 25 6. Conveying Non-Source Forms. 26 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629466">A.26 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394339">A. 27 27 7. Additional Terms. 28 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629602">A.28 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394444">A. 29 29 8. Termination. 30 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629646">A.30 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394476">A. 31 31 9. Acceptance Not Required for Having Copies. 32 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629675">A.32 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394495">A. 33 33 10. Automatic Licensing of Downstream Recipients. 34 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629727">A.34 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394529">A. 35 35 11. Patents. 36 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629872">A.36 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394618">A. 37 37 12. No Surrender of Others’ Freedom. 38 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629894">A.38 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394633">A. 39 39 13. Use with the ???TITLE??? Affero General Public License. 40 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629923">A.40 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394657">A. 41 41 14. Revised Versions of this License. 42 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629986">A.42 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394704">A. 43 43 15. Disclaimer of Warranty. 44 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2630012">A.44 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394722">A. 45 45 16. Limitation of Liability. 46 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2630032">A.46 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394736">A. 47 47 17. Interpretation of Sections 15 and 16. 48 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2630049">A.48 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394749">A. 49 49 END OF TERMS AND CONDITIONS 50 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2630052">A.50 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394752">A. 51 51 How to Apply These Terms to Your New Programs 52 52 </a></span></dt></dl></dd></dl></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="nw4migration.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="kerberos.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 10. Migrating NetWare Server to Samba-3 </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 11. Active Directory, Kerberos, and Security</td></tr></table></div></body></html> -
trunk/server/docs/htmldocs/Samba3-ByExample/apa.html
r414 r599 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Appendix A. GNU General Public License version 3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.74.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="primer.html" title="Chapter 16. Networking Primer"><link rel="next" href="go01.html" title="Glossary"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Appendix A. 2 GNU General Public License version 3 3 </th></tr><tr><td width="20%" align="left"><a accesskey="p" href="primer.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="go01.html">Next</a></td></tr></table><hr></div><div class="appendix" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="id2628713"></a>Appendix A. 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Appendix A. GNU General Public License version 3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="primer.html" title="Chapter 16. Networking Primer"><link rel="next" href="go01.html" title="Glossary"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Appendix A. 4 2 <acronym class="acronym">GNU</acronym> General Public License version 3 5 </h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="bridgehead"><a href="apa.html#id2628743">A. 3 </th></tr><tr><td width="20%" align="left"><a accesskey="p" href="primer.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="go01.html">Next</a></td></tr></table><hr></div><div class="appendix" title="Appendix A. GNU General Public License version 3"><div class="titlepage"><div><div><h2 class="title"><a name="id393802"></a>Appendix A. 4 <acronym class="acronym">GNU</acronym> General Public License version 3 5 </h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="bridgehead"><a href="apa.html#id393828">A. 6 6 Preamble 7 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2628888">A.7 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393937">A. 8 8 TERMS AND CONDITIONS 9 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2628892">A.9 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393940">A. 10 10 0. Definitions. 11 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2628984">A.11 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394004">A. 12 12 1. Source Code. 13 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629082">A.13 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394066">A. 14 14 2. Basic Permissions. 15 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629122">A.15 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394094">A. 16 16 3. Protecting Users’ Legal Rights From Anti-Circumvention Law. 17 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629154">A.17 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394116">A. 18 18 4. Conveying Verbatim Copies. 19 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629181">A.19 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394135">A. 20 20 5. Conveying Modified Source Versions. 21 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629277">A.21 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394207">A. 22 22 6. Conveying Non-Source Forms. 23 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629466">A.23 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394339">A. 24 24 7. Additional Terms. 25 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629602">A.25 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394444">A. 26 26 8. Termination. 27 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629646">A.27 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394476">A. 28 28 9. Acceptance Not Required for Having Copies. 29 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629675">A.29 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394495">A. 30 30 10. Automatic Licensing of Downstream Recipients. 31 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629727">A.31 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394529">A. 32 32 11. Patents. 33 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629872">A.33 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394618">A. 34 34 12. No Surrender of Others’ Freedom. 35 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629894">A.35 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394633">A. 36 36 13. Use with the ???TITLE??? Affero General Public License. 37 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629923">A.37 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394657">A. 38 38 14. Revised Versions of this License. 39 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629986">A.39 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394704">A. 40 40 15. Disclaimer of Warranty. 41 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2630012">A.41 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394722">A. 42 42 16. Limitation of Liability. 43 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2630032">A.43 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394736">A. 44 44 17. Interpretation of Sections 15 and 16. 45 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2630049">A.45 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394749">A. 46 46 END OF TERMS AND CONDITIONS 47 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2630052">A.47 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394752">A. 48 48 How to Apply These Terms to Your New Programs 49 49 </a></span></dt></dl></div><p> … … 55 55 Everyone is permitted to copy and distribute verbatim copies of this license 56 56 document, but changing it is not allowed. 57 </p><h2><a name="id 2628743"></a>57 </p><h2><a name="id393828"></a> 58 58 Preamble 59 59 </h2><p> … … 119 119 The precise terms and conditions for copying, distribution and modification 120 120 follow. 121 </p><h2><a name="id 2628888"></a>121 </p><h2><a name="id393937"></a> 122 122 TERMS AND CONDITIONS 123 </h2><h2><a name="id 2628892"></a>123 </h2><h2><a name="id393940"></a> 124 124 0. Definitions. 125 125 </h2><p> … … 163 163 a list of user commands or options, such as a menu, a prominent item in the 164 164 list meets this criterion. 165 </p><h2><a name="id 2628984"></a>165 </p><h2><a name="id394004"></a> 166 166 1. Source Code. 167 167 </h2><p> … … 203 203 </p><p> 204 204 The Corresponding Source for a work in source code form is that same work. 205 </p><h2><a name="id 2629082"></a>205 </p><h2><a name="id394066"></a> 206 206 2. Basic Permissions. 207 207 </h2><p> … … 228 228 conditions stated below. Sublicensing is not allowed; section 10 makes it 229 229 unnecessary. 230 </p><h2><a name="id 2629122"></a>230 </p><h2><a name="id394094"></a> 231 231 3. Protecting Users’ Legal Rights From Anti-Circumvention Law. 232 232 </h2><p> … … 243 243 third parties’ legal rights to forbid circumvention of technological 244 244 measures. 245 </p><h2><a name="id 2629154"></a>245 </p><h2><a name="id394116"></a> 246 246 4. Conveying Verbatim Copies. 247 247 </h2><p> … … 256 256 You may charge any price or no price for each copy that you convey, and you 257 257 may offer support or warranty protection for a fee. 258 </p><h2><a name="id 2629181"></a>258 </p><h2><a name="id394135"></a> 259 259 5. Conveying Modified Source Versions. 260 260 </h2><p> … … 262 262 it from the Program, in the form of source code under the terms of section 263 263 4, provided that you also meet all of these conditions: 264 </p><div class="orderedlist"><ol type="a"><li><p>264 </p><div class="orderedlist"><ol class="orderedlist" type="a"><li class="listitem"><p> 265 265 The work must carry prominent notices stating that you modified it, and 266 266 giving a relevant date. 267 </p></li><li ><p>267 </p></li><li class="listitem"><p> 268 268 The work must carry prominent notices stating that it is released under 269 269 this License and any conditions added under section 7. This requirement 270 270 modifies the requirement in section 4 to “keep intact all 271 271 notices”. 272 </p></li><li ><p>272 </p></li><li class="listitem"><p> 273 273 You must license the entire work, as a whole, under this License to 274 274 anyone who comes into possession of a copy. This License will therefore … … 278 278 other way, but it does not invalidate such permission if you have 279 279 separately received it. 280 </p></li><li ><p>280 </p></li><li class="listitem"><p> 281 281 If the work has interactive user interfaces, each must display 282 282 Appropriate Legal Notices; however, if the Program has interactive … … 292 292 permit. Inclusion of a covered work in an aggregate does not cause 293 293 this License to apply to the other parts of the aggregate. 294 </p><h2><a name="id 2629277"></a>294 </p><h2><a name="id394207"></a> 295 295 6. Conveying Non-Source Forms. 296 296 </h2><p> … … 298 298 sections 4 and 5, provided that you also convey the machine-readable 299 299 Corresponding Source under the terms of this License, in one of these ways: 300 </p><div class="orderedlist"><ol type="a"><li><p>300 </p><div class="orderedlist"><ol class="orderedlist" type="a"><li class="listitem"><p> 301 301 Convey the object code in, or embodied in, a physical product (including 302 302 a physical distribution medium), accompanied by the Corresponding Source 303 303 fixed on a durable physical medium customarily used for software 304 304 interchange. 305 </p></li><li ><p>305 </p></li><li class="listitem"><p> 306 306 Convey the object code in, or embodied in, a physical product (including 307 307 a physical distribution medium), accompanied by a written offer, valid … … 314 314 conveying of source, or (2) access to copy the Corresponding Source from 315 315 a network server at no charge. 316 </p></li><li ><p>316 </p></li><li class="listitem"><p> 317 317 Convey individual copies of the object code with a copy of the written 318 318 offer to provide the Corresponding Source. This alternative is allowed 319 319 only occasionally and noncommercially, and only if you received the 320 320 object code with such an offer, in accord with subsection 6b. 321 </p></li><li ><p>321 </p></li><li class="listitem"><p> 322 322 Convey the object code by offering access from a designated place 323 323 (gratis or for a charge), and offer equivalent access to the … … 332 332 obligated to ensure that it is available for as long as needed to 333 333 satisfy these requirements. 334 </p></li><li ><p>334 </p></li><li class="listitem"><p> 335 335 Convey the object code using peer-to-peer transmission, provided you 336 336 inform other peers where the object code and Corresponding Source of the … … 387 387 and must require no special password or key for unpacking, reading or 388 388 copying. 389 </p><h2><a name="id 2629466"></a>389 </p><h2><a name="id394339"></a> 390 390 7. Additional Terms. 391 391 </h2><p> … … 409 409 to a covered work, you may (if authorized by the copyright holders of that 410 410 material) supplement the terms of this License with terms: 411 </p><div class="orderedlist"><ol type="a"><li><p>411 </p><div class="orderedlist"><ol class="orderedlist" type="a"><li class="listitem"><p> 412 412 Disclaiming warranty or limiting liability differently from the terms 413 413 of sections 15 and 16 of this License; or 414 </p></li><li ><p>414 </p></li><li class="listitem"><p> 415 415 Requiring preservation of specified reasonable legal notices or author 416 416 attributions in that material or in the Appropriate Legal Notices 417 417 displayed by works containing it; or 418 </p></li><li ><p>418 </p></li><li class="listitem"><p> 419 419 Prohibiting misrepresentation of the origin of that material, or 420 420 requiring that modified versions of such material be marked in 421 421 reasonable ways as different from the original version; or 422 </p></li><li ><p>422 </p></li><li class="listitem"><p> 423 423 Limiting the use for publicity purposes of names of licensors or 424 424 authors of the material; or 425 </p></li><li ><p>425 </p></li><li class="listitem"><p> 426 426 Declining to grant rights under trademark law for use of some trade 427 427 names, trademarks, or service marks; or 428 </p></li><li ><p>428 </p></li><li class="listitem"><p> 429 429 Requiring indemnification of licensors and authors of that material by 430 430 anyone who conveys the material (or modified versions of it) with … … 451 451 of a separately written license, or stated as exceptions; the above 452 452 requirements apply either way. 453 </p><h2><a name="id 2629602"></a>453 </p><h2><a name="id394444"></a> 454 454 8. Termination. 455 455 </h2><p> … … 477 477 reinstated, you do not qualify to receive new licenses for the same 478 478 material under section 10. 479 </p><h2><a name="id 2629646"></a>479 </p><h2><a name="id394476"></a> 480 480 9. Acceptance Not Required for Having Copies. 481 481 </h2><p> … … 488 488 Therefore, by modifying or propagating a covered work, you indicate your 489 489 acceptance of this License to do so. 490 </p><h2><a name="id 2629675"></a>490 </p><h2><a name="id394495"></a> 491 491 10. Automatic Licensing of Downstream Recipients. 492 492 </h2><p> … … 513 513 by making, using, selling, offering for sale, or importing the Program or 514 514 any portion of it. 515 </p><h2><a name="id 2629727"></a>515 </p><h2><a name="id394529"></a> 516 516 11. Patents. 517 517 </h2><p> … … 580 580 implied license or other defenses to infringement that may otherwise be 581 581 available to you under applicable patent law. 582 </p><h2><a name="id 2629872"></a>582 </p><h2><a name="id394618"></a> 583 583 12. No Surrender of Others’ Freedom. 584 584 </h2><p> … … 592 592 Program, the only way you could satisfy both those terms and this License 593 593 would be to refrain entirely from conveying the Program. 594 </p><h2><a name="id 2629894"></a>594 </p><h2><a name="id394633"></a> 595 595 13. Use with the <acronym class="acronym">GNU</acronym> Affero General Public License. 596 596 </h2><p> … … 603 603 section 13, concerning interaction through a network will apply to the 604 604 combination as such. 605 </p><h2><a name="id 2629923"></a>605 </p><h2><a name="id394657"></a> 606 606 14. Revised Versions of this License. 607 607 </h2><p> … … 628 628 However, no additional obligations are imposed on any author or copyright 629 629 holder as a result of your choosing to follow a later version. 630 </p><h2><a name="id 2629986"></a>630 </p><h2><a name="id394704"></a> 631 631 15. Disclaimer of Warranty. 632 632 </h2><p> … … 639 639 YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL 640 640 NECESSARY SERVICING, REPAIR OR CORRECTION. 641 </p><h2><a name="id 2630012"></a>641 </p><h2><a name="id394722"></a> 642 642 16. Limitation of Liability. 643 643 </h2><p> … … 651 651 EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF 652 652 SUCH DAMAGES. 653 </p><h2><a name="id 2630032"></a>653 </p><h2><a name="id394736"></a> 654 654 17. Interpretation of Sections 15 and 16. 655 655 </h2><p> … … 660 660 warranty or assumption of liability accompanies a copy of the Program in 661 661 return for a fee. 662 </p><h2><a name="id 2630049"></a>662 </p><h2><a name="id394749"></a> 663 663 END OF TERMS AND CONDITIONS 664 </h2><h2><a name="id 2630052"></a>664 </h2><h2><a name="id394752"></a> 665 665 How to Apply These Terms to Your New Programs 666 666 </h2><p> -
trunk/server/docs/htmldocs/Samba3-ByExample/appendix.html
r414 r599 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 15. A Collection of Useful Tidbits</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 4.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="ch14.html" title="Chapter 14. Samba Support"><link rel="next" href="primer.html" title="Chapter 16. Networking Primer"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 15. A Collection of Useful Tidbits</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="ch14.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="primer.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="appendix"></a>Chapter 15. A Collection of Useful Tidbits</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></span></dt><dt><span class="sect1"><a href="appendix.html#id2621811">Samba System File Location</a></span></dt><dt><span class="sect1"><a href="appendix.html#id2622232">Starting Samba</a></span></dt><dt><span class="sect1"><a href="appendix.html#id2622592">DNS Configuration Files</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id2622604">The Forward Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2622652">The Reverse Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2622792">DNS Root Server Hint File</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id2622851">Initialization of the LDAP Database</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#id2623411">The LDAP Account Manager</a></span></dt><dt><span class="sect1"><a href="appendix.html#id2624406">IDEALX Management Console</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12dblck">Shared Data Integrity</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id2624881">Microsoft Access</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2625028">Act! Database Sharing</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2625113">Opportunistic Locking Controls</a></span></dt></dl></dd></dl></div><p>2 <a class="indexterm" name="id 2621228"></a>3 <a class="indexterm" name="id 2621234"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 15. A Collection of Useful Tidbits</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="ch14.html" title="Chapter 14. Samba Support"><link rel="next" href="primer.html" title="Chapter 16. Networking Primer"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 15. A Collection of Useful Tidbits</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="ch14.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="primer.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 15. A Collection of Useful Tidbits"><div class="titlepage"><div><div><h2 class="title"><a name="appendix"></a>Chapter 15. A Collection of Useful Tidbits</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></span></dt><dt><span class="sect1"><a href="appendix.html#id387559">Samba System File Location</a></span></dt><dt><span class="sect1"><a href="appendix.html#id387952">Starting Samba</a></span></dt><dt><span class="sect1"><a href="appendix.html#id388254">DNS Configuration Files</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id388264">The Forward Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id388308">The Reverse Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id388408">DNS Root Server Hint File</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id388463">Initialization of the LDAP Database</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#id388919">The LDAP Account Manager</a></span></dt><dt><span class="sect1"><a href="appendix.html#id389839">IDEALX Management Console</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12dblck">Shared Data Integrity</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id390270">Microsoft Access</a></span></dt><dt><span class="sect2"><a href="appendix.html#id390409">Act! Database Sharing</a></span></dt><dt><span class="sect2"><a href="appendix.html#id390484">Opportunistic Locking Controls</a></span></dt></dl></dd></dl></div><p> 2 <a class="indexterm" name="id387011"></a> 3 <a class="indexterm" name="id387018"></a> 4 4 Information presented here is considered to be either basic or well-known material that is informative 5 5 yet helpful. Over the years, I have observed an interesting behavior. There is an expectation that … … 7 7 different from doing so with Windows NT4 or a Windows ADS domain. Be assured that the steps are identical, 8 8 as shown in the example given below. 9 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="domjoin"></a>Joining a Domain: Windows 200x/XP Professional</h2></div></div></div><p>10 <a class="indexterm" name="id 2621264"></a>9 </p><div class="sect1" title="Joining a Domain: Windows 200x/XP Professional"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="domjoin"></a>Joining a Domain: Windows 200x/XP Professional</h2></div></div></div><p> 10 <a class="indexterm" name="id387044"></a> 11 11 Microsoft Windows NT/200x/XP Professional platforms can participate in Domain Security. 12 12 This section steps through the process for making a Windows 200x/XP Professional machine a 13 13 member of a Domain Security environment. It should be noted that this process is identical 14 14 when joining a domain that is controlled by Windows NT4/200x as well as a Samba PDC. 15 </p><div class="procedure" ><a name="id2621278"></a><p class="title"><b>Procedure 15.1. Steps to Join a Domain</b></p><ol type="1"><li><p>15 </p><div class="procedure" title="Procedure 15.1. Steps to Join a Domain"><a name="id387055"></a><p class="title"><b>Procedure 15.1. Steps to Join a Domain</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 16 16 Click <span class="guimenu">Start</span>. 17 </p></li><li ><p>17 </p></li><li class="step" title="Step 2"><p> 18 18 Right-click <span class="guimenu">My Computer</span>, and then select <span class="guimenuitem">Properties</span>. 19 </p></li><li ><p>19 </p></li><li class="step" title="Step 3"><p> 20 20 The opening panel is the same one that can be reached by clicking <span class="guimenu">System</span> on the Control Panel. 21 21 See <a class="link" href="appendix.html#swxpp001" title="Figure 15.1. The General Panel.">“The General Panel.”</a>. 22 22 </p><div class="figure"><a name="swxpp001"></a><p class="title"><b>Figure 15.1. The General Panel.</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/wxpp001.png" alt="The General Panel."></div></div></div><p><br class="figure-break"> 23 </p></li><li ><p>23 </p></li><li class="step" title="Step 4"><p> 24 24 Click the <span class="guimenu">Computer Name</span> tab. 25 25 This panel shows the <span class="guimenuitem">Computer Description</span>, the <span class="guimenuitem">Full computer name</span>, … … 30 30 See <a class="link" href="appendix.html#swxpp004" title="Figure 15.2. The Computer Name Panel.">“The Computer Name Panel.”</a>. 31 31 </p><div class="figure"><a name="swxpp004"></a><p class="title"><b>Figure 15.2. The Computer Name Panel.</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/wxpp004.png" alt="The Computer Name Panel."></div></div></div><p><br class="figure-break"> 32 </p></li><li ><p>32 </p></li><li class="step" title="Step 5"><p> 33 33 Click on <span class="guimenu">Change</span>. This panel shows that our example machine (TEMPTATION) is in a workgroup called WORKGROUP. 34 34 We join the domain called MIDEARTH. See <a class="link" href="appendix.html#swxpp006" title="Figure 15.3. The Computer Name Changes Panel">“The Computer Name Changes Panel”</a>. 35 35 </p><div class="figure"><a name="swxpp006"></a><p class="title"><b>Figure 15.3. The Computer Name Changes Panel</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/wxpp006.png" alt="The Computer Name Changes Panel"></div></div></div><p><br class="figure-break"> 36 </p></li><li ><p>36 </p></li><li class="step" title="Step 6"><p> 37 37 Enter the name <span class="guimenu">MIDEARTH</span> in the field below the Domain radio button. 38 38 </p><p> 39 39 This panel shows that our example machine (TEMPTATION) is set to join the domain called MIDEARTH. See <a class="link" href="appendix.html#swxpp007" title="Figure 15.4. The Computer Name Changes Panel Domain MIDEARTH">“The Computer Name Changes Panel Domain MIDEARTH”</a>. 40 40 </p><div class="figure"><a name="swxpp007"></a><p class="title"><b>Figure 15.4. The Computer Name Changes Panel Domain MIDEARTH</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/wxpp007.png" alt="The Computer Name Changes Panel Domain MIDEARTH"></div></div></div><p><br class="figure-break"> 41 </p></li><li ><p>41 </p></li><li class="step" title="Step 7"><p> 42 42 Now click the <span class="guimenu">OK</span> button. A dialog box should appear to allow you to provide the credentials (username and password) 43 43 of a domain administrative account that has the rights to add machines to the domain. 44 44 </p><p> 45 Enter the name “<span class="quote">root</span>”and the root password from your Samba-3 server. See <a class="link" href="appendix.html#swxpp008" title="Figure 15.5. Computer Name Changes User name and Password Panel">“Computer Name Changes User name and Password Panel”</a>.45 Enter the name <span class="quote">“<span class="quote">root</span>”</span> and the root password from your Samba-3 server. See <a class="link" href="appendix.html#swxpp008" title="Figure 15.5. Computer Name Changes User name and Password Panel">“Computer Name Changes User name and Password Panel”</a>. 46 46 </p><div class="figure"><a name="swxpp008"></a><p class="title"><b>Figure 15.5. Computer Name Changes User name and Password Panel</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/wxpp008.png" alt="Computer Name Changes User name and Password Panel"></div></div></div><p><br class="figure-break"> 47 </p></li><li ><p>47 </p></li><li class="step" title="Step 8"><p> 48 48 Click <span class="guimenu">OK</span>. 49 49 </p><p> 50 The “<span class="quote">Welcome to the MIDEARTH domain</span>”dialog box should appear. At this point, the machine must be rebooted.50 The <span class="quote">“<span class="quote">Welcome to the MIDEARTH domain</span>”</span> dialog box should appear. At this point, the machine must be rebooted. 51 51 Joining the domain is now complete. 52 52 </p></li></ol></div><p> 53 <a class="indexterm" name="id 2621696"></a>54 <a class="indexterm" name="id 2621703"></a>53 <a class="indexterm" name="id387460"></a> 54 <a class="indexterm" name="id387466"></a> 55 55 The screen capture shown in <a class="link" href="appendix.html#swxpp007" title="Figure 15.4. The Computer Name Changes Panel Domain MIDEARTH">“The Computer Name Changes Panel Domain MIDEARTH”</a> has a button labeled <span class="guimenu">More...</span>. This button opens a 56 56 panel in which you can set (or change) the Primary DNS suffix of the computer. This is a parameter that mainly affects members 57 57 of Microsoft Active Directory. Active Directory is heavily oriented around the DNS namespace. 58 58 </p><p> 59 <a class="indexterm" name="id 2621730"></a>60 <a class="indexterm" name="id 2621736"></a>59 <a class="indexterm" name="id387490"></a> 60 <a class="indexterm" name="id387497"></a> 61 61 Where NetBIOS technology uses WINS as well as UDP broadcast as key mechanisms for name resolution, Active Directory servers 62 62 register their services with the Microsoft Dynamic DNS server. Windows clients must be able to query the correct DNS server 63 63 to find the services (like which machines are domain controllers or which machines have the Netlogon service running). 64 64 </p><p> 65 <a class="indexterm" name="id 2621755"></a>65 <a class="indexterm" name="id387512"></a> 66 66 The default setting of the Primary DNS suffix is the Active Directory domain name. When you change the Primary DNS suffix, 67 67 this does not affect domain membership, but it can break network browsing and the ability to resolve your computer name to … … 71 71 Where the client is a member of a Samba domain, it is preferable to leave this field blank. 72 72 </p><p> 73 <a class="indexterm" name="id 2621783"></a>74 According to Microsoft documentation, “<span class="quote">If this computer belongs to a group with <code class="constant">Group Policy</code>73 <a class="indexterm" name="id387534"></a> 74 According to Microsoft documentation, <span class="quote">“<span class="quote">If this computer belongs to a group with <code class="constant">Group Policy</code> 75 75 enabled on <code class="literal">Primary DNS suffice of this computer</code>, the string specified in the Group Policy is used 76 76 as the primary DNS suffix and you might need to restart your computer to view the correct setting. The local setting is 77 used only if Group Policy is disabled or unspecified.</span>” 78 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2621811"></a>Samba System File Location</h2></div></div></div><p><a class="indexterm" name="id2621818"></a><a class="indexterm" name="id2621826"></a><a class="indexterm" name="id2621834"></a>77 used only if Group Policy is disabled or unspecified.</span>”</span> 78 </p></div><div class="sect1" title="Samba System File Location"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id387559"></a>Samba System File Location</h2></div></div></div><p><a class="indexterm" name="id387566"></a><a class="indexterm" name="id387574"></a><a class="indexterm" name="id387581"></a> 79 79 One of the frustrations expressed by subscribers to the Samba mailing lists revolves around the choice of where the default Samba Team 80 80 build and installation process locates its Samba files. The location, chosen in the early 1990s, for the default installation is … … 84 84 Several UNIX vendors, and Linux vendors in particular, elected to locate the Samba files in a location other than the Samba Team 85 85 default. 86 </p><p><a class="indexterm" name="id 2621870"></a><a class="indexterm" name="id2621882"></a><a class="indexterm" name="id2621889"></a><a class="indexterm" name="id2621901"></a><a class="indexterm" name="id2621909"></a><a class="indexterm" name="id2621920"></a><a class="indexterm" name="id2621928"></a><a class="indexterm" name="id2621936"></a><a class="indexterm" name="id2621944"></a><a class="indexterm" name="id2621952"></a><a class="indexterm" name="id2621960"></a><a class="indexterm" name="id2621968"></a><a class="indexterm" name="id2621976"></a><a class="indexterm" name="id2621984"></a><a class="indexterm" name="id2621992"></a><a class="indexterm" name="id2622000"></a>86 </p><p><a class="indexterm" name="id387612"></a><a class="indexterm" name="id387624"></a><a class="indexterm" name="id387631"></a><a class="indexterm" name="id387643"></a><a class="indexterm" name="id387650"></a><a class="indexterm" name="id387662"></a><a class="indexterm" name="id387670"></a><a class="indexterm" name="id387677"></a><a class="indexterm" name="id387685"></a><a class="indexterm" name="id387693"></a><a class="indexterm" name="id387701"></a><a class="indexterm" name="id387709"></a><a class="indexterm" name="id387717"></a><a class="indexterm" name="id387725"></a><a class="indexterm" name="id387732"></a><a class="indexterm" name="id387740"></a> 87 87 Linux vendors, working in conjunction with the Free Standards Group (FSG), Linux Standards Base (LSB), and File Hierarchy 88 88 System (FHS), have elected to locate the configuration files under the <code class="filename">/etc/samba</code> directory, common binary … … 93 93 <code class="filename">/usr/lib/samba</code> directory tree. The files located there include the dynamically loadable modules for the 94 94 passdb backend as well as for the VFS modules. 95 </p><p><a class="indexterm" name="id 2622069"></a><a class="indexterm" name="id2622077"></a><a class="indexterm" name="id2622085"></a>95 </p><p><a class="indexterm" name="id387804"></a><a class="indexterm" name="id387812"></a><a class="indexterm" name="id387820"></a> 96 96 Samba creates runtime control files and generates log files. The runtime control files (tdb and dat files) are stored in 97 97 the <code class="filename">/var/lib/samba</code> directory. Log files are created in <code class="filename">/var/log/samba.</code> … … 99 99 When Samba is built and installed using the default Samba Team process, all files are located under the 100 100 <code class="filename">/usr/local/samba</code> directory tree. This makes it simple to find the files that Samba owns. 101 </p><p><a class="indexterm" name="id 2622123"></a>101 </p><p><a class="indexterm" name="id387854"></a> 102 102 One way to find the Samba files that are installed on your UNIX/Linux system is to search for the location 103 103 of all files called <code class="literal">smbd</code>. Here is an example: … … 132 132 Many people have been caught by installation of Samba using the default Samba Team process when it was already installed 133 133 by the platform vendor's method. If your platform uses RPM format packages, you can check to see if Samba is installed by 134 executing:<a class="indexterm" name="id 2622196"></a>134 executing:<a class="indexterm" name="id387919"></a> 135 135 </p><pre class="screen"> 136 136 <code class="prompt">root# </code> rpm -qa | grep samba … … 144 144 samba3-client-3.0.20-1 145 145 samba3-cifsmount-3.0.20-1 146 </pre><p><a class="indexterm" name="id 2622219"></a>146 </pre><p><a class="indexterm" name="id387940"></a> 147 147 The package names, of course, vary according to how the vendor, or the binary package builder, prepared them. 148 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2622232"></a>Starting Samba</h2></div></div></div><p><a class="indexterm" name="id2622239"></a>148 </p></div><div class="sect1" title="Starting Samba"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id387952"></a>Starting Samba</h2></div></div></div><p><a class="indexterm" name="id387958"></a> 149 149 Samba essentially consists of two or three daemons. A daemon is a UNIX application that runs in the background and provides services. 150 150 An example of a service is the Apache Web server for which the daemon is called <code class="literal">httpd</code>. In the case of Samba, there … … 187 187 exit 0 188 188 </pre></div></div><br class="example-break"><div class="variablelist"><dl><dt><span class="term">nmbd</span></dt><dd><p> 189 <a class="indexterm" name="id 2622312"></a>190 <a class="indexterm" name="id 2622319"></a>189 <a class="indexterm" name="id388017"></a> 190 <a class="indexterm" name="id388024"></a> 191 191 This daemon handles all name registration and resolution requests. It is the primary vehicle involved 192 192 in network browsing. It handles all UDP-based protocols. The <code class="literal">nmbd</code> daemon should 193 193 be the first command started as part of the Samba startup process. 194 194 </p></dd><dt><span class="term">smbd</span></dt><dd><p> 195 <a class="indexterm" name="id 2622349"></a>196 <a class="indexterm" name="id 2622355"></a>195 <a class="indexterm" name="id388051"></a> 196 <a class="indexterm" name="id388058"></a> 197 197 This daemon handles all TCP/IP-based connection services for file- and print-based operations. It also 198 198 manages local authentication. It should be started immediately following the startup of <code class="literal">nmbd</code>. 199 199 </p></dd><dt><span class="term">winbindd</span></dt><dd><p> 200 <a class="indexterm" name="id 2622384"></a>201 <a class="indexterm" name="id 2622391"></a>200 <a class="indexterm" name="id388085"></a> 201 <a class="indexterm" name="id388092"></a> 202 202 This daemon should be started when Samba is a member of a Windows NT4 or ADS domain. It is also needed when 203 203 Samba has trust relationships with another domain. The <code class="literal">winbindd</code> daemon will check the … … 253 253 exit 1 254 254 esac 255 </pre></div></div><br class="example-break"><p><a class="indexterm" name="id 2622513"></a>255 </pre></div></div><br class="example-break"><p><a class="indexterm" name="id388184"></a> 256 256 SUSE Linux implements individual control over each Samba daemon. A Samba control script that can be conveniently 257 257 executed from the command line is shown in <a class="link" href="appendix.html#ch12SL" title="Example 15.1. A Useful Samba Control Script for SUSE Linux">“A Useful Samba Control Script for SUSE Linux”</a>. This can be located in the directory 258 258 <code class="filename">/sbin</code> in a file called <code class="filename">samba</code>. This type of control script should be 259 259 owned by user root and group root, and set so that only root can execute it. 260 </p><p><a class="indexterm" name="id 2622549"></a>260 </p><p><a class="indexterm" name="id388216"></a> 261 261 A sample startup script for a Red Hat Linux system is shown in <a class="link" href="appendix.html#ch12RHscript" title="Example 15.2. A Sample Samba Control Script for Red Hat Linux">“A Sample Samba Control Script for Red Hat Linux”</a>. 262 262 This file could be located in the directory <code class="filename">/etc/rc.d</code> and can be called … … 265 265 the Samba source code distribution tarball. The packaging files for each platform include a 266 266 startup control file. 267 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2622592"></a>DNS Configuration Files</h2></div></div></div><p>267 </p></div><div class="sect1" title="DNS Configuration Files"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id388254"></a>DNS Configuration Files</h2></div></div></div><p> 268 268 The following files are common to all DNS server configurations. Rather than repeat them multiple times, they 269 269 are presented here for general reference. 270 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2622604"></a>The Forward Zone File for the Loopback Adaptor</h3></div></div></div><p>270 </p><div class="sect2" title="The Forward Zone File for the Loopback Adaptor"><div class="titlepage"><div><div><h3 class="title"><a name="id388264"></a>The Forward Zone File for the Loopback Adaptor</h3></div></div></div><p> 271 271 The forward zone file for the loopback address never changes. An example file is shown 272 272 in <a class="link" href="appendix.html#loopback" title="Example 15.3. DNS Localhost Forward Zone File: /var/lib/named/localhost.zone">“DNS Localhost Forward Zone File: /var/lib/named/localhost.zone”</a>. All traffic destined for an IP address that is hosted on a … … 285 285 IN NS @ 286 286 IN A 127.0.0.1 287 </pre></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2622652"></a>The Reverse Zone File for the Loopback Adaptor</h3></div></div></div><p>287 </pre></div></div><br class="example-break"></div><div class="sect2" title="The Reverse Zone File for the Loopback Adaptor"><div class="titlepage"><div><div><h3 class="title"><a name="id388308"></a>The Reverse Zone File for the Loopback Adaptor</h3></div></div></div><p> 288 288 The reverse zone file for the loopback address as shown in <a class="link" href="appendix.html#dnsloopy" title="Example 15.4. DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone">“DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone”</a> 289 289 is necessary so that references to the address <code class="constant">127.0.0.1</code> can be … … 345 345 M.ROOT-SERVERS.NET. 3600000 A 202.12.27.33 346 346 ; End of File 347 </pre></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2622792"></a>DNS Root Server Hint File</h3></div></div></div><p>347 </pre></div></div><br class="example-break"></div><div class="sect2" title="DNS Root Server Hint File"><div class="titlepage"><div><div><h3 class="title"><a name="id388408"></a>DNS Root Server Hint File</h3></div></div></div><p> 348 348 The content of the root hints file as shown in <a class="link" href="appendix.html#roothint" title="Example 15.5. DNS Root Name Server Hint File: /var/lib/named/root.hint">“DNS Root Name Server Hint File: /var/lib/named/root.hint”</a> changes slowly over time. 349 349 Periodically this file should be updated from the source shown. Because 350 350 of its size, this file is located at the end of this chapter. 351 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="altldapcfg"></a>Alternative LDAP Database Initialization</h2></div></div></div><p><a class="indexterm" name="id2622823"></a><a class="indexterm" name="id2622834"></a>351 </p></div></div><div class="sect1" title="Alternative LDAP Database Initialization"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="altldapcfg"></a>Alternative LDAP Database Initialization</h2></div></div></div><p><a class="indexterm" name="id388437"></a><a class="indexterm" name="id388448"></a> 352 352 The following procedure may be used as an alternative means of configuring 353 353 the initial LDAP database. Many administrators prefer to have greater control 354 354 over how system files get configured. 355 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2622851"></a>Initialization of the LDAP Database</h3></div></div></div><p><a class="indexterm" name="id2622858"></a><a class="indexterm" name="id2622866"></a><a class="indexterm" name="id2622878"></a>355 </p><div class="sect2" title="Initialization of the LDAP Database"><div class="titlepage"><div><div><h3 class="title"><a name="id388463"></a>Initialization of the LDAP Database</h3></div></div></div><p><a class="indexterm" name="id388470"></a><a class="indexterm" name="id388478"></a><a class="indexterm" name="id388489"></a> 356 356 The first step to get the LDAP server ready for action is to create the LDIF file from 357 357 which the LDAP database will be preloaded. This is necessary to create the containers … … 359 359 preload the well-known Windows NT Domain Groups, as they must have the correct SID so 360 360 that they can be recognized as special NT Groups by the MS Windows clients. 361 </p><div class="procedure" ><a name="ldapinit"></a><p class="title"><b>Procedure 15.2. LDAP Directory Pre-Load Steps</b></p><ol type="1"><li><p>361 </p><div class="procedure" title="Procedure 15.2. LDAP Directory Pre-Load Steps"><a name="ldapinit"></a><p class="title"><b>Procedure 15.2. LDAP Directory Pre-Load Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 362 362 Create a directory in which to store the files you use to generate 363 363 the LDAP LDIF file for your system. Execute the following: … … 367 367 <code class="prompt">root# </code> chmod 700 /etc/openldap/SambaInit 368 368 </pre><p> 369 </p></li><li ><p>369 </p></li><li class="step" title="Step 2"><p> 370 370 Install the files shown in <a class="link" href="appendix.html#sbehap-ldapreconfa" title="Example 15.6. LDAP Pre-configuration Script: SMBLDAP-ldif-preconfig.sh Part A">“LDAP Pre-configuration Script: SMBLDAP-ldif-preconfig.sh Part A”</a>, <a class="link" href="appendix.html#sbehap-ldapreconfb" title="Example 15.7. LDAP Pre-configuration Script: SMBLDAP-ldif-preconfig.sh Part B">“LDAP Pre-configuration Script: SMBLDAP-ldif-preconfig.sh Part B”</a>, 371 371 and <a class="link" href="appendix.html#sbehap-ldapreconfc" title="Example 15.8. LDAP Pre-configuration Script: SMBLDAP-ldif-preconfig.sh Part C">“LDAP Pre-configuration Script: SMBLDAP-ldif-preconfig.sh Part C”</a> into the directory 372 372 <code class="filename">/etc/openldap/SambaInit/SMBLDAP-ldif-preconfig.sh.</code> These three files are, 373 373 respectively, parts A, B, and C of the <code class="filename">SMBLDAP-ldif-preconfig.sh</code> file. 374 </p></li><li ><p>374 </p></li><li class="step" title="Step 3"><p> 375 375 Install the files shown in <a class="link" href="appendix.html#sbehap-ldifpata" title="Example 15.9. LDIF Pattern File Used to Pre-configure LDAP Part A">“LDIF Pattern File Used to Pre-configure LDAP Part A”</a> and <a class="link" href="appendix.html#sbehap-ldifpatb" title="Example 15.10. LDIF Pattern File Used to Pre-configure LDAP Part B">“LDIF Pattern File Used to Pre-configure LDAP Part B”</a> into the directory 376 376 <code class="filename">/etc/openldap/SambaInit/.</code> These two files are 377 377 parts A and B, respectively, of the <code class="filename">init-ldif.pat</code> file. 378 </p></li><li ><p>378 </p></li><li class="step" title="Step 4"><p> 379 379 Change to the <code class="filename">/etc/openldap/SambaInit</code> directory. Execute the following: 380 380 </p><pre class="screen"> … … 416 416 </pre><p> 417 417 This creates a file called <code class="filename">MEGANET2.ldif</code>. 418 </p></li><li ><p>418 </p></li><li class="step" title="Step 5"><p> 419 419 It is now time to preload the LDAP database with the following 420 420 command: … … 467 467 entryCSN: 2003121705:57:47Z#0x000a#0#0000 468 468 </pre><p> 469 </p></li><li ><p>469 </p></li><li class="step" title="Step 6"><p> 470 470 Your LDAP database is ready for testing. You can now start the LDAP server 471 471 using the system tool for your Linux operating system. For SUSE Linux, you can … … 474 474 <code class="prompt">root# </code> rcldap start 475 475 </pre><p> 476 </p></li><li ><p>476 </p></li><li class="step" title="Step 7"><p> 477 477 It is now a good idea to validate that the LDAP server is running correctly. 478 478 Execute the following: … … 706 706 displayName: Domain Users 707 707 description: Domain Users 708 </pre></div></div><br class="example-break"></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2623411"></a>The LDAP Account Manager</h2></div></div></div><p>709 <a class="indexterm" name="id 2623419"></a>710 <a class="indexterm" name="id 2623426"></a>711 <a class="indexterm" name="id 2623435"></a>712 <a class="indexterm" name="id 2623442"></a>713 <a class="indexterm" name="id 2623448"></a>714 <a class="indexterm" name="id 2623455"></a>715 <a class="indexterm" name="id 2623462"></a>708 </pre></div></div><br class="example-break"></div><div class="sect1" title="The LDAP Account Manager"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id388919"></a>The LDAP Account Manager</h2></div></div></div><p> 709 <a class="indexterm" name="id388927"></a> 710 <a class="indexterm" name="id388934"></a> 711 <a class="indexterm" name="id388943"></a> 712 <a class="indexterm" name="id388949"></a> 713 <a class="indexterm" name="id388956"></a> 714 <a class="indexterm" name="id388963"></a> 715 <a class="indexterm" name="id388970"></a> 716 716 The LDAP Account Manager (LAM) is an application suite that has been written in PHP. 717 717 LAM can be used with any Web server that has PHP4 support. It connects to the LDAP … … 725 725 of 2005. 726 726 </p><p> 727 <a class="indexterm" name="id 2623493"></a>728 <a class="indexterm" name="id 2623500"></a>729 <a class="indexterm" name="id 2623507"></a>727 <a class="indexterm" name="id388996"></a> 728 <a class="indexterm" name="id389003"></a> 729 <a class="indexterm" name="id389010"></a> 730 730 Requirements: 731 </p><div class="itemizedlist"><ul type="disc"><li><p>A web server that will work with PHP4.</p></li><li><p>PHP4 (available from the <a class="ulink" href="http://www.php.net/" target="_top">PHP</a> home page.)</p></li><li><p>OpenLDAP 2.0 or later.</p></li><li><p>A Web browser that supports CSS.</p></li><li><p>Perl.</p></li><li><p>The gettext package.</p></li><li><p>mcrypt + mhash (optional).</p></li><li><p>It is also a good idea to install SSL support.</p></li></ul></div><p>731 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>A web server that will work with PHP4.</p></li><li class="listitem"><p>PHP4 (available from the <a class="ulink" href="http://www.php.net/" target="_top">PHP</a> home page.)</p></li><li class="listitem"><p>OpenLDAP 2.0 or later.</p></li><li class="listitem"><p>A Web browser that supports CSS.</p></li><li class="listitem"><p>Perl.</p></li><li class="listitem"><p>The gettext package.</p></li><li class="listitem"><p>mcrypt + mhash (optional).</p></li><li class="listitem"><p>It is also a good idea to install SSL support.</p></li></ul></div><p> 732 732 LAM is a useful tool that provides a simple Web-based device that can be used to 733 733 manage the contents of the LDAP directory to: 734 <a class="indexterm" name="id 2623568"></a>735 <a class="indexterm" name="id 2623575"></a>736 <a class="indexterm" name="id 2623582"></a>737 </p><div class="itemizedlist"><ul type="disc"><li><p>Display user/group/host and Domain entries.</p></li><li><p>Manage entries (Add/Delete/Edit).</p></li><li><p>Filter and sort entries.</p></li><li><p>Store and use multiple operating profiles.</p></li><li><p>Edit organizational units (OUs).</p></li><li><p>Upload accounts from a file.</p></li><li><p>Is compatible with Samba-2.2.x and Samba-3.</p></li></ul></div><p>734 <a class="indexterm" name="id389067"></a> 735 <a class="indexterm" name="id389074"></a> 736 <a class="indexterm" name="id389081"></a> 737 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Display user/group/host and Domain entries.</p></li><li class="listitem"><p>Manage entries (Add/Delete/Edit).</p></li><li class="listitem"><p>Filter and sort entries.</p></li><li class="listitem"><p>Store and use multiple operating profiles.</p></li><li class="listitem"><p>Edit organizational units (OUs).</p></li><li class="listitem"><p>Upload accounts from a file.</p></li><li class="listitem"><p>Is compatible with Samba-2.2.x and Samba-3.</p></li></ul></div><p> 738 738 When correctly configured, LAM allows convenient management of UNIX (Posix) and Samba 739 739 user, group, and windows domain member machine accounts. 740 740 </p><p> 741 <a class="indexterm" name="id 2623636"></a>742 <a class="indexterm" name="id 2623643"></a>743 <a class="indexterm" name="id 2623650"></a>744 <a class="indexterm" name="id 2623656"></a>745 The default password is “<span class="quote">lam.</span>”It is highly recommended that you use only741 <a class="indexterm" name="id389132"></a> 742 <a class="indexterm" name="id389139"></a> 743 <a class="indexterm" name="id389145"></a> 744 <a class="indexterm" name="id389152"></a> 745 The default password is <span class="quote">“<span class="quote">lam.</span>”</span> It is highly recommended that you use only 746 746 an SSL connection to your Web server for all remote operations involving LAM. If you 747 747 want secure connections, you must configure your Apache Web server to permit connections 748 748 to LAM using only SSL. 749 </p><div class="procedure" ><a name="sbehap-laminst"></a><p class="title"><b>Procedure 15.3. Apache Configuration Steps for LAM</b></p><ol type="1"><li><p>749 </p><div class="procedure" title="Procedure 15.3. Apache Configuration Steps for LAM"><a name="sbehap-laminst"></a><p class="title"><b>Procedure 15.3. Apache Configuration Steps for LAM</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 750 750 Extract the LAM package by untarring it as shown here: 751 751 </p><pre class="screen"> … … 756 756 <code class="prompt">root# </code> dpkg -i ldap-account-manager_0.4.9.all.deb 757 757 </pre><p> 758 </p></li><li ><p>758 </p></li><li class="step" title="Step 2"><p> 759 759 Copy the extracted files to the document root directory of your Web server. 760 760 For example, on SUSE Linux Enterprise Server 9, copy to the 761 761 <code class="filename">/srv/www/htdocs</code> directory. 762 </p></li><li ><p>763 <a class="indexterm" name="id 2623736"></a>762 </p></li><li class="step" title="Step 3"><p> 763 <a class="indexterm" name="id389226"></a> 764 764 Set file permissions using the following commands: 765 765 </p><pre class="screen"> … … 770 770 <code class="prompt">root# </code> chmod 755 /srv/www/htdocs/lam/lib/*pl 771 771 </pre><p> 772 </p></li><li ><p>773 <a class="indexterm" name="id 2623789"></a>772 </p></li><li class="step" title="Step 4"><p> 773 <a class="indexterm" name="id389276"></a> 774 774 Using your favorite editor create the following <code class="filename">config.cfg</code> 775 775 LAM configuration file: … … 779 779 <code class="prompt">root# </code> vi config.cfg 780 780 </pre><p> 781 <a class="indexterm" name="id 2623830"></a>782 <a class="indexterm" name="id 2623839"></a>781 <a class="indexterm" name="id389315"></a> 782 <a class="indexterm" name="id389324"></a> 783 783 An example file is shown in <a class="link" href="appendix.html#lamcfg" title="Example 15.11. Example LAM Configuration File config.cfg">“Example LAM Configuration File config.cfg”</a>. 784 784 This is the minimum configuration that must be completed. The LAM profile 785 785 file can be created using a convenient wizard that is part of the LAM 786 786 configuration suite. 787 </p></li><li ><p>787 </p></li><li class="step" title="Step 5"><p> 788 788 Start your Web server then, using your Web browser, connect to 789 789 <a class="ulink" href="http://localhost/lam" target="_top">LAM</a> URL. Click on the … … 795 795 change the settings to match local site needs. 796 796 </p></li></ol></div><p> 797 <a class="indexterm" name="id 2623898"></a>797 <a class="indexterm" name="id389379"></a> 798 798 An example of a working file is shown here in <a class="link" href="appendix.html#lamconf" title="Example 15.12. LAM Profile Control File lam.conf">“LAM Profile Control File lam.conf”</a>. 799 799 This file has been stripped of comments to keep the size small. The comments … … 803 803 are preferred at your site. 804 804 </p><p> 805 <a class="indexterm" name="id 2623921"></a>805 <a class="indexterm" name="id389399"></a> 806 806 It is important that your LDAP server is running at the time that LAM is 807 807 being configured. This permits you to validate correct operation. 808 808 An example of the LAM login screen is provided in <a class="link" href="appendix.html#lam-login" title="Figure 15.6. The LDAP Account Manager Login Screen">“The LDAP Account Manager Login Screen”</a>. 809 809 </p><div class="figure"><a name="lam-login"></a><p class="title"><b>Figure 15.6. The LDAP Account Manager Login Screen</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/lam-login.png" width="270" alt="The LDAP Account Manager Login Screen"></div></div></div><br class="figure-break"><p> 810 <a class="indexterm" name="id 2623984"></a>810 <a class="indexterm" name="id389458"></a> 811 811 The LAM configuration editor has a number of options that must be managed correctly. 812 812 An example of use of the LAM configuration editor is shown in <a class="link" href="appendix.html#lam-config" title="Figure 15.7. The LDAP Account Manager Configuration Screen">“The LDAP Account Manager Configuration Screen”</a>. … … 818 818 using LAM to add additional users and groups. 819 819 </p><div class="figure"><a name="lam-config"></a><p class="title"><b>Figure 15.7. The LDAP Account Manager Configuration Screen</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/lam-config.png" width="270" alt="The LDAP Account Manager Configuration Screen"></div></div></div><br class="figure-break"><p> 820 <a class="indexterm" name="id 2624056"></a>820 <a class="indexterm" name="id389523"></a> 821 821 LAM has some nice, but unusual features. For example, one unexpected feature in most application 822 822 screens permits the generation of a PDF file that lists configuration information. This is a well … … 824 824 space. 825 825 </p><p> 826 <a class="indexterm" name="id 2624071"></a>826 <a class="indexterm" name="id389536"></a> 827 827 When you log onto LAM the opening screen drops you right into the user manager as shown in 828 828 <a class="link" href="appendix.html#lam-user" title="Figure 15.8. The LDAP Account Manager User Edit Screen">“The LDAP Account Manager User Edit Screen”</a>. This is a logical action as it permits the most-needed facility … … 838 838 memberships. 839 839 </p><div class="figure"><a name="lam-group"></a><p class="title"><b>Figure 15.9. The LDAP Account Manager Group Edit Screen</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/lam-groups.png" width="270" alt="The LDAP Account Manager Group Edit Screen"></div></div></div><br class="figure-break"><div class="figure"><a name="lam-group-mem"></a><p class="title"><b>Figure 15.10. The LDAP Account Manager Group Membership Edit Screen</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/lam-group-members.png" width="270" alt="The LDAP Account Manager Group Membership Edit Screen"></div></div></div><br class="figure-break"><p> 840 <a class="indexterm" name="id 2624251"></a><a class="indexterm" name="id2624256"></a>840 <a class="indexterm" name="id389704"></a><a class="indexterm" name="id389710"></a> 841 841 The final screen presented here is one that you should not normally need to use. Host accounts will 842 842 be automatically managed using the smbldap-tools scripts. This means that the screen <a class="link" href="appendix.html#lam-host" title="Figure 15.11. The LDAP Account Manager Host Edit Screen">“The LDAP Account Manager Host Edit Screen”</a> … … 884 884 cachetimeout: 5 885 885 pwdhash: SSHA 886 </pre></div></div><br class="example-break"></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2624406"></a>IDEALX Management Console</h2></div></div></div><p>886 </pre></div></div><br class="example-break"></div><div class="sect1" title="IDEALX Management Console"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id389839"></a>IDEALX Management Console</h2></div></div></div><p> 887 887 IMC (the IDEALX Mamagement Console) is a tool that can be used as the basis for a comprehensive 888 888 web-based management interface for UNIX and Linux systems. … … 898 898 For further information regarding IMC refer to the web <a class="ulink" href="http://imc.sourceforge.net/" target="_top">site.</a> 899 899 Prebuilt RPM packages are also <a class="ulink" href="http://imc.sourceforge.net/download.html" target="_top">available.</a> 900 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="ch12-SUIDSGID"></a>Effect of Setting File and Directory SUID/SGID Permissions Explained</h2></div></div></div><a class="indexterm" name="id2624512"></a><a class="indexterm" name="id2624519"></a><p>900 </p></div><div class="sect1" title="Effect of Setting File and Directory SUID/SGID Permissions Explained"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="ch12-SUIDSGID"></a>Effect of Setting File and Directory SUID/SGID Permissions Explained</h2></div></div></div><a class="indexterm" name="id389935"></a><a class="indexterm" name="id389942"></a><p> 901 901 The setting of the SUID/SGID bits on the file or directory permissions flag has particular 902 902 consequences. If the file is executable and the SUID bit is set, it executes with the privilege … … 968 968 drw-rw-r-- 2 bobj Domain Users 12346 Dec 18 18:11 maryvfile.txt 969 969 </pre><p> 970 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="ch12dblck"></a>Shared Data Integrity</h2></div></div></div><p><a class="indexterm" name="id2624750"></a><a class="indexterm" name="id2624757"></a>970 </p></div><div class="sect1" title="Shared Data Integrity"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="ch12dblck"></a>Shared Data Integrity</h2></div></div></div><p><a class="indexterm" name="id390147"></a><a class="indexterm" name="id390155"></a> 971 971 The integrity of shared data is often viewed as a particularly emotional issue, especially where 972 972 there are concurrent problems with multiuser data access. Contrary to the assertions of some who have … … 974 974 </p><p> 975 975 The solution to concurrent multiuser data access problems must consider three separate areas 976 from which the problem may stem:<a class="indexterm" name="id 2624781"></a><a class="indexterm" name="id2624792"></a><a class="indexterm" name="id2624803"></a>977 </p><div class="itemizedlist"><ul type="disc"><li><p>application-level locking controls</p></li><li><p>client-side locking controls</p></li><li><p>server-side locking controls</p></li></ul></div><p><a class="indexterm" name="id2624836"></a><a class="indexterm" name="id2624844"></a>976 from which the problem may stem:<a class="indexterm" name="id390175"></a><a class="indexterm" name="id390186"></a><a class="indexterm" name="id390197"></a> 977 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>application-level locking controls</p></li><li class="listitem"><p>client-side locking controls</p></li><li class="listitem"><p>server-side locking controls</p></li></ul></div><p><a class="indexterm" name="id390229"></a><a class="indexterm" name="id390237"></a> 978 978 Many database applications use some form of application-level access control. An example of one 979 979 well-known application that uses application-level locking is Microsoft Access. Detailed guidance 980 980 is provided here because this is the most common application for which problems have been reported. 981 </p><p><a class="indexterm" name="id 2624860"></a><a class="indexterm" name="id2624868"></a>981 </p><p><a class="indexterm" name="id390251"></a><a class="indexterm" name="id390259"></a> 982 982 Common applications that are affected by client- and server-side locking controls include MS 983 983 Excel and Act!. Important locking guidance is provided here. 984 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2624881"></a>Microsoft Access</h3></div></div></div><p>984 </p><div class="sect2" title="Microsoft Access"><div class="titlepage"><div><div><h3 class="title"><a name="id390270"></a>Microsoft Access</h3></div></div></div><p> 985 985 The best advice that can be given is to carefully read the Microsoft knowledgebase articles that 986 986 cover this area. Examples of relevant documents include: 987 </p><div class="itemizedlist"><ul type="disc"><li><p>http://support.microsoft.com/default.aspx?scid=kb;en-us;208778</p></li><li><p>http://support.microsoft.com/default.aspx?scid=kb;en-us;299373</p></li></ul></div><p><a class="indexterm" name="id2624908"></a><a class="indexterm" name="id2624919"></a>987 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>http://support.microsoft.com/default.aspx?scid=kb;en-us;208778</p></li><li class="listitem"><p>http://support.microsoft.com/default.aspx?scid=kb;en-us;299373</p></li></ul></div><p><a class="indexterm" name="id390294"></a><a class="indexterm" name="id390306"></a> 988 988 Make sure that your MS Access database file is configured for multiuser access (not set for 989 989 exclusive open). Open MS Access on each client workstation, then set the following: <span class="guimenu">(Menu bar) Tools</span>+<span class="guimenu">Options</span>+<span class="guimenu">[tab] General</span>. Set network path to Default database folder: <code class="filename">\\server\share\folder</code>. 990 990 </p><p> 991 991 You can configure MS Access file sharing behavior as follows: click <span class="guimenu">[tab] Advanced</span>. 992 Set:<a class="indexterm" name="id 2624970"></a>993 </p><div class="itemizedlist"><ul type="disc"><li><p>Default open mode: Shared</p></li><li><p>Default Record Locking: Edited Record</p></li><li><p>Open databases using record_level locking</p></li></ul></div><p><a class="indexterm" name="id2625000"></a>992 Set:<a class="indexterm" name="id390353"></a> 993 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Default open mode: Shared</p></li><li class="listitem"><p>Default Record Locking: Edited Record</p></li><li class="listitem"><p>Open databases using record_level locking</p></li></ul></div><p><a class="indexterm" name="id390382"></a> 994 994 You must now commit the changes so that they will take effect. To do so, click 995 995 <span class="guimenu">Apply</span><span class="guimenu">Ok</span>. At this point, you should exit MS Access, restart 996 996 it, and then validate that these settings have not changed. 997 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2625028"></a>Act! Database Sharing</h3></div></div></div><p><a class="indexterm" name="id2625035"></a><a class="indexterm" name="id2625043"></a>997 </p></div><div class="sect2" title="Act! Database Sharing"><div class="titlepage"><div><div><h3 class="title"><a name="id390409"></a>Act! Database Sharing</h3></div></div></div><p><a class="indexterm" name="id390415"></a><a class="indexterm" name="id390423"></a> 998 998 Where the server sharing the ACT! database(s) is running Samba,or Windows NT, 200x, or XP, you 999 999 must disable opportunistic locking on the server and all workstations. Failure to do so … … 1003 1003 as well as from article 1004 1004 <a class="ulink" href="http://itdomino.saleslogix.com/act.nsf/docid/200110485036" target="_top">200110485036</a>. 1005 </p><p><a class="indexterm" name="id 2625073"></a><a class="indexterm" name="id2625081"></a>1005 </p><p><a class="indexterm" name="id390449"></a><a class="indexterm" name="id390457"></a> 1006 1006 These documents clearly state that opportunistic locking must be disabled on both 1007 1007 the server (Samba in the case we are interested in here), as well as on every workstation … … 1011 1011 Registered Act! users may download this utility from the Act! Web 1012 1012 <a class="ulink" href="http://www.act.com/support/updates/index.cfm" target="_top">site.</a> 1013 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2625113"></a>Opportunistic Locking Controls</h3></div></div></div><p><a class="indexterm" name="id2625120"></a>1013 </p></div><div class="sect2" title="Opportunistic Locking Controls"><div class="titlepage"><div><div><h3 class="title"><a name="id390484"></a>Opportunistic Locking Controls</h3></div></div></div><p><a class="indexterm" name="id390491"></a> 1014 1014 Third-party Windows applications may not be compatible with the use of opportunistic file 1015 and record locking. For applications that are known not to be compatible,<sup>[<a name="id 2625132" href="#ftn.id2625132" class="footnote">14</a>]</sup> oplock1015 and record locking. For applications that are known not to be compatible,<sup>[<a name="id390501" href="#ftn.id390501" class="footnote">14</a>]</sup> oplock 1016 1016 support may need to be disabled both on the Samba server and on the Windows workstations. 1017 </p><p><a class="indexterm" name="id 2625147"></a><a class="indexterm" name="id2625155"></a><a class="indexterm" name="id2625163"></a>1017 </p><p><a class="indexterm" name="id390512"></a><a class="indexterm" name="id390520"></a><a class="indexterm" name="id390528"></a> 1018 1018 Oplocks enable a Windows client to cache parts of a file that are being 1019 1019 edited. Another windows client may then request to open the file with the … … 1022 1022 doing so, that workstation must flush the file from cache memory to the 1023 1023 disk or network drive. 1024 </p><p><a class="indexterm" name="id 2625184"></a>1024 </p><p><a class="indexterm" name="id390546"></a> 1025 1025 Disabling of Oplocks usage may require server and client changes. 1026 1026 Oplocks may be disabled by file, by file pattern, on the share, or on the … … 1058 1058 Comprehensive coverage of file and record-locking controls is provided in TOSHARG2, Chapter 13. 1059 1059 The information in that chapter was obtained from a wide variety of sources. 1060 </p></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id 2625132" href="#id2625132" class="para">14</a>] </sup>Refer to1060 </p></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id390501" href="#id390501" class="para">14</a>] </sup>Refer to 1061 1061 the application manufacturer's installation guidelines and knowledge base for specific 1062 1062 information regarding compatibility. It is often safe to assume that if the software -
trunk/server/docs/htmldocs/Samba3-ByExample/ch14.html
r414 r599 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 14. Samba Support</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 4.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="HA.html" title="Chapter 13. Performance, Reliability, and Availability"><link rel="next" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 14. Samba Support</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="HA.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="appendix.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en-US"><div class="titlepage"><div><div><h2 class="title"><a name="id2620743"></a>Chapter 14. Samba Support</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ch14.html#id2620874">Free Support</a></span></dt><dt><span class="sect1"><a href="ch14.html#id2621092">Commercial Support</a></span></dt></dl></div><p>2 <a class="indexterm" name="id 2620752"></a>3 One of the most difficult to answer questions in the information technology industry is, “<span class="quote">What is4 support?</span>” . That question irritates some folks, as much as common answers may annoy others.1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 14. Samba Support</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="HA.html" title="Chapter 13. Performance, Reliability, and Availability"><link rel="next" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 14. Samba Support</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="HA.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="appendix.html">Next</a></td></tr></table><hr></div><div lang="en-US" class="chapter" title="Chapter 14. Samba Support"><div class="titlepage"><div><div><h2 class="title"><a name="id386581"></a>Chapter 14. Samba Support</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ch14.html#id386696">Free Support</a></span></dt><dt><span class="sect1"><a href="ch14.html#id386894">Commercial Support</a></span></dt></dl></div><p> 2 <a class="indexterm" name="id386590"></a> 3 One of the most difficult to answer questions in the information technology industry is, <span class="quote">“<span class="quote">What is 4 support?</span>”</span>. That question irritates some folks, as much as common answers may annoy others. 5 5 </p><p> 6 <a class="indexterm" name="id 2620769"></a>6 <a class="indexterm" name="id386604"></a> 7 7 The most aggravating situation pertaining to support is typified when, as a Linux user, a call is made to 8 8 an Internet service provider who, instead of listening to the problem to find a solution, blandly replies: 9 “<span class="quote">Oh, Linux? We do not support Linux!</span>”. It has happened to me, and similar situations happen9 <span class="quote">“<span class="quote">Oh, Linux? We do not support Linux!</span>”</span>. It has happened to me, and similar situations happen 10 10 through-out the IT industry. Answers like that are designed to inform us that there are some customers 11 11 that a business just does not want to deal with, and well may we feel the anguish of the rejection that … … 16 16 inconvenience, loss of productivity, disorientation, uncertainty, and real or perceived risk. 17 17 </p><p> 18 <a class="indexterm" name="id 2620800"></a>19 <a class="indexterm" name="id 2620807"></a>20 <a class="indexterm" name="id 2620814"></a>18 <a class="indexterm" name="id386628"></a> 19 <a class="indexterm" name="id386635"></a> 20 <a class="indexterm" name="id386642"></a> 21 21 One of the forces that has become a driving force for the adoption of open source software is the fact that 22 22 many IT businesses have provided services that have perhaps failed to deliver what the customer expected, or 23 23 that have been found wanting for other reasons. 24 24 </p><p> 25 <a class="indexterm" name="id 2620828"></a>26 <a class="indexterm" name="id 2620835"></a>25 <a class="indexterm" name="id386654"></a> 26 <a class="indexterm" name="id386661"></a> 27 27 In recognition of the need for needs satisfaction as the primary experience an information technology user or 28 28 consumer expects, the information provided in this chapter may help someone to avoid an unpleasant experience 29 29 in respect of problem resolution. 30 30 </p><p> 31 <a class="indexterm" name="id 2620850"></a>32 <a class="indexterm" name="id 2620857"></a>33 <a class="indexterm" name="id 2620864"></a>31 <a class="indexterm" name="id386673"></a> 32 <a class="indexterm" name="id386680"></a> 33 <a class="indexterm" name="id386687"></a> 34 34 In the open source software arena there are two support options: free support and paid-for (commercial) 35 35 support. 36 </p><div class="sect1" lang="en-US"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2620874"></a>Free Support</h2></div></div></div><p>37 <a class="indexterm" name="id 2620881"></a>38 <a class="indexterm" name="id 2620888"></a>39 <a class="indexterm" name="id 2620895"></a>40 <a class="indexterm" name="id 2620902"></a>41 <a class="indexterm" name="id 2620909"></a>42 <a class="indexterm" name="id 2620916"></a>36 </p><div class="sect1" title="Free Support"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id386696"></a>Free Support</h2></div></div></div><p> 37 <a class="indexterm" name="id386704"></a> 38 <a class="indexterm" name="id386710"></a> 39 <a class="indexterm" name="id386717"></a> 40 <a class="indexterm" name="id386724"></a> 41 <a class="indexterm" name="id386731"></a> 42 <a class="indexterm" name="id386738"></a> 43 43 Free support may be obtained from friends, colleagues, user groups, mailing lists, and interactive help 44 44 facilities. An example of an interactive dacility is the Internet relay chat (IRC) channels that host user 45 45 supported mutual assistance. 46 46 </p><p> 47 <a class="indexterm" name="id 2620930"></a>48 <a class="indexterm" name="id 2620937"></a>49 <a class="indexterm" name="id 2620944"></a>50 <a class="indexterm" name="id 2620951"></a>51 <a class="indexterm" name="id 2620958"></a>47 <a class="indexterm" name="id386750"></a> 48 <a class="indexterm" name="id386756"></a> 49 <a class="indexterm" name="id386763"></a> 50 <a class="indexterm" name="id386770"></a> 51 <a class="indexterm" name="id386777"></a> 52 52 The Samba project maintains a mailing list that is commonly used to discuss solutions to Samba deployments. 53 53 Information regarding subscription to the Samba mailing list can be found on the Samba <a class="ulink" href="https://lists.samba.org/mailman/" target="_top">web</a> site. The public mailing list that can be used to obtain … … 56 56 the Samba <a class="ulink" href="http://www.samba.org/samba.irc.html" target="_top">IRC</a> web page. 57 57 </p><p> 58 <a class="indexterm" name="id 2620999"></a>59 <a class="indexterm" name="id 2621006"></a>60 <a class="indexterm" name="id 2621013"></a>61 <a class="indexterm" name="id 2621020"></a>58 <a class="indexterm" name="id386814"></a> 59 <a class="indexterm" name="id386821"></a> 60 <a class="indexterm" name="id386828"></a> 61 <a class="indexterm" name="id386834"></a> 62 62 As a general rule, it is considered poor net behavior to contact a Samba Team member directly 63 63 for free support. Most active members of the Samba Team work exceptionally long hours to assist … … 67 67 to show appropriate discretion and reservation in all direct contact. 68 68 </p><p> 69 <a class="indexterm" name="id 2621040"></a>70 <a class="indexterm" name="id 2621046"></a>71 <a class="indexterm" name="id 2621053"></a>69 <a class="indexterm" name="id386849"></a> 70 <a class="indexterm" name="id386856"></a> 71 <a class="indexterm" name="id386863"></a> 72 72 When you stumble across a Samba bug, often the quickest way to get it resolved is by posting 73 73 a bug <a class="ulink" href="https://bugzilla.samba.org/" target="_top">report</a>. All such reports are mailed to … … 77 77 that will permit the problem to be reproduced. 78 78 </p><p> 79 <a class="indexterm" name="id 2621078"></a>79 <a class="indexterm" name="id386883"></a> 80 80 We all recognize that sometimes free support does not provide the answer that is sought within 81 81 the time-frame required. At other times the problem is elusive and you may lack the experience 82 82 necessary to isolate the problem and thus to resolve it. This is a situation where is may be 83 83 prudent to purchase paid-for support. 84 </p></div><div class="sect1" lang="en-US"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2621092"></a>Commercial Support</h2></div></div></div><p>84 </p></div><div class="sect1" title="Commercial Support"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id386894"></a>Commercial Support</h2></div></div></div><p> 85 85 There are six basic support oriented services that are most commonly sought by Samba sites: 86 </p><div class="itemizedlist"><ul type="disc"><li><p>Assistance with network design</p></li><li><p>Staff Training</p></li><li><p>Assistance with Samba network deployment and installation</p></li><li><p>Priority telephone or email Samba configuration assistance</p></li><li><p>Trouble-shooting and diagnostic assistance</p></li><li><p>Provision of quality assured ready-to-install Samba binary packages</p></li></ul></div><p>87 <a class="indexterm" name="id 2621139"></a>88 <a class="indexterm" name="id 2621146"></a>86 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Assistance with network design</p></li><li class="listitem"><p>Staff Training</p></li><li class="listitem"><p>Assistance with Samba network deployment and installation</p></li><li class="listitem"><p>Priority telephone or email Samba configuration assistance</p></li><li class="listitem"><p>Trouble-shooting and diagnostic assistance</p></li><li class="listitem"><p>Provision of quality assured ready-to-install Samba binary packages</p></li></ul></div><p> 87 <a class="indexterm" name="id386938"></a> 88 <a class="indexterm" name="id386945"></a> 89 89 Information regarding companies that provide professional Samba support can be obtained by performing a Google 90 90 search, as well as by reference to the Samba <a class="ulink" href="http://www.samba.org/samba/support.html" target="_top">Support</a> web page. Companies who notify the Samba Team … … 94 94 them. 95 95 </p><p> 96 <a class="indexterm" name="id 2621172"></a>96 <a class="indexterm" name="id386966"></a> 97 97 The policy within the Samba Team is to treat all commercial support providers equally and to show no 98 98 preference. As a result, Samba Team members who provide commercial support are lumped in with everyone else. … … 100 100 is pro-community; so do what you can to help a local business to prosper. 101 101 </p><p> 102 <a class="indexterm" name="id 2621195"></a>102 <a class="indexterm" name="id386982"></a> 103 103 Open source software support can be found in any quality, at any price and in any place you can 104 104 to obtain it. Over 180 companies around the world provide Samba support, there is no excuse for -
trunk/server/docs/htmldocs/Samba3-ByExample/go01.html
r414 r599 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Glossary</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 4.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="apa.html" title="Appendix A. GNU General Public License version 3"><link rel="next" href="ix01.html" title="Index"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Glossary</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="apa.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="ix01.html">Next</a></td></tr></table><hr></div><div class="glossary"><div class="titlepage"><div><div><h2 class="title"><a name="id2630241"></a>Glossary</h2></div></div></div><dl><dt>Access Control List</dt><dd><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Glossary</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="apa.html" title="Appendix A. GNU General Public License version 3"><link rel="next" href="ix01.html" title="Index"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Glossary</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="apa.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="ix01.html">Next</a></td></tr></table><hr></div><div class="glossary" title="Glossary"><div class="titlepage"><div><div><h2 class="title"><a name="id394912"></a>Glossary</h2></div></div></div><dl><dt>Access Control List</dt><dd><p> 2 2 A detailed list of permissions granted to users or groups with respect to file and network 3 3 resource access. … … 12 12 to CIFS, an additional dialect of the SMB protocol was in development. The need for the 13 13 deployment of the NetBIOS layer was also removed, thus paving the way for use of the SMB 14 protocol natively over TCP/IP (known as NetBIOS-less SMB or “<span class="quote">naked</span>”TCP14 protocol natively over TCP/IP (known as NetBIOS-less SMB or <span class="quote">“<span class="quote">naked</span>”</span> TCP 15 15 transport). 16 16 </p></dd><dt>Common UNIX Printing System</dt><dd><p> … … 97 97 binary encodings in a platform-independent manner. Samba has support for SPNEGO. 98 98 </p></dd><dt>The Official Samba-3 HOWTO and Reference Guide, Second Edition</dt><dd><p> 99 This book makes repeated reference to “<span class="quote">The Official Samba-3 HOWTO and Reference Guide, Second100 Edition</span>” by John H. Terpstra and Jelmer R. Vernooij. This publication is available from99 This book makes repeated reference to <span class="quote">“<span class="quote">The Official Samba-3 HOWTO and Reference Guide, Second 100 Edition</span>”</span> by John H. Terpstra and Jelmer R. Vernooij. This publication is available from 101 101 Amazon.com. Publisher: Prentice Hall PTR (August 2005), 102 102 ISBN: 013122282. … … 112 112 <a class="ulink" href="http://www.wireshark.org" target="_top">the Wireshark Web site</a>. 113 113 </p></dd></dl></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="apa.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="ix01.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Appendix A. 114 GNUGeneral Public License version 3114 <acronym class="acronym">GNU</acronym> General Public License version 3 115 115 </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Index</td></tr></table></div></body></html> -
trunk/server/docs/htmldocs/Samba3-ByExample/happy.html
r414 r599 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 5. Making Happy Users</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 4.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="Big500users.html" title="Chapter 4. The 500-User Office"><link rel="next" href="net2000users.html" title="Chapter 6. A Distributed 2000-User Network"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 5. Making Happy Users</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="Big500users.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="net2000users.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="happy"></a>Chapter 5. Making Happy Users</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="happy.html#id2571022">Regarding LDAP Directories and Windows Computer Accounts</a></span></dt><dt><span class="sect1"><a href="happy.html#id2571164">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id2571262">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2571399">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id2571856">Technical Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id2573730">Political Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id2573745">Installation Checklist</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2573925">Samba Server Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbeidealx">Install and Configure Idealx smbldap-tools Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id2576821">LDAP Initialization and Creation of User and Group Accounts</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-ptrcfg">Printer Configuration</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a></span></dt><dt><span class="sect1"><a href="happy.html#id2580771">Miscellaneous Server Preparation Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id2580791">Configuring Directory Share Point Roots</a></span></dt><dt><span class="sect2"><a href="happy.html#id2580886">Configuring Profile Directories</a></span></dt><dt><span class="sect2"><a href="happy.html#id2581130">Preparation of Logon Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id2581241">Assigning User Rights and Privileges</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2581375">Windows Client Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></span></dt><dt><span class="sect2"><a href="happy.html#id2582129">Configuration of MS Outlook to Relocate PST File</a></span></dt><dt><span class="sect2"><a href="happy.html#id2582445">Configure Delete Cached Profiles on Logout</a></span></dt><dt><span class="sect2"><a href="happy.html#id2582625">Uploading Printer Drivers to Samba Servers</a></span></dt><dt><span class="sect2"><a href="happy.html#id2583127">Software Installation</a></span></dt><dt><span class="sect2"><a href="happy.html#id2583163">Roll-out Image Creation</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2583197">Key Points Learned</a></span></dt><dt><span class="sect1"><a href="happy.html#id2583303">Questions and Answers</a></span></dt></dl></div><p>2 It is said that “<span class="quote">a day that is without troubles is not fulfilling. Rather, give3 me a day of troubles well handled so that I can be content with my achievements.</span>” 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 5. Making Happy Users</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="Big500users.html" title="Chapter 4. The 500-User Office"><link rel="next" href="net2000users.html" title="Chapter 6. A Distributed 2000-User Network"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 5. Making Happy Users</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="Big500users.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="net2000users.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 5. Making Happy Users"><div class="titlepage"><div><div><h2 class="title"><a name="happy"></a>Chapter 5. Making Happy Users</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="happy.html#id341339">Regarding LDAP Directories and Windows Computer Accounts</a></span></dt><dt><span class="sect1"><a href="happy.html#id341463">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id341540">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id341668">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id342070">Technical Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id343725">Political Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id343737">Installation Checklist</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id343908">Samba Server Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbeidealx">Install and Configure Idealx smbldap-tools Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-ptrcfg">Printer Configuration</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a></span></dt><dt><span class="sect1"><a href="happy.html#id350178">Miscellaneous Server Preparation Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id350194">Configuring Directory Share Point Roots</a></span></dt><dt><span class="sect2"><a href="happy.html#id350283">Configuring Profile Directories</a></span></dt><dt><span class="sect2"><a href="happy.html#id350512">Preparation of Logon Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id350609">Assigning User Rights and Privileges</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id350723">Windows Client Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></span></dt><dt><span class="sect2"><a href="happy.html#id351441">Configuration of MS Outlook to Relocate PST File</a></span></dt><dt><span class="sect2"><a href="happy.html#id351724">Configure Delete Cached Profiles on Logout</a></span></dt><dt><span class="sect2"><a href="happy.html#id351896">Uploading Printer Drivers to Samba Servers</a></span></dt><dt><span class="sect2"><a href="happy.html#id352365">Software Installation</a></span></dt><dt><span class="sect2"><a href="happy.html#id352391">Roll-out Image Creation</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id352420">Key Points Learned</a></span></dt><dt><span class="sect1"><a href="happy.html#id352508">Questions and Answers</a></span></dt></dl></div><p> 2 It is said that <span class="quote">“<span class="quote">a day that is without troubles is not fulfilling. Rather, give 3 me a day of troubles well handled so that I can be content with my achievements.</span>”</span> 4 4 </p><p> 5 5 In the world of computer networks, problems are as varied as the people who create them … … 7 7 may create problems for some network users. The following lists some of the problems that 8 8 may occur: 9 </p><a class="indexterm" name="id 2570600"></a><a class="indexterm" name="id2570606"></a><a class="indexterm" name="id2570616"></a><a class="indexterm" name="id2570622"></a><a class="indexterm" name="id2570629"></a><div class="caution" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Caution</h3><p>9 </p><a class="indexterm" name="id340972"></a><a class="indexterm" name="id340978"></a><a class="indexterm" name="id340987"></a><a class="indexterm" name="id340994"></a><a class="indexterm" name="id341000"></a><div class="caution" title="Caution" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Caution</h3><p> 10 10 A significant number of network administrators have responded to the guidance given 11 11 here. It should be noted that there are sites that have a single PDC for many hundreds of … … 20 20 clients is conservative and if followed will minimize problems but it is not absolute. 21 21 </p></div><div class="variablelist"><dl><dt><span class="term">Users experiencing difficulty logging onto the network</span></dt><dd><p> 22 <a class="indexterm" name="id 2570674"></a>23 <a class="indexterm" name="id 2570684"></a>22 <a class="indexterm" name="id341038"></a> 23 <a class="indexterm" name="id341046"></a> 24 24 When a Windows client logs onto the network, many data packets are exchanged 25 25 between the client and the server that is providing the network logon services. … … 31 31 characteristics. 32 32 </p><p> 33 <a class="indexterm" name="id 2570704"></a>34 <a class="indexterm" name="id 2570710"></a>35 <a class="indexterm" name="id 2570717"></a>33 <a class="indexterm" name="id341061"></a> 34 <a class="indexterm" name="id341068"></a> 35 <a class="indexterm" name="id341074"></a> 36 36 If the domain controller provides only network logon services 37 37 and all file and print activity is handled by domain member servers, one domain … … 47 47 the Samba server as well as network bandwidth utilization. 48 48 </p></dd><dt><span class="term">Slow logons and log-offs</span></dt><dd><p> 49 <a class="indexterm" name="id 2570750"></a>49 <a class="indexterm" name="id341100"></a> 50 50 Slow logons and log-offs may be caused by many factors that include: 51 51 52 </p><div class="itemizedlist"><ul type="disc"><li><p>53 <a class="indexterm" name="id 2570764"></a>54 <a class="indexterm" name="id 2570776"></a>52 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 53 <a class="indexterm" name="id341113"></a> 54 <a class="indexterm" name="id341125"></a> 55 55 Excessive delays in the resolution of a NetBIOS name to its IP 56 56 address. This may be observed when an overloaded domain controller 57 57 is also the WINS server. Another cause may be the failure to use 58 58 a WINS server (this assumes that there is a single network segment). 59 </p></li><li ><p>60 <a class="indexterm" name="id 2570794"></a>61 <a class="indexterm" name="id 2570801"></a>62 <a class="indexterm" name="id 2570808"></a>59 </p></li><li class="listitem"><p> 60 <a class="indexterm" name="id341141"></a> 61 <a class="indexterm" name="id341147"></a> 62 <a class="indexterm" name="id341154"></a> 63 63 Network traffic collisions due to overloading of the network 64 64 segment. One short-term workaround to this may be to replace 65 65 network HUBs with Ethernet switches. 66 </p></li><li ><p>67 <a class="indexterm" name="id 2570822"></a>66 </p></li><li class="listitem"><p> 67 <a class="indexterm" name="id341167"></a> 68 68 Defective networking hardware. Over the past few years, we have seen 69 69 on the Samba mailing list a significant increase in the number of … … 72 72 it was the erratic nature of the problem that ultimately pointed to 73 73 the cause of the problem. 74 </p></li><li ><p>75 <a class="indexterm" name="id 2570843"></a>76 <a class="indexterm" name="id 2570852"></a>74 </p></li><li class="listitem"><p> 75 <a class="indexterm" name="id341184"></a> 76 <a class="indexterm" name="id341193"></a> 77 77 Excessively large roaming profiles. This type of problem is typically 78 78 the result of poor user education as well as poor network management. … … 81 81 These are old bad habits that require much discipline and vigilance 82 82 on the part of network management. 83 </p></li><li ><p>84 <a class="indexterm" name="id 2570872"></a>83 </p></li><li class="listitem"><p> 84 <a class="indexterm" name="id341210"></a> 85 85 You should verify that the Windows XP WebClient service is not running. 86 86 The use of the WebClient service has been implicated in many Windows … … 90 90 Loss of access to network resources during client operation may be caused by a number 91 91 of factors, including: 92 </p><div class="itemizedlist"><ul type="disc"><li><p>93 <a class="indexterm" name="id 2570905"></a>92 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 93 <a class="indexterm" name="id341240"></a> 94 94 Network overload (typically indicated by a high network collision rate) 95 </p></li><li ><p>95 </p></li><li class="listitem"><p> 96 96 Server overload 97 </p></li><li ><p>98 <a class="indexterm" name="id 2570924"></a>97 </p></li><li class="listitem"><p> 98 <a class="indexterm" name="id341258"></a> 99 99 Timeout causing the client to close a connection that is in use but has 100 100 been latent (no traffic) for some time (5 minutes or more) 101 </p></li><li ><p>102 <a class="indexterm" name="id 2570940"></a>101 </p></li><li class="listitem"><p> 102 <a class="indexterm" name="id341273"></a> 103 103 Defective networking hardware 104 104 </p></li></ul></div><p> 105 <a class="indexterm" name="id 2570955"></a>105 <a class="indexterm" name="id341287"></a> 106 106 No matter what the cause, a sudden loss of access to network resources can 107 107 result in BSOD (blue screen of death) situations that necessitate rebooting of the client … … 110 110 problem, data corruption. 111 111 </p></dd><dt><span class="term">Potential data corruption</span></dt><dd><p> 112 <a class="indexterm" name="id 2570988"></a>112 <a class="indexterm" name="id341314"></a> 113 113 Data corruption is one of the most serious problems. It leads to uncertainty, anger, and 114 114 frustration, and generally precipitates immediate corrective demands. Management response … … 124 124 methods to improve the reliability of your network environment, but be warned that all such steps 125 125 demand the price of complexity. 126 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2571022"></a>Regarding LDAP Directories and Windows Computer Accounts</h2></div></div></div><p>127 <a class="indexterm" name="id 2571030"></a>126 </p><div class="sect1" title="Regarding LDAP Directories and Windows Computer Accounts"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id341339"></a>Regarding LDAP Directories and Windows Computer Accounts</h2></div></div></div><p> 127 <a class="indexterm" name="id341347"></a> 128 128 Computer (machine) accounts can be placed wherever you like in an LDAP directory subject to some 129 129 constraints that are described in this section. 130 130 </p><p> 131 <a class="indexterm" name="id 2571045"></a>132 <a class="indexterm" name="id 2571052"></a>133 <a class="indexterm" name="id 2571059"></a>134 <a class="indexterm" name="id 2571066"></a>131 <a class="indexterm" name="id341361"></a> 132 <a class="indexterm" name="id341367"></a> 133 <a class="indexterm" name="id341374"></a> 134 <a class="indexterm" name="id341381"></a> 135 135 The POSIX and SambaSAMAccount components of computer (machine) accounts are both used by Samba. 136 136 That is, machine accounts are treated inside Samba in the same way that Windows NT4/200X treats … … 138 138 the machine account ends in a $ character, as do trust accounts. 139 139 </p><p> 140 <a class="indexterm" name="id 2571082"></a>141 <a class="indexterm" name="id 2571089"></a>140 <a class="indexterm" name="id341394"></a> 141 <a class="indexterm" name="id341401"></a> 142 142 The need for Windows user, group, machine, trust, and other such accounts to be tied to a valid UNIX UID 143 143 is a design decision that was made a long way back in the history of Samba development. It is … … 145 145 Samba-3.x series. 146 146 </p><p> 147 <a class="indexterm" name="id 2571104"></a>148 <a class="indexterm" name="id 2571110"></a>147 <a class="indexterm" name="id341414"></a> 148 <a class="indexterm" name="id341420"></a> 149 149 The resolution of a UID from the Windows SID is achieved within Samba through a mechanism that 150 150 must refer back to the host operating system on which Samba is running. The name service … … 152 152 need to know everything about every host OS it runs on. 153 153 </p><p> 154 Samba asks the host OS to provide a UID via the “<span class="quote">passwd</span>”, “<span class="quote">shadow</span>”155 and “<span class="quote">group</span>”facilities in the NSS control (configuration) file. The best tool154 Samba asks the host OS to provide a UID via the <span class="quote">“<span class="quote">passwd</span>”</span>, <span class="quote">“<span class="quote">shadow</span>”</span> 155 and <span class="quote">“<span class="quote">group</span>”</span> facilities in the NSS control (configuration) file. The best tool 156 156 for achieving this is left up to the UNIX administrator to determine. It is not imposed by 157 157 Samba. Samba provides winbindd together with its support libraries as one method. It is … … 159 159 all account entities can be located in an LDAP directory. 160 160 </p><p> 161 <a class="indexterm" name="id 2571148"></a>161 <a class="indexterm" name="id341451"></a> 162 162 For many the weapon of choice is to use the PADL nss_ldap utility. This utility must 163 163 be configured so that computer accounts can be resolved to a POSIX/UNIX account UID. That … … 165 165 in the documentation is directed at providing working examples only. The design 166 166 of an LDAP directory is a complex subject that is beyond the scope of this documentation. 167 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2571164"></a>Introduction</h2></div></div></div><p>167 </p></div><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id341463"></a>Introduction</h2></div></div></div><p> 168 168 You just opened an email from Christine that reads: 169 169 </p><p> … … 194 194 </p></td><td width="10%" valign="top"> </td></tr><tr><td width="10%" valign="top"> </td><td colspan="2" align="right" valign="top">--<span class="attribution">Christine</span></td></tr></table></div><p> 195 195 </p><p> 196 <a class="indexterm" name="id 2571226"></a>197 <a class="indexterm" name="id 2571233"></a>196 <a class="indexterm" name="id341510"></a> 197 <a class="indexterm" name="id341517"></a> 198 198 Every compromise has consequences. Having a large routed (i.e., multisegment) network with only a 199 199 single domain controller is a poor design that has obvious operational effects that may … … 205 205 Please let Stan know what the estimated cost will be so I can approve the expense. Do not wait 206 206 for approval; I appreciate the urgency. 207 </p></td><td width="10%" valign="top"> </td></tr><tr><td width="10%" valign="top"> </td><td colspan="2" align="right" valign="top">--<span class="attribution">Bob</span></td></tr></table></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2571262"></a>Assignment Tasks</h3></div></div></div><p>207 </p></td><td width="10%" valign="top"> </td></tr><tr><td width="10%" valign="top"> </td><td colspan="2" align="right" valign="top">--<span class="attribution">Bob</span></td></tr></table></div><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id341540"></a>Assignment Tasks</h3></div></div></div><p> 208 208 The priority of assigned tasks in this chapter is: 209 </p><div class="orderedlist"><ol type="1"><li><p>210 <a class="indexterm" name="id 2571282"></a>211 <a class="indexterm" name="id 2571291"></a>212 <a class="indexterm" name="id 2571297"></a>213 <a class="indexterm" name="id 2571304"></a><a class="indexterm" name="id2571310"></a>209 </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p> 210 <a class="indexterm" name="id341559"></a> 211 <a class="indexterm" name="id341568"></a> 212 <a class="indexterm" name="id341575"></a> 213 <a class="indexterm" name="id341582"></a><a class="indexterm" name="id341587"></a> 214 214 Implement Backup Domain Controllers (BDCs) in each building. This involves 215 215 a change from a <span class="emphasis"><em>tdbsam</em></span> backend that was used in the previous … … 217 217 </p><p> 218 218 You can implement a single central LDAP server for this purpose. 219 </p></li><li ><p>220 <a class="indexterm" name="id 2571332"></a>221 <a class="indexterm" name="id 2571339"></a>222 <a class="indexterm" name="id 2571346"></a>223 <a class="indexterm" name="id 2571353"></a>219 </p></li><li class="listitem"><p> 220 <a class="indexterm" name="id341608"></a> 221 <a class="indexterm" name="id341614"></a> 222 <a class="indexterm" name="id341621"></a> 223 <a class="indexterm" name="id341628"></a> 224 224 Rectify the problem of excessive logon times. This involves redirection of 225 225 folders to network shares as well as modification of all user desktops to … … 227 227 create a new default profile that can be used for all new users. 228 228 </p></li></ol></div><p> 229 <a class="indexterm" name="id 2571372"></a>229 <a class="indexterm" name="id341644"></a> 230 230 You configure a new MS Windows XP Professional workstation disk image that you roll out 231 231 to all desktop users. The instructions you have created are followed on a staging machine 232 232 from which all changes can be carefully tested before inflicting them on your network users. 233 233 </p><p> 234 <a class="indexterm" name="id 2571386"></a>234 <a class="indexterm" name="id341657"></a> 235 235 This is the last network example in which specific mention of printing is made. The example 236 236 again makes use of the CUPS printing system. 237 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2571399"></a>Dissection and Discussion</h2></div></div></div><p>238 <a class="indexterm" name="id 2571407"></a>239 <a class="indexterm" name="id 2571413"></a>240 <a class="indexterm" name="id 2571420"></a>237 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id341668"></a>Dissection and Discussion</h2></div></div></div><p> 238 <a class="indexterm" name="id341676"></a> 239 <a class="indexterm" name="id341682"></a> 240 <a class="indexterm" name="id341689"></a> 241 241 The implementation of Samba BDCs necessitates the installation and configuration of LDAP. 242 242 For this site, you use OpenLDAP, the open source software LDAP server platform. Commercial 243 243 LDAP servers in current use with Samba-3 include: 244 </p><div class="itemizedlist"><ul type="disc"><li><p>245 <a class="indexterm" name="id 2571438"></a>244 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 245 <a class="indexterm" name="id341704"></a> 246 246 Novell <a class="ulink" href="http://www.novell.com/products/edirectory/" target="_top">eDirectory</a> 247 247 is being successfully used by some sites. Information on how to use eDirectory can be 248 248 obtained from the Samba mailing lists or from Novell. 249 </p></li><li ><p>250 <a class="indexterm" name="id 2571458"></a>249 </p></li><li class="listitem"><p> 250 <a class="indexterm" name="id341723"></a> 251 251 IBM <a class="ulink" href="http://www-306.ibm.com/software/tivoli/products/directory-server/" target="_top">Tivoli 252 252 Directory Server</a> can be used to provide the Samba LDAP backend. Example schema 253 253 files are provided in the Samba source code tarball under the directory 254 254 <code class="filename">~samba/example/LDAP.</code> 255 </p></li><li ><p>256 <a class="indexterm" name="id 2571485"></a>255 </p></li><li class="listitem"><p> 256 <a class="indexterm" name="id341748"></a> 257 257 Sun <a class="ulink" href="http://www.sun.com/software/software/products/identity_srvr/home_identity.xml" target="_top">ONE Identity 258 258 Server product suite</a> provides an LDAP server that can be used for Samba. … … 265 265 help you to get OpenLDAP and Samba-3 running as required, albeit with some learning curve challenges. 266 266 </p><p> 267 <a class="indexterm" name="id 2571522"></a>267 <a class="indexterm" name="id341780"></a> 268 268 For most sites, the deployment of Microsoft Active Directory from the shrink-wrapped installation is quite 269 269 adequate. If you are migrating from Microsoft Active Directory, be warned that OpenLDAP does not include … … 271 271 requires an understanding of what you are doing, why you are doing it, and the tools that you must use. 272 272 </p><p> 273 <a class="indexterm" name="id 2571540"></a>274 <a class="indexterm" name="id 2571547"></a>275 <a class="indexterm" name="id 2571554"></a>276 <a class="indexterm" name="id 2571563"></a>277 <a class="indexterm" name="id 2571572"></a>278 <a class="indexterm" name="id 2571579"></a>279 <a class="indexterm" name="id 2571588"></a>273 <a class="indexterm" name="id341793"></a> 274 <a class="indexterm" name="id341800"></a> 275 <a class="indexterm" name="id341807"></a> 276 <a class="indexterm" name="id341816"></a> 277 <a class="indexterm" name="id341825"></a> 278 <a class="indexterm" name="id341832"></a> 279 <a class="indexterm" name="id341841"></a> 280 280 When installed and configured, an OpenLDAP Identity Management backend for Samba functions well. 281 281 High availability operation may be obtained through directory replication/synchronization and … … 287 287 with Microsoft Active Directory. 288 288 </p><p> 289 <a class="indexterm" name="id 2571613"></a>290 <a class="indexterm" name="id 2571623"></a>291 <a class="indexterm" name="id 2571630"></a>292 <a class="indexterm" name="id 2571637"></a>289 <a class="indexterm" name="id341860"></a> 290 <a class="indexterm" name="id341869"></a> 291 <a class="indexterm" name="id341876"></a> 292 <a class="indexterm" name="id341883"></a> 293 293 A comparison of OpenLDAP with Microsoft Active Directory does not do justice to either. OpenLDAP is an LDAP directory 294 294 tool-set. Microsoft Active Directory Server is an implementation of an LDAP server that is largely preconfigured … … 301 301 of OpenLDAP. 302 302 </p><p> 303 <a class="indexterm" name="id 2571666"></a>304 <a class="indexterm" name="id 2571675"></a>303 <a class="indexterm" name="id341906"></a> 304 <a class="indexterm" name="id341915"></a> 305 305 You may wish to consider outsourcing the development of your OpenLDAP directory to an expert, particularly 306 306 if you find the challenge of learning about LDAP directories, schemas, configuration, and management … … 310 310 that is required for use as a passdb backend. 311 311 </p><p> 312 <a class="indexterm" name="id 2571693"></a>312 <a class="indexterm" name="id341929"></a> 313 313 For those who are willing to brave the process of installing and configuring LDAP and Samba-3 interoperability, 314 314 there are a few nice Web-based tools that may help you to manage your users and groups more effectively. … … 324 324 <a class="ulink" href="http://www.jxplorer.org/" target="_top">; JXplorer</a> (by Computer Associates); 325 325 and <a class="ulink" href="http://phpldapadmin.sourceforge.net/" target="_top">phpLDAPadmin</a>. 326 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>326 </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 327 327 The following prescriptive guidance is not an LDAP tutorial. The LDAP implementation expressly uses minimal 328 328 security controls. No form of secure LDAP communications is attempted. The LDAP configuration information provided … … 335 335 by Jerry Carter quite useful. 336 336 </p><p> 337 <a class="indexterm" name="id 2571791"></a>338 <a class="indexterm" name="id 2571798"></a>339 <a class="indexterm" name="id 2571807"></a>340 <a class="indexterm" name="id 2571814"></a>337 <a class="indexterm" name="id342015"></a> 338 <a class="indexterm" name="id342022"></a> 339 <a class="indexterm" name="id342031"></a> 340 <a class="indexterm" name="id342038"></a> 341 341 Mary's problems are due to two factors. First, the absence of a domain controller on the local network is the 342 342 main cause of the errors that result in blue screen crashes. Second, Mary has a large profile that must … … 346 346 staff morale. The following procedures solve this problem. 347 347 </p><p> 348 <a class="indexterm" name="id 2571836"></a>348 <a class="indexterm" name="id342055"></a> 349 349 There is also an opportunity to implement smart printing features. You add this to the Samba configuration 350 350 so that future printer changes can be managed without need to change desktop configurations. … … 353 353 in the default desktop profile. Only one example of printing configuration is given. It is assumed that 354 354 you can extrapolate the principles and use them to install all printers that may be needed. 355 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2571856"></a>Technical Issues</h3></div></div></div><p>356 <a class="indexterm" name="id 2571864"></a>357 <a class="indexterm" name="id 2571873"></a>358 <a class="indexterm" name="id 2571882"></a>355 </p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id342070"></a>Technical Issues</h3></div></div></div><p> 356 <a class="indexterm" name="id342078"></a> 357 <a class="indexterm" name="id342087"></a> 358 <a class="indexterm" name="id342097"></a> 359 359 The solution provided is a minimal approach to getting OpenLDAP running as an identity management directory 360 360 server for UNIX system accounts as well as for Samba. From the OpenLDAP perspective, UNIX system 361 361 accounts are stored POSIX schema extensions. Samba provides its own schema to permit storage of account 362 362 attributes Samba needs. Samba-3 can use the LDAP backend to store: 363 </p><div class="itemizedlist"><ul type="disc"><li><p>Windows Networking User Accounts</p></li><li><p>Windows NT Group Accounts</p></li><li><p>Mapping Information between UNIX Groups and Windows NT Groups</p></li><li><p>ID Mappings for SIDs to UIDs (also for foreign Domain SIDs)</p></li></ul></div><p>364 <a class="indexterm" name="id 2571923"></a>365 <a class="indexterm" name="id 2571930"></a>366 <a class="indexterm" name="id 2571937"></a>367 <a class="indexterm" name="id 2571944"></a>368 <a class="indexterm" name="id 2571951"></a>369 <a class="indexterm" name="id 2571958"></a>370 <a class="indexterm" name="id 2571967"></a>371 <a class="indexterm" name="id 2571973"></a>372 <a class="indexterm" name="id 2571980"></a>363 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Windows Networking User Accounts</p></li><li class="listitem"><p>Windows NT Group Accounts</p></li><li class="listitem"><p>Mapping Information between UNIX Groups and Windows NT Groups</p></li><li class="listitem"><p>ID Mappings for SIDs to UIDs (also for foreign Domain SIDs)</p></li></ul></div><p> 364 <a class="indexterm" name="id342133"></a> 365 <a class="indexterm" name="id342140"></a> 366 <a class="indexterm" name="id342146"></a> 367 <a class="indexterm" name="id342153"></a> 368 <a class="indexterm" name="id342160"></a> 369 <a class="indexterm" name="id342167"></a> 370 <a class="indexterm" name="id342176"></a> 371 <a class="indexterm" name="id342182"></a> 372 <a class="indexterm" name="id342189"></a> 373 373 The use of LDAP with Samba-3 makes it necessary to store UNIX accounts as well as Windows Networking 374 374 accounts in the LDAP backend. This implies the need to use the … … 379 379 of the UNIX username to the UID. The relationships are demonstrated in <a class="link" href="happy.html#sbehap-LDAPdiag" title="Figure 5.1. The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts">“The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts”</a>. 380 380 </p><div class="figure"><a name="sbehap-LDAPdiag"></a><p class="title"><b>Figure 5.1. The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/UNIX-Samba-and-LDAP.png" width="270" alt="The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts"></div></div></div><br class="figure-break"><p> 381 <a class="indexterm" name="id 2572065"></a>382 <a class="indexterm" name="id 2572072"></a>381 <a class="indexterm" name="id342269"></a> 382 <a class="indexterm" name="id342275"></a> 383 383 You configure OpenLDAP so that it is operational. Before deploying the OpenLDAP, you really 384 384 ought to learn how to configure secure communications over LDAP so that site security is not 385 385 at risk. This is not covered in the following guidance. 386 386 </p><p> 387 <a class="indexterm" name="id 2572089"></a>388 <a class="indexterm" name="id 2572095"></a>389 <a class="indexterm" name="id 2572105"></a>390 <a class="indexterm" name="id 2572112"></a>387 <a class="indexterm" name="id342290"></a> 388 <a class="indexterm" name="id342296"></a> 389 <a class="indexterm" name="id342306"></a> 390 <a class="indexterm" name="id342312"></a> 391 391 When OpenLDAP has been made operative, you configure the PDC called <code class="constant">MASSIVE</code>. 392 392 You initialize the Samba <code class="filename">secrets.tdb<sub></sub></code> file. Then you … … 396 396 that help to manage user and group configuration. 397 397 </p><p> 398 <a class="indexterm" name="id 2572146"></a>399 <a class="indexterm" name="id 2572152"></a>400 <a class="indexterm" name="id 2572159"></a>398 <a class="indexterm" name="id342343"></a> 399 <a class="indexterm" name="id342350"></a> 400 <a class="indexterm" name="id342356"></a> 401 401 In order to effect folder redirection and to add robustness to the implementation, 402 402 create a network default profile. All network users workstations are configured to use … … 404 404 when the user logs off. 405 405 </p><p> 406 <a class="indexterm" name="id 2572174"></a>406 <a class="indexterm" name="id342369"></a> 407 407 The profile is configured so that users cannot change the appearance 408 408 of their desktop. This is known as a mandatory profile. You make certain that users 409 409 are able to use their computers efficiently. 410 410 </p><p> 411 <a class="indexterm" name="id 2572188"></a>411 <a class="indexterm" name="id342381"></a> 412 412 A network logon script is used to deliver flexible but consistent network drive 413 413 connections. 414 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="sbehap-ppc"></a>Addition of Machines to the Domain</h4></div></div></div><p>415 <a class="indexterm" name="id 2572209"></a>416 <a class="indexterm" name="id 2572215"></a>417 <a class="indexterm" name="id 2572220"></a>418 <a class="indexterm" name="id 2572226"></a>414 </p><div class="sect3" title="Addition of Machines to the Domain"><div class="titlepage"><div><div><h4 class="title"><a name="sbehap-ppc"></a>Addition of Machines to the Domain</h4></div></div></div><p> 415 <a class="indexterm" name="id342401"></a> 416 <a class="indexterm" name="id342406"></a> 417 <a class="indexterm" name="id342412"></a> 418 <a class="indexterm" name="id342417"></a> 419 419 Samba versions prior to 3.0.11 necessitated the use of a domain administrator account 420 420 that maps to the UNIX UID=0. The UNIX operating system permits only the <code class="constant">root</code> … … 426 426 how any user can now be given the ability to add machines to the domain using a normal user account 427 427 that has been given the appropriate privileges. 428 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2572363"></a>Roaming Profile Background</h4></div></div></div><p>428 </p></div><div class="sect3" title="Roaming Profile Background"><div class="titlepage"><div><div><h4 class="title"><a name="id342548"></a>Roaming Profile Background</h4></div></div></div><p> 429 429 As XP roaming profiles grow, so does the amount of time it takes to log in and out. 430 430 </p><p> 431 <a class="indexterm" name="id 2572376"></a>432 <a class="indexterm" name="id 2572383"></a>433 <a class="indexterm" name="id 2572390"></a>434 <a class="indexterm" name="id 2572397"></a>431 <a class="indexterm" name="id342560"></a> 432 <a class="indexterm" name="id342566"></a> 433 <a class="indexterm" name="id342573"></a> 434 <a class="indexterm" name="id342580"></a> 435 435 An XP roaming profile consists of the <code class="constant">HKEY_CURRENT_USER</code> hive file 436 436 <code class="filename">NTUSER.DAT</code> and a number of folders (My Documents, Application Data, … … 454 454 instead of the <code class="filename">My Documents</code> folder for saving documents. 455 455 </p><p> 456 <a class="indexterm" name="id 2572476"></a>456 <a class="indexterm" name="id342644"></a> 457 457 Using a folder other than <code class="filename">My Documents</code> is a nuisance for 458 458 some users, since many applications use it by default. 459 459 </p><p> 460 <a class="indexterm" name="id 2572494"></a>461 <a class="indexterm" name="id 2572501"></a>462 <a class="indexterm" name="id 2572508"></a>460 <a class="indexterm" name="id342661"></a> 461 <a class="indexterm" name="id342668"></a> 462 <a class="indexterm" name="id342675"></a> 463 463 The secret to rapid loading of roaming profiles is to prevent unnecessary data from 464 464 being copied back and forth, without losing any functionality. This is not difficult; … … 466 466 as changing some paths in each user's <code class="filename">NTUSER.DAT</code> hive. 467 467 </p><p> 468 <a class="indexterm" name="id 2572529"></a>469 <a class="indexterm" name="id 2572536"></a>468 <a class="indexterm" name="id342693"></a> 469 <a class="indexterm" name="id342700"></a> 470 470 Every user profile has its own <code class="filename">NTUSER.DAT</code> file. This means 471 471 you need to edit every user's profile, unless a better method can be … … 475 475 necessary to copy all files from redirected folders to the network share to which 476 476 they are redirected. 477 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="sbehap-locgrppol"></a>The Local Group Policy</h4></div></div></div><p>478 <a class="indexterm" name="id 2572576"></a>479 <a class="indexterm" name="id 2572583"></a>480 <a class="indexterm" name="id 2572590"></a>481 <a class="indexterm" name="id 2572596"></a>477 </p></div><div class="sect3" title="The Local Group Policy"><div class="titlepage"><div><div><h4 class="title"><a name="sbehap-locgrppol"></a>The Local Group Policy</h4></div></div></div><p> 478 <a class="indexterm" name="id342736"></a> 479 <a class="indexterm" name="id342742"></a> 480 <a class="indexterm" name="id342749"></a> 481 <a class="indexterm" name="id342756"></a> 482 482 Without an Active Directory PDC, you cannot take full advantage of Group Policy 483 483 Objects. However, you can still make changes to the Local Group Policy by using … … 488 488 <span class="guimenu">User Configuration</span> → <span class="guimenuitem">Administrative Templates</span> → <span class="guimenuitem">System</span> → <span class="guimenuitem">User Profiles</span>. 489 489 By default this setting contains 490 “<span class="quote">Local Settings; Temporary Internet Files; History; Temp</span>”.490 <span class="quote">“<span class="quote">Local Settings; Temporary Internet Files; History; Temp</span>”</span>. 491 491 </p><p> 492 492 Simply add the folders you do not wish to be copied back and forth to this 493 493 semicolon-separated list. Note that this change must be made on all clients 494 494 that are using roaming profiles. 495 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2572664"></a>Profile Changes</h4></div></div></div><p>496 <a class="indexterm" name="id 2572672"></a>497 <a class="indexterm" name="id 2572678"></a>495 </p></div><div class="sect3" title="Profile Changes"><div class="titlepage"><div><div><h4 class="title"><a name="id342818"></a>Profile Changes</h4></div></div></div><p> 496 <a class="indexterm" name="id342826"></a> 497 <a class="indexterm" name="id342832"></a> 498 498 There are two changes that should be done to each user's profile. Move each of 499 499 the directories that you have excluded from being copied back and forth out of … … 502 502 path (<code class="filename">C:\Documents and Settings\%USERNAME%</code>). 503 503 </p><p> 504 <a class="indexterm" name="id 2572706"></a>505 <a class="indexterm" name="id 2572713"></a>504 <a class="indexterm" name="id342857"></a> 505 <a class="indexterm" name="id342864"></a> 506 506 The above modifies existing user profiles. So that newly created profiles have 507 507 these settings, you need to modify the <code class="filename">NTUSER.DAT</code> in … … 510 510 <code class="filename">NTUSER.DAT</code> to a Linux box and using <code class="literal">regedt32</code>. 511 511 The basic method is described under <a class="link" href="happy.html#redirfold" title="Configuration of Default Profile with Folder Redirection">“Configuration of Default Profile with Folder Redirection”</a>. 512 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2572758"></a>Using a Network Default User Profile</h4></div></div></div><p>513 <a class="indexterm" name="id 2572766"></a>514 <a class="indexterm" name="id 2572773"></a>512 </p></div><div class="sect3" title="Using a Network Default User Profile"><div class="titlepage"><div><div><h4 class="title"><a name="id342906"></a>Using a Network Default User Profile</h4></div></div></div><p> 513 <a class="indexterm" name="id342914"></a> 514 <a class="indexterm" name="id342921"></a> 515 515 If you are using Samba as your PDC, you should create a file share called 516 516 <code class="constant">NETLOGON</code> and within that create a directory called … … 521 521 See also <a class="ulink" href="http://isg.ee.ethz.ch/tools/realmen/det/skel.en.html" target="_top"> 522 522 the Real Men Don't Click</a> Web site. 523 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2572816"></a>Installation of Printer Driver Auto-Download</h4></div></div></div><p>524 <a class="indexterm" name="id 2572825"></a>525 <a class="indexterm" name="id 2572834"></a>526 <a class="indexterm" name="id 2572841"></a>523 </p></div><div class="sect3" title="Installation of Printer Driver Auto-Download"><div class="titlepage"><div><div><h4 class="title"><a name="id342960"></a>Installation of Printer Driver Auto-Download</h4></div></div></div><p> 524 <a class="indexterm" name="id342968"></a> 525 <a class="indexterm" name="id342977"></a> 526 <a class="indexterm" name="id342984"></a> 527 527 The subject of printing is quite topical. Printing problems run second place to name 528 528 resolution issues today. So far in this book, you have experienced only what is generally 529 known as “<span class="quote">dumb</span>”printing. Dumb printing is the arrangement by which all drivers529 known as <span class="quote">“<span class="quote">dumb</span>”</span> printing. Dumb printing is the arrangement by which all drivers 530 530 are manually installed on each client and the printing subsystems perform no filtering 531 531 or intelligent processing. Dumb printing is easily understood. It usually works without … … 533 533 <code class="literal">Raw-Print-Through</code> printing. 534 534 </p><p> 535 <a class="indexterm" name="id 2572870"></a>536 <a class="indexterm" name="id 2572879"></a>535 <a class="indexterm" name="id343008"></a> 536 <a class="indexterm" name="id343017"></a> 537 537 Samba permits the configuration of <code class="literal">smart</code> printing using the Microsoft 538 538 Windows point-and-click (also called drag-and-drop) printing. What this provides is … … 548 548 suited to the printer to which the job is dispatched. 549 549 </p><p> 550 <a class="indexterm" name="id 2572926"></a>551 <a class="indexterm" name="id 2572933"></a>552 <a class="indexterm" name="id 2572940"></a>550 <a class="indexterm" name="id343057"></a> 551 <a class="indexterm" name="id343064"></a> 552 <a class="indexterm" name="id343071"></a> 553 553 The CUPS printing subsystem is capable of intelligent printing. It has the capacity to 554 554 detect the data format and apply a print filter. This means that it is feasible to install … … 567 567 style of installation. Those interested in further information regarding intelligent 568 568 printing should review documentation on the Easy Software Products Web site. 569 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="sbeavoid"></a>Avoiding Failures: Solving Problems Before They Happen</h4></div></div></div><p>569 </p></div><div class="sect3" title="Avoiding Failures: Solving Problems Before They Happen"><div class="titlepage"><div><div><h4 class="title"><a name="sbeavoid"></a>Avoiding Failures: Solving Problems Before They Happen</h4></div></div></div><p> 570 570 It has often been said that there are three types of people in the world: those who 571 571 have sharp minds and those who forget things. Please do not ask what the third group … … 575 575 </p><p> 576 576 Here are some diagnostic guidelines that can be referred to when things go wrong: 577 </p><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2573007"></a>Preliminary Advice: Dangers Can Be Avoided</h5></div></div></div><p>578 The best advice regarding how to mend a broken leg is “<span class="quote">Never break a leg!</span>”579 </p><p> 580 <a class="indexterm" name="id 2573023"></a>577 </p><div class="sect4" title="Preliminary Advice: Dangers Can Be Avoided"><div class="titlepage"><div><div><h5 class="title"><a name="id343123"></a>Preliminary Advice: Dangers Can Be Avoided</h5></div></div></div><p> 578 The best advice regarding how to mend a broken leg is <span class="quote">“<span class="quote">Never break a leg!</span>”</span> 579 </p><p> 580 <a class="indexterm" name="id343138"></a> 581 581 Newcomers to Samba and LDAP seem to struggle a great deal at first. If you want advice 582 regarding the best way to remedy LDAP and Samba problems: “<span class="quote">Avoid them like the plague!</span>”582 regarding the best way to remedy LDAP and Samba problems: <span class="quote">“<span class="quote">Avoid them like the plague!</span>”</span> 583 583 </p><p> 584 584 If you are now asking yourself how problems can be avoided, the best advice is to start … … 590 590 that they could serve as the kick-off point for your journey through fields of knowledge. 591 591 Use this resource carefully; we hope it serves you well. 592 </p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>592 </p><div class="warning" title="Warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p> 593 593 Do not be lulled into thinking that you can easily adopt the examples in this 594 594 book and adapt them without first working through the examples provided. A little 595 595 thing overlooked can cause untold pain and may permanently tarnish your experience. 596 </p></div></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2573067"></a>The Name Service Caching Daemon</h5></div></div></div><p>596 </p></div></div><div class="sect4" title="The Name Service Caching Daemon"><div class="titlepage"><div><div><h5 class="title"><a name="id343173"></a>The Name Service Caching Daemon</h5></div></div></div><p> 597 597 The name service caching daemon (nscd) is a primary cause of difficulties with name 598 598 resolution, particularly where <code class="literal">winbind</code> is used. Winbind does its … … 661 661 <code class="prompt">root# </code> rcnscd off 662 662 </pre><p> 663 </p></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2573240"></a>Debugging LDAP</h5></div></div></div><p>664 <a class="indexterm" name="id 2573248"></a>665 <a class="indexterm" name="id 2573255"></a>666 <a class="indexterm" name="id 2573262"></a>663 </p></div><div class="sect4" title="Debugging LDAP"><div class="titlepage"><div><div><h5 class="title"><a name="id343291"></a>Debugging LDAP</h5></div></div></div><p> 664 <a class="indexterm" name="id343298"></a> 665 <a class="indexterm" name="id343305"></a> 666 <a class="indexterm" name="id343312"></a> 667 667 In the example <code class="filename">/etc/openldap/slapd.conf</code> control file 668 668 (see <a class="link" href="happy.html#sbehap-dbconf" title="Example 5.1. LDAP DB_CONFIG File">“LDAP DB_CONFIG File”</a>) there is an entry for <code class="constant">loglevel 256</code>. … … 670 670 and restart <code class="literal">slapd</code>. 671 671 </p><p> 672 <a class="indexterm" name="id 2573298"></a>673 <a class="indexterm" name="id 2573305"></a>672 <a class="indexterm" name="id343346"></a> 673 <a class="indexterm" name="id343352"></a> 674 674 LDAP log information can be directed into a file that is separate from the normal system 675 675 log files by changing the <code class="filename">/etc/syslog.conf</code> file so it has the following … … 690 690 customization with the intent that LDAP log files will be stored at a location 691 691 that meets local site needs and wishes more fully. 692 </p></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2573347"></a>Debugging NSS_LDAP</h5></div></div></div><p>692 </p></div><div class="sect4" title="Debugging NSS_LDAP"><div class="titlepage"><div><div><h5 class="title"><a name="id343386"></a>Debugging NSS_LDAP</h5></div></div></div><p> 693 693 The basic mechanism for diagnosing problems with the nss_ldap utility involves adding to the 694 694 <code class="filename">/etc/ldap.conf</code> file the following parameters: … … 703 703 </p><p> 704 704 The diagnostic process should follow these steps: 705 </p><div class="procedure" ><a name="id2573390"></a><p class="title"><b>Procedure 5.1. NSS_LDAP Diagnostic Steps</b></p><ol type="1"><li><p>705 </p><div class="procedure" title="Procedure 5.1. NSS_LDAP Diagnostic Steps"><a name="id343427"></a><p class="title"><b>Procedure 5.1. NSS_LDAP Diagnostic Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 706 706 Verify the <code class="constant">nss_base_passwd, nss_base_shadow, nss_base_group</code> entries 707 707 in the <code class="filename">/etc/ldap.conf</code> file and compare them closely with the directory … … 740 740 has been implemented: 741 741 </p><p> 742 </p><div class="itemizedlist"><ul type="disc"><li><p>User accounts are stored under the DIT: ou=Users, dc=abmas, dc=biz</p></li><li><p>User login accounts are under the DIT: ou=People, ou-Users, dc=abmas, dc=biz</p></li><li><p>Computer accounts are under the DIT: ou=Computers, ou=Users, dc=abmas, dc=biz</p></li></ul></div><p>742 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>User accounts are stored under the DIT: ou=Users, dc=abmas, dc=biz</p></li><li class="listitem"><p>User login accounts are under the DIT: ou=People, ou-Users, dc=abmas, dc=biz</p></li><li class="listitem"><p>Computer accounts are under the DIT: ou=Computers, ou=Users, dc=abmas, dc=biz</p></li></ul></div><p> 743 743 </p><p> 744 744 The appropriate multiple entry for the <code class="constant">nss_base_passwd</code> directive … … 748 748 nss_base_passwd ou=Computers,ou=Users,dc=abmas,dc=org?one 749 749 </pre><p> 750 </p></li><li ><p>750 </p></li><li class="step" title="Step 2"><p> 751 751 Perform lookups such as: 752 752 </p><pre class="screen"> … … 756 756 for each such process executed. The contents of each file created in this directory 757 757 may provide a hint as to the cause of the a problem that is under investigation. 758 </p></li><li ><p>758 </p></li><li class="step" title="Step 3"><p> 759 759 For additional diagnostic information, check the contents of the <code class="filename">/var/log/messages</code> 760 760 to see what error messages are being generated as a result of the LDAP lookups. Here is an example of … … 789 789 790 790 </pre><p> 791 </p></li><li ><p>791 </p></li><li class="step" title="Step 4"><p> 792 792 Check that the bindpw entry in the <code class="filename">/etc/ldap.conf</code> or in the 793 793 <code class="filename">/etc/ldap.secrets</code> file is correct, as specified in the 794 794 <code class="filename">/etc/openldap/slapd.conf</code> file. 795 </p></li></ol></div></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2573641"></a>Debugging Samba</h5></div></div></div><p>795 </p></li></ol></div></div><div class="sect4" title="Debugging Samba"><div class="titlepage"><div><div><h5 class="title"><a name="id343646"></a>Debugging Samba</h5></div></div></div><p> 796 796 The following parameters in the <code class="filename">smb.conf</code> file can be useful in tracking down Samba-related problems: 797 797 </p><pre class="screen"> … … 823 823 Search for hints of what may have failed by looking for the words <span class="emphasis"><em>fail</em></span> 824 824 and <span class="emphasis"><em>error</em></span>. 825 </p></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2573712"></a>Debugging on the Windows Client</h5></div></div></div><p>825 </p></div><div class="sect4" title="Debugging on the Windows Client"><div class="titlepage"><div><div><h5 class="title"><a name="id343710"></a>Debugging on the Windows Client</h5></div></div></div><p> 826 826 MS Windows 2000 Professional and Windows XP Professional clients can be configured 827 827 to create a netlogon.log file that can be very helpful in diagnosing network logon problems. Search 828 828 the Microsoft knowledge base for detailed instructions. The techniques vary a little with each 829 829 version of MS Windows. 830 </p></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2573730"></a>Political Issues</h3></div></div></div><p>830 </p></div></div></div><div class="sect2" title="Political Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id343725"></a>Political Issues</h3></div></div></div><p> 831 831 MS Windows network users are generally very sensitive to limits that may be imposed when 832 832 confronted with locked-down workstation configurations. The challenge you face must 833 833 be promoted as a choice between reliable, fast network operation and a constant flux 834 834 of problems that result in user irritation. 835 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2573745"></a>Installation Checklist</h3></div></div></div><p>835 </p></div><div class="sect2" title="Installation Checklist"><div class="titlepage"><div><div><h3 class="title"><a name="id343737"></a>Installation Checklist</h3></div></div></div><p> 836 836 You are starting a complex project. Even though you went through the installation of a complex 837 837 network in <a class="link" href="Big500users.html" title="Chapter 4. The 500-User Office">“The 500-User Office”</a>, this network is a bigger challenge because of the … … 841 841 been completed. The following task list may help you to keep track of the task items 842 842 that are covered: 843 </p><div class="itemizedlist"><ul type="disc"><li><p>Samba-3 PDC Server Configuration</p><div class="orderedlist"><ol type="1"><li><p>DHCP and DNS servers</p></li><li><p>OpenLDAP server</p></li><li><p>PAM and NSS client tools</p></li><li><p>Samba-3 PDC</p></li><li><p>Idealx smbldap scripts</p></li><li><p>LDAP initialization</p></li><li><p>Create user and group accounts</p></li><li><p>Printers</p></li><li><p>Share point directory roots</p></li><li><p>Profile directories</p></li><li><p>Logon scripts</p></li><li><p>Configuration of user rights and privileges</p></li></ol></div></li><li><p>Samba-3 BDC Server Configuration</p><div class="orderedlist"><ol type="1"><li><p>DHCP and DNS servers</p></li><li><p>PAM and NSS client tools</p></li><li><p>Printers</p></li><li><p>Share point directory roots</p></li><li><p>Profiles directories</p></li></ol></div></li><li><p>Windows XP Client Configuration</p><div class="orderedlist"><ol type="1"><li><p>Default profile folder redirection</p></li><li><p>MS Outlook PST file relocation</p></li><li><p>Delete roaming profile on logout</p></li><li><p>Upload printer drivers to Samba servers</p></li><li><p>Install software</p></li><li><p>Creation of roll-out images</p></li></ol></div></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2573925"></a>Samba Server Implementation</h2></div></div></div><p>844 <a class="indexterm" name="id 2573933"></a>845 <a class="indexterm" name="id 2573940"></a>843 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Samba-3 PDC Server Configuration</p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p>DHCP and DNS servers</p></li><li class="listitem"><p>OpenLDAP server</p></li><li class="listitem"><p>PAM and NSS client tools</p></li><li class="listitem"><p>Samba-3 PDC</p></li><li class="listitem"><p>Idealx smbldap scripts</p></li><li class="listitem"><p>LDAP initialization</p></li><li class="listitem"><p>Create user and group accounts</p></li><li class="listitem"><p>Printers</p></li><li class="listitem"><p>Share point directory roots</p></li><li class="listitem"><p>Profile directories</p></li><li class="listitem"><p>Logon scripts</p></li><li class="listitem"><p>Configuration of user rights and privileges</p></li></ol></div></li><li class="listitem"><p>Samba-3 BDC Server Configuration</p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p>DHCP and DNS servers</p></li><li class="listitem"><p>PAM and NSS client tools</p></li><li class="listitem"><p>Printers</p></li><li class="listitem"><p>Share point directory roots</p></li><li class="listitem"><p>Profiles directories</p></li></ol></div></li><li class="listitem"><p>Windows XP Client Configuration</p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p>Default profile folder redirection</p></li><li class="listitem"><p>MS Outlook PST file relocation</p></li><li class="listitem"><p>Delete roaming profile on logout</p></li><li class="listitem"><p>Upload printer drivers to Samba servers</p></li><li class="listitem"><p>Install software</p></li><li class="listitem"><p>Creation of roll-out images</p></li></ol></div></li></ul></div></div></div><div class="sect1" title="Samba Server Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id343908"></a>Samba Server Implementation</h2></div></div></div><p> 844 <a class="indexterm" name="id343916"></a> 845 <a class="indexterm" name="id343923"></a> 846 846 The network design shown in <a class="link" href="happy.html#chap6net" title="Figure 5.2. Network Topology 500 User Network Using ldapsam passdb backend">“Network Topology 500 User Network Using ldapsam passdb backend”</a> is not comprehensive. It is assumed 847 847 that you will install additional file servers and possibly additional BDCs. 848 848 </p><div class="figure"><a name="chap6net"></a><p class="title"><b>Figure 5.2. Network Topology 500 User Network Using ldapsam passdb backend</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap6-net.png" width="270" alt="Network Topology 500 User Network Using ldapsam passdb backend"></div></div></div><br class="figure-break"><p> 849 <a class="indexterm" name="id 2574003"></a>850 <a class="indexterm" name="id 2574010"></a>849 <a class="indexterm" name="id343983"></a> 850 <a class="indexterm" name="id343990"></a> 851 851 All configuration files and locations are shown for SUSE Linux 9.2 and are equally valid for SUSE 852 852 Linux Enterprise Server 9. The file locations for Red Hat Linux are similar. You may need to 853 853 adjust the locations for your particular Linux system distribution/implementation. 854 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>854 </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 855 855 The following information applies to Samba-3.0.20 when used with the Idealx smbldap-tools 856 856 scripts version 0.9.1. If using a different version of Samba or of the smbldap-tools tarball, … … 868 868 with newly installed Linux servers, you must complete the steps shown in 869 869 <a class="link" href="Big500users.html#ch5-dnshcp-setup" title="Installation of DHCP, DNS, and Samba Control Files">“Installation of DHCP, DNS, and Samba Control Files”</a> before commencing at <a class="link" href="happy.html#ldapsetup" title="OpenLDAP Server Configuration">“OpenLDAP Server Configuration”</a>. 870 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ldapsetup"></a>OpenLDAP Server Configuration</h3></div></div></div><p>871 <a class="indexterm" name="id 2574092"></a>872 <a class="indexterm" name="id 2574098"></a>873 <a class="indexterm" name="id 2574105"></a>870 </p><div class="sect2" title="OpenLDAP Server Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="ldapsetup"></a>OpenLDAP Server Configuration</h3></div></div></div><p> 871 <a class="indexterm" name="id344059"></a> 872 <a class="indexterm" name="id344066"></a> 873 <a class="indexterm" name="id344073"></a> 874 874 Confirm that the packages shown in <a class="link" href="happy.html#oldapreq" title="Table 5.2. Required OpenLDAP Linux Packages">“Required OpenLDAP Linux Packages”</a> are installed on your system. 875 875 </p><div class="table"><a name="oldapreq"></a><p class="title"><b>Table 5.2. Required OpenLDAP Linux Packages</b></p><div class="table-contents"><table summary="Required OpenLDAP Linux Packages" border="1"><colgroup><col align="left"><col align="left"><col align="left"></colgroup><thead><tr><th align="center">SUSE Linux 8.x</th><th align="center">SUSE Linux 9.x</th><th align="center">Red Hat Linux</th></tr></thead><tbody><tr><td align="left">nss_ldap</td><td align="left">nss_ldap</td><td align="left">nss_ldap</td></tr><tr><td align="left">pam_ldap</td><td align="left">pam_ldap</td><td align="left">pam_ldap</td></tr><tr><td align="left">openldap2</td><td align="left">openldap2</td><td align="left">openldap</td></tr><tr><td align="left">openldap2-client</td><td align="left">openldap2-client</td><td align="left"> </td></tr></tbody></table></div></div><br class="table-break"><p> … … 877 877 for bootstrapping the LDAP and Samba-3 configuration is relatively straightforward. If you 878 878 follow these guidelines, the resulting system should work fine. 879 </p><div class="procedure" ><a name="id2574237"></a><p class="title"><b>Procedure 5.2. OpenLDAP Server Configuration Steps</b></p><ol type="1"><li><p>880 <a class="indexterm" name="id 2574249"></a>879 </p><div class="procedure" title="Procedure 5.2. OpenLDAP Server Configuration Steps"><a name="id344202"></a><p class="title"><b>Procedure 5.2. OpenLDAP Server Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 880 <a class="indexterm" name="id344213"></a> 881 881 Install the file shown in <a class="link" href="happy.html#sbehap-slapdconf" title="Example 5.2. LDAP Master Configuration File /etc/openldap/slapd.conf Part A">“LDAP Master Configuration File /etc/openldap/slapd.conf Part A”</a> in the directory 882 882 <code class="filename">/etc/openldap</code>. 883 </p></li><li ><p>884 <a class="indexterm" name="id 2574277"></a>885 <a class="indexterm" name="id 2574283"></a>886 <a class="indexterm" name="id 2574290"></a>883 </p></li><li class="step" title="Step 2"><p> 884 <a class="indexterm" name="id344240"></a> 885 <a class="indexterm" name="id344247"></a> 886 <a class="indexterm" name="id344253"></a> 887 887 Remove all files from the directory <code class="filename">/data/ldap</code>, making certain that 888 888 the directory exists with permissions: … … 892 892 </pre><p> 893 893 This may require you to add a user and a group account for LDAP if they do not exist. 894 </p></li><li ><p>895 <a class="indexterm" name="id 2574326"></a>894 </p></li><li class="step" title="Step 3"><p> 895 <a class="indexterm" name="id344286"></a> 896 896 Install the file shown in <a class="link" href="happy.html#sbehap-dbconf" title="Example 5.1. LDAP DB_CONFIG File">“LDAP DB_CONFIG File”</a> in the directory 897 897 <code class="filename">/data/ldap</code>. In the event that this file is added after <code class="constant">ldap</code> … … 899 899 the <code class="constant">LDAP</code> server, executing the <code class="literal">db_recover</code> command inside the 900 900 <code class="filename">/data/ldap</code> directory, and then restarting the <code class="constant">LDAP</code> server. 901 </p></li><li ><p>902 <a class="indexterm" name="id 2574379"></a>901 </p></li><li class="step" title="Step 4"><p> 902 <a class="indexterm" name="id344336"></a> 903 903 Performance logging can be enabled and should preferably be sent to a file on 904 904 a file system that is large enough to handle significantly sized logs. To enable 905 905 the logging at a verbose level to permit detailed analysis, uncomment the entry in 906 the <code class="filename">/etc/openldap/slapd.conf</code> shown as “<span class="quote">loglevel 256</span>”.906 the <code class="filename">/etc/openldap/slapd.conf</code> shown as <span class="quote">“<span class="quote">loglevel 256</span>”</span>. 907 907 </p><p> 908 908 Edit the <code class="filename">/etc/syslog.conf</code> file to add the following at the end … … 975 975 index sambaDomainName eq 976 976 index default sub 977 </pre></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="sbehap-PAM-NSS"></a>PAM and NSS Client Configuration</h3></div></div></div><p>978 <a class="indexterm" name="id 2574531"></a>979 <a class="indexterm" name="id 2574537"></a>980 <a class="indexterm" name="id 2574544"></a>977 </pre></div></div><br class="example-break"></div><div class="sect2" title="PAM and NSS Client Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="sbehap-PAM-NSS"></a>PAM and NSS Client Configuration</h3></div></div></div><p> 978 <a class="indexterm" name="id344468"></a> 979 <a class="indexterm" name="id344474"></a> 980 <a class="indexterm" name="id344481"></a> 981 981 The steps that follow involve configuration of LDAP, NSS LDAP-based resolution of users and 982 982 groups. Also, so that LDAP-based accounts can log onto the system, the steps ahead configure 983 983 the Pluggable Authentication Modules (PAM) to permit LDAP-based authentication. 984 984 </p><p> 985 <a class="indexterm" name="id 2574558"></a>986 <a class="indexterm" name="id 2574568"></a>985 <a class="indexterm" name="id344493"></a> 986 <a class="indexterm" name="id344502"></a> 987 987 Since you have chosen to put UNIX user and group accounts into the LDAP database, it is likely 988 988 that you may want to use them for UNIX system (Linux) local machine logons. This necessitates … … 991 991 module also has the ability to redirect authentication requests through LDAP. 992 992 </p><p> 993 <a class="indexterm" name="id 2574596"></a>994 <a class="indexterm" name="id 2574603"></a>995 <a class="indexterm" name="id 2574610"></a>996 <a class="indexterm" name="id 2574617"></a>993 <a class="indexterm" name="id344527"></a> 994 <a class="indexterm" name="id344534"></a> 995 <a class="indexterm" name="id344541"></a> 996 <a class="indexterm" name="id344548"></a> 997 997 You have chosen to configure these services by directly editing the system files, but of course, you 998 998 know that this configuration can be done using system tools provided by the Linux system vendor. … … 1000 1000 configuration of SUSE Linux as an LDAP client. Red Hat Linux provides the <code class="literal">authconfig</code> 1001 1001 tool for this. 1002 </p><div class="procedure" ><a name="id2574656"></a><p class="title"><b>Procedure 5.3. PAM and NSS Client Configuration Steps</b></p><div class="example"><a name="sbehap-nss01"></a><p class="title"><b>Example 5.4. Configuration File for NSS LDAP Support <code class="filename">/etc/ldap.conf</code></b></p><div class="example-contents"><pre class="screen">1002 </p><div class="procedure" title="Procedure 5.3. PAM and NSS Client Configuration Steps"><a name="id344584"></a><p class="title"><b>Procedure 5.3. PAM and NSS Client Configuration Steps</b></p><div class="example"><a name="sbehap-nss01"></a><p class="title"><b>Example 5.4. Configuration File for NSS LDAP Support <code class="filename">/etc/ldap.conf</code></b></p><div class="example-contents"><pre class="screen"> 1003 1003 host 127.0.0.1 1004 1004 … … 1042 1042 1043 1043 ssl off 1044 </pre></div></div><br class="example-break"><ol type="1"><li><p>1045 <a class="indexterm" name="id 2574668"></a>1046 <a class="indexterm" name="id 2574675"></a>1047 <a class="indexterm" name="id 2574682"></a>1044 </pre></div></div><br class="example-break"><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 1045 <a class="indexterm" name="id344595"></a> 1046 <a class="indexterm" name="id344602"></a> 1047 <a class="indexterm" name="id344609"></a> 1048 1048 Execute the following command to find where the <code class="filename">nss_ldap</code> module 1049 1049 expects to find its control file: … … 1052 1052 </pre><p> 1053 1053 The preferred and usual location is <code class="filename">/etc/ldap.conf</code>. 1054 </p></li><li ><p>1054 </p></li><li class="step" title="Step 2"><p> 1055 1055 On the server <code class="constant">MASSIVE</code>, install the file shown in 1056 1056 <a class="link" href="happy.html#sbehap-nss01" title="Example 5.4. Configuration File for NSS LDAP Support /etc/ldap.conf">“Configuration File for NSS LDAP Support /etc/ldap.conf”</a> into the path that was obtained from the step above. 1057 1057 On the servers called <code class="constant">BLDG1</code> and <code class="constant">BLDG2</code>, install the file shown in 1058 1058 <a class="link" href="happy.html#sbehap-nss02" title="Example 5.5. Configuration File for NSS LDAP Clients Support /etc/ldap.conf">“Configuration File for NSS LDAP Clients Support /etc/ldap.conf”</a> into the path that was obtained from the step above. 1059 </p></li><li ><p>1060 <a class="indexterm" name="id 2574821"></a>1059 </p></li><li class="step" title="Step 3"><p> 1060 <a class="indexterm" name="id344734"></a> 1061 1061 Edit the NSS control file (<code class="filename">/etc/nsswitch.conf</code>) so that the lines that 1062 1062 control user and group resolution will obtain information from the normal system files as … … 1072 1072 WINS-based hostname resolution is deliberate so that all MS Windows client hostnames can be 1073 1073 resolved to their IP addresses, whether or not they are DHCP clients. 1074 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>1074 </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 1075 1075 Some Linux systems (Novell SUSE Linux in particular) add entries to the <code class="filename">nsswitch.conf</code> 1076 1076 file that may cause operational problems with the configuration methods adopted in this book. It is … … 1080 1080 Even at the risk of overstating the issue, incorrect and inappropriate configuration of the 1081 1081 <code class="filename">nsswitch.conf</code> file is a significant cause of operational problems with LDAP. 1082 </p></li><li ><p>1083 <a class="indexterm" name="id 2574897"></a>1082 </p></li><li class="step" title="Step 4"><p> 1083 <a class="indexterm" name="id344800"></a> 1084 1084 For PAM LDAP configuration on this SUSE Linux 9.0 system, the simplest solution is to edit the following 1085 1085 files in the <code class="filename">/etc/pam.d</code> directory: <code class="literal">login</code>, <code class="literal">password</code>, … … 1103 1103 </pre><p> 1104 1104 </p><p> 1105 <a class="indexterm" name="id 2574976"></a>1105 <a class="indexterm" name="id344872"></a> 1106 1106 On other Linux systems that do not have an LDAP-enabled <code class="literal">pam_unix2.so</code> module, 1107 1107 you must edit these files by adding the <code class="literal">pam_ldap.so</code> modules as shown here: … … 1126 1126 implementation, but if the <code class="literal">pam_unix2.so</code> on your system supports 1127 1127 LDAP, you probably want to use it rather than add an additional module. 1128 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="sbehap-massive"></a>Samba-3 PDC Configuration</h3></div></div></div><p>1129 <a class="indexterm" name="id 2575059"></a>1128 </p></li></ol></div></div><div class="sect2" title="Samba-3 PDC Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="sbehap-massive"></a>Samba-3 PDC Configuration</h3></div></div></div><p> 1129 <a class="indexterm" name="id344942"></a> 1130 1130 Verify that the Samba-3.0.20 (or later) packages are installed on each SUSE Linux server 1131 1131 before following the steps below. If Samba-3.0.20 (or later) is not installed, you have the … … 1134 1134 Red Hat Fedora Core and Red Hat Enterprise Linux Server 3 and 4, are included on the CD-ROM that 1135 1135 is included with this book. 1136 </p><div class="procedure" ><a name="id2575075"></a><p class="title"><b>Procedure 5.4. Configuration of PDC Called <code class="constant">MASSIVE</code></b></p><ol type="1"><li><p>1136 </p><div class="procedure" title="Procedure 5.4. Configuration of PDC Called MASSIVE"><a name="id344954"></a><p class="title"><b>Procedure 5.4. Configuration of PDC Called <code class="constant">MASSIVE</code></b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 1137 1137 Install the files in <a class="link" href="happy.html#sbehap-massive-smbconfa" title="Example 5.6. LDAP Based smb.conf File, Server: MASSIVE global Section: Part A">“LDAP Based smb.conf File, Server: MASSIVE global Section: Part A”</a>, 1138 1138 <a class="link" href="happy.html#sbehap-massive-smbconfb" title="Example 5.7. LDAP Based smb.conf File, Server: MASSIVE global Section: Part B">“LDAP Based smb.conf File, Server: MASSIVE global Section: Part B”</a>, <a class="link" href="happy.html#sbehap-shareconfa" title="Example 5.10. LDAP Based smb.conf File, Shares Section Part A">“LDAP Based smb.conf File, Shares Section Part A”</a>, … … 1143 1143 on the master file. The operational <code class="filename">smb.conf</code> is then generated as shown in 1144 1144 the next step. 1145 </p></li><li ><p>1146 <a class="indexterm" name="id 2575151"></a>1145 </p></li><li class="step" title="Step 2"><p> 1146 <a class="indexterm" name="id345025"></a> 1147 1147 Create and verify the contents of the <code class="filename">smb.conf</code> file that is generated by: 1148 1148 </p><pre class="screen"> … … 1171 1171 Press enter to see a dump of your service definitions 1172 1172 </pre><p> 1173 </p></li><li ><p>1173 </p></li><li class="step" title="Step 3"><p> 1174 1174 Delete all runtime files from prior Samba operation by executing (for SUSE 1175 1175 Linux): … … 1180 1180 <code class="prompt">root# </code> rm /var/log/samba/* 1181 1181 </pre><p> 1182 </p></li><li ><p>1183 <a class="indexterm" name="id 2575251"></a>1184 <a class="indexterm" name="id 2575257"></a>1182 </p></li><li class="step" title="Step 4"><p> 1183 <a class="indexterm" name="id345117"></a> 1184 <a class="indexterm" name="id345124"></a> 1185 1185 Samba-3 communicates with the LDAP server. The password that it uses to 1186 1186 authenticate to the LDAP server must be stored in the <code class="filename">secrets.tdb</code> … … 1194 1194 Setting stored password for "cn=Manager,dc=abmas,dc=biz" in secrets.tdb 1195 1195 </pre><p> 1196 </p></li><li ><p>1197 <a class="indexterm" name="id 2575306"></a>1198 <a class="indexterm" name="id 2575313"></a>1196 </p></li><li class="step" title="Step 5"><p> 1197 <a class="indexterm" name="id345169"></a> 1198 <a class="indexterm" name="id345176"></a> 1199 1199 Samba-3 generates a Windows Security Identifier (SID) only when <code class="literal">smbd</code> 1200 1200 has been started. For this reason, you start Samba. After a few seconds delay, … … 1227 1227 errors (the most common problem). The use of the <code class="literal">testparm</code> is highly 1228 1228 recommended to validate the contents of this file. 1229 </p></li><li ><p>1229 </p></li><li class="step" title="Step 6"><p> 1230 1230 When a positive domain SID has been reported, stop Samba. 1231 </p></li><li ><p>1232 <a class="indexterm" name="id 2575425"></a>1233 <a class="indexterm" name="id 2575432"></a>1234 <a class="indexterm" name="id 2575439"></a>1235 <a class="indexterm" name="id 2575445"></a>1231 </p></li><li class="step" title="Step 7"><p> 1232 <a class="indexterm" name="id345275"></a> 1233 <a class="indexterm" name="id345281"></a> 1234 <a class="indexterm" name="id345288"></a> 1235 <a class="indexterm" name="id345295"></a> 1236 1236 Configure the NFS server for your Linux system. So you can complete the steps that 1237 1237 follow, enter into the <code class="filename">/etc/exports</code> the following entry: … … 1251 1251 Your Samba-3 PDC is now ready to communicate with the LDAP password backend. Let's get on with 1252 1252 configuration of the LDAP server. 1253 </p><div class="example"><a name="sbehap-massive-smbconfa"></a><p class="title"><b>Example 5.6. LDAP Based <code class="filename">smb.conf</code> File, Server: MASSIVE global Section: Part A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2575532"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id2575544"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id2575555"></a><em class="parameter"><code>netbios name = MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id2575567"></a><em class="parameter"><code>interfaces = eth1, lo</code></em></td></tr><tr><td><a class="indexterm" name="id2575579"></a><em class="parameter"><code>bind interfaces only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2575591"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2575603"></a><em class="parameter"><code>enable privileges = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2575615"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2575627"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2575639"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2575650"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2575662"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id2575674"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2575685"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2575698"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2575709"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2575721"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2575733"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id2575746"></a><em class="parameter"><code>delete user script = /opt/IDEALX/sbin/smbldap-userdel "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id2575758"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd -p "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id2575770"></a><em class="parameter"><code>delete group script = /opt/IDEALX/sbin/smbldap-groupdel "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id2575783"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/smbldap-groupmod -m "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id2575796"></a><em class="parameter"><code>delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id2575809"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g "%g" "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id2575822"></a><em class="parameter"><code>add machine script = /opt/IDEALX/sbin/smbldap-useradd -w "%u"</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-massive-smbconfb"></a><p class="title"><b>Example 5.7. LDAP Based <code class="filename">smb.conf</code> File, Server: MASSIVE global Section: Part B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id2575859"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2575871"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2575883"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2575895"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2575906"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2575918"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2575930"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2575942"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2575954"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2575966"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2575978"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2575990"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2576002"></a><em class="parameter"><code>idmap backend = ldap:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2576014"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2576026"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2576038"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2576050"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2576061"></a><em class="parameter"><code>printer admin = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="sbeidealx"></a>Install and Configure Idealx smbldap-tools Scripts</h3></div></div></div><p>1254 <a class="indexterm" name="id 2576087"></a>1253 </p><div class="example"><a name="sbehap-massive-smbconfa"></a><p class="title"><b>Example 5.6. LDAP Based <code class="filename">smb.conf</code> File, Server: MASSIVE global Section: Part A</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id345373"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id345384"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id345396"></a><em class="parameter"><code>netbios name = MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id345407"></a><em class="parameter"><code>interfaces = eth1, lo</code></em></td></tr><tr><td><a class="indexterm" name="id345418"></a><em class="parameter"><code>bind interfaces only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id345430"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id345442"></a><em class="parameter"><code>enable privileges = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id345453"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id345465"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id345476"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id345488"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id345499"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id345511"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id345522"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id345534"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id345545"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id345557"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id345568"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id345580"></a><em class="parameter"><code>delete user script = /opt/IDEALX/sbin/smbldap-userdel "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id345592"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd -p "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id345604"></a><em class="parameter"><code>delete group script = /opt/IDEALX/sbin/smbldap-groupdel "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id345616"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/smbldap-groupmod -m "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id345628"></a><em class="parameter"><code>delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id345640"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g "%g" "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id345652"></a><em class="parameter"><code>add machine script = /opt/IDEALX/sbin/smbldap-useradd -w "%u"</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-massive-smbconfb"></a><p class="title"><b>Example 5.7. LDAP Based <code class="filename">smb.conf</code> File, Server: MASSIVE global Section: Part B</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td><a class="indexterm" name="id345688"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id345700"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id345711"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id345723"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id345734"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id345746"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id345757"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id345769"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id345780"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id345792"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id345804"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id345815"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id345827"></a><em class="parameter"><code>idmap backend = ldap:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id345839"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id345850"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id345862"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id345873"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id345884"></a><em class="parameter"><code>printer admin = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect2" title="Install and Configure Idealx smbldap-tools Scripts"><div class="titlepage"><div><div><h3 class="title"><a name="sbeidealx"></a>Install and Configure Idealx smbldap-tools Scripts</h3></div></div></div><p> 1254 <a class="indexterm" name="id345910"></a> 1255 1255 The Idealx scripts, or equivalent, are necessary to permit Samba-3 to manage accounts 1256 1256 on the LDAP server. You have chosen the Idealx scripts because they are the best-known … … 1262 1262 <a class="ulink" href="http://samba.idealx.org/dist/smbldap-tools-0.9.1-1.src.rpm" target="_top">smbldap-tools-0.9.1-1.src.rpm</a> 1263 1263 file that may be used to build an installable RPM package for your Linux system. 1264 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>1264 </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 1265 1265 The smbldap-tools scripts can be installed in any convenient directory of your choice, in which case you must 1266 1266 change the path to them in your <code class="filename">smb.conf</code> file on the PDC (<code class="constant">MASSIVE</code>). … … 1269 1269 The scripts are not needed on BDC machines because all LDAP updates are handled by 1270 1270 the PDC alone. 1271 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2576154"></a>Installation of smbldap-tools from the Tarball</h4></div></div></div><p>1271 </p><div class="sect3" title="Installation of smbldap-tools from the Tarball"><div class="titlepage"><div><div><h4 class="title"><a name="id345968"></a>Installation of smbldap-tools from the Tarball</h4></div></div></div><p> 1272 1272 To perform a manual installation of the smbldap-tools scripts, the following procedure may be used: 1273 </p><div class="procedure" ><a name="idealxscript"></a><p class="title"><b>Procedure 5.5. Unpacking and Installation Steps for the <code class="constant">smbldap-tools</code> Tarball</b></p><ol type="1"><li><p>1273 </p><div class="procedure" title="Procedure 5.5. Unpacking and Installation Steps for the smbldap-tools Tarball"><a name="idealxscript"></a><p class="title"><b>Procedure 5.5. Unpacking and Installation Steps for the <code class="constant">smbldap-tools</code> Tarball</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 1274 1274 Create the <code class="filename">/opt/IDEALX/sbin</code> directory, and set its permissions 1275 1275 and ownership as shown here: … … 1282 1282 <code class="prompt">root# </code> chmod 755 /etc/smbldap-tools 1283 1283 </pre><p> 1284 </p></li><li ><p>1284 </p></li><li class="step" title="Step 2"><p> 1285 1285 If you wish to use the downloaded tarball, unpack the smbldap-tools in a suitable temporary location. 1286 1286 Change into either the directory extracted from the tarball or the smbldap-tools 1287 1287 directory in your <code class="filename">/usr/share/doc/packages</code> directory tree. 1288 </p></li><li ><p>1288 </p></li><li class="step" title="Step 3"><p> 1289 1289 Copy all the <code class="filename">smbldap-*</code> and the <code class="filename">configure.pl</code> files into the 1290 1290 <code class="filename">/opt/IDEALX/sbin</code> directory, as shown here: … … 1298 1298 <code class="prompt">root# </code> chmod 600 /etc/smbldap-tools/smbldap_bind.conf 1299 1299 </pre><p> 1300 </p></li><li ><p>1300 </p></li><li class="step" title="Step 4"><p> 1301 1301 The smbldap-tools scripts master control file must now be configured. 1302 1302 Change to the <code class="filename">/opt/IDEALX/sbin</code> directory, then edit the … … 1311 1311 ... 1312 1312 </pre><p> 1313 </p></li><li ><p>1313 </p></li><li class="step" title="Step 5"><p> 1314 1314 To complete the configuration of the smbldap-tools, set the permissions and ownership 1315 1315 by executing the following commands: … … 1321 1321 The smbldap-tools scripts are now ready for the configuration step outlined in 1322 1322 <a class="link" href="happy.html#smbldap-init" title="Configuration of smbldap-tools">“Configuration of smbldap-tools”</a>. 1323 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2576407"></a>Installing smbldap-tools from the RPM Package</h4></div></div></div><p>1323 </p></li></ol></div></div><div class="sect3" title="Installing smbldap-tools from the RPM Package"><div class="titlepage"><div><div><h4 class="title"><a name="id346204"></a>Installing smbldap-tools from the RPM Package</h4></div></div></div><p> 1324 1324 In the event that you have elected to use the RPM package provided by Idealx, download the 1325 1325 source RPM <code class="filename">smbldap-tools-0.9.1-1.src.rpm</code>, then follow this procedure: 1326 </p><div class="procedure" ><a name="id2576425"></a><p class="title"><b>Procedure 5.6. Installation Steps for <code class="constant">smbldap-tools</code> RPM's</b></p><ol type="1"><li><p>1326 </p><div class="procedure" title="Procedure 5.6. Installation Steps for smbldap-tools RPM's"><a name="id346220"></a><p class="title"><b>Procedure 5.6. Installation Steps for <code class="constant">smbldap-tools</code> RPM's</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 1327 1327 Install the source RPM that has been downloaded as follows: 1328 1328 </p><pre class="screen"> 1329 1329 <code class="prompt">root# </code> rpm -i smbldap-tools-0.9.1-1.src.rpm 1330 1330 </pre><p> 1331 </p></li><li ><p>1331 </p></li><li class="step" title="Step 2"><p> 1332 1332 Change into the directory in which the SPEC files are located. On SUSE Linux: 1333 1333 </p><pre class="screen"> … … 1338 1338 <code class="prompt">root# </code> cd /usr/src/redhat/SPECS 1339 1339 </pre><p> 1340 </p></li><li ><p>1340 </p></li><li class="step" title="Step 3"><p> 1341 1341 Edit the <code class="filename">smbldap-tools.spec</code> file to change the value of the 1342 1342 <code class="constant">_sysconfig</code> macro as shown here: … … 1346 1346 </pre><p> 1347 1347 Note: Any suitable directory can be specified. 1348 </p></li><li ><p>1348 </p></li><li class="step" title="Step 4"><p> 1349 1349 Build the package by executing: 1350 1350 </p><pre class="screen"> … … 1353 1353 A build process that has completed without error will place the installable binary 1354 1354 files in the directory <code class="filename">../RPMS/noarch</code>. 1355 </p></li><li ><p>1355 </p></li><li class="step" title="Step 5"><p> 1356 1356 Install the binary package by executing: 1357 1357 </p><pre class="screen"> … … 1361 1361 The Idealx scripts should now be ready for configuration using the steps outlined in 1362 1362 <a class="link" href="happy.html#smbldap-init" title="Configuration of smbldap-tools">Configuration of smbldap-tools</a>. 1363 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="smbldap-init"></a>Configuration of smbldap-tools</h4></div></div></div><p>1363 </p></div><div class="sect3" title="Configuration of smbldap-tools"><div class="titlepage"><div><div><h4 class="title"><a name="smbldap-init"></a>Configuration of smbldap-tools</h4></div></div></div><p> 1364 1364 Prior to use, the smbldap-tools must be configured to match the settings in the <code class="filename">smb.conf</code> file 1365 1365 and to match the settings in the <code class="filename">/etc/openldap/slapd.conf</code> file. The assumption … … 1369 1369 The smbldap-tools require that the NetBIOS name (machine name) of the Samba server be included 1370 1370 in the <code class="filename">smb.conf</code> file. 1371 </p><div class="procedure" ><a name="id2576620"></a><p class="title"><b>Procedure 5.7. Configuration Steps for <code class="constant">smbldap-tools</code> to Enable Use</b></p><ol type="1"><li><p>1371 </p><div class="procedure" title="Procedure 5.7. Configuration Steps for smbldap-tools to Enable Use"><a name="id346402"></a><p class="title"><b>Procedure 5.7. Configuration Steps for <code class="constant">smbldap-tools</code> to Enable Use</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 1372 1372 Change into the directory that contains the <code class="filename">configure.pl</code> script. 1373 1373 </p><pre class="screen"> 1374 1374 <code class="prompt">root# </code> cd /opt/IDEALX/sbin 1375 1375 </pre><p> 1376 </p></li><li ><p>1376 </p></li><li class="step" title="Step 2"><p> 1377 1377 Execute the <code class="filename">configure.pl</code> script as follows: 1378 1378 </p><pre class="screen"> … … 1470 1470 address of the master LDAP server for both the master and the slave configuration 1471 1471 prompts. 1472 </p></li><li ><p>1472 </p></li><li class="step" title="Step 3"><p> 1473 1473 Change to the directory that contains the <code class="filename">smbldap.conf</code> file, 1474 1474 then verify its contents. 1475 1475 </p></li></ol></div><p> 1476 1476 The smbldap-tools are now ready for use. 1477 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2576821"></a>LDAP Initialization and Creation of User and Group Accounts</h3></div></div></div><p>1477 </p></div></div><div class="sect2" title="LDAP Initialization and Creation of User and Group Accounts"><div class="titlepage"><div><div><h3 class="title"><a name="id346546"></a>LDAP Initialization and Creation of User and Group Accounts</h3></div></div></div><p> 1478 1478 The LDAP database must be populated with well-known Windows domain user accounts and domain group 1479 1479 accounts before Samba can be used. The following procedures step you through the process. … … 1487 1487 </p><p> 1488 1488 Addition of an account to the LDAP backend can be done in two ways: 1489 </p><div class="itemizedlist"><ul type="disc"><li><p>1490 <a class="indexterm" name="id 2576855"></a>1491 <a class="indexterm" name="id 2576862"></a>1492 <a class="indexterm" name="id 2576869"></a>1493 <a class="indexterm" name="id 2576876"></a>1494 <a class="indexterm" name="id 2576882"></a>1495 <a class="indexterm" name="id 2576889"></a>1489 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 1490 <a class="indexterm" name="id346574"></a> 1491 <a class="indexterm" name="id346580"></a> 1492 <a class="indexterm" name="id346587"></a> 1493 <a class="indexterm" name="id346594"></a> 1494 <a class="indexterm" name="id346601"></a> 1495 <a class="indexterm" name="id346608"></a> 1496 1496 If you always have a user account in the <code class="filename">/etc/passwd</code> on every 1497 1497 server or in a NIS(+) backend, it is not necessary to add POSIX accounts for them in … … 1504 1504 migration tool to migrate all system accounts from either the <code class="filename">/etc/passwd</code> 1505 1505 files, or from NIS, to LDAP. 1506 </p></li><li ><p>1506 </p></li><li class="listitem"><p> 1507 1507 If you decide that it is probably a good idea to add both the PosixAccount attributes 1508 1508 as well as the SambaSamAccount attributes for each user, then a suitable script is needed. … … 1511 1511 is included on the enclosed CD-ROM under <code class="filename">Chap06/Tools.</code> 1512 1512 </p></li></ul></div><p> 1513 <a class="indexterm" name="id 2576949"></a>1513 <a class="indexterm" name="id346659"></a> 1514 1514 If you wish to have more control over how the LDAP database is initialized or 1515 1515 if you don't want to use the Idealx smbldap-tools, you should refer to 1516 1516 <a class="link" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">“A Collection of Useful Tidbits”</a>, <a class="link" href="appendix.html#altldapcfg" title="Alternative LDAP Database Initialization">“Alternative LDAP Database Initialization”</a>. 1517 1517 </p><p> 1518 <a class="indexterm" name="id 2576976"></a>1518 <a class="indexterm" name="id346685"></a> 1519 1519 The following steps initialize the LDAP database, and then you can add user and group 1520 1520 accounts that Samba can use. You use the <code class="literal">smbldap-populate</code> to 1521 1521 seed the LDAP database. You then manually add the accounts shown in <a class="link" href="happy.html#sbehap-bigacct" title="Table 5.3. Abmas Network Users and Groups">“Abmas Network Users and Groups”</a>. 1522 1522 The list of users does not cover all 500 network users; it provides examples only. 1523 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>1524 <a class="indexterm" name="id 2577006"></a>1525 <a class="indexterm" name="id 2577015"></a>1526 <a class="indexterm" name="id 2577024"></a>1523 </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 1524 <a class="indexterm" name="id346712"></a> 1525 <a class="indexterm" name="id346720"></a> 1526 <a class="indexterm" name="id346730"></a> 1527 1527 In the following examples, as the LDAP database is initialized, we do create a container 1528 1528 for Computer (machine) accounts. In the Samba-3 <code class="filename">smb.conf</code> files, specific use is made … … 1541 1541 are able to sidestep this limitation. This is the simpler solution that has been adopted 1542 1542 in this chapter. 1543 </p></div><div class="table"><a name="sbehap-bigacct"></a><p class="title"><b>Table 5.3. Abmas Network Users and Groups</b></p><div class="table-contents"><table summary="Abmas Network Users and Groups" border="1"><colgroup><col align="left"><col align="left"><col align="left"><col align="left"></colgroup><thead><tr><th align="center">Account Name</th><th align="center">Type</th><th align="center">ID</th><th align="center">Password</th></tr></thead><tbody><tr><td align="left">Robert Jordan</td><td align="left">User</td><td align="left">bobj</td><td align="left">n3v3r2l8</td></tr><tr><td align="left">Stanley Soroka</td><td align="left">User</td><td align="left">stans</td><td align="left">impl13dst4r</td></tr><tr><td align="left">Christine Roberson</td><td align="left">User</td><td align="left">chrisr</td><td align="left">S9n0nw4ll</td></tr><tr><td align="left">Mary Vortexis</td><td align="left">User</td><td align="left">maryv</td><td align="left">kw13t0n3</td></tr><tr><td align="left">Accounts</td><td align="left">Group</td><td align="left">Accounts</td><td align="left"> </td></tr><tr><td align="left">Finances</td><td align="left">Group</td><td align="left">Finances</td><td align="left"> </td></tr><tr><td align="left">Insurance</td><td align="left">Group</td><td align="left">PIOps</td><td align="left"> </td></tr></tbody></table></div></div><br class="table-break"><div class="procedure" ><a name="creatacc"></a><p class="title"><b>Procedure 5.8. LDAP Directory Initialization Steps</b></p><ol type="1"><li><p>1543 </p></div><div class="table"><a name="sbehap-bigacct"></a><p class="title"><b>Table 5.3. Abmas Network Users and Groups</b></p><div class="table-contents"><table summary="Abmas Network Users and Groups" border="1"><colgroup><col align="left"><col align="left"><col align="left"><col align="left"></colgroup><thead><tr><th align="center">Account Name</th><th align="center">Type</th><th align="center">ID</th><th align="center">Password</th></tr></thead><tbody><tr><td align="left">Robert Jordan</td><td align="left">User</td><td align="left">bobj</td><td align="left">n3v3r2l8</td></tr><tr><td align="left">Stanley Soroka</td><td align="left">User</td><td align="left">stans</td><td align="left">impl13dst4r</td></tr><tr><td align="left">Christine Roberson</td><td align="left">User</td><td align="left">chrisr</td><td align="left">S9n0nw4ll</td></tr><tr><td align="left">Mary Vortexis</td><td align="left">User</td><td align="left">maryv</td><td align="left">kw13t0n3</td></tr><tr><td align="left">Accounts</td><td align="left">Group</td><td align="left">Accounts</td><td align="left"> </td></tr><tr><td align="left">Finances</td><td align="left">Group</td><td align="left">Finances</td><td align="left"> </td></tr><tr><td align="left">Insurance</td><td align="left">Group</td><td align="left">PIOps</td><td align="left"> </td></tr></tbody></table></div></div><br class="table-break"><div class="procedure" title="Procedure 5.8. LDAP Directory Initialization Steps"><a name="creatacc"></a><p class="title"><b>Procedure 5.8. LDAP Directory Initialization Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 1544 1544 Start the LDAP server by executing: 1545 1545 </p><pre class="screen"> … … 1547 1547 Starting ldap-server done 1548 1548 </pre><p> 1549 </p></li><li ><p>1549 </p></li><li class="step" title="Step 2"><p> 1550 1550 Change to the <code class="filename">/opt/IDEALX/sbin</code> directory. 1551 </p></li><li ><p>1551 </p></li><li class="step" title="Step 3"><p> 1552 1552 Execute the script that will populate the LDAP database as shown here: 1553 1553 </p><pre class="screen"> … … 1580 1580 adding new entry: cn=Replicators,ou=Groups,dc=abmas,dc=biz 1581 1581 </pre><p> 1582 </p></li><li ><p>1582 </p></li><li class="step" title="Step 4"><p> 1583 1583 Edit the <code class="filename">/etc/smbldap-tools/smbldap.conf</code> file so that the following 1584 1584 information is changed from: … … 1593 1593 sambaUnixIdPooldn="sambaDomainName=MEGANET2,dc=abmas,dc=biz" 1594 1594 </pre><p> 1595 </p></li><li ><p>1595 </p></li><li class="step" title="Step 5"><p> 1596 1596 It is necessary to restart the LDAP server as shown here: 1597 1597 </p><pre class="screen"> … … 1600 1600 Starting ldap-server done 1601 1601 </pre><p> 1602 </p></li><li ><p>1603 <a class="indexterm" name="id 2577444"></a>1602 </p></li><li class="step" title="Step 6"><p> 1603 <a class="indexterm" name="id347108"></a> 1604 1604 So that we can use a global IDMAP repository, the LDAP directory must have a container object for IDMAP data. 1605 1605 There are several ways you can check that your LDAP database is able to receive IDMAP information. One of … … 1610 1610 ou: idmap 1611 1611 </pre><p> 1612 <a class="indexterm" name="id 2577468"></a>1612 <a class="indexterm" name="id347129"></a> 1613 1613 If the execution of this command does not return IDMAP entries, you need to create an LDIF 1614 1614 template file (see <a class="link" href="happy.html#sbehap-ldifadd" title="Example 5.12. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF">“LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF”</a>). You can add the required entries using … … 1619 1619 </pre><p> 1620 1620 Samba automatically populates this LDAP directory container when it needs to. 1621 </p></li><li ><p>1622 <a class="indexterm" name="id 2577507"></a>1621 </p></li><li class="step" title="Step 7"><p> 1622 <a class="indexterm" name="id347164"></a> 1623 1623 It looks like all has gone well, as expected. Let's confirm that this is the case 1624 1624 by running a few tests. First we check the contents of the database directly … … 1657 1657 </pre><p> 1658 1658 This looks good so far. 1659 </p></li><li ><p>1660 <a class="indexterm" name="id 2577558"></a>1659 </p></li><li class="step" title="Step 8"><p> 1660 <a class="indexterm" name="id347205"></a> 1661 1661 The next step is to prove that the LDAP server is running and responds to a 1662 1662 search request. Execute the following as shown (output has been cut to save space): … … 1702 1702 </pre><p> 1703 1703 Good. It is all working just fine. 1704 </p></li><li ><p>1705 <a class="indexterm" name="id 2577615"></a>1704 </p></li><li class="step" title="Step 9"><p> 1705 <a class="indexterm" name="id347246"></a> 1706 1706 You must now make certain that the NSS resolver can interrogate LDAP also. 1707 1707 Execute the following commands: … … 1716 1716 Domain Computers:x:553: 1717 1717 </pre><p> 1718 <a class="indexterm" name="id 2577645"></a>1718 <a class="indexterm" name="id347273"></a> 1719 1719 This demonstrates that the <code class="literal">nss_ldap</code> library is functioning 1720 1720 as it should. If these two steps fail to produce this information, refer to … … 1722 1722 isolate the cause of the problem. Proceed to the next step only when the previous steps 1723 1723 have been successfully completed. 1724 </p></li><li ><p>1725 <a class="indexterm" name="id 2577675"></a>1726 <a class="indexterm" name="id 2577682"></a>1727 <a class="indexterm" name="id 2577689"></a>1724 </p></li><li class="step" title="Step 10"><p> 1725 <a class="indexterm" name="id347301"></a> 1726 <a class="indexterm" name="id347308"></a> 1727 <a class="indexterm" name="id347314"></a> 1728 1728 Our database is now ready for the addition of network users. For each user for 1729 1729 whom an account must be created, execute the following: … … 1740 1740 </pre><p> 1741 1741 where <code class="constant">username</code> is the login ID for each user. 1742 </p></li><li ><p>1743 <a class="indexterm" name="id 2577750"></a>1742 </p></li><li class="step" title="Step 11"><p> 1743 <a class="indexterm" name="id347372"></a> 1744 1744 Now verify that the UNIX (POSIX) accounts can be resolved via NSS by executing the 1745 1745 following: … … 1757 1757 </pre><p> 1758 1758 This demonstrates that user account resolution via LDAP is working. 1759 </p></li><li ><p>1759 </p></li><li class="step" title="Step 12"><p> 1760 1760 This step will determine whether or not identity resolution is working correctly. 1761 1761 Do not procede is this step fails, rather find the cause of the failure. The … … 1768 1768 This confirms that the UNIX (POSIX) user account information can be resolved from LDAP 1769 1769 by system tools that make a getentpw() system call. 1770 </p></li><li ><p>1771 <a class="indexterm" name="id 2577816"></a>1770 </p></li><li class="step" title="Step 13"><p> 1771 <a class="indexterm" name="id347429"></a> 1772 1772 The root account must have UID=0; if not, this means that operations conducted from 1773 1773 a Windows client using tools such as the Domain User Manager fails under UNIX because … … 1780 1780 <code class="prompt">root# </code> ./smbldap-usermod -u 0 -d /root -s /bin/bash root 1781 1781 </pre><p> 1782 </p></li><li ><p>1782 </p></li><li class="step" title="Step 14"><p> 1783 1783 Verify that the changes just made to the <code class="constant">root</code> account were 1784 1784 accepted by executing: … … 1789 1789 </pre><p> 1790 1790 This demonstrates that the changes were accepted. 1791 </p></li><li ><p>1791 </p></li><li class="step" title="Step 15"><p> 1792 1792 Make certain that a home directory has been created for every user by listing the 1793 1793 directories in <code class="filename">/home</code> as follows: … … 1802 1802 </pre><p> 1803 1803 This is precisely what we want to see. 1804 </p></li><li ><p>1805 <a class="indexterm" name="id 2577915"></a>1806 <a class="indexterm" name="id 2577922"></a>1804 </p></li><li class="step" title="Step 16"><p> 1805 <a class="indexterm" name="id347517"></a> 1806 <a class="indexterm" name="id347524"></a> 1807 1807 The final validation step involves making certain that Samba-3 can obtain the user 1808 1808 accounts from the LDAP ldapsam passwd backend. Execute the following command as shown: … … 1834 1834 </pre><p> 1835 1835 This looks good. Of course, you fully expected that it would all work, didn't you? 1836 </p></li><li ><p>1837 <a class="indexterm" name="id 2577967"></a>1836 </p></li><li class="step" title="Step 17"><p> 1837 <a class="indexterm" name="id347558"></a> 1838 1838 Now you add the group accounts that are used on the Abmas network. Execute 1839 1839 the following exactly as shown: … … 1845 1845 The addition of groups does not involve keyboard interaction, so the lack of console 1846 1846 output is of no concern. 1847 </p></li><li ><p>1848 <a class="indexterm" name="id 2578010"></a>1847 </p></li><li class="step" title="Step 18"><p> 1848 <a class="indexterm" name="id347598"></a> 1849 1849 You really do want to confirm that UNIX group resolution from LDAP is functioning 1850 1850 as it should. Let's do this as shown here: … … 1862 1862 The well-known special accounts (Domain Admins, Domain Users, Domain Guests), as well 1863 1863 as our own site-specific group accounts, are correctly listed. This is looking good. 1864 </p></li><li ><p>1865 <a class="indexterm" name="id 2578042"></a>1864 </p></li><li class="step" title="Step 19"><p> 1865 <a class="indexterm" name="id347627"></a> 1866 1866 The final step we need to validate is that Samba can see all the Windows domain groups 1867 1867 and that they are correctly mapped to the respective UNIX group account. To do this, … … 1880 1880 the lines were shortened by replacing the middle value (1010554828) of the SID with the 1881 1881 ellipsis (...). 1882 </p></li><li ><p>1882 </p></li><li class="step" title="Step 20"><p> 1883 1883 The server you have so carefully built is now ready for another important step. You 1884 1884 start the Samba-3 server and validate its operation. Execute the following to render all … … 1896 1896 <code class="prompt">root# </code> rcwinbind start 1897 1897 </pre><p> 1898 </p></li><li ><p>1898 </p></li><li class="step" title="Step 21"><p> 1899 1899 The next step might seem a little odd at this point, but take note that you are about to 1900 1900 start <code class="literal">winbindd</code>, which must be able to authenticate to the PDC via the … … 1911 1911 </pre><p> 1912 1912 This indicates that the domain security account for the PDC has been correctly created. 1913 </p></li><li ><p>1913 </p></li><li class="step" title="Step 22"><p> 1914 1914 At this time it is necessary to restart <code class="literal">winbindd</code> so that it can 1915 1915 correctly authenticate to the PDC. The following command achieves that: … … 1917 1917 <code class="prompt">root# </code> rcwinbind restart 1918 1918 </pre><p> 1919 </p></li><li ><p>1920 <a class="indexterm" name="id 2578257"></a>1919 </p></li><li class="step" title="Step 23"><p> 1920 <a class="indexterm" name="id347824"></a> 1921 1921 You may now check Samba-3 operation as follows: 1922 1922 </p><pre class="screen"> … … 1944 1944 </pre><p> 1945 1945 This shows that an anonymous connection is working. 1946 </p></li><li ><p>1946 </p></li><li class="step" title="Step 24"><p> 1947 1947 For your finale, let's try an authenticated connection: 1948 1948 </p><pre class="screen"> … … 1963 1963 </p></li></ol></div><p> 1964 1964 The server <code class="constant">MASSIVE</code> is now configured, and it is time to move onto the next task. 1965 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="sbehap-ptrcfg"></a>Printer Configuration</h3></div></div></div><p>1966 <a class="indexterm" name="id 2578368"></a>1965 </p></div><div class="sect2" title="Printer Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="sbehap-ptrcfg"></a>Printer Configuration</h3></div></div></div><p> 1966 <a class="indexterm" name="id347908"></a> 1967 1967 The configuration for Samba-3 to enable CUPS raw-print-through printing has already been 1968 1968 taken care of in the <code class="filename">smb.conf</code> file. The only preparation needed for <code class="constant">smart</code> 1969 1969 printing to be possible involves creation of the directories in which Samba-3 stores 1970 1970 Windows printing driver files. 1971 </p><div class="procedure" ><a name="id2578390"></a><p class="title"><b>Procedure 5.9. Printer Configuration Steps</b></p><ol type="1"><li><p>1971 </p><div class="procedure" title="Procedure 5.9. Printer Configuration Steps"><a name="id347927"></a><p class="title"><b>Procedure 5.9. Printer Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 1972 1972 Configure all network-attached printers to have a fixed IP address. 1973 </p></li><li ><p>1973 </p></li><li class="step" title="Step 2"><p> 1974 1974 Create an entry in the DNS database on the server <code class="constant">MASSIVE</code> 1975 1975 in both the forward lookup database for the zone <code class="constant">abmas.biz.hosts</code> … … 1977 1977 be located in. Example configuration files for similar zones were presented in <a class="link" href="secure.html" title="Chapter 3. Secure Office Networking">“Secure Office Networking”</a>, 1978 1978 <a class="link" href="secure.html#abmasbiz" title="Example 3.14. DNS Abmas.biz Forward Zone File">“DNS Abmas.biz Forward Zone File”</a> and in <a class="link" href="secure.html#eth2zone" title="Example 3.13. DNS 192.168.2 Reverse Zone File">“DNS 192.168.2 Reverse Zone File”</a>. 1979 </p></li><li ><p>1979 </p></li><li class="step" title="Step 3"><p> 1980 1980 Follow the instructions in the printer manufacturers' manuals to permit printing 1981 1981 to port 9100. Use any other port the manufacturer specifies for direct mode, 1982 1982 raw printing. This allows the CUPS spooler to print using raw mode protocols. 1983 <a class="indexterm" name="id 2578451"></a>1984 <a class="indexterm" name="id 2578458"></a>1985 </p></li><li ><p>1986 <a class="indexterm" name="id 2578472"></a>1987 <a class="indexterm" name="id 2578478"></a>1983 <a class="indexterm" name="id347982"></a> 1984 <a class="indexterm" name="id347989"></a> 1985 </p></li><li class="step" title="Step 4"><p> 1986 <a class="indexterm" name="id348002"></a> 1987 <a class="indexterm" name="id348009"></a> 1988 1988 Only on the server to which the printer is attached, configure the CUPS Print 1989 1989 Queues as follows: … … 1992 1992 -v socket://<em class="parameter"><code>printer-name</code></em>.abmas.biz:9100 -E 1993 1993 </pre><p> 1994 <a class="indexterm" name="id 2578514"></a>1994 <a class="indexterm" name="id348043"></a> 1995 1995 This step creates the necessary print queue to use no assigned print filter. This 1996 1996 is ideal for raw printing, that is, printing without use of filters. 1997 1997 The name <em class="parameter"><code>printque</code></em> is the name you have assigned for 1998 1998 the particular printer. 1999 </p></li><li ><p>1999 </p></li><li class="step" title="Step 5"><p> 2000 2000 Print queues may not be enabled at creation. Make certain that the queues 2001 2001 you have just created are enabled by executing the following: … … 2003 2003 <code class="prompt">root# </code> /usr/bin/enable <em class="parameter"><code>printque</code></em> 2004 2004 </pre><p> 2005 </p></li><li ><p>2005 </p></li><li class="step" title="Step 6"><p> 2006 2006 Even though your print queue may be enabled, it is still possible that it 2007 2007 may not accept print jobs. A print queue will service incoming printing … … 2011 2011 <code class="prompt">root# </code> /usr/bin/accept <em class="parameter"><code>printque</code></em> 2012 2012 </pre><p> 2013 </p></li><li ><p>2014 <a class="indexterm" name="id 2578595"></a>2015 <a class="indexterm" name="id 2578602"></a>2016 <a class="indexterm" name="id 2578609"></a>2013 </p></li><li class="step" title="Step 7"><p> 2014 <a class="indexterm" name="id348117"></a> 2015 <a class="indexterm" name="id348124"></a> 2016 <a class="indexterm" name="id348130"></a> 2017 2017 Edit the file <code class="filename">/etc/cups/mime.convs</code> to uncomment the line: 2018 2018 </p><pre class="screen"> 2019 2019 application/octet-stream application/vnd.cups-raw 0 - 2020 2020 </pre><p> 2021 </p></li><li ><p>2022 <a class="indexterm" name="id 2578638"></a>2021 </p></li><li class="step" title="Step 8"><p> 2022 <a class="indexterm" name="id348157"></a> 2023 2023 Edit the file <code class="filename">/etc/cups/mime.types</code> to uncomment the line: 2024 2024 </p><pre class="screen"> 2025 2025 application/octet-stream 2026 2026 </pre><p> 2027 </p></li><li ><p>2027 </p></li><li class="step" title="Step 9"><p> 2028 2028 Refer to the CUPS printing manual for instructions regarding how to configure 2029 2029 CUPS so that print queues that reside on CUPS servers on remote networks … … 2031 2031 on your CUPS server may automatically discover remotely installed printers and 2032 2032 may permit this functionality without requiring specific configuration. 2033 </p></li><li ><p>2033 </p></li><li class="step" title="Step 10"><p> 2034 2034 The following action creates the necessary directory subsystem. Follow these 2035 2035 steps to printing heaven: … … 2039 2039 <code class="prompt">root# </code> chmod -R ug=rwx,o=rx /var/lib/samba/drivers 2040 2040 </pre><p> 2041 </p></li></ol></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="sbehap-bldg1"></a>Samba-3 BDC Configuration</h2></div></div></div><div class="procedure"><a name="id2578721"></a><p class="title"><b>Procedure 5.10. Configuration of BDC Called: <code class="constant">BLDG1</code></b></p><ol type="1"><li><p>2041 </p></li></ol></div></div></div><div class="sect1" title="Samba-3 BDC Configuration"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="sbehap-bldg1"></a>Samba-3 BDC Configuration</h2></div></div></div><div class="procedure" title="Procedure 5.10. Configuration of BDC Called: BLDG1"><a name="id348233"></a><p class="title"><b>Procedure 5.10. Configuration of BDC Called: <code class="constant">BLDG1</code></b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 2042 2042 Install the files in <a class="link" href="happy.html#sbehap-bldg1-smbconf" title="Example 5.8. LDAP Based smb.conf File, Server: BLDG1">“LDAP Based smb.conf File, Server: BLDG1”</a>, 2043 2043 <a class="link" href="happy.html#sbehap-shareconfa" title="Example 5.10. LDAP Based smb.conf File, Shares Section Part A">“LDAP Based smb.conf File, Shares Section Part A”</a>, and <a class="link" href="happy.html#sbehap-shareconfb" title="Example 5.11. LDAP Based smb.conf File, Shares Section Part B">“LDAP Based smb.conf File, Shares Section Part B”</a> 2044 2044 into the <code class="filename">/etc/samba/</code> directory. The three files 2045 2045 should be added together to form the <code class="filename">smb.conf</code> file. 2046 </p></li><li ><p>2046 </p></li><li class="step" title="Step 2"><p> 2047 2047 Verify the <code class="filename">smb.conf</code> file as in step 2 of <a class="link" href="happy.html#sbehap-massive" title="Samba-3 PDC Configuration">“Samba-3 PDC Configuration”</a>. 2048 </p></li><li ><p>2048 </p></li><li class="step" title="Step 3"><p> 2049 2049 Carefully follow the steps outlined in <a class="link" href="happy.html#sbehap-PAM-NSS" title="PAM and NSS Client Configuration">“PAM and NSS Client Configuration”</a>, taking 2050 2050 particular note to install the correct <code class="filename">ldap.conf</code>. 2051 </p></li><li ><p>2051 </p></li><li class="step" title="Step 4"><p> 2052 2052 Verify that the NSS resolver is working. You may need to cycle the run level 2053 2053 to 1 and back to 5 before the NSS LDAP resolver functions. Follow these … … 2081 2081 </pre><p> 2082 2082 This is the correct output. If the accounts that have UIDs above 512 are not shown, there is a problem. 2083 </p></li><li ><p>2084 <a class="indexterm" name="id 2578881"></a>2083 </p></li><li class="step" title="Step 5"><p> 2084 <a class="indexterm" name="id348380"></a> 2085 2085 The next step in the verification process involves testing the operation of UNIX group 2086 2086 resolution via the NSS LDAP resolver. Execute these commands: … … 2111 2111 This is also the correct and desired output, because it demonstrates that the LDAP client 2112 2112 is able to communicate correctly with the LDAP server (<code class="constant">MASSIVE</code>). 2113 </p></li><li ><p>2114 <a class="indexterm" name="id 2578922"></a>2113 </p></li><li class="step" title="Step 6"><p> 2114 <a class="indexterm" name="id348415"></a> 2115 2115 You must now set the LDAP administrative password into the Samba-3 <code class="filename">secrets.tdb</code> 2116 2116 file by executing this command: … … 2119 2119 Setting stored password for "cn=Manager,dc=abmas,dc=biz" in secrets.tdb 2120 2120 </pre><p> 2121 </p></li><li ><p>2121 </p></li><li class="step" title="Step 7"><p> 2122 2122 Now you must obtain the domain SID from the PDC and store it into the 2123 2123 <code class="filename">secrets.tdb</code> file also. This step is not necessary with an LDAP … … 2136 2136 thus requiring that the BDC should be joined to the domain. The process of joining 2137 2137 the domain creates the necessary authentication accounts. 2138 </p></li><li ><p>2138 </p></li><li class="step" title="Step 8"><p> 2139 2139 To join the Samba BDC to the domain, execute the following: 2140 2140 </p><pre class="screen"> … … 2143 2143 </pre><p> 2144 2144 This indicates that the domain security account for the BDC has been correctly created. 2145 </p></li><li ><p>2146 <a class="indexterm" name="id 2579023"></a>2145 </p></li><li class="step" title="Step 9"><p> 2146 <a class="indexterm" name="id348504"></a> 2147 2147 Verify that user and group account resolution works via Samba-3 tools as follows: 2148 2148 </p><pre class="screen"> … … 2170 2170 </pre><p> 2171 2171 These results show that all things are in order. 2172 </p></li><li ><p>2172 </p></li><li class="step" title="Step 10"><p> 2173 2173 The server you have so carefully built is now ready for another important step. Now 2174 2174 start the Samba-3 server and validate its operation. Execute the following to render all … … 2186 2186 </pre><p> 2187 2187 Samba-3 should now be running and is ready for a quick test. But not quite yet! 2188 </p></li><li ><p>2188 </p></li><li class="step" title="Step 11"><p> 2189 2189 Your new <code class="constant">BLDG1, BLDG2</code> servers do not have home directories for users. 2190 2190 To rectify this using the SUSE yast2 utility or by manually editing the <code class="filename">/etc/fstab</code> … … 2206 2206 massive:/home 29532988 283388 29249600 1% /home 2207 2207 </pre><p> 2208 </p></li><li ><p>2208 </p></li><li class="step" title="Step 12"><p> 2209 2209 Implement a quick check using one of the users that is in the LDAP database. Here you go: 2210 2210 </p><pre class="screen"> … … 2225 2225 Now that the first BDC (<code class="constant">BDLG1</code>) has been configured it is time to build 2226 2226 and configure the second BDC server (<code class="constant">BLDG2</code>) as follows: 2227 </p><div class="procedure" ><a name="sbehap-bldg2"></a><p class="title"><b>Procedure 5.11. Configuration of BDC Called <code class="constant">BLDG2</code></b></p><ol type="1"><li><p>2227 </p><div class="procedure" title="Procedure 5.11. Configuration of BDC Called BLDG2"><a name="sbehap-bldg2"></a><p class="title"><b>Procedure 5.11. Configuration of BDC Called <code class="constant">BLDG2</code></b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 2228 2228 Install the files in <a class="link" href="happy.html#sbehap-bldg2-smbconf" title="Example 5.9. LDAP Based smb.conf File, Server: BLDG2">“LDAP Based smb.conf File, Server: BLDG2”</a>, 2229 2229 <a class="link" href="happy.html#sbehap-shareconfa" title="Example 5.10. LDAP Based smb.conf File, Shares Section Part A">“LDAP Based smb.conf File, Shares Section Part A”</a>, and <a class="link" href="happy.html#sbehap-shareconfb" title="Example 5.11. LDAP Based smb.conf File, Shares Section Part B">“LDAP Based smb.conf File, Shares Section Part B”</a> 2230 2230 into the <code class="filename">/etc/samba/</code> directory. The three files 2231 2231 should be added together to form the <code class="filename">smb.conf</code> file. 2232 </p></li><li ><p>2232 </p></li><li class="step" title="Step 2"><p> 2233 2233 Follow carefully the steps shown in <a class="link" href="happy.html#sbehap-bldg1" title="Samba-3 BDC Configuration">“Samba-3 BDC Configuration”</a>, starting at step 2. 2234 </p></li></ol></div><div class="example"><a name="sbehap-bldg1-smbconf"></a><p class="title"><b>Example 5.8. LDAP Based <code class="filename">smb.conf</code> File, Server: BLDG1</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2579369"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id2579381"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id2579393"></a><em class="parameter"><code>netbios name = BLDG1</code></em></td></tr><tr><td><a class="indexterm" name="id2579405"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2579417"></a><em class="parameter"><code>enable privileges = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2579429"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2579441"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2579452"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2579464"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2579476"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id2579487"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2579499"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2579511"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2579523"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2579535"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2579547"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2579559"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2579571"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2579582"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id2579594"></a><em class="parameter"><code>wins server = 172.16.0.1</code></em></td></tr><tr><td><a class="indexterm" name="id2579606"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2579618"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2579630"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2579642"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2579654"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2579666"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2579678"></a><em class="parameter"><code>idmap backend = ldap:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2579690"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2579702"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2579714"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2579725"></a><em class="parameter"><code>printer admin = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-bldg2-smbconf"></a><p class="title"><b>Example 5.9. LDAP Based <code class="filename">smb.conf</code> File, Server: BLDG2</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2579772"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id2579784"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id2579795"></a><em class="parameter"><code>netbios name = BLDG2</code></em></td></tr><tr><td><a class="indexterm" name="id2579807"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2579819"></a><em class="parameter"><code>enable privileges = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2579831"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2579843"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2579855"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2579866"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2579878"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id2579890"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2579902"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2579914"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2579926"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2579938"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2579950"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2579962"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2579973"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2579985"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id2579997"></a><em class="parameter"><code>wins server = 172.16.0.1</code></em></td></tr><tr><td><a class="indexterm" name="id2580008"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2580020"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2580032"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2580044"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2580056"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2580068"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2580080"></a><em class="parameter"><code>idmap backend = ldap:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2580093"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2580104"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2580116"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2580128"></a><em class="parameter"><code>printer admin = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-shareconfa"></a><p class="title"><b>Example 5.10. LDAP Based <code class="filename">smb.conf</code> File, Shares Section Part A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id2580174"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id2580186"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id2580198"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id2580218"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id2580230"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id2580241"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id2580262"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id2580274"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id2580285"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2580306"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2580318"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2580329"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2580341"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2580361"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2580373"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2580385"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2580396"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2580408"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-shareconfb"></a><p class="title"><b>Example 5.11. LDAP Based <code class="filename">smb.conf</code> File, Shares Section Part B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id2580454"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id2580466"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id2580477"></a><em class="parameter"><code>admin users = bjordan</code></em></td></tr><tr><td><a class="indexterm" name="id2580489"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2580509"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2580521"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2580533"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2580544"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2580565"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2580577"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2580589"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2580600"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id2580621"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id2580633"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id2580645"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2580656"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id2580677"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2580689"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2580700"></a><em class="parameter"><code>browseable = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2580712"></a><em class="parameter"><code>guest ok = no</code></em></td></tr><tr><td><a class="indexterm" name="id2580724"></a><em class="parameter"><code>read only = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2580735"></a><em class="parameter"><code>write list = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-ldifadd"></a><p class="title"><b>Example 5.12. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF</b></p><div class="example-contents"><pre class="screen">2234 </p></li></ol></div><div class="example"><a name="sbehap-bldg1-smbconf"></a><p class="title"><b>Example 5.8. LDAP Based <code class="filename">smb.conf</code> File, Server: BLDG1</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id348810"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id348821"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id348832"></a><em class="parameter"><code>netbios name = BLDG1</code></em></td></tr><tr><td><a class="indexterm" name="id348844"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id348856"></a><em class="parameter"><code>enable privileges = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id348867"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id348879"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id348890"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id348902"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id348913"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id348925"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id348936"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id348948"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id348959"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id348971"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id348982"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id348994"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id349006"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id349017"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id349028"></a><em class="parameter"><code>wins server = 172.16.0.1</code></em></td></tr><tr><td><a class="indexterm" name="id349040"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id349052"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id349063"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id349075"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id349086"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id349098"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id349110"></a><em class="parameter"><code>idmap backend = ldap:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id349122"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id349133"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id349144"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id349156"></a><em class="parameter"><code>printer admin = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-bldg2-smbconf"></a><p class="title"><b>Example 5.9. LDAP Based <code class="filename">smb.conf</code> File, Server: BLDG2</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id349201"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id349213"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id349224"></a><em class="parameter"><code>netbios name = BLDG2</code></em></td></tr><tr><td><a class="indexterm" name="id349236"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id349247"></a><em class="parameter"><code>enable privileges = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id349259"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id349270"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id349282"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id349293"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id349305"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id349316"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id349328"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id349339"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id349351"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id349362"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id349374"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id349386"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id349397"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id349409"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id349420"></a><em class="parameter"><code>wins server = 172.16.0.1</code></em></td></tr><tr><td><a class="indexterm" name="id349432"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id349443"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id349455"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id349466"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id349478"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id349490"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id349501"></a><em class="parameter"><code>idmap backend = ldap:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id349513"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id349525"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id349536"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id349548"></a><em class="parameter"><code>printer admin = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-shareconfa"></a><p class="title"><b>Example 5.10. LDAP Based <code class="filename">smb.conf</code> File, Shares Section Part A</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id349592"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id349604"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id349615"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id349635"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id349647"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id349658"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id349679"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id349690"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id349702"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id349722"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id349734"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id349745"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id349757"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id349777"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id349789"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id349800"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id349812"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id349823"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-shareconfb"></a><p class="title"><b>Example 5.11. LDAP Based <code class="filename">smb.conf</code> File, Shares Section Part B</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id349868"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id349879"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id349891"></a><em class="parameter"><code>admin users = bjordan</code></em></td></tr><tr><td><a class="indexterm" name="id349902"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id349922"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id349934"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id349946"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id349957"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id349978"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id349989"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id350001"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id350012"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id350032"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id350044"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id350056"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id350067"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id350088"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id350099"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id350111"></a><em class="parameter"><code>browseable = yes</code></em></td></tr><tr><td><a class="indexterm" name="id350122"></a><em class="parameter"><code>guest ok = no</code></em></td></tr><tr><td><a class="indexterm" name="id350134"></a><em class="parameter"><code>read only = yes</code></em></td></tr><tr><td><a class="indexterm" name="id350145"></a><em class="parameter"><code>write list = root, chrisr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbehap-ldifadd"></a><p class="title"><b>Example 5.12. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF</b></p><div class="example-contents"><pre class="screen"> 2235 2235 dn: ou=Idmap,dc=abmas,dc=biz 2236 2236 objectClass: organizationalUnit 2237 2237 ou: idmap 2238 2238 structuralObjectClass: organizationalUnit 2239 </pre></div></div><br class="example-break"></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2580771"></a>Miscellaneous Server Preparation Tasks</h2></div></div></div><p>2240 My father would say, “<span class="quote">Dinner is not over until the dishes have been done.</span>”2239 </pre></div></div><br class="example-break"></div><div class="sect1" title="Miscellaneous Server Preparation Tasks"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id350178"></a>Miscellaneous Server Preparation Tasks</h2></div></div></div><p> 2240 My father would say, <span class="quote">“<span class="quote">Dinner is not over until the dishes have been done.</span>”</span> 2241 2241 The makings of a great network environment take a lot of effort and attention to detail. 2242 2242 So far, you have completed most of the complex (and to many administrators, the interesting … … 2244 2244 a few more steps that must be completed so that your network runs like a well-rehearsed 2245 2245 orchestra. 2246 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2580791"></a>Configuring Directory Share Point Roots</h3></div></div></div><p>2246 </p><div class="sect2" title="Configuring Directory Share Point Roots"><div class="titlepage"><div><div><h3 class="title"><a name="id350194"></a>Configuring Directory Share Point Roots</h3></div></div></div><p> 2247 2247 In your <code class="filename">smb.conf</code> file, you have specified Windows shares. Each has a <em class="parameter"><code>path</code></em> 2248 2248 parameter. Even though it is obvious to all, one of the common Samba networking problems is … … 2262 2262 <code class="prompt">root# </code> chmod -R ug+rwx,o+rx-w /apps 2263 2263 </pre><p> 2264 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2580886"></a>Configuring Profile Directories</h3></div></div></div><p>2264 </p></div><div class="sect2" title="Configuring Profile Directories"><div class="titlepage"><div><div><h3 class="title"><a name="id350283"></a>Configuring Profile Directories</h3></div></div></div><p> 2265 2265 You made a conscious decision to do everything it would take to improve network client 2266 2266 performance. One of your decisions was to implement folder redirection. This means that Windows … … 2287 2287 </pre><p> 2288 2288 </p><p> 2289 <a class="indexterm" name="id 2581002"></a>2290 <a class="indexterm" name="id 2581009"></a>2289 <a class="indexterm" name="id350393"></a> 2290 <a class="indexterm" name="id350399"></a> 2291 2291 You have three options insofar as the dynamically loaded portion of the roaming profile 2292 2292 is concerned: 2293 </p><div class="itemizedlist"><ul type="disc"><li><p>You may permit the user to obtain a default profile.</p></li><li><p>You can create a mandatory profile.</p></li><li><p>You can create a group profile (which is almost always a mandatory profile).</p></li></ul></div><p>2293 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>You may permit the user to obtain a default profile.</p></li><li class="listitem"><p>You can create a mandatory profile.</p></li><li class="listitem"><p>You can create a group profile (which is almost always a mandatory profile).</p></li></ul></div><p> 2294 2294 Mandatory profiles cannot be overwritten by a user. The change from a user profile to a mandatory 2295 2295 profile is effected by renaming the <code class="filename">NTUSER.DAT</code> to <code class="filename">NTUSER.MAN</code>, 2296 2296 that is, just by changing the filename extension. 2297 2297 </p><p> 2298 <a class="indexterm" name="id 2581059"></a>2299 <a class="indexterm" name="id 2581066"></a>2298 <a class="indexterm" name="id350445"></a> 2299 <a class="indexterm" name="id350452"></a> 2300 2300 The location of the profile that a user can obtain is set in the user's account in the LDAP passdb backend. 2301 2301 You can manage this using the Idealx smbldap-tools or using the … … 2310 2310 <code class="prompt">root# </code> chmod 700 /var/lib/samba/profiles/<span class="emphasis"><em>username</em></span> 2311 2311 </pre><p> 2312 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2581130"></a>Preparation of Logon Scripts</h3></div></div></div><p>2313 <a class="indexterm" name="id 2581138"></a>2312 </p></div><div class="sect2" title="Preparation of Logon Scripts"><div class="titlepage"><div><div><h3 class="title"><a name="id350512"></a>Preparation of Logon Scripts</h3></div></div></div><p> 2313 <a class="indexterm" name="id350519"></a> 2314 2314 The use of a logon script with Windows XP Professional is an option that every site should consider. 2315 2315 Unless you have locked down the desktop so the user cannot change anything, there is risk that … … 2336 2336 Section 24.4. A quick Web search will bring up a host of options. One of the most popular logon 2337 2337 facilities in use today is called <a class="ulink" href="http://www.kixtart.org" target="_top">KiXtart</a>. 2338 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2581241"></a>Assigning User Rights and Privileges</h3></div></div></div><p>2338 </p></div><div class="sect2" title="Assigning User Rights and Privileges"><div class="titlepage"><div><div><h3 class="title"><a name="id350609"></a>Assigning User Rights and Privileges</h3></div></div></div><p> 2339 2339 The ability to perform tasks such as joining Windows clients to the domain can be assigned to 2340 2340 normal user accounts. By default, only the domain administrator account (<code class="constant">root</code> on UNIX … … 2348 2348 are granted rights can be restricted to particular machines. It is left to the network administrator 2349 2349 to determine which rights should be provided and to whom. 2350 </p><div class="procedure" ><a name="id2581277"></a><p class="title"><b>Procedure 5.12. Steps for Assignment of User Rights and Privileges</b></p><ol type="1"><li><p>2350 </p><div class="procedure" title="Procedure 5.12. Steps for Assignment of User Rights and Privileges"><a name="id350638"></a><p class="title"><b>Procedure 5.12. Steps for Assignment of User Rights and Privileges</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 2351 2351 Log onto the PDC as the <code class="constant">root</code> account. 2352 </p></li><li ><p>2352 </p></li><li class="step" title="Step 2"><p> 2353 2353 Execute the following command to grant the <code class="constant">Domain Admins</code> group all 2354 2354 rights and privileges: … … 2362 2362 Repeat this step on each domain controller, in each case substituting the name of the server 2363 2363 (e.g., BLDG1, BLDG2) in place of the PDC called MASSIVE. 2364 </p></li><li ><p>2364 </p></li><li class="step" title="Step 3"><p> 2365 2365 In this step the privilege will be granted to Bob Jordan (bobj) to add Windows workstations 2366 2366 to the domain. Execute the following only on the PDC. It is not necessary to do this on … … 2371 2371 Successfully granted rights. 2372 2372 </pre><p> 2373 </p></li><li ><p>2373 </p></li><li class="step" title="Step 4"><p> 2374 2374 Verify that privilege assignments have been correctly applied by executing: 2375 2375 </p><pre class="screen"> … … 2406 2406 SeDiskOperatorPrivilege 2407 2407 </pre><p> 2408 </p></li></ol></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2581375"></a>Windows Client Configuration</h2></div></div></div><p>2409 <a class="indexterm" name="id 2581383"></a>2408 </p></li></ol></div></div></div><div class="sect1" title="Windows Client Configuration"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id350723"></a>Windows Client Configuration</h2></div></div></div><p> 2409 <a class="indexterm" name="id350731"></a> 2410 2410 In the next few sections, you can configure a new Windows XP Professional disk image on a staging 2411 2411 machine. You will configure all software, printer settings, profile and policy handling, and desktop … … 2419 2419 Base Profile for All Users."</a> 2420 2420 2421 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="redirfold"></a>Configuration of Default Profile with Folder Redirection</h3></div></div></div><p>2422 <a class="indexterm" name="id 2581433"></a>2421 </p><div class="sect2" title="Configuration of Default Profile with Folder Redirection"><div class="titlepage"><div><div><h3 class="title"><a name="redirfold"></a>Configuration of Default Profile with Folder Redirection</h3></div></div></div><p> 2422 <a class="indexterm" name="id350774"></a> 2423 2423 Log onto the Windows XP Professional workstation as the local <code class="constant">Administrator</code>. 2424 2424 It is necessary to expose folders that are generally hidden to provide access to the 2425 2425 <code class="constant">Default User</code> folder. 2426 </p><div class="procedure" ><a name="id2581451"></a><p class="title"><b>Procedure 5.13. Expose Hidden Folders</b></p><ol type="1"><li><p>2426 </p><div class="procedure" title="Procedure 5.13. Expose Hidden Folders"><a name="id350791"></a><p class="title"><b>Procedure 5.13. Expose Hidden Folders</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 2427 2427 Launch the Windows Explorer by clicking 2428 2428 <span class="guimenu">Start</span> → <span class="guimenuitem">My Computer</span> → <span class="guimenuitem">Tools</span> → <span class="guimenuitem">Folder Options</span> → <span class="guimenuitem">View Tab</span>. 2429 2429 Select <span class="guilabel">Show hidden files and folders</span>, 2430 2430 and click <span class="guibutton">OK</span>. Exit Windows Explorer. 2431 </p></li><li ><p>2432 <a class="indexterm" name="id 2581518"></a>2431 </p></li><li class="step" title="Step 2"><p> 2432 <a class="indexterm" name="id350856"></a> 2433 2433 Launch the Registry Editor. Click 2434 2434 <span class="guimenu">Start</span> → <span class="guimenuitem">Run</span>. Key in <code class="literal">regedt32</code>, and click 2435 2435 <span class="guibutton">OK</span>. 2436 2436 </p></li></ol></div><p> 2437 </p><div class="procedure" ><a name="sbehap-rdrfldr"></a><p class="title"><b>Procedure 5.14. Redirect Folders in Default System User Profile</b></p><ol type="1"><li><p>2438 <a class="indexterm" name="id 2581576"></a>2439 <a class="indexterm" name="id 2581582"></a>2437 </p><div class="procedure" title="Procedure 5.14. Redirect Folders in Default System User Profile"><a name="sbehap-rdrfldr"></a><p class="title"><b>Procedure 5.14. Redirect Folders in Default System User Profile</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 2438 <a class="indexterm" name="id350912"></a> 2439 <a class="indexterm" name="id350919"></a> 2440 2440 Give focus to <code class="constant">HKEY_LOCAL_MACHINE</code> hive entry in the left panel. 2441 2441 Click <span class="guimenu">File</span> → <span class="guimenuitem">Load Hive...</span> → <span class="guimenuitem">Documents and Settings</span> → <span class="guimenuitem">Default User</span> → <span class="guimenuitem">NTUSER</span> → <span class="guimenuitem">Open</span>. In the dialog box that opens, enter the key name 2442 2442 <code class="constant">Default</code> and click <span class="guibutton">OK</span>. 2443 </p></li><li ><p>2443 </p></li><li class="step" title="Step 2"><p> 2444 2444 Browse inside the newly loaded Default folder to: 2445 2445 </p><pre class="screen"> … … 2448 2448 </pre><p> 2449 2449 The right panel reveals the contents as shown in <a class="link" href="happy.html#XP-screen001" title="Figure 5.3. Windows XP Professional User Shared Folders">“Windows XP Professional User Shared Folders”</a>. 2450 </p></li><li ><p>2451 <a class="indexterm" name="id 2581675"></a>2452 <a class="indexterm" name="id 2581682"></a>2450 </p></li><li class="step" title="Step 3"><p> 2451 <a class="indexterm" name="id351008"></a> 2452 <a class="indexterm" name="id351015"></a> 2453 2453 You edit hive keys. Acceptable values to replace the 2454 2454 <code class="constant">%USERPROFILE%</code> variable includes: 2455 2455 2456 </p><div class="itemizedlist"><ul type="disc"><li><p>A drive letter such as <code class="constant">U:</code></p></li><li><p>A direct network path such as2457 <code class="constant">\\MASSIVE\profdata</code></p></li><li ><p>A network redirection (UNC name) that contains a macro such as </p><p><code class="constant">%LOGONSERVER%\profdata\</code></p></li></ul></div><p>2458 </p></li><li ><p>2459 <a class="indexterm" name="id 2581729"></a>2456 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>A drive letter such as <code class="constant">U:</code></p></li><li class="listitem"><p>A direct network path such as 2457 <code class="constant">\\MASSIVE\profdata</code></p></li><li class="listitem"><p>A network redirection (UNC name) that contains a macro such as </p><p><code class="constant">%LOGONSERVER%\profdata\</code></p></li></ul></div><p> 2458 </p></li><li class="step" title="Step 4"><p> 2459 <a class="indexterm" name="id351059"></a> 2460 2460 Set the registry keys as shown in <a class="link" href="happy.html#proffold" title="Table 5.4. Default Profile Redirections">“Default Profile Redirections”</a>. Your implementation makes the assumption 2461 2461 that users have statically located machines. Notebook computers (mobile users) need to be 2462 2462 accommodated using local profiles. This is not an uncommon assumption. 2463 </p></li><li ><p>2463 </p></li><li class="step" title="Step 5"><p> 2464 2464 Click back to the root of the loaded hive <code class="constant">Default</code>. 2465 2465 Click <span class="guimenu">File</span> → <span class="guimenuitem">Unload Hive...</span> → <span class="guimenuitem">Yes</span>. 2466 </p></li><li ><p>2467 <a class="indexterm" name="id 2581784"></a>2466 </p></li><li class="step" title="Step 6"><p> 2467 <a class="indexterm" name="id351112"></a> 2468 2468 Click <span class="guimenu">File</span> → <span class="guimenuitem">Exit</span>. This exits the 2469 2469 Registry Editor. 2470 </p></li><li ><p>2470 </p></li><li class="step" title="Step 7"><p> 2471 2471 Now follow the procedure given in <a class="link" href="happy.html#sbehap-locgrppol" title="The Local Group Policy">“The Local Group Policy”</a>. Make sure that each folder you 2472 2472 have redirected is in the exclusion list. 2473 </p></li><li ><p>2474 You are now ready to copy<sup>[<a name="id 2581828" href="#ftn.id2581828" class="footnote">11</a>]</sup>2473 </p></li><li class="step" title="Step 8"><p> 2474 You are now ready to copy<sup>[<a name="id351153" href="#ftn.id351153" class="footnote">11</a>]</sup> 2475 2475 the Default User profile to the Samba domain controllers. Launch Microsoft Windows Explorer, 2476 2476 and use it to copy the full contents of the directory <code class="filename">Default User</code> that … … 2483 2483 desktop behavior should be returned to the original Microsoft settings. The following steps achieve 2484 2484 that ojective: 2485 </p><div class="procedure" ><a name="id2581895"></a><p class="title"><b>Procedure 5.15. Reset Folder Display to Original Behavior</b></p><ul><li><p>2485 </p><div class="procedure" title="Procedure 5.15. Reset Folder Display to Original Behavior"><a name="id351213"></a><p class="title"><b>Procedure 5.15. Reset Folder Display to Original Behavior</b></p><ul class="procedure"><li class="step" title="Step 1"><p> 2486 2486 To launch the Windows Explorer, click 2487 2487 <span class="guimenu">Start</span> → <span class="guimenuitem">My Computer</span> → <span class="guimenuitem">Tools</span> → <span class="guimenuitem">Folder Options</span> → <span class="guimenuitem">View Tab</span>. 2488 2488 Deselect <span class="guilabel">Show hidden files and folders</span>, and click <span class="guibutton">OK</span>. 2489 2489 Exit Windows Explorer. 2490 </p></li></ul></div><div class="figure"><a name="XP-screen001"></a><p class="title"><b>Figure 5.3. Windows XP Professional User Shared Folders</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/XP-screen001.png" width="351" alt="Windows XP Professional User Shared Folders"></div></div></div><br class="figure-break"><div class="table"><a name="proffold"></a><p class="title"><b>Table 5.4. Default Profile Redirections</b></p><div class="table-contents"><table summary="Default Profile Redirections" border="1"><colgroup><col align="left"><col align="left"></colgroup><thead><tr><th align="left">Registry Key</th><th align="left">Redirected Value</th></tr></thead><tbody><tr><td align="left">Cache</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\InternetFiles</td></tr><tr><td align="left">Cookies</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\Cookies</td></tr><tr><td align="left">History</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\History</td></tr><tr><td align="left">Local AppData</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\AppData</td></tr><tr><td align="left">Local Settings</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\LocalSettings</td></tr><tr><td align="left">My Pictures</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\MyPictures</td></tr><tr><td align="left">Personal</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\MyDocuments</td></tr><tr><td align="left">Recent</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\Recent</td></tr></tbody></table></div></div><br class="table-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2582129"></a>Configuration of MS Outlook to Relocate PST File</h3></div></div></div><p>2491 <a class="indexterm" name="id 2582138"></a>2492 <a class="indexterm" name="id 2582147"></a>2490 </p></li></ul></div><div class="figure"><a name="XP-screen001"></a><p class="title"><b>Figure 5.3. Windows XP Professional User Shared Folders</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/XP-screen001.png" width="351" alt="Windows XP Professional User Shared Folders"></div></div></div><br class="figure-break"><div class="table"><a name="proffold"></a><p class="title"><b>Table 5.4. Default Profile Redirections</b></p><div class="table-contents"><table summary="Default Profile Redirections" border="1"><colgroup><col align="left"><col align="left"></colgroup><thead><tr><th align="left">Registry Key</th><th align="left">Redirected Value</th></tr></thead><tbody><tr><td align="left">Cache</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\InternetFiles</td></tr><tr><td align="left">Cookies</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\Cookies</td></tr><tr><td align="left">History</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\History</td></tr><tr><td align="left">Local AppData</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\AppData</td></tr><tr><td align="left">Local Settings</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\LocalSettings</td></tr><tr><td align="left">My Pictures</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\MyPictures</td></tr><tr><td align="left">Personal</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\MyDocuments</td></tr><tr><td align="left">Recent</td><td align="left">%LOGONSERVER%\profdata\%USERNAME%\Recent</td></tr></tbody></table></div></div><br class="table-break"></div><div class="sect2" title="Configuration of MS Outlook to Relocate PST File"><div class="titlepage"><div><div><h3 class="title"><a name="id351441"></a>Configuration of MS Outlook to Relocate PST File</h3></div></div></div><p> 2491 <a class="indexterm" name="id351449"></a> 2492 <a class="indexterm" name="id351458"></a> 2493 2493 Microsoft Outlook can store a Personal Storage file, generally known as a PST file. 2494 2494 It is the nature of email storage that this file grows, at times quite rapidly. … … 2499 2499 To redirect the Outlook PST file in Outlook 2003 (older versions of Outlook behave 2500 2500 slightly differently), follow these steps: 2501 </p><div class="procedure" ><a name="id2582170"></a><p class="title"><b>Procedure 5.16. Outlook PST File Relocation</b></p><ol type="1"><li><p>2501 </p><div class="procedure" title="Procedure 5.16. Outlook PST File Relocation"><a name="id351476"></a><p class="title"><b>Procedure 5.16. Outlook PST File Relocation</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 2502 2502 Close Outlook if it is open. 2503 </p></li><li ><p>2503 </p></li><li class="step" title="Step 2"><p> 2504 2504 From the <span class="guimenu">Control Panel</span>, launch the Mail icon. 2505 </p></li><li ><p>2505 </p></li><li class="step" title="Step 3"><p> 2506 2506 Click <span class="guimenu">Email Accounts.</span> 2507 </p></li><li ><p>2507 </p></li><li class="step" title="Step 4"><p> 2508 2508 Make a note of the location of the PST file(s). From this location, move 2509 2509 the files to the desired new target location. The most desired new target location 2510 2510 may well be the users' home directory. 2511 </p></li><li ><p>2511 </p></li><li class="step" title="Step 5"><p> 2512 2512 Add a new data file, selecting the PST file in the new desired target location. 2513 Give this entry (not the filename) a new name such as “<span class="quote">Personal Mail Folders.</span>”2513 Give this entry (not the filename) a new name such as <span class="quote">“<span class="quote">Personal Mail Folders.</span>”</span> 2514 2514 </p><p> 2515 2515 Note: If MS Outlook has been configured to use an IMAP account configuration there may be problems … … 2519 2519 used please email <code class="literal">jht@samba.org</code> with useful tips and suggestions so that 2520 2520 this warning can be removed or modified. 2521 </p></li><li ><p>2521 </p></li><li class="step" title="Step 6"><p> 2522 2522 Close the <span class="guimenu">Date Files</span> windows, then click <span class="guimenu">Email Accounts</span>. 2523 </p></li><li ><p>2523 </p></li><li class="step" title="Step 7"><p> 2524 2524 Select <span class="guimenu">View of Change</span> exiting email accounts, click <span class="guibutton">Next.</span> 2525 </p></li><li ><p>2525 </p></li><li class="step" title="Step 8"><p> 2526 2526 Change the <span class="guimenu">Mail Delivery Location</span> so as to use the data file in the new 2527 2527 target location. 2528 </p></li><li ><p>2528 </p></li><li class="step" title="Step 9"><p> 2529 2529 Go back to the <span class="guimenu">Data Files</span> window, then delete the old data file entry. 2530 </p></li></ol></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>2531 <a class="indexterm" name="id 2582319"></a>2530 </p></li></ol></div><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 2531 <a class="indexterm" name="id351615"></a> 2532 2532 You may have to remove and reinstall the Outlook Address Book (Contacts) entries, otherwise 2533 2533 the user may be not be able to retrieve contacts when addressing a new email message. 2534 </p></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>2535 <a class="indexterm" name="id 2582334"></a>2534 </p></div><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 2535 <a class="indexterm" name="id351628"></a> 2536 2536 Outlook Express is not at all like MS OutLook. It stores file very differently also. Outlook 2537 2537 Express storage files can not be redirected to network shares. The options panel will not permit … … 2542 2542 registry, experience has shown that data corruption and loss of email messages will result. 2543 2543 </p><p> 2544 <a class="indexterm" name="id 2582357"></a>2545 <a class="indexterm" name="id 2582364"></a>2544 <a class="indexterm" name="id351646"></a> 2545 <a class="indexterm" name="id351653"></a> 2546 2546 In the same vane as MS Outlook, Outlook Express data stores can become very large. When used with 2547 2547 roaming profiles this can result in excruciatingly long login and logout behavior will files are … … 2549 2549 profiles are used. 2550 2550 </p></div><p> 2551 <a class="indexterm" name="id 2582379"></a>2551 <a class="indexterm" name="id351665"></a> 2552 2552 Microsoft does not support storing PST files on network shares, although the practice does appear 2553 2553 to be rather popular. Anyone who does relocation the PST file to a network resource should refer … … 2555 2555 understand the issues. 2556 2556 </p><p> 2557 <a class="indexterm" name="id 2582400"></a>2557 <a class="indexterm" name="id351684"></a> 2558 2558 Apart from manually moving PST files to a network share, it is possible to set the default PST 2559 2559 location for new accounts by following the instructions at the WindowsITPro <a class="ulink" href="http://www.windowsitpro.com/Windows/Article/ArticleID/48228/48228.html" target="_top">web</a> site. 2560 2560 </p><p> 2561 <a class="indexterm" name="id 2582420"></a>2561 <a class="indexterm" name="id351701"></a> 2562 2562 User feedback suggests that disabling of oplocks on PST files will significantly improve 2563 2563 network performance by reducing locking overheads. One way this can be done is to add to the … … 2566 2566 veto oplock files = /*.pdf/*.PST/ 2567 2567 </pre><p> 2568 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2582445"></a>Configure Delete Cached Profiles on Logout</h3></div></div></div><p>2568 </p></div><div class="sect2" title="Configure Delete Cached Profiles on Logout"><div class="titlepage"><div><div><h3 class="title"><a name="id351724"></a>Configure Delete Cached Profiles on Logout</h3></div></div></div><p> 2569 2569 Configure the Windows XP Professional client to auto-delete roaming profiles on logout: 2570 2570 </p><p> 2571 <a class="indexterm" name="id 2582458"></a>2571 <a class="indexterm" name="id351736"></a> 2572 2572 Click 2573 2573 <span class="guimenu">Start</span> → <span class="guimenuitem">Run</span>. In the dialog box, enter <code class="literal">MMC</code> and click <span class="guibutton">OK</span>. … … 2577 2577 <span class="guimenu">File</span> → <span class="guimenuitem">Add/Remove Snap-in</span> → <span class="guimenuitem">Add</span> → <span class="guimenuitem">Group Policy</span> → <span class="guimenuitem">Add</span> → <span class="guimenuitem">Finish</span> → <span class="guimenuitem">Close</span> → <span class="guimenuitem">OK</span>. 2578 2578 </p><p> 2579 <a class="indexterm" name="id 2582554"></a>2579 <a class="indexterm" name="id351830"></a> 2580 2580 The Microsoft Management Console now shows the <span class="guimenu">Group Policy</span> 2581 2581 utility that enables you to set the policies needed. In the left panel, click 2582 2582 <span class="guimenuitem">Local Computer Policy</span> → <span class="guimenuitem">Administrative Templates</span> → <span class="guimenuitem">System</span> → <span class="guimenuitem">User Profiles</span>. In the right panel, set the properties shown here by double-clicking on each 2583 2583 item as shown: 2584 </p><div class="itemizedlist"><ul type="disc"><li><p>Do not check for user ownership of Roaming Profile Folders = Enabled</p></li><li><p>Delete cached copies of roaming profiles = Enabled</p></li></ul></div><p>2584 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Do not check for user ownership of Roaming Profile Folders = Enabled</p></li><li class="listitem"><p>Delete cached copies of roaming profiles = Enabled</p></li></ul></div><p> 2585 2585 Close the Microsoft Management Console. The settings take immediate effect and persist onto all image copies 2586 2586 made of this system to deploy the new standard desktop system. 2587 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2582625"></a>Uploading Printer Drivers to Samba Servers</h3></div></div></div><p>2588 <a class="indexterm" name="id 2582633"></a>2587 </p></div><div class="sect2" title="Uploading Printer Drivers to Samba Servers"><div class="titlepage"><div><div><h3 class="title"><a name="id351896"></a>Uploading Printer Drivers to Samba Servers</h3></div></div></div><p> 2588 <a class="indexterm" name="id351904"></a> 2589 2589 Users want to be able to use network printers. You have a vested interest in making 2590 2590 it easy for them to print. You have chosen to install the printer drivers onto the Samba … … 2593 2593 print to the printer chosen. The following procedure must be followed for every network 2594 2594 printer: 2595 </p><div class="procedure" ><a name="id2582651"></a><p class="title"><b>Procedure 5.17. Steps to Install Printer Drivers on the Samba Servers</b></p><ol type="1"><li><p>2595 </p><div class="procedure" title="Procedure 5.17. Steps to Install Printer Drivers on the Samba Servers"><a name="id351918"></a><p class="title"><b>Procedure 5.17. Steps to Install Printer Drivers on the Samba Servers</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 2596 2596 Join your Windows XP Professional workstation (the staging machine) to the 2597 2597 <code class="constant">MEGANET2</code> domain. If you are not sure of the procedure, 2598 2598 follow the guidance given in <a class="link" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">“A Collection of Useful Tidbits”</a>, <a class="link" href="appendix.html#domjoin" title="Joining a Domain: Windows 200x/XP Professional">“Joining a Domain: Windows 200x/XP Professional”</a>. 2599 </p></li><li ><p>2599 </p></li><li class="step" title="Step 2"><p> 2600 2600 After the machine has rebooted, log onto the workstation as the domain 2601 2601 <code class="constant">root</code> (this is the Administrator account for the 2602 2602 operating system that is the host platform for this implementation of Samba. 2603 </p></li><li ><p>2603 </p></li><li class="step" title="Step 3"><p> 2604 2604 Launch MS Windows Explorer. Navigate in the left panel. Click 2605 2605 <span class="guimenu">My Network Places</span> → <span class="guimenuitem">Entire Network</span> → <span class="guimenuitem">Microsoft Windows Network</span> → <span class="guimenuitem">Meganet2</span> → <span class="guimenuitem">Massive</span>. Click on <span class="guimenu">Massive</span> 2606 2606 <span class="guimenu">Printers and Faxes</span>. 2607 </p></li><li ><p>2607 </p></li><li class="step" title="Step 4"><p> 2608 2608 Identify a printer that is shown in the right panel. Let us assume the printer is called 2609 2609 <code class="constant">ps01-color</code>. Right-click on the <span class="guimenu">ps01-color</span> icon 2610 2610 and select the <span class="guimenu">Properties</span> entry. This opens a dialog box that indicates 2611 that “<span class="quote">The printer driver is not installed on this computer. Some printer properties2611 that <span class="quote">“<span class="quote">The printer driver is not installed on this computer. Some printer properties 2612 2612 will not be accessible unless you install the printer driver. Do you want to install the 2613 driver now?</span>” It is important at this point you answer <span class="guimenu">No</span>.2614 </p></li><li ><p>2613 driver now?</span>”</span> It is important at this point you answer <span class="guimenu">No</span>. 2614 </p></li><li class="step" title="Step 5"><p> 2615 2615 The printer properties panel for the <span class="guimenu">ps01-color</span> printer on the server 2616 2616 <code class="constant">MASSIVE</code> is displayed. Click the <span class="guimenu">Advanced</span> tab. 2617 2617 Note that the box labeled <span class="guimenu">Driver</span> is empty. Click the <span class="guimenu">New Driver</span> 2618 button that is next to the <span class="guimenu">Driver</span> box. This launches the “<span class="quote">Add Printer Wizard</span>”.2619 </p></li><li ><p>2620 <a class="indexterm" name="id 2582840"></a>2621 <a class="indexterm" name="id 2582849"></a>2622 The “<span class="quote">Add Printer Driver Wizard on <code class="constant">MASSIVE</code></span>”panel2618 button that is next to the <span class="guimenu">Driver</span> box. This launches the <span class="quote">“<span class="quote">Add Printer Wizard</span>”</span>. 2619 </p></li><li class="step" title="Step 6"><p> 2620 <a class="indexterm" name="id352097"></a> 2621 <a class="indexterm" name="id352106"></a> 2622 The <span class="quote">“<span class="quote">Add Printer Driver Wizard on <code class="constant">MASSIVE</code></span>”</span> panel 2623 2623 is now presented. Click <span class="guimenu">Next</span> to continue. From the left panel, select the 2624 2624 printer manufacturer. In your case, you are adding a driver for a printer manufactured by … … 2627 2627 progress bar appears and instructs you as each file is being uploaded and that it is being 2628 2628 directed at the network server <code class="constant">\\massive\ps01-color</code>. 2629 </p></li><li ><p>2630 <a class="indexterm" name="id 2582898"></a>2631 <a class="indexterm" name="id 2582907"></a>2632 <a class="indexterm" name="id 2582916"></a>2633 <a class="indexterm" name="id 2582925"></a>2634 <a class="indexterm" name="id 2582934"></a>2635 <a class="indexterm" name="id 2582944"></a>2629 </p></li><li class="step" title="Step 7"><p> 2630 <a class="indexterm" name="id352150"></a> 2631 <a class="indexterm" name="id352160"></a> 2632 <a class="indexterm" name="id352169"></a> 2633 <a class="indexterm" name="id352178"></a> 2634 <a class="indexterm" name="id352187"></a> 2635 <a class="indexterm" name="id352196"></a> 2636 2636 The driver upload completes in anywhere from a few seconds to a few minutes. When it completes, 2637 2637 you are returned to the <span class="guimenu">Advanced</span> tab in the <span class="guimenu">Properties</span> panel. 2638 2638 You can set the Location (under the <span class="guimenu">General</span> tab) and Security settings (under 2639 2639 the <span class="guimenu">Security</span> tab). Under the <span class="guimenu">Sharing</span> tab it is possible to 2640 load additional printer drivers; there is also a check-box in this tab called “<span class="quote">List in the2641 directory</span>” . When this box is checked, the printer will be published in Active Directory2640 load additional printer drivers; there is also a check-box in this tab called <span class="quote">“<span class="quote">List in the 2641 directory</span>”</span>. When this box is checked, the printer will be published in Active Directory 2642 2642 (Applicable to Active Directory use only.) 2643 </p></li><li ><p>2644 <a class="indexterm" name="id 2582999"></a>2643 </p></li><li class="step" title="Step 8"><p> 2644 <a class="indexterm" name="id352247"></a> 2645 2645 Click <span class="guimenu">OK</span>. It will take a minute or so to upload the settings to the server. 2646 2646 You are now returned to the <span class="guimenu">Printers and Faxes on Massive</span> monitor. … … 2648 2648 your requirements. BE CERTAIN TO CHANGE AT LEAST ONE SETTING and apply the changes even if 2649 2649 you need to reverse the changes back to their original settings. 2650 </p></li><li ><p>2650 </p></li><li class="step" title="Step 9"><p> 2651 2651 This is necessary so that the printer settings are initialized in the Samba printers 2652 2652 database. Click <span class="guimenu">Apply</span> to commit your settings. Revert any settings you changed 2653 2653 just to initialize the Samba printers database entry for this printer. If you need to revert a setting, 2654 2654 click <span class="guimenu">Apply</span> again. 2655 </p></li><li ><p>2656 <a class="indexterm" name="id 2583072"></a>2655 </p></li><li class="step" title="Step 10"><p> 2656 <a class="indexterm" name="id352314"></a> 2657 2657 Verify that all printer settings are at the desired configuration. When you are satisfied that they are, 2658 2658 click the <span class="guimenu">General</span> tab. Now click the <span class="guimenu">Print Test Page</span> button. … … 2660 2660 in the panel that is newly presented. Click <span class="guimenu">OK</span> on the <span class="guimenu">ps01-color on 2661 2661 massive Properties</span> panel. 2662 </p></li><li ><p>2662 </p></li><li class="step" title="Step 11"><p> 2663 2663 You must repeat this process for all network printers (i.e., for every printer on each server). 2664 2664 When you have finished uploading drivers to all printers, close all applications. The next task 2665 2665 is to install software your users require to do their work. 2666 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2583127"></a>Software Installation</h3></div></div></div><p>2666 </p></li></ol></div></div><div class="sect2" title="Software Installation"><div class="titlepage"><div><div><h3 class="title"><a name="id352365"></a>Software Installation</h3></div></div></div><p> 2667 2667 Your network has both fixed desktop workstations as well as notebook computers. As a general rule, it is 2668 2668 a good idea to not tamper with the operating system that is provided by the notebook computer manufacturer. … … 2679 2679 and migrate that to the Samba server for later reuse when creating custom mandatory profiles, just in 2680 2680 case a user may have specific needs you had not anticipated. 2681 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2583163"></a>Roll-out Image Creation</h3></div></div></div><p>2681 </p></div><div class="sect2" title="Roll-out Image Creation"><div class="titlepage"><div><div><h3 class="title"><a name="id352391"></a>Roll-out Image Creation</h3></div></div></div><p> 2682 2682 The final steps before preparing the distribution Norton Ghost image file you might follow are: 2683 2683 </p><div class="blockquote"><blockquote class="blockquote"><p> … … 2688 2688 in better performance and often significantly reduces the size of the compressed disk image. That 2689 2689 also means it will take less time to deploy the image onto 500 workstations. 2690 </p></blockquote></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2583197"></a>Key Points Learned</h2></div></div></div><p>2690 </p></blockquote></div></div></div><div class="sect1" title="Key Points Learned"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id352420"></a>Key Points Learned</h2></div></div></div><p> 2691 2691 This chapter introduced many new concepts. Is it a sad fact that the example presented deliberately 2692 2692 avoided any consideration of security. Security does not just happen; you must design it into your total … … 2697 2697 of compromise. 2698 2698 </p><p> 2699 <a class="indexterm" name="id 2583218"></a>2700 <a class="indexterm" name="id 2583228"></a>2699 <a class="indexterm" name="id352437"></a> 2700 <a class="indexterm" name="id352445"></a> 2701 2701 As a minimum, the LDAP server must be protected by way of Access Control Lists (ACLs), and it must be 2702 2702 configured to use secure protocols for all communications over the network. Of course, secure networking … … 2709 2709 </p><p> 2710 2710 The substance of this chapter that has been deserving of particular attention includes: 2711 </p><div class="itemizedlist"><ul type="disc"><li><p>2711 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 2712 2712 Implementation of an OpenLDAP-based passwd backend, necessary to support distributed 2713 2713 domain control. 2714 </p></li><li ><p>2714 </p></li><li class="listitem"><p> 2715 2715 Implementation of Samba primary and secondary domain controllers with a common LDAP backend 2716 2716 for user and group accounts that is shared with the UNIX system through the PADL nss_ldap and 2717 2717 pam_ldap tool-sets. 2718 </p></li><li ><p>2718 </p></li><li class="listitem"><p> 2719 2719 Use of the Idealx smbldap-tools scripts for UNIX (POSIX) account management as well as 2720 2720 to manage Samba Windows user and group accounts. 2721 </p></li><li ><p>2721 </p></li><li class="listitem"><p> 2722 2722 The basics of implementation of Group Policy controls for Windows network clients. 2723 </p></li><li ><p>2723 </p></li><li class="listitem"><p> 2724 2724 Control over roaming profiles, with particular focus on folder redirection to network drives. 2725 </p></li><li ><p>2725 </p></li><li class="listitem"><p> 2726 2726 Use of the CUPS printing system together with Samba-based printer driver auto-download. 2727 </p></li></ul></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2583303"></a>Questions and Answers</h2></div></div></div><p>2727 </p></li></ul></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id352508"></a>Questions and Answers</h2></div></div></div><p> 2728 2728 Well, here we are at the end of this chapter and we have only ten questions to help you to 2729 2729 remember so much. There are bound to be some sticky issues here. 2730 </p><div class="qandaset" ><dl><dt> <a href="happy.html#id2583322">2730 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id352518"></a><dl><dt> <a href="happy.html#id352525"> 2731 2731 Why did you not cover secure practices? Isn't it rather irresponsible to instruct 2732 2732 network administrators to implement insecure solutions? 2733 </a></dt><dt> <a href="happy.html#id 2583366">2733 </a></dt><dt> <a href="happy.html#id352558"> 2734 2734 You have focused much on SUSE Linux and little on the market leader, Red Hat. Do 2735 2735 you have a problem with Red Hat Linux? Doesn't that make your guidance irrelevant 2736 2736 to the Linux I might be using? 2737 </a></dt><dt> <a href="happy.html#id 2583427">2737 </a></dt><dt> <a href="happy.html#id352600"> 2738 2738 You did not use SWAT to configure Samba. Is there something wrong with it? 2739 </a></dt><dt> <a href="happy.html#id 2583466">2739 </a></dt><dt> <a href="happy.html#id352635"> 2740 2740 You have exposed a well-used password not24get. Is that 2741 2741 not irresponsible? 2742 </a></dt><dt> <a href="happy.html#id 2583491">2742 </a></dt><dt> <a href="happy.html#id352657"> 2743 2743 The Idealx smbldap-tools create many domain group accounts that are not used. Is that 2744 2744 a good thing? 2745 </a></dt><dt> <a href="happy.html#id 2583518">2745 </a></dt><dt> <a href="happy.html#id352681"> 2746 2746 Can I use LDAP just for Samba accounts and not for UNIX system accounts? 2747 </a></dt><dt> <a href="happy.html#id 2583543">2747 </a></dt><dt> <a href="happy.html#id352701"> 2748 2748 Why are the Windows domain RID portions not the same as the UNIX UID? 2749 </a></dt><dt> <a href="happy.html#id 2583579">2749 </a></dt><dt> <a href="happy.html#id352732"> 2750 2750 Printer configuration examples all show printing to the HP port 9100. Does this 2751 2751 mean that I must have HP printers for these solutions to work? 2752 </a></dt><dt> <a href="happy.html#id 2583608">2752 </a></dt><dt> <a href="happy.html#id352757"> 2753 2753 Is folder redirection dangerous? I've heard that you can lose your data that way. 2754 </a></dt><dt> <a href="happy.html#id 2583635">2754 </a></dt><dt> <a href="happy.html#id352779"> 2755 2755 Is it really necessary to set a local Group Policy to exclude the redirected 2756 2756 folders from the roaming profile? 2757 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2583322"></a><a name="id2583324"></a></td><td align="left" valign="top"><p>2757 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id352525"></a><a name="id352527"></a></td><td align="left" valign="top"><p> 2758 2758 Why did you not cover secure practices? Isn't it rather irresponsible to instruct 2759 2759 network administrators to implement insecure solutions? … … 2774 2774 that you should implement a network without provision for data recovery and for disaster 2775 2775 management? Back to our focus: The deployment of Samba has been clearly demonstrated. 2776 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2583366"></a><a name="id2583368"></a></td><td align="left" valign="top"><p>2776 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id352558"></a><a name="id352561"></a></td><td align="left" valign="top"><p> 2777 2777 You have focused much on SUSE Linux and little on the market leader, Red Hat. Do 2778 2778 you have a problem with Red Hat Linux? Doesn't that make your guidance irrelevant … … 2801 2801 features of both products (companies also). No bias in presentation is intended. 2802 2802 Oh, before I forget, I particularly like Debian Linux; that is my favorite playground. 2803 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2583427"></a><a name="id2583429"></a></td><td align="left" valign="top"><p>2803 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id352600"></a><a name="id352603"></a></td><td align="left" valign="top"><p> 2804 2804 You did not use SWAT to configure Samba. Is there something wrong with it? 2805 2805 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 2812 2812 and insecure. Many will not touch it with a barge-pole. By not introducing SWAT, I 2813 2813 hope to have brought their interests on board. SWAT is well covered is <span class="emphasis"><em>TOSHARG2</em></span>. 2814 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2583466"></a><a name="id2583468"></a></td><td align="left" valign="top"><p>2814 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id352635"></a><a name="id352637"></a></td><td align="left" valign="top"><p> 2815 2815 You have exposed a well-used password <span class="emphasis"><em>not24get</em></span>. Is that 2816 2816 not irresponsible? … … 2819 2819 used throughout. I guess you can figure out that in a real deployment it would make 2820 2820 sense to use a more secure and original password. 2821 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2583491"></a><a name="id2583493"></a></td><td align="left" valign="top"><p>2821 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id352657"></a><a name="id352660"></a></td><td align="left" valign="top"><p> 2822 2822 The Idealx smbldap-tools create many domain group accounts that are not used. Is that 2823 2823 a good thing? … … 2827 2827 and, besides, it does no harm to create accounts that are not now used at some time 2828 2828 Samba may well use them. 2829 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2583518"></a><a name="id2583520"></a></td><td align="left" valign="top"><p>2829 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id352681"></a><a name="id352683"></a></td><td align="left" valign="top"><p> 2830 2830 Can I use LDAP just for Samba accounts and not for UNIX system accounts? 2831 2831 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 2835 2835 password files in sync? I think that having everything in LDAP makes a lot of sense 2836 2836 for the UNIX administrator who is still learning the craft and is migrating from MS Windows. 2837 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2583543"></a><a name="id2583545"></a></td><td align="left" valign="top"><p>2837 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id352701"></a><a name="id352703"></a></td><td align="left" valign="top"><p> 2838 2838 Why are the Windows domain RID portions not the same as the UNIX UID? 2839 2839 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 2844 2844 permit you to override that to some extent. See the <code class="filename">smb.conf</code> man page entry 2845 2845 for <em class="parameter"><code>algorithmic rid base</code></em>. 2846 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2583579"></a><a name="id2583581"></a></td><td align="left" valign="top"><p>2846 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id352732"></a><a name="id352735"></a></td><td align="left" valign="top"><p> 2847 2847 Printer configuration examples all show printing to the HP port 9100. Does this 2848 2848 mean that I must have HP printers for these solutions to work? … … 2854 2854 argument to the <code class="constant">lpadmin -v</code> option that is right for your 2855 2855 printer. 2856 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2583608"></a><a name="id2583610"></a></td><td align="left" valign="top"><p>2856 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id352757"></a><a name="id352759"></a></td><td align="left" valign="top"><p> 2857 2857 Is folder redirection dangerous? I've heard that you can lose your data that way. 2858 2858 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 2864 2864 folder. That was not the case, so by declining to move the data back, he wiped out 2865 2865 the data. You cannot hold the tool responsible for that. Caveat emptor still applies. 2866 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2583635"></a><a name="id2583637"></a></td><td align="left" valign="top"><p>2866 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id352779"></a><a name="id352781"></a></td><td align="left" valign="top"><p> 2867 2867 Is it really necessary to set a local Group Policy to exclude the redirected 2868 2868 folders from the roaming profile? … … 2870 2870 Yes. If you do not do this, the data will still be copied from the network folder 2871 2871 (share) to the local cached copy of the profile. 2872 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id 2581828" href="#id2581828" class="para">11</a>] </sup>2872 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id351153" href="#id351153" class="para">11</a>] </sup> 2873 2873 There is an alternate method by which a default user profile can be added to the 2874 2874 <code class="constant">NETLOGON</code> share. This facility in the Windows System tool -
trunk/server/docs/htmldocs/Samba3-ByExample/index.html
r414 r599 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Samba-3 by Example</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 4.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="next" href="pr01.html" title="About the Cover Artwork"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Samba-3 by Example</th></tr><tr><td width="20%" align="left"> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="pr01.html">Next</a></td></tr></table><hr></div><div class="book" lang="en"><div class="titlepage"><div><div><h1 class="title"><a name="S3bE"></a>Samba-3 by Example</h1></div><div><h2 class="subtitle">Practical Exercises in Successful Samba Deployment</h2></div><div><div class="authorgroup"><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="orgname">Samba Team</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div></div><div><p class="pubdate">July, 2006</p></div></div><hr></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="preface"><a href="pr01.html">About the Cover Artwork</a></span></dt><dt><span class="preface"><a href="pr02.html">Acknowledgments</a></span></dt><dt><span class="preface"><a href="pr03.html">Foreword</a></span></dt><dd><dl><dt><span class="sect1"><a href="pr03.html#id2501062">By John M. Weathersby, Executive Director, OSSI</a></span></dt></dl></dd><dt><span class="preface"><a href="preface.html">Preface</a></span></dt><dd><dl><dt><span class="sect1"><a href="preface.html#id2501251">Why Is This Book Necessary?</a></span></dt><dd><dl><dt><span class="sect2"><a href="preface.html#id2498970">Samba 3.0.20 Update Edition</a></span></dt></dl></dd><dt><span class="sect1"><a href="preface.html#id2498857">Prerequisites</a></span></dt><dt><span class="sect1"><a href="preface.html#id2498889">Approach</a></span></dt><dt><span class="sect1"><a href="preface.html#id2498954">Summary of Topics</a></span></dt><dt><span class="sect1"><a href="preface.html#id2550647">Conventions Used</a></span></dt></dl></dd><dt><span class="part"><a href="ExNetworks.html">I. Example Network Configurations</a></span></dt><dd><dl><dt><span class="chapter"><a href="simple.html">1. No-Frills Samba Servers</a></span></dt><dd><dl><dt><span class="sect1"><a href="simple.html#id2550843">Introduction</a></span></dt><dt><span class="sect1"><a href="simple.html#id2550883">Assignment Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="simple.html#id2550925">Drafting Office</a></span></dt><dt><span class="sect2"><a href="simple.html#id2551634">Charity Administration Office</a></span></dt><dt><span class="sect2"><a href="simple.html#AccountingOffice">Accounting Office</a></span></dt></dl></dd><dt><span class="sect1"><a href="simple.html#id2554969">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="small.html">2. Small Office Networking</a></span></dt><dd><dl><dt><span class="sect1"><a href="small.html#id2555439">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2555462">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2555522">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2555570">Technical Issues</a></span></dt><dt><span class="sect2"><a href="small.html#id2555768">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2555790">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2557337">Validation</a></span></dt><dt><span class="sect2"><a href="small.html#id2557985">Notebook Computers: A Special Case</a></span></dt><dt><span class="sect2"><a href="small.html#id2558010">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2558084">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="secure.html">3. Secure Office Networking</a></span></dt><dd><dl><dt><span class="sect1"><a href="secure.html#id2558563">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id2558614">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2558848">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id2558863">Technical Issues</a></span></dt><dt><span class="sect2"><a href="secure.html#id2559289">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2559329">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#ch4bsc">Basic System Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id2560183">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4ptrcfg">Printer Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4valid">Validation</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4appscfg">Application Share Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id2564645">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2564707">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="Big500users.html">4. The 500-User Office</a></span></dt><dd><dl><dt><span class="sect1"><a href="Big500users.html#id2565229">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id2565274">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id2565373">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id2565409">Technical Issues</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2565612">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id2565635">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#ch5-dnshcp-setup">Installation of DHCP, DNS, and Samba Control Files</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2566362">Server Preparation: All Servers</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2566927">Server-Specific Preparation</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5-procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id2570125">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id2570184">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="happy.html">5. Making Happy Users</a></span></dt><dd><dl><dt><span class="sect1"><a href="happy.html#id2571022">Regarding LDAP Directories and Windows Computer Accounts</a></span></dt><dt><span class="sect1"><a href="happy.html#id2571164">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id2571262">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2571399">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id2571856">Technical Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id2573730">Political Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id2573745">Installation Checklist</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2573925">Samba Server Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbeidealx">Install and Configure Idealx smbldap-tools Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id2576821">LDAP Initialization and Creation of User and Group Accounts</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-ptrcfg">Printer Configuration</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a></span></dt><dt><span class="sect1"><a href="happy.html#id2580771">Miscellaneous Server Preparation Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id2580791">Configuring Directory Share Point Roots</a></span></dt><dt><span class="sect2"><a href="happy.html#id2580886">Configuring Profile Directories</a></span></dt><dt><span class="sect2"><a href="happy.html#id2581130">Preparation of Logon Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id2581241">Assigning User Rights and Privileges</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2581375">Windows Client Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></span></dt><dt><span class="sect2"><a href="happy.html#id2582129">Configuration of MS Outlook to Relocate PST File</a></span></dt><dt><span class="sect2"><a href="happy.html#id2582445">Configure Delete Cached Profiles on Logout</a></span></dt><dt><span class="sect2"><a href="happy.html#id2582625">Uploading Printer Drivers to Samba Servers</a></span></dt><dt><span class="sect2"><a href="happy.html#id2583127">Software Installation</a></span></dt><dt><span class="sect2"><a href="happy.html#id2583163">Roll-out Image Creation</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id2583197">Key Points Learned</a></span></dt><dt><span class="sect1"><a href="happy.html#id2583303">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="net2000users.html">6. A Distributed 2000-User Network</a></span></dt><dd><dl><dt><span class="sect1"><a href="net2000users.html#id2583726">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id2583756">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id2583824">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id2584098">Technical Issues</a></span></dt><dt><span class="sect2"><a href="net2000users.html#id2585046">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id2585064">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id2588223">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id2588370">Questions and Answers</a></span></dt></dl></dd></dl></dd><dt><span class="part"><a href="DMSMig.html">II. Domain Members, Updating Samba and Migration</a></span></dt><dd><dl><dt><span class="chapter"><a href="unixclients.html">7. Adding Domain Member Servers and Clients</a></span></dt><dd><dl><dt><span class="sect1"><a href="unixclients.html#id2589228">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id2589282">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id2589317">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id2589345">Technical Issues</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id2589994">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id2590094">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></span></dt><dt><span class="sect2"><a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></span></dt><dt><span class="sect2"><a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a></span></dt><dt><span class="sect2"><a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id2596343">UNIX/Linux Client Domain Member</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id2596918">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id2596972">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="upgrades.html">8. Updating Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="upgrades.html#id2598125">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id2598221">Cautions and Notes</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id2599550">Upgrading from Samba 1.x and 2.x to Samba-3</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2599919">Applicable to All Samba 2.x to Samba-3 Upgrades</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2600245">Samba-2.x with LDAP Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id2600427">Updating a Samba-3 Installation</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id2600542">Samba-3 to Samba-3 Updates on the Same Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2600746">Migrating Samba-3 to a New Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2601160">Migration of Samba Accounts to Active Directory</a></span></dt></dl></dd></dl></dd><dt><span class="chapter"><a href="ntmigration.html">9. Migrating NT4 Domain to Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="ntmigration.html#id2601332">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2601417">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2601472">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2601658">Technical Issues</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2601981">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2602007">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2602148">NT4 Migration Using LDAP Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2604606">NT4 Migration Using tdbsam Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2605013">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2605051">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="nw4migration.html">10. Migrating NetWare Server to Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="nw4migration.html#id2606026">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id2606137">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id2606228">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id2606305">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id2606495">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id2606504">NetWare Migration Using LDAP Backend</a></span></dt></dl></dd></dl></dd></dl></dd><dt><span class="part"><a href="RefSection.html">III. Reference Section</a></span></dt><dd><dl><dt><span class="chapter"><a href="kerberos.html">11. Active Directory, Kerberos, and Security</a></span></dt><dd><dl><dt><span class="sect1"><a href="kerberos.html#id2610496">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2611138">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id2611154">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2611545">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#ch10expl">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2613169">Share Access Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2613518">Share Definition Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2614131">Share Point Directory and File Permissions</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2614530">Managing Windows 200x ACLs</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2615257">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id2615391">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="DomApps.html">12. Integrating Additional Services</a></span></dt><dd><dl><dt><span class="sect1"><a href="DomApps.html#id2616020">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id2616051">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2616160">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id2616193">Technical Issues</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id2616349">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2616373">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id2618225">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id2618286">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="HA.html">13. Performance, Reliability, and Availability</a></span></dt><dd><dl><dt><span class="sect1"><a href="HA.html#id2618805">Introduction</a></span></dt><dt><span class="sect1"><a href="HA.html#id2618892">Dissection and Discussion</a></span></dt><dt><span class="sect1"><a href="HA.html#id2619366">Guidelines for Reliable Samba Operation</a></span></dt><dd><dl><dt><span class="sect2"><a href="HA.html#id2619393">Name Resolution</a></span></dt><dt><span class="sect2"><a href="HA.html#id2619868">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="HA.html#id2620205">Use and Location of BDCs</a></span></dt><dt><span class="sect2"><a href="HA.html#id2620281">Use One Consistent Version of MS Windows Client</a></span></dt><dt><span class="sect2"><a href="HA.html#id2620303">For Scalability, Use SAN-Based Storage on Samba Servers</a></span></dt><dt><span class="sect2"><a href="HA.html#id2620352">Distribute Network Load with MSDFS</a></span></dt><dt><span class="sect2"><a href="HA.html#id2620407">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></span></dt><dt><span class="sect2"><a href="HA.html#id2620452">Hardware Problems</a></span></dt><dt><span class="sect2"><a href="HA.html#id2620600">Large Directories</a></span></dt></dl></dd><dt><span class="sect1"><a href="HA.html#id2620704">Key Points Learned</a></span></dt></dl></dd><dt><span class="chapter"><a href="ch14.html">14. Samba Support</a></span></dt><dd><dl><dt><span class="sect1"><a href="ch14.html#id2620874">Free Support</a></span></dt><dt><span class="sect1"><a href="ch14.html#id2621092">Commercial Support</a></span></dt></dl></dd><dt><span class="chapter"><a href="appendix.html">15. A Collection of Useful Tidbits</a></span></dt><dd><dl><dt><span class="sect1"><a href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></span></dt><dt><span class="sect1"><a href="appendix.html#id2621811">Samba System File Location</a></span></dt><dt><span class="sect1"><a href="appendix.html#id2622232">Starting Samba</a></span></dt><dt><span class="sect1"><a href="appendix.html#id2622592">DNS Configuration Files</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id2622604">The Forward Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2622652">The Reverse Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2622792">DNS Root Server Hint File</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id2622851">Initialization of the LDAP Database</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#id2623411">The LDAP Account Manager</a></span></dt><dt><span class="sect1"><a href="appendix.html#id2624406">IDEALX Management Console</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12dblck">Shared Data Integrity</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id2624881">Microsoft Access</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2625028">Act! Database Sharing</a></span></dt><dt><span class="sect2"><a href="appendix.html#id2625113">Opportunistic Locking Controls</a></span></dt></dl></dd></dl></dd><dt><span class="chapter"><a href="primer.html">16. Networking Primer</a></span></dt><dd><dl><dt><span class="sect1"><a href="primer.html#id2625280">Requirements and Notes</a></span></dt><dt><span class="sect1"><a href="primer.html#id2625441">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id2625502">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#id2625618">Exercises</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id2625744">Single-Machine Broadcast Activity</a></span></dt><dt><span class="sect2"><a href="primer.html#secondmachine">Second Machine Startup Broadcast Interaction</a></span></dt><dt><span class="sect2"><a href="primer.html#id2626892">Simple Windows Client Connection Characteristics</a></span></dt><dt><span class="sect2"><a href="primer.html#id2627394">Windows 200x/XP Client Interaction with Samba-3</a></span></dt><dt><span class="sect2"><a href="primer.html#id2627962">Conclusions to Exercises</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01conc">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id2628077">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01qa">Questions and Answers</a></span></dt></dl></dd><dt><span class="appendix"><a href="apa.html">A.2 GNUGeneral Public License version 33 </a></span></dt><dd><dl><dt><span class="bridgehead"><a href="apa.html#id 2628743">A.1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Samba-3 by Example</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="next" href="pr01.html" title="About the Cover Artwork"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Samba-3 by Example</th></tr><tr><td width="20%" align="left"> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="pr01.html">Next</a></td></tr></table><hr></div><div class="book" title="Samba-3 by Example"><div class="titlepage"><div><div><h1 class="title"><a name="S3bE"></a>Samba-3 by Example</h1></div><div><h2 class="subtitle">Practical Exercises in Successful Samba Deployment</h2></div><div><div class="authorgroup"><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div></div><div><p class="pubdate">July, 2006</p></div></div><hr></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="preface"><a href="pr01.html">About the Cover Artwork</a></span></dt><dt><span class="preface"><a href="pr02.html">Acknowledgments</a></span></dt><dt><span class="preface"><a href="pr03.html">Foreword</a></span></dt><dd><dl><dt><span class="sect1"><a href="pr03.html#id280658">By John M. Weathersby, Executive Director, OSSI</a></span></dt></dl></dd><dt><span class="preface"><a href="preface.html">Preface</a></span></dt><dd><dl><dt><span class="sect1"><a href="preface.html#id280788">Why Is This Book Necessary?</a></span></dt><dd><dl><dt><span class="sect2"><a href="preface.html#id280825">Samba 3.0.20 Update Edition</a></span></dt></dl></dd><dt><span class="sect1"><a href="preface.html#id280643">Prerequisites</a></span></dt><dt><span class="sect1"><a href="preface.html#id322292">Approach</a></span></dt><dt><span class="sect1"><a href="preface.html#id322341">Summary of Topics</a></span></dt><dt><span class="sect1"><a href="preface.html#id322920">Conventions Used</a></span></dt></dl></dd><dt><span class="part"><a href="ExNetworks.html">I. Example Network Configurations</a></span></dt><dd><dl><dt><span class="chapter"><a href="simple.html">1. No-Frills Samba Servers</a></span></dt><dd><dl><dt><span class="sect1"><a href="simple.html#id323089">Introduction</a></span></dt><dt><span class="sect1"><a href="simple.html#id323120">Assignment Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="simple.html#id323158">Drafting Office</a></span></dt><dt><span class="sect2"><a href="simple.html#id323803">Charity Administration Office</a></span></dt><dt><span class="sect2"><a href="simple.html#AccountingOffice">Accounting Office</a></span></dt></dl></dd><dt><span class="sect1"><a href="simple.html#id326925">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="small.html">2. Small Office Networking</a></span></dt><dd><dl><dt><span class="sect1"><a href="small.html#id327308">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id327326">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id327371">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id327416">Technical Issues</a></span></dt><dt><span class="sect2"><a href="small.html#id327588">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id327606">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id329058">Validation</a></span></dt><dt><span class="sect2"><a href="small.html#id329633">Notebook Computers: A Special Case</a></span></dt><dt><span class="sect2"><a href="small.html#id329652">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id329716">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="secure.html">3. Secure Office Networking</a></span></dt><dd><dl><dt><span class="sect1"><a href="secure.html#id330143">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id330177">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id330386">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id330398">Technical Issues</a></span></dt><dt><span class="sect2"><a href="secure.html#id330742">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id330776">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#ch4bsc">Basic System Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id331530">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4ptrcfg">Printer Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4valid">Validation</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4appscfg">Application Share Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id335513">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id335566">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="Big500users.html">4. The 500-User Office</a></span></dt><dd><dl><dt><span class="sect1"><a href="Big500users.html#id336007">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id336038">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id336113">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#id336141">Technical Issues</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id336318">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id336338">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="Big500users.html#ch5-dnshcp-setup">Installation of DHCP, DNS, and Samba Control Files</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id337052">Server Preparation: All Servers</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id337568">Server-Specific Preparation</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5-procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#ch5wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="Big500users.html#id340544">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="Big500users.html#id340597">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="happy.html">5. Making Happy Users</a></span></dt><dd><dl><dt><span class="sect1"><a href="happy.html#id341339">Regarding LDAP Directories and Windows Computer Accounts</a></span></dt><dt><span class="sect1"><a href="happy.html#id341463">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id341540">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id341668">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id342070">Technical Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id343725">Political Issues</a></span></dt><dt><span class="sect2"><a href="happy.html#id343737">Installation Checklist</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id343908">Samba Server Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></span></dt><dt><span class="sect2"><a href="happy.html#sbeidealx">Install and Configure Idealx smbldap-tools Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a></span></dt><dt><span class="sect2"><a href="happy.html#sbehap-ptrcfg">Printer Configuration</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a></span></dt><dt><span class="sect1"><a href="happy.html#id350178">Miscellaneous Server Preparation Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#id350194">Configuring Directory Share Point Roots</a></span></dt><dt><span class="sect2"><a href="happy.html#id350283">Configuring Profile Directories</a></span></dt><dt><span class="sect2"><a href="happy.html#id350512">Preparation of Logon Scripts</a></span></dt><dt><span class="sect2"><a href="happy.html#id350609">Assigning User Rights and Privileges</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id350723">Windows Client Configuration</a></span></dt><dd><dl><dt><span class="sect2"><a href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></span></dt><dt><span class="sect2"><a href="happy.html#id351441">Configuration of MS Outlook to Relocate PST File</a></span></dt><dt><span class="sect2"><a href="happy.html#id351724">Configure Delete Cached Profiles on Logout</a></span></dt><dt><span class="sect2"><a href="happy.html#id351896">Uploading Printer Drivers to Samba Servers</a></span></dt><dt><span class="sect2"><a href="happy.html#id352365">Software Installation</a></span></dt><dt><span class="sect2"><a href="happy.html#id352391">Roll-out Image Creation</a></span></dt></dl></dd><dt><span class="sect1"><a href="happy.html#id352420">Key Points Learned</a></span></dt><dt><span class="sect1"><a href="happy.html#id352508">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="net2000users.html">6. A Distributed 2000-User Network</a></span></dt><dd><dl><dt><span class="sect1"><a href="net2000users.html#id352846">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id352871">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id352928">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id353175">Technical Issues</a></span></dt><dt><span class="sect2"><a href="net2000users.html#id353997">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id354011">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id357027">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id357166">Questions and Answers</a></span></dt></dl></dd></dl></dd><dt><span class="part"><a href="DMSMig.html">II. Domain Members, Updating Samba and Migration</a></span></dt><dd><dl><dt><span class="chapter"><a href="unixclients.html">7. Adding Domain Member Servers and Clients</a></span></dt><dd><dl><dt><span class="sect1"><a href="unixclients.html#id357946">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id357994">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id358022">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id358046">Technical Issues</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id358646">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id358731">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></span></dt><dt><span class="sect2"><a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></span></dt><dt><span class="sect2"><a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a></span></dt><dt><span class="sect2"><a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id364506">UNIX/Linux Client Domain Member</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id365002">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id365047">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="upgrades.html">8. Updating Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="upgrades.html#id366117">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id366200">Cautions and Notes</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id367413">Upgrading from Samba 1.x and 2.x to Samba-3</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id368069">Samba-2.x with LDAP Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id368184">Updating a Samba-3 Installation</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id368281">Samba-3 to Samba-3 Updates on the Same Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id368465">Migrating Samba-3 to a New Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id368842">Migration of Samba Accounts to Active Directory</a></span></dt></dl></dd></dl></dd><dt><span class="chapter"><a href="ntmigration.html">9. Migrating NT4 Domain to Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="ntmigration.html#id368988">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id369064">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id369115">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id369276">Technical Issues</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id369580">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id369600">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id371918">NT4 Migration Using tdbsam Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id372263">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id372297">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="nw4migration.html">10. Migrating NetWare Server to Samba-3</a></span></dt><dd><dl><dt><span class="sect1"><a href="nw4migration.html#id373183">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id373282">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id373359">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id373431">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id373599">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id373608">NetWare Migration Using LDAP Backend</a></span></dt></dl></dd></dl></dd></dl></dd><dt><span class="part"><a href="RefSection.html">III. Reference Section</a></span></dt><dd><dl><dt><span class="chapter"><a href="kerberos.html">11. Active Directory, Kerberos, and Security</a></span></dt><dd><dl><dt><span class="sect1"><a href="kerberos.html#id377126">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id377710">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id377723">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id378089">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#ch10expl">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id379573">Share Access Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id379908">Share Definition Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id380465">Share Point Directory and File Permissions</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id380830">Managing Windows 200x ACLs</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id381514">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id381636">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="DomApps.html">12. Integrating Additional Services</a></span></dt><dd><dl><dt><span class="sect1"><a href="DomApps.html#id382225">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id382248">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id382338">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#id382367">Technical Issues</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id382513">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id382530">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></span></dt><dt><span class="sect2"><a href="DomApps.html#id384281">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="DomApps.html#id384336">Questions and Answers</a></span></dt></dl></dd><dt><span class="chapter"><a href="HA.html">13. Performance, Reliability, and Availability</a></span></dt><dd><dl><dt><span class="sect1"><a href="HA.html#id384815">Introduction</a></span></dt><dt><span class="sect1"><a href="HA.html#id384892">Dissection and Discussion</a></span></dt><dt><span class="sect1"><a href="HA.html#id385344">Guidelines for Reliable Samba Operation</a></span></dt><dd><dl><dt><span class="sect2"><a href="HA.html#id385369">Name Resolution</a></span></dt><dt><span class="sect2"><a href="HA.html#id385810">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="HA.html#id386110">Use and Location of BDCs</a></span></dt><dt><span class="sect2"><a href="HA.html#id386178">Use One Consistent Version of MS Windows Client</a></span></dt><dt><span class="sect2"><a href="HA.html#id386195">For Scalability, Use SAN-Based Storage on Samba Servers</a></span></dt><dt><span class="sect2"><a href="HA.html#id386240">Distribute Network Load with MSDFS</a></span></dt><dt><span class="sect2"><a href="HA.html#id386291">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></span></dt><dt><span class="sect2"><a href="HA.html#id386332">Hardware Problems</a></span></dt><dt><span class="sect2"><a href="HA.html#id386465">Large Directories</a></span></dt></dl></dd><dt><span class="sect1"><a href="HA.html#id386548">Key Points Learned</a></span></dt></dl></dd><dt><span class="chapter"><a href="ch14.html">14. Samba Support</a></span></dt><dd><dl><dt><span class="sect1"><a href="ch14.html#id386696">Free Support</a></span></dt><dt><span class="sect1"><a href="ch14.html#id386894">Commercial Support</a></span></dt></dl></dd><dt><span class="chapter"><a href="appendix.html">15. A Collection of Useful Tidbits</a></span></dt><dd><dl><dt><span class="sect1"><a href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></span></dt><dt><span class="sect1"><a href="appendix.html#id387559">Samba System File Location</a></span></dt><dt><span class="sect1"><a href="appendix.html#id387952">Starting Samba</a></span></dt><dt><span class="sect1"><a href="appendix.html#id388254">DNS Configuration Files</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id388264">The Forward Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id388308">The Reverse Zone File for the Loopback Adaptor</a></span></dt><dt><span class="sect2"><a href="appendix.html#id388408">DNS Root Server Hint File</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id388463">Initialization of the LDAP Database</a></span></dt></dl></dd><dt><span class="sect1"><a href="appendix.html#id388919">The LDAP Account Manager</a></span></dt><dt><span class="sect1"><a href="appendix.html#id389839">IDEALX Management Console</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></span></dt><dt><span class="sect1"><a href="appendix.html#ch12dblck">Shared Data Integrity</a></span></dt><dd><dl><dt><span class="sect2"><a href="appendix.html#id390270">Microsoft Access</a></span></dt><dt><span class="sect2"><a href="appendix.html#id390409">Act! Database Sharing</a></span></dt><dt><span class="sect2"><a href="appendix.html#id390484">Opportunistic Locking Controls</a></span></dt></dl></dd></dl></dd><dt><span class="chapter"><a href="primer.html">16. Networking Primer</a></span></dt><dd><dl><dt><span class="sect1"><a href="primer.html#id390627">Requirements and Notes</a></span></dt><dt><span class="sect1"><a href="primer.html#id390763">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id390813">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#id390920">Exercises</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id391033">Single-Machine Broadcast Activity</a></span></dt><dt><span class="sect2"><a href="primer.html#secondmachine">Second Machine Startup Broadcast Interaction</a></span></dt><dt><span class="sect2"><a href="primer.html#id392130">Simple Windows Client Connection Characteristics</a></span></dt><dt><span class="sect2"><a href="primer.html#id392597">Windows 200x/XP Client Interaction with Samba-3</a></span></dt><dt><span class="sect2"><a href="primer.html#id393121">Conclusions to Exercises</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01conc">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id393223">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01qa">Questions and Answers</a></span></dt></dl></dd><dt><span class="appendix"><a href="apa.html">A. 2 <acronym class="acronym">GNU</acronym> General Public License version 3 3 </a></span></dt><dd><dl><dt><span class="bridgehead"><a href="apa.html#id393828">A. 4 4 Preamble 5 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2628888">A.5 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393937">A. 6 6 TERMS AND CONDITIONS 7 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2628892">A.7 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id393940">A. 8 8 0. Definitions. 9 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2628984">A.9 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394004">A. 10 10 1. Source Code. 11 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629082">A.11 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394066">A. 12 12 2. Basic Permissions. 13 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629122">A.13 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394094">A. 14 14 3. Protecting Users’ Legal Rights From Anti-Circumvention Law. 15 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629154">A.15 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394116">A. 16 16 4. Conveying Verbatim Copies. 17 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629181">A.17 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394135">A. 18 18 5. Conveying Modified Source Versions. 19 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629277">A.19 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394207">A. 20 20 6. Conveying Non-Source Forms. 21 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629466">A.21 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394339">A. 22 22 7. Additional Terms. 23 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629602">A.23 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394444">A. 24 24 8. Termination. 25 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629646">A.25 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394476">A. 26 26 9. Acceptance Not Required for Having Copies. 27 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629675">A.27 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394495">A. 28 28 10. Automatic Licensing of Downstream Recipients. 29 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629727">A.29 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394529">A. 30 30 11. Patents. 31 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629872">A.31 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394618">A. 32 32 12. No Surrender of Others’ Freedom. 33 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629894">A.33 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394633">A. 34 34 13. Use with the ???TITLE??? Affero General Public License. 35 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629923">A.35 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394657">A. 36 36 14. Revised Versions of this License. 37 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2629986">A.37 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394704">A. 38 38 15. Disclaimer of Warranty. 39 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2630012">A.39 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394722">A. 40 40 16. Limitation of Liability. 41 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2630032">A.41 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394736">A. 42 42 17. Interpretation of Sections 15 and 16. 43 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2630049">A.43 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394749">A. 44 44 END OF TERMS AND CONDITIONS 45 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id 2630052">A.45 </a></span></dt><dt><span class="bridgehead"><a href="apa.html#id394752">A. 46 46 How to Apply These Terms to Your New Programs 47 </a></span></dt></dl></dd></dl></dd><dt><span class="glossary"><a href="go01.html">Glossary</a></span></dt><dt><span class="index"><a href="ix01.html">Index</a></span></dt></dl></div><div class="list-of-figures"><p><b>List of Figures</b></p><dl><dt>1.1. <a href="simple.html#charitynet">Charity Administration Office Network</a></dt><dt>1.2. <a href="simple.html#acctingnet2">Accounting Office Network Topology</a></dt><dt>2.1. <a href="small.html#acct2net">Abmas Accounting 52-User Network Topology</a></dt><dt>3.1. <a href="secure.html#ch04net">Abmas Network Topology 130 Users</a></dt><dt>4.1. <a href="Big500users.html#chap05net">Network Topology 500 User Network Using tdbsam passdb backend.</a></dt><dt>5.1. <a href="happy.html#sbehap-LDAPdiag">The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts</a></dt><dt>5.2. <a href="happy.html#chap6net">Network Topology 500 User Network Using ldapsam passdb backend</a></dt><dt>5.3. <a href="happy.html#XP-screen001">Windows XP Professional User Shared Folders</a></dt><dt>6.1. <a href="net2000users.html#chap7idres">Samba and Authentication Backend Search Pathways</a></dt><dt>6.2. <a href="net2000users.html#ch7singleLDAP">Samba Configuration to Use a Single LDAP Server</a></dt><dt>6.3. <a href="net2000users.html#ch7dualLDAP">Samba Configuration to Use a Dual (Fail-over) LDAP Server</a></dt><dt>6.4. <a href="net2000users.html#ch7dualadd">Samba Configuration to Use Dual LDAP Databases - Broken - Do Not Use!</a></dt><dt>6.5. <a href="net2000users.html#ch7dualok">Samba Configuration to Use Two LDAP Databases - The result is additive.</a></dt><dt>6.6. <a href="net2000users.html#chap7net">Network Topology 2000 User Complex Design A</a></dt><dt>6.7. <a href="net2000users.html#chap7net2">Network Topology 2000 User Complex Design B</a></dt><dt>7.1. <a href="unixclients.html#ch09openmag">Open Magazine Samba Survey</a></dt><dt>7.2. <a href="unixclients.html#ch9-sambadc">Samba Domain: Samba Member Server</a></dt><dt>7.3. <a href="unixclients.html#ch9-adsdc">Active Directory Domain: Samba Member Server</a></dt><dt>9.1. <a href="ntmigration.html#ch8-migration">Schematic Explaining the net rpc vampire Process</a></dt><dt>9.2. <a href="ntmigration.html#NT4DUM">View of Accounts in NT4 Domain User Manager</a></dt><dt>15.1. <a href="appendix.html#swxpp001">The General Panel.</a></dt><dt>15.2. <a href="appendix.html#swxpp004">The Computer Name Panel.</a></dt><dt>15.3. <a href="appendix.html#swxpp006">The Computer Name Changes Panel</a></dt><dt>15.4. <a href="appendix.html#swxpp007">The Computer Name Changes Panel Domain MIDEARTH</a></dt><dt>15.5. <a href="appendix.html#swxpp008">Computer Name Changes User name and Password Panel</a></dt><dt>15.6. <a href="appendix.html#lam-login">The LDAP Account Manager Login Screen</a></dt><dt>15.7. <a href="appendix.html#lam-config">The LDAP Account Manager Configuration Screen</a></dt><dt>15.8. <a href="appendix.html#lam-user">The LDAP Account Manager User Edit Screen</a></dt><dt>15.9. <a href="appendix.html#lam-group">The LDAP Account Manager Group Edit Screen</a></dt><dt>15.10. <a href="appendix.html#lam-group-mem">The LDAP Account Manager Group Membership Edit Screen</a></dt><dt>15.11. <a href="appendix.html#lam-host">The LDAP Account Manager Host Edit Screen</a></dt><dt>15.12. <a href="appendix.html#imcidealx">The IMC Samba User Account Screen</a></dt><dt>16.1. <a href="primer.html#pktcap01">Windows Me Broadcasts The First 10 Minutes</a></dt><dt>16.2. <a href="primer.html#pktcap02">Windows Me Later Broadcast Sample</a></dt><dt>16.3. <a href="primer.html#hostannounce">Typical Windows 9x/Me Host Announcement</a></dt><dt>16.4. <a href="primer.html#nullconnect">Typical Windows 9x/Me NULL SessionSetUp AndX Request</a></dt><dt>16.5. <a href="primer.html#userconnect">Typical Windows 9x/Me User SessionSetUp AndX Request</a></dt><dt>16.6. <a href="primer.html#XPCap01">Typical Windows XP NULL Session Setup AndX Request</a></dt><dt>16.7. <a href="primer.html#XPCap02">Typical Windows XP User Session Setup AndX Request</a></dt></dl></div><div class="list-of-tables"><p><b>List of Tables</b></p><dl><dt>1. <a href="preface.html#pref-new">Samba Changes 3.0.2 to 3.0.20</a></dt><dt>1.1. <a href="simple.html#acctingnet">Accounting Office Network Information</a></dt><dt>3.1. <a href="secure.html#chap4netid">Abmas.US ISP Information</a></dt><dt>3.2. <a href="secure.html#namedrscfiles">DNS (named) Resource Files</a></dt><dt>4.1. <a href="Big500users.html#ch5-filelocations">Domain: MEGANET, File Locations for Servers</a></dt><dt>5.1. <a href="happy.html#sbehap-privs">Current Privilege Capabilities</a></dt><dt>5.2. <a href="happy.html#oldapreq">Required OpenLDAP Linux Packages</a></dt><dt>5.3. <a href="happy.html#sbehap-bigacct">Abmas Network Users and Groups</a></dt><dt>5.4. <a href="happy.html#proffold">Default Profile Redirections</a></dt><dt>9.1. <a href="ntmigration.html#ch8-vampire">Samba smb.conf Scripts Essential to Samba Operation</a></dt><dt>13.1. <a href="HA.html#ProbList">Effect of Common Problems</a></dt><dt>16.1. <a href="primer.html#capsstats01">Windows Me Startup Broadcast Capture Statistics</a></dt><dt>16.2. <a href="primer.html#capsstats02">Second Machine (Windows 98) Capture Statistics</a></dt></dl></div><div class="list-of-examples"><p><b>List of Examples</b></p><dl><dt>1.1. <a href="simple.html#draft-smbconf">Drafting Office smb.conf File</a></dt><dt>1.2. <a href="simple.html#charity-smbconfnew">Charity Administration Office smb.conf New-style File</a></dt><dt>1.3. <a href="simple.html#charity-smbconf">Charity Administration Office smb.conf Old-style File</a></dt><dt>1.4. <a href="simple.html#MEreg">Windows Me Registry Edit File: Disable Password Caching</a></dt><dt>1.5. <a href="simple.html#acctconf">Accounting Office Network smb.conf Old Style Configuration File</a></dt><dt>2.1. <a href="small.html#initGrps">Script to Map Windows NT Groups to UNIX Groups</a></dt><dt>2.2. <a href="small.html#dhcp01">Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf</a></dt><dt>2.3. <a href="small.html#acct2conf">Accounting Office Network smb.conf File [globals] Section</a></dt><dt>2.4. <a href="small.html#acct3conf">Accounting Office Network smb.conf File Services and Shares Section</a></dt><dt>3.1. <a href="secure.html#ch4memoryest">Estimation of Memory Requirements</a></dt><dt>3.2. <a href="secure.html#ch4diskest">Estimation of Disk Storage Requirements</a></dt><dt>3.3. <a href="secure.html#ch4natfw">NAT Firewall Configuration Script</a></dt><dt>3.4. <a href="secure.html#promisnet">130 User Network with tdbsam [globals] Section</a></dt><dt>3.5. <a href="secure.html#promisnetsvca">130 User Network with tdbsam Services Section Part A</a></dt><dt>3.6. <a href="secure.html#promisnetsvcb">130 User Network with tdbsam Services Section Part B</a></dt><dt>3.7. <a href="secure.html#ch4initGrps">Script to Map Windows NT Groups to UNIX Groups</a></dt><dt>3.8. <a href="secure.html#prom-dhcp">DHCP Server Configuration File /etc/dhcpd.conf</a></dt><dt>3.9. <a href="secure.html#ch4namedcfg">DNS Master Configuration File /etc/named.conf Master Section</a></dt><dt>3.10. <a href="secure.html#ch4namedvarfwd">DNS Master Configuration File /etc/named.conf Forward Lookup Definition Section</a></dt><dt>3.11. <a href="secure.html#ch4namedvarrev">DNS Master Configuration File /etc/named.conf Reverse Lookup Definition Section</a></dt><dt>3.12. <a href="secure.html#eth1zone">DNS 192.168.1 Reverse Zone File</a></dt><dt>3.13. <a href="secure.html#eth2zone">DNS 192.168.2 Reverse Zone File</a></dt><dt>3.14. <a href="secure.html#abmasbiz">DNS Abmas.biz Forward Zone File</a></dt><dt>3.15. <a href="secure.html#abmasus">DNS Abmas.us Forward Zone File</a></dt><dt>4.1. <a href="Big500users.html#ch5-massivesmb">Server: MASSIVE (PDC), File: /etc/samba/smb.conf</a></dt><dt>4.2. <a href="Big500users.html#ch5-dc-common">Server: MASSIVE (PDC), File: /etc/samba/dc-common.conf</a></dt><dt>4.3. <a href="Big500users.html#ch5-commonsmb">Common Samba Configuration File: /etc/samba/common.conf</a></dt><dt>4.4. <a href="Big500users.html#ch5-bldg1-smb">Server: BLDG1 (Member), File: smb.conf</a></dt><dt>4.5. <a href="Big500users.html#ch5-bldg2-smb">Server: BLDG2 (Member), File: smb.conf</a></dt><dt>4.6. <a href="Big500users.html#ch5-dommem-smb">Common Domain Member Include File: dom-mem.conf</a></dt><dt>4.7. <a href="Big500users.html#massive-dhcp">Server: MASSIVE, File: dhcpd.conf</a></dt><dt>4.8. <a href="Big500users.html#bldg1dhcp">Server: BLDG1, File: dhcpd.conf</a></dt><dt>4.9. <a href="Big500users.html#bldg2dhcp">Server: BLDG2, File: dhcpd.conf</a></dt><dt>4.10. <a href="Big500users.html#massive-nameda">Server: MASSIVE, File: named.conf, Part: A</a></dt><dt>4.11. <a href="Big500users.html#massive-namedb">Server: MASSIVE, File: named.conf, Part: B</a></dt><dt>4.12. <a href="Big500users.html#massive-namedc">Server: MASSIVE, File: named.conf, Part: C</a></dt><dt>4.13. <a href="Big500users.html#abmasbizdns">Forward Zone File: abmas.biz.hosts</a></dt><dt>4.14. <a href="Big500users.html#abmasusdns">Forward Zone File: abmas.biz.hosts</a></dt><dt>4.15. <a href="Big500users.html#bldg12nameda">Servers: BLDG1/BLDG2, File: named.conf, Part: A</a></dt><dt>4.16. <a href="Big500users.html#bldg12namedb">Servers: BLDG1/BLDG2, File: named.conf, Part: B</a></dt><dt>4.17. <a href="Big500users.html#ch5-initgrps">Initialize Groups Script, File: /etc/samba/initGrps.sh</a></dt><dt>5.1. <a href="happy.html#sbehap-dbconf">LDAP DB_CONFIG File</a></dt><dt>5.2. <a href="happy.html#sbehap-slapdconf">LDAP Master Configuration File /etc/openldap/slapd.conf Part A</a></dt><dt>5.3. <a href="happy.html#sbehap-slapdconf2">LDAP Master Configuration File /etc/openldap/slapd.conf Part B</a></dt><dt>5.4. <a href="happy.html#sbehap-nss01">Configuration File for NSS LDAP Support /etc/ldap.conf</a></dt><dt>5.5. <a href="happy.html#sbehap-nss02">Configuration File for NSS LDAP Clients Support /etc/ldap.conf</a></dt><dt>5.6. <a href="happy.html#sbehap-massive-smbconfa">LDAP Based smb.conf File, Server: MASSIVE global Section: Part A</a></dt><dt>5.7. <a href="happy.html#sbehap-massive-smbconfb">LDAP Based smb.conf File, Server: MASSIVE global Section: Part B</a></dt><dt>5.8. <a href="happy.html#sbehap-bldg1-smbconf">LDAP Based smb.conf File, Server: BLDG1</a></dt><dt>5.9. <a href="happy.html#sbehap-bldg2-smbconf">LDAP Based smb.conf File, Server: BLDG2</a></dt><dt>5.10. <a href="happy.html#sbehap-shareconfa">LDAP Based smb.conf File, Shares Section Part A</a></dt><dt>5.11. <a href="happy.html#sbehap-shareconfb">LDAP Based smb.conf File, Shares Section Part B</a></dt><dt>5.12. <a href="happy.html#sbehap-ldifadd">LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF</a></dt><dt>6.1. <a href="net2000users.html#ch7-LDAP-master">LDAP Master Server Configuration File /etc/openldap/slapd.conf</a></dt><dt>6.2. <a href="net2000users.html#ch7-LDAP-slave">LDAP Slave Configuration File /etc/openldap/slapd.conf</a></dt><dt>6.3. <a href="net2000users.html#ch7-massmbconfA">Primary Domain Controller smb.conf File Part A</a></dt><dt>6.4. <a href="net2000users.html#ch7-massmbconfB">Primary Domain Controller smb.conf File Part B</a></dt><dt>6.5. <a href="net2000users.html#ch7-massmbconfC">Primary Domain Controller smb.conf File Part C</a></dt><dt>6.6. <a href="net2000users.html#ch7-slvsmbocnfA">Backup Domain Controller smb.conf File Part A</a></dt><dt>6.7. <a href="net2000users.html#ch7-slvsmbocnfB">Backup Domain Controller smb.conf File Part B</a></dt><dt>7.1. <a href="unixclients.html#ch9-sdmsdc">Samba Domain Member in Samba Domain Using LDAP smb.conf File</a></dt><dt>7.2. <a href="unixclients.html#ch9-ldifadd">LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF</a></dt><dt>7.3. <a href="unixclients.html#ch9-sdmlcnf">Configuration File for NSS LDAP Support /etc/ldap.conf</a></dt><dt>7.4. <a href="unixclients.html#ch9-sdmnss">NSS using LDAP for Identity Resolution File: /etc/nsswitch.conf</a></dt><dt>7.5. <a href="unixclients.html#ch0-NT4DSDM">Samba Domain Member Server Using Winbind smb.conf File for NT4 Domain</a></dt><dt>7.6. <a href="unixclients.html#ch0-NT4DSCM">Samba Domain Member Server Using Local Accounts smb.conf File for NT4 Domain</a></dt><dt>7.7. <a href="unixclients.html#ch9-adssdm">Samba Domain Member smb.conf File for Active Directory Membership</a></dt><dt>7.8. <a href="unixclients.html#sbe-idmapridex">Example smb.conf File Using idmap_rid</a></dt><dt>7.9. <a href="unixclients.html#sbeunxa">Typical ADS Style Domain smb.conf File</a></dt><dt>7.10. <a href="unixclients.html#sbewinbindex">ADS Membership Using RFC2307bis Identity Resolution smb.conf File</a></dt><dt>7.11. <a href="unixclients.html#ch9-pamwnbdlogin">SUSE: PAM login Module Using Winbind</a></dt><dt>7.12. <a href="unixclients.html#ch9-pamwbndxdm">SUSE: PAM xdm Module Using Winbind</a></dt><dt>7.13. <a href="unixclients.html#ch9-rhsysauth">Red Hat 9: PAM System Authentication File: /etc/pam.d/system-auth Module Using Winbind</a></dt><dt>9.1. <a href="ntmigration.html#sbent4smb">NT4 Migration Samba-3 Server smb.conf Part: A</a></dt><dt>9.2. <a href="ntmigration.html#sbent4smb2">NT4 Migration Samba-3 Server smb.conf Part: B</a></dt><dt>9.3. <a href="ntmigration.html#sbentslapd">NT4 Migration LDAP Server Configuration File: /etc/openldap/slapd.conf Part A</a></dt><dt>9.4. <a href="ntmigration.html#sbentslapd2">NT4 Migration LDAP Server Configuration File: /etc/openldap/slapd.conf Part B</a></dt><dt>9.5. <a href="ntmigration.html#sbrntldapconf">NT4 Migration NSS LDAP File: /etc/ldap.conf</a></dt><dt>9.6. <a href="ntmigration.html#sbentnss">NT4 Migration NSS Control File: /etc/nsswitch.conf (Stage:1)</a></dt><dt>9.7. <a href="ntmigration.html#sbentnss2">NT4 Migration NSS Control File: /etc/nsswitch.conf (Stage:2)</a></dt><dt>10.1. <a href="nw4migration.html#sbeamg">A Rough Tool to Create an LDIF File from the System Account Files</a></dt><dt>10.2. <a href="nw4migration.html#ch8ldap">NSS LDAP Control File /etc/ldap.conf</a></dt><dt>10.3. <a href="nw4migration.html#sbepu2">The PAM Control File /etc/security/pam_unix2.conf</a></dt><dt>10.4. <a href="nw4migration.html#ch8smbconf">Samba Configuration File smb.conf Part A</a></dt><dt>10.5. <a href="nw4migration.html#ch8smbconf2">Samba Configuration File smb.conf Part B</a></dt><dt>10.6. <a href="nw4migration.html#ch8smbconf3">Samba Configuration File smb.conf Part C</a></dt><dt>10.7. <a href="nw4migration.html#ch8smbconf4">Samba Configuration File smb.conf Part D</a></dt><dt>10.8. <a href="nw4migration.html#ch8smbconf5">Samba Configuration File smb.conf Part E</a></dt><dt>10.9. <a href="nw4migration.html#sbersync">Rsync Script</a></dt><dt>10.10. <a href="nw4migration.html#sbexcld">Rsync Files Exclusion List /root/excludes.txt</a></dt><dt>10.11. <a href="nw4migration.html#ch8ideal">Idealx smbldap-tools Control File Part A</a></dt><dt>10.12. <a href="nw4migration.html#ch8ideal2">Idealx smbldap-tools Control File Part B</a></dt><dt>10.13. <a href="nw4migration.html#ch8ideal3">Idealx smbldap-tools Control File Part C</a></dt><dt>10.14. <a href="nw4migration.html#ch8ideal4">Idealx smbldap-tools Control File Part D</a></dt><dt>10.15. <a href="nw4migration.html#ch8kix">Kixtart Control File File: logon.kix</a></dt><dt>10.16. <a href="nw4migration.html#ch8kix2">Kixtart Control File File: main.kix</a></dt><dt>10.17. <a href="nw4migration.html#ch8kix3">Kixtart Control File File: setup.kix, Part A</a></dt><dt>10.18. <a href="nw4migration.html#ch8kix3b">Kixtart Control File File: setup.kix, Part B</a></dt><dt>10.19. <a href="nw4migration.html#ch8kix4">Kixtart Control File File: acct.kix</a></dt><dt>12.1. <a href="DomApps.html#ch10-krb5conf">Kerberos Configuration File: /etc/krb5.conf</a></dt><dt>12.2. <a href="DomApps.html#ch10-smbconf">Samba Configuration File: /etc/samba/smb.conf</a></dt><dt>12.3. <a href="DomApps.html#ch10-etcnsscfg">NSS Configuration File Extract File: /etc/nsswitch.conf</a></dt><dt>12.4. <a href="DomApps.html#etcsquidcfg">Squid Configuration File Extract /etc/squid.conf [ADMINISTRATIVE PARAMETERS Section]</a></dt><dt>12.5. <a href="DomApps.html#etcsquid2">Squid Configuration File extract File: /etc/squid.conf [AUTHENTICATION PARAMETERS Section]</a></dt><dt>15.1. <a href="appendix.html#ch12SL">A Useful Samba Control Script for SUSE Linux</a></dt><dt>15.2. <a href="appendix.html#ch12RHscript">A Sample Samba Control Script for Red Hat Linux</a></dt><dt>15.3. <a href="appendix.html#loopback">DNS Localhost Forward Zone File: /var/lib/named/localhost.zone</a></dt><dt>15.4. <a href="appendix.html#dnsloopy">DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone</a></dt><dt>15.5. <a href="appendix.html#roothint">DNS Root Name Server Hint File: /var/lib/named/root.hint</a></dt><dt>15.6. <a href="appendix.html#sbehap-ldapreconfa">LDAP Pre-configuration Script: SMBLDAP-ldif-preconfig.sh Part A</a></dt><dt>15.7. <a href="appendix.html#sbehap-ldapreconfb">LDAP Pre-configuration Script: SMBLDAP-ldif-preconfig.sh Part B</a></dt><dt>15.8. <a href="appendix.html#sbehap-ldapreconfc">LDAP Pre-configuration Script: SMBLDAP-ldif-preconfig.sh Part C</a></dt><dt>15.9. <a href="appendix.html#sbehap-ldifpata">LDIF Pattern File Used to Pre-configure LDAP Part A</a></dt><dt>15.10. <a href="appendix.html#sbehap-ldifpatb">LDIF Pattern File Used to Pre-configure LDAP Part B</a></dt><dt>15.11. <a href="appendix.html#lamcfg">Example LAM Configuration File config.cfg</a></dt><dt>15.12. <a href="appendix.html#lamconf">LAM Profile Control File lam.conf</a></dt></dl></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="pr01.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top"> </td><td width="20%" align="center"> </td><td width="40%" align="right" valign="top"> About the Cover Artwork</td></tr></table></div></body></html>47 </a></span></dt></dl></dd></dl></dd><dt><span class="glossary"><a href="go01.html">Glossary</a></span></dt><dt><span class="index"><a href="ix01.html">Index</a></span></dt></dl></div><div class="list-of-figures"><p><b>List of Figures</b></p><dl><dt>1.1. <a href="simple.html#charitynet">Charity Administration Office Network</a></dt><dt>1.2. <a href="simple.html#acctingnet2">Accounting Office Network Topology</a></dt><dt>2.1. <a href="small.html#acct2net">Abmas Accounting 52-User Network Topology</a></dt><dt>3.1. <a href="secure.html#ch04net">Abmas Network Topology 130 Users</a></dt><dt>4.1. <a href="Big500users.html#chap05net">Network Topology 500 User Network Using tdbsam passdb backend.</a></dt><dt>5.1. <a href="happy.html#sbehap-LDAPdiag">The Interaction of LDAP, UNIX Posix Accounts and Samba Accounts</a></dt><dt>5.2. <a href="happy.html#chap6net">Network Topology 500 User Network Using ldapsam passdb backend</a></dt><dt>5.3. <a href="happy.html#XP-screen001">Windows XP Professional User Shared Folders</a></dt><dt>6.1. <a href="net2000users.html#chap7idres">Samba and Authentication Backend Search Pathways</a></dt><dt>6.2. <a href="net2000users.html#ch7singleLDAP">Samba Configuration to Use a Single LDAP Server</a></dt><dt>6.3. <a href="net2000users.html#ch7dualLDAP">Samba Configuration to Use a Dual (Fail-over) LDAP Server</a></dt><dt>6.4. <a href="net2000users.html#ch7dualadd">Samba Configuration to Use Dual LDAP Databases - Broken - Do Not Use!</a></dt><dt>6.5. <a href="net2000users.html#ch7dualok">Samba Configuration to Use Two LDAP Databases - The result is additive.</a></dt><dt>6.6. <a href="net2000users.html#chap7net">Network Topology 2000 User Complex Design A</a></dt><dt>6.7. <a href="net2000users.html#chap7net2">Network Topology 2000 User Complex Design B</a></dt><dt>7.1. <a href="unixclients.html#ch09openmag">Open Magazine Samba Survey</a></dt><dt>7.2. <a href="unixclients.html#ch9-sambadc">Samba Domain: Samba Member Server</a></dt><dt>7.3. <a href="unixclients.html#ch9-adsdc">Active Directory Domain: Samba Member Server</a></dt><dt>9.1. <a href="ntmigration.html#ch8-migration">Schematic Explaining the <code class="literal">net rpc vampire</code> Process</a></dt><dt>9.2. <a href="ntmigration.html#NT4DUM">View of Accounts in NT4 Domain User Manager</a></dt><dt>15.1. <a href="appendix.html#swxpp001">The General Panel.</a></dt><dt>15.2. <a href="appendix.html#swxpp004">The Computer Name Panel.</a></dt><dt>15.3. <a href="appendix.html#swxpp006">The Computer Name Changes Panel</a></dt><dt>15.4. <a href="appendix.html#swxpp007">The Computer Name Changes Panel Domain MIDEARTH</a></dt><dt>15.5. <a href="appendix.html#swxpp008">Computer Name Changes User name and Password Panel</a></dt><dt>15.6. <a href="appendix.html#lam-login">The LDAP Account Manager Login Screen</a></dt><dt>15.7. <a href="appendix.html#lam-config">The LDAP Account Manager Configuration Screen</a></dt><dt>15.8. <a href="appendix.html#lam-user">The LDAP Account Manager User Edit Screen</a></dt><dt>15.9. <a href="appendix.html#lam-group">The LDAP Account Manager Group Edit Screen</a></dt><dt>15.10. <a href="appendix.html#lam-group-mem">The LDAP Account Manager Group Membership Edit Screen</a></dt><dt>15.11. <a href="appendix.html#lam-host">The LDAP Account Manager Host Edit Screen</a></dt><dt>15.12. <a href="appendix.html#imcidealx">The IMC Samba User Account Screen</a></dt><dt>16.1. <a href="primer.html#pktcap01">Windows Me Broadcasts The First 10 Minutes</a></dt><dt>16.2. <a href="primer.html#pktcap02">Windows Me Later Broadcast Sample</a></dt><dt>16.3. <a href="primer.html#hostannounce">Typical Windows 9x/Me Host Announcement</a></dt><dt>16.4. <a href="primer.html#nullconnect">Typical Windows 9x/Me NULL SessionSetUp AndX Request</a></dt><dt>16.5. <a href="primer.html#userconnect">Typical Windows 9x/Me User SessionSetUp AndX Request</a></dt><dt>16.6. <a href="primer.html#XPCap01">Typical Windows XP NULL Session Setup AndX Request</a></dt><dt>16.7. <a href="primer.html#XPCap02">Typical Windows XP User Session Setup AndX Request</a></dt></dl></div><div class="list-of-tables"><p><b>List of Tables</b></p><dl><dt>1. <a href="preface.html#pref-new">Samba Changes 3.0.2 to 3.0.20</a></dt><dt>1.1. <a href="simple.html#acctingnet">Accounting Office Network Information</a></dt><dt>3.1. <a href="secure.html#chap4netid">Abmas.US ISP Information</a></dt><dt>3.2. <a href="secure.html#namedrscfiles">DNS (named) Resource Files</a></dt><dt>4.1. <a href="Big500users.html#ch5-filelocations">Domain: <code class="constant">MEGANET</code>, File Locations for Servers</a></dt><dt>5.1. <a href="happy.html#sbehap-privs">Current Privilege Capabilities</a></dt><dt>5.2. <a href="happy.html#oldapreq">Required OpenLDAP Linux Packages</a></dt><dt>5.3. <a href="happy.html#sbehap-bigacct">Abmas Network Users and Groups</a></dt><dt>5.4. <a href="happy.html#proffold">Default Profile Redirections</a></dt><dt>9.1. <a href="ntmigration.html#ch8-vampire">Samba <code class="filename">smb.conf</code> Scripts Essential to Samba Operation</a></dt><dt>13.1. <a href="HA.html#ProbList">Effect of Common Problems</a></dt><dt>16.1. <a href="primer.html#capsstats01">Windows Me Startup Broadcast Capture Statistics</a></dt><dt>16.2. <a href="primer.html#capsstats02">Second Machine (Windows 98) Capture Statistics</a></dt></dl></div><div class="list-of-examples"><p><b>List of Examples</b></p><dl><dt>1.1. <a href="simple.html#draft-smbconf">Drafting Office <code class="filename">smb.conf</code> File</a></dt><dt>1.2. <a href="simple.html#charity-smbconfnew">Charity Administration Office <code class="filename">smb.conf</code> New-style File</a></dt><dt>1.3. <a href="simple.html#charity-smbconf">Charity Administration Office <code class="filename">smb.conf</code> Old-style File</a></dt><dt>1.4. <a href="simple.html#MEreg">Windows Me Registry Edit File: Disable Password Caching</a></dt><dt>1.5. <a href="simple.html#acctconf">Accounting Office Network <code class="filename">smb.conf</code> Old Style Configuration File</a></dt><dt>2.1. <a href="small.html#initGrps">Script to Map Windows NT Groups to UNIX Groups</a></dt><dt>2.2. <a href="small.html#dhcp01">Abmas Accounting DHCP Server Configuration File <code class="filename">/etc/dhcpd.conf</code></a></dt><dt>2.3. <a href="small.html#acct2conf">Accounting Office Network <code class="filename">smb.conf</code> File [globals] Section</a></dt><dt>2.4. <a href="small.html#acct3conf">Accounting Office Network <code class="filename">smb.conf</code> File Services and Shares Section</a></dt><dt>3.1. <a href="secure.html#ch4memoryest">Estimation of Memory Requirements</a></dt><dt>3.2. <a href="secure.html#ch4diskest">Estimation of Disk Storage Requirements</a></dt><dt>3.3. <a href="secure.html#ch4natfw">NAT Firewall Configuration Script</a></dt><dt>3.4. <a href="secure.html#promisnet">130 User Network with <span class="emphasis"><em>tdbsam</em></span> [globals] Section</a></dt><dt>3.5. <a href="secure.html#promisnetsvca">130 User Network with <span class="emphasis"><em>tdbsam</em></span> Services Section Part A</a></dt><dt>3.6. <a href="secure.html#promisnetsvcb">130 User Network with <span class="emphasis"><em>tdbsam</em></span> Services Section Part B</a></dt><dt>3.7. <a href="secure.html#ch4initGrps">Script to Map Windows NT Groups to UNIX Groups</a></dt><dt>3.8. <a href="secure.html#prom-dhcp">DHCP Server Configuration File <code class="filename">/etc/dhcpd.conf</code></a></dt><dt>3.9. <a href="secure.html#ch4namedcfg">DNS Master Configuration File <code class="filename">/etc/named.conf</code> Master Section</a></dt><dt>3.10. <a href="secure.html#ch4namedvarfwd">DNS Master Configuration File <code class="filename">/etc/named.conf</code> Forward Lookup Definition Section</a></dt><dt>3.11. <a href="secure.html#ch4namedvarrev">DNS Master Configuration File <code class="filename">/etc/named.conf</code> Reverse Lookup Definition Section</a></dt><dt>3.12. <a href="secure.html#eth1zone">DNS 192.168.1 Reverse Zone File</a></dt><dt>3.13. <a href="secure.html#eth2zone">DNS 192.168.2 Reverse Zone File</a></dt><dt>3.14. <a href="secure.html#abmasbiz">DNS Abmas.biz Forward Zone File</a></dt><dt>3.15. <a href="secure.html#abmasus">DNS Abmas.us Forward Zone File</a></dt><dt>4.1. <a href="Big500users.html#ch5-massivesmb">Server: MASSIVE (PDC), File: <code class="filename">/etc/samba/smb.conf</code></a></dt><dt>4.2. <a href="Big500users.html#ch5-dc-common">Server: MASSIVE (PDC), File: <code class="filename">/etc/samba/dc-common.conf</code></a></dt><dt>4.3. <a href="Big500users.html#ch5-commonsmb">Common Samba Configuration File: <code class="filename">/etc/samba/common.conf</code></a></dt><dt>4.4. <a href="Big500users.html#ch5-bldg1-smb">Server: BLDG1 (Member), File: smb.conf</a></dt><dt>4.5. <a href="Big500users.html#ch5-bldg2-smb">Server: BLDG2 (Member), File: smb.conf</a></dt><dt>4.6. <a href="Big500users.html#ch5-dommem-smb">Common Domain Member Include File: dom-mem.conf</a></dt><dt>4.7. <a href="Big500users.html#massive-dhcp">Server: MASSIVE, File: dhcpd.conf</a></dt><dt>4.8. <a href="Big500users.html#bldg1dhcp">Server: BLDG1, File: dhcpd.conf</a></dt><dt>4.9. <a href="Big500users.html#bldg2dhcp">Server: BLDG2, File: dhcpd.conf</a></dt><dt>4.10. <a href="Big500users.html#massive-nameda">Server: MASSIVE, File: named.conf, Part: A</a></dt><dt>4.11. <a href="Big500users.html#massive-namedb">Server: MASSIVE, File: named.conf, Part: B</a></dt><dt>4.12. <a href="Big500users.html#massive-namedc">Server: MASSIVE, File: named.conf, Part: C</a></dt><dt>4.13. <a href="Big500users.html#abmasbizdns">Forward Zone File: abmas.biz.hosts</a></dt><dt>4.14. <a href="Big500users.html#abmasusdns">Forward Zone File: abmas.biz.hosts</a></dt><dt>4.15. <a href="Big500users.html#bldg12nameda">Servers: BLDG1/BLDG2, File: named.conf, Part: A</a></dt><dt>4.16. <a href="Big500users.html#bldg12namedb">Servers: BLDG1/BLDG2, File: named.conf, Part: B</a></dt><dt>4.17. <a href="Big500users.html#ch5-initgrps">Initialize Groups Script, File: /etc/samba/initGrps.sh</a></dt><dt>5.1. <a href="happy.html#sbehap-dbconf">LDAP DB_CONFIG File</a></dt><dt>5.2. <a href="happy.html#sbehap-slapdconf">LDAP Master Configuration File <code class="filename">/etc/openldap/slapd.conf</code> Part A</a></dt><dt>5.3. <a href="happy.html#sbehap-slapdconf2">LDAP Master Configuration File <code class="filename">/etc/openldap/slapd.conf</code> Part B</a></dt><dt>5.4. <a href="happy.html#sbehap-nss01">Configuration File for NSS LDAP Support <code class="filename">/etc/ldap.conf</code></a></dt><dt>5.5. <a href="happy.html#sbehap-nss02">Configuration File for NSS LDAP Clients Support <code class="filename">/etc/ldap.conf</code></a></dt><dt>5.6. <a href="happy.html#sbehap-massive-smbconfa">LDAP Based <code class="filename">smb.conf</code> File, Server: MASSIVE global Section: Part A</a></dt><dt>5.7. <a href="happy.html#sbehap-massive-smbconfb">LDAP Based <code class="filename">smb.conf</code> File, Server: MASSIVE global Section: Part B</a></dt><dt>5.8. <a href="happy.html#sbehap-bldg1-smbconf">LDAP Based <code class="filename">smb.conf</code> File, Server: BLDG1</a></dt><dt>5.9. <a href="happy.html#sbehap-bldg2-smbconf">LDAP Based <code class="filename">smb.conf</code> File, Server: BLDG2</a></dt><dt>5.10. <a href="happy.html#sbehap-shareconfa">LDAP Based <code class="filename">smb.conf</code> File, Shares Section Part A</a></dt><dt>5.11. <a href="happy.html#sbehap-shareconfb">LDAP Based <code class="filename">smb.conf</code> File, Shares Section Part B</a></dt><dt>5.12. <a href="happy.html#sbehap-ldifadd">LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF</a></dt><dt>6.1. <a href="net2000users.html#ch7-LDAP-master">LDAP Master Server Configuration File <code class="filename">/etc/openldap/slapd.conf</code></a></dt><dt>6.2. <a href="net2000users.html#ch7-LDAP-slave">LDAP Slave Configuration File <code class="filename">/etc/openldap/slapd.conf</code></a></dt><dt>6.3. <a href="net2000users.html#ch7-massmbconfA">Primary Domain Controller <code class="filename">smb.conf</code> File Part A</a></dt><dt>6.4. <a href="net2000users.html#ch7-massmbconfB">Primary Domain Controller <code class="filename">smb.conf</code> File Part B</a></dt><dt>6.5. <a href="net2000users.html#ch7-massmbconfC">Primary Domain Controller <code class="filename">smb.conf</code> File Part C</a></dt><dt>6.6. <a href="net2000users.html#ch7-slvsmbocnfA">Backup Domain Controller <code class="filename">smb.conf</code> File Part A</a></dt><dt>6.7. <a href="net2000users.html#ch7-slvsmbocnfB">Backup Domain Controller <code class="filename">smb.conf</code> File Part B</a></dt><dt>7.1. <a href="unixclients.html#ch9-sdmsdc">Samba Domain Member in Samba Domain Using LDAP <code class="filename">smb.conf</code> File</a></dt><dt>7.2. <a href="unixclients.html#ch9-ldifadd">LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF</a></dt><dt>7.3. <a href="unixclients.html#ch9-sdmlcnf">Configuration File for NSS LDAP Support <code class="filename">/etc/ldap.conf</code></a></dt><dt>7.4. <a href="unixclients.html#ch9-sdmnss">NSS using LDAP for Identity Resolution File: <code class="filename">/etc/nsswitch.conf</code></a></dt><dt>7.5. <a href="unixclients.html#ch0-NT4DSDM">Samba Domain Member Server Using Winbind <code class="filename">smb.conf</code> File for NT4 Domain</a></dt><dt>7.6. <a href="unixclients.html#ch0-NT4DSCM">Samba Domain Member Server Using Local Accounts <code class="filename">smb.conf</code> File for NT4 Domain</a></dt><dt>7.7. <a href="unixclients.html#ch9-adssdm">Samba Domain Member <code class="filename">smb.conf</code> File for Active Directory Membership</a></dt><dt>7.8. <a href="unixclients.html#sbe-idmapridex">Example <code class="filename">smb.conf</code> File Using <code class="constant">idmap_rid</code></a></dt><dt>7.9. <a href="unixclients.html#sbeunxa">Typical ADS Style Domain <code class="filename">smb.conf</code> File</a></dt><dt>7.10. <a href="unixclients.html#sbewinbindex">ADS Membership Using RFC2307bis Identity Resolution <code class="filename">smb.conf</code> File</a></dt><dt>7.11. <a href="unixclients.html#ch9-pamwnbdlogin">SUSE: PAM <code class="filename">login</code> Module Using Winbind</a></dt><dt>7.12. <a href="unixclients.html#ch9-pamwbndxdm">SUSE: PAM <code class="filename">xdm</code> Module Using Winbind</a></dt><dt>7.13. <a href="unixclients.html#ch9-rhsysauth">Red Hat 9: PAM System Authentication File: <code class="filename">/etc/pam.d/system-auth</code> Module Using Winbind</a></dt><dt>9.1. <a href="ntmigration.html#sbent4smb">NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: A</a></dt><dt>9.2. <a href="ntmigration.html#sbent4smb2">NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: B</a></dt><dt>9.3. <a href="ntmigration.html#sbentslapd">NT4 Migration LDAP Server Configuration File: <code class="filename">/etc/openldap/slapd.conf</code> Part A</a></dt><dt>9.4. <a href="ntmigration.html#sbentslapd2">NT4 Migration LDAP Server Configuration File: <code class="filename">/etc/openldap/slapd.conf</code> Part B</a></dt><dt>9.5. <a href="ntmigration.html#sbrntldapconf">NT4 Migration NSS LDAP File: <code class="filename">/etc/ldap.conf</code></a></dt><dt>9.6. <a href="ntmigration.html#sbentnss">NT4 Migration NSS Control File: <code class="filename">/etc/nsswitch.conf</code> (Stage:1)</a></dt><dt>9.7. <a href="ntmigration.html#sbentnss2">NT4 Migration NSS Control File: <code class="filename">/etc/nsswitch.conf</code> (Stage:2)</a></dt><dt>10.1. <a href="nw4migration.html#sbeamg">A Rough Tool to Create an LDIF File from the System Account Files</a></dt><dt>10.2. <a href="nw4migration.html#ch8ldap">NSS LDAP Control File /etc/ldap.conf</a></dt><dt>10.3. <a href="nw4migration.html#sbepu2">The PAM Control File <code class="filename">/etc/security/pam_unix2.conf</code></a></dt><dt>10.4. <a href="nw4migration.html#ch8smbconf">Samba Configuration File smb.conf Part A</a></dt><dt>10.5. <a href="nw4migration.html#ch8smbconf2">Samba Configuration File smb.conf Part B</a></dt><dt>10.6. <a href="nw4migration.html#ch8smbconf3">Samba Configuration File smb.conf Part C</a></dt><dt>10.7. <a href="nw4migration.html#ch8smbconf4">Samba Configuration File smb.conf Part D</a></dt><dt>10.8. <a href="nw4migration.html#ch8smbconf5">Samba Configuration File smb.conf Part E</a></dt><dt>10.9. <a href="nw4migration.html#sbersync">Rsync Script</a></dt><dt>10.10. <a href="nw4migration.html#sbexcld">Rsync Files Exclusion List <code class="filename">/root/excludes.txt</code></a></dt><dt>10.11. <a href="nw4migration.html#ch8ideal">Idealx smbldap-tools Control File Part A</a></dt><dt>10.12. <a href="nw4migration.html#ch8ideal2">Idealx smbldap-tools Control File Part B</a></dt><dt>10.13. <a href="nw4migration.html#ch8ideal3">Idealx smbldap-tools Control File Part C</a></dt><dt>10.14. <a href="nw4migration.html#ch8ideal4">Idealx smbldap-tools Control File Part D</a></dt><dt>10.15. <a href="nw4migration.html#ch8kix">Kixtart Control File File: logon.kix</a></dt><dt>10.16. <a href="nw4migration.html#ch8kix2">Kixtart Control File File: main.kix</a></dt><dt>10.17. <a href="nw4migration.html#ch8kix3">Kixtart Control File File: setup.kix, Part A</a></dt><dt>10.18. <a href="nw4migration.html#ch8kix3b">Kixtart Control File File: setup.kix, Part B</a></dt><dt>10.19. <a href="nw4migration.html#ch8kix4">Kixtart Control File File: acct.kix</a></dt><dt>12.1. <a href="DomApps.html#ch10-krb5conf">Kerberos Configuration File: <code class="filename">/etc/krb5.conf</code></a></dt><dt>12.2. <a href="DomApps.html#ch10-smbconf">Samba Configuration File: <code class="filename">/etc/samba/smb.conf</code></a></dt><dt>12.3. <a href="DomApps.html#ch10-etcnsscfg">NSS Configuration File Extract File: <code class="filename">/etc/nsswitch.conf</code></a></dt><dt>12.4. <a href="DomApps.html#etcsquidcfg">Squid Configuration File Extract <code class="filename">/etc/squid.conf</code> [ADMINISTRATIVE PARAMETERS Section]</a></dt><dt>12.5. <a href="DomApps.html#etcsquid2">Squid Configuration File extract File: <code class="filename">/etc/squid.conf</code> [AUTHENTICATION PARAMETERS Section]</a></dt><dt>15.1. <a href="appendix.html#ch12SL">A Useful Samba Control Script for SUSE Linux</a></dt><dt>15.2. <a href="appendix.html#ch12RHscript">A Sample Samba Control Script for Red Hat Linux</a></dt><dt>15.3. <a href="appendix.html#loopback">DNS Localhost Forward Zone File: <code class="filename">/var/lib/named/localhost.zone</code></a></dt><dt>15.4. <a href="appendix.html#dnsloopy">DNS Localhost Reverse Zone File: <code class="filename">/var/lib/named/127.0.0.zone</code></a></dt><dt>15.5. <a href="appendix.html#roothint">DNS Root Name Server Hint File: <code class="filename">/var/lib/named/root.hint</code></a></dt><dt>15.6. <a href="appendix.html#sbehap-ldapreconfa">LDAP Pre-configuration Script: <code class="filename">SMBLDAP-ldif-preconfig.sh</code> Part A</a></dt><dt>15.7. <a href="appendix.html#sbehap-ldapreconfb">LDAP Pre-configuration Script: <code class="filename">SMBLDAP-ldif-preconfig.sh</code> Part B</a></dt><dt>15.8. <a href="appendix.html#sbehap-ldapreconfc">LDAP Pre-configuration Script: <code class="filename">SMBLDAP-ldif-preconfig.sh</code> Part C</a></dt><dt>15.9. <a href="appendix.html#sbehap-ldifpata">LDIF Pattern File Used to Pre-configure LDAP Part A</a></dt><dt>15.10. <a href="appendix.html#sbehap-ldifpatb">LDIF Pattern File Used to Pre-configure LDAP Part B</a></dt><dt>15.11. <a href="appendix.html#lamcfg">Example LAM Configuration File <code class="filename">config.cfg</code></a></dt><dt>15.12. <a href="appendix.html#lamconf">LAM Profile Control File <code class="filename">lam.conf</code></a></dt></dl></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="pr01.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top"> </td><td width="20%" align="center"> </td><td width="40%" align="right" valign="top"> About the Cover Artwork</td></tr></table></div></body></html> -
trunk/server/docs/htmldocs/Samba3-ByExample/ix01.html
r414 r599 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Index</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 4.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="go01.html" title="Glossary"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Index</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="go01.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> </td></tr></table><hr></div><div class="index"><div class="titlepage"><div><div><h2 class="title"><a name="id2630726"></a>Index</h2></div></div></div><div class="index"><div class="indexdiv"><h3>Symbols</h3><dl><dt>%LOGONSERVER%, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>%USERNAME%, <a class="indexterm" href="happy.html#id2572363">Roaming Profile Background</a>, <a class="indexterm" href="happy.html#id2572664">Profile Changes</a></dt><dt>%USERPROFILE%, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>/data/ldap, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>/etc/cups/mime.convs, <a class="indexterm" href="simple.html#id2551953">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a></dt><dt>/etc/cups/mime.types, <a class="indexterm" href="simple.html#id2551953">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a></dt><dt>/etc/dhcpd.conf, <a class="indexterm" href="small.html#id2555790">Implementation</a>, <a class="indexterm" href="small.html#id2557337">Validation</a>, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>/etc/exports, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></dt><dt>/etc/group, <a class="indexterm" href="happy.html#id2571856">Technical Issues</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="upgrades.html#id2600758">Replacing a Domain Member Server</a>, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a>, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>/etc/hosts, <a class="indexterm" href="simple.html#id2551061">Implementation</a>, <a class="indexterm" href="small.html#id2555790">Implementation</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="Big500users.html#id2566362">Server Preparation: All Servers</a>, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a>, <a class="indexterm" href="DomApps.html#id2616622">Kerberos Configuration</a>, <a class="indexterm" href="HA.html#id2619404">Bad Hostnames</a></dt><dt>/etc/krb5.conf, <a class="indexterm" href="unixclients.html#id2595411">IDMAP Storage in LDAP using Winbind</a>, <a class="indexterm" href="DomApps.html#id2616622">Kerberos Configuration</a></dt><dt>/etc/ldap.conf, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="unixclients.html#id2595411">IDMAP Storage in LDAP using Winbind</a>, <a class="indexterm" href="unixclients.html#id2596006">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a class="indexterm" href="ntmigration.html#id2602148">NT4 Migration Using LDAP Backend</a>, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a></dt><dt>/etc/mime.convs, <a class="indexterm" href="small.html#id2555790">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id2566362">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>/etc/mime.types, <a class="indexterm" href="small.html#id2555790">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id2566362">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>/etc/named.conf, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></dt><dt>/etc/nsswitch.conf, <a class="indexterm" href="small.html#id2555790">Implementation</a>, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="Big500users.html#id2566940">Configuration for Server: MASSIVE</a>, <a class="indexterm" href="Big500users.html#ch5-domsvrspec">Configuration Specific to Domain Member Servers: BLDG1, BLDG2</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#id2594807">IDMAP_RID with Winbind</a>, <a class="indexterm" href="unixclients.html#id2596006">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id2602148">NT4 Migration Using LDAP Backend</a></dt><dt>/etc/openldap/slapd.conf, <a class="indexterm" href="happy.html#id2573240">Debugging LDAP</a>, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a>, <a class="indexterm" href="net2000users.html#id2585064">Implementation</a></dt><dt>/etc/passwd, <a class="indexterm" href="small.html#id2555790">Implementation</a>, <a class="indexterm" href="secure.html#id2560183">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2566940">Configuration for Server: MASSIVE</a>, <a class="indexterm" href="happy.html#id2576821">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id2600758">Replacing a Domain Member Server</a>, <a class="indexterm" href="ntmigration.html#id2601658">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id2606305">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2614131">Share Point Directory and File Permissions</a>, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a class="indexterm" href="primer.html#id2627129">Findings and Comments</a></dt><dt>/etc/rc.d/boot.local, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="Big500users.html#id2566940">Configuration for Server: MASSIVE</a></dt><dt>/etc/rc.d/rc.local, <a class="indexterm" href="small.html#id2555790">Implementation</a></dt><dt>/etc/resolv.conf, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a>, <a class="indexterm" href="Big500users.html#id2566362">Server Preparation: All Servers</a></dt><dt>/etc/samba, <a class="indexterm" href="appendix.html#id2621811">Samba System File Location</a></dt><dt>/etc/samba/secrets.tdb, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>/etc/samba/smbusers, <a class="indexterm" href="Big500users.html#id2566362">Server Preparation: All Servers</a></dt><dt>/etc/shadow, <a class="indexterm" href="upgrades.html#id2600758">Replacing a Domain Member Server</a>, <a class="indexterm" href="nw4migration.html#id2606305">Technical Issues</a></dt><dt>/etc/squid/squid.conf, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>/etc/syslog.conf, <a class="indexterm" href="happy.html#id2573240">Debugging LDAP</a></dt><dt>/etc/xinetd.d, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a>, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dt>/lib/libnss_ldap.so.2, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dt>/opt/IDEALX/sbin, <a class="indexterm" href="ntmigration.html#id2602148">NT4 Migration Using LDAP Backend</a></dt><dt>/proc/sys/net/ipv4/ip_forward, <a class="indexterm" href="small.html#id2555790">Implementation</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a></dt><dt>/usr/bin, <a class="indexterm" href="appendix.html#id2621811">Samba System File Location</a></dt><dt>/usr/lib/samba, <a class="indexterm" href="appendix.html#id2621811">Samba System File Location</a></dt><dt>/usr/local, <a class="indexterm" href="appendix.html#id2621811">Samba System File Location</a></dt><dt>/usr/local/samba, <a class="indexterm" href="appendix.html#id2621811">Samba System File Location</a></dt><dt>/usr/local/samba/var/locks, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></dt><dt>/usr/sbin, <a class="indexterm" href="appendix.html#id2621811">Samba System File Location</a></dt><dt>/usr/share, <a class="indexterm" href="appendix.html#id2621811">Samba System File Location</a></dt><dt>/usr/share/samba/swat, <a class="indexterm" href="appendix.html#id2621811">Samba System File Location</a></dt><dt>/usr/share/swat, <a class="indexterm" href="appendix.html#id2621811">Samba System File Location</a></dt><dt>/var/cache/samba, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></dt><dt>/var/lib/samba, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="appendix.html#id2621811">Samba System File Location</a></dt><dt>/var/log/ldaplogs, <a class="indexterm" href="happy.html#id2573240">Debugging LDAP</a></dt><dt>/var/log/samba, <a class="indexterm" href="appendix.html#id2621811">Samba System File Location</a></dt><dt>8-bit, <a class="indexterm" href="upgrades.html#id2599385">International Language Support</a></dt></dl></div><div class="indexdiv"><h3></h3><dl><dt>, <a class="indexterm" href="simple.html#id2551061">Implementation</a>, <a class="indexterm" href="simple.html#id2551953">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id2555790">Implementation</a>, <a class="indexterm" href="secure.html#id2560183">Samba Configuration</a>, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a>, <a class="indexterm" href="Big500users.html#id2565635">Implementation</a>, <a class="indexterm" href="happy.html#sbehap-ppc">Addition of Machines to the Domain</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a class="indexterm" href="net2000users.html#id2585064">Implementation</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id2594807">IDMAP_RID with Winbind</a>, <a class="indexterm" href="unixclients.html#id2595411">IDMAP Storage in LDAP using Winbind</a>, <a class="indexterm" href="unixclients.html#id2596006">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a class="indexterm" href="upgrades.html#sbeug1">Location of config files</a>, <a class="indexterm" href="ntmigration.html#id2602148">NT4 Migration Using LDAP Backend</a>, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a>, <a class="indexterm" href="DomApps.html#id2617564">NSS Configuration</a></dt><dd><dl><dt>Domain account, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>liability, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a></dt><dt>logon, <a class="indexterm" href="simple.html#id2551953">Implementation</a></dt><dt>problem, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a></dt><dt>transparent inter-operability, <a class="indexterm" href="DomApps.html#id2618286">Questions and Answers</a></dt></dl></dd></dl></div><div class="indexdiv"><h3>A</h3><dl><dt>abmas-netfw.sh, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a></dt><dt>accept, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a></dt><dt>accepts liability, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a></dt><dt>access, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2613658">Checkpoint Controls</a></dt><dt>access control, <a class="indexterm" href="kerberos.html#id2612822">Kerberos Exposed</a>, <a class="indexterm" href="kerberos.html#id2614585">Using the MMC Computer Management Interface</a></dt><dt>Access Control Lists (see ACLs)</dt><dt>access control settings, <a class="indexterm" href="kerberos.html#id2613169">Share Access Controls</a></dt><dt>access controls, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2613518">Share Definition Controls</a></dt><dt>accessible, <a class="indexterm" href="kerberos.html#id2614131">Share Point Directory and File Permissions</a></dt><dt>account, <a class="indexterm" href="happy.html#id2571022">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="kerberos.html#id2613169">Share Access Controls</a></dt><dd><dl><dt>ADS Domain, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt></dl></dd><dt>account credentials, <a class="indexterm" href="primer.html#id2627129">Findings and Comments</a></dt><dt>account information, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a></dt><dt>account names, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a></dt><dt>account policies, <a class="indexterm" href="appendix.html#id2623411">The LDAP Account Manager</a></dt><dt>accountable, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a>, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a></dt><dt>accounts</dt><dd><dl><dt>authoritative, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a></dt><dt>Domain, <a class="indexterm" href="ntmigration.html#id2601332">Introduction</a>, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a></dt><dt>group, <a class="indexterm" href="ntmigration.html#id2601332">Introduction</a>, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a></dt><dt>machine, <a class="indexterm" href="ntmigration.html#id2601332">Introduction</a>, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a></dt><dt>manage, <a class="indexterm" href="appendix.html#id2623411">The LDAP Account Manager</a></dt><dt>user, <a class="indexterm" href="ntmigration.html#id2601332">Introduction</a>, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a></dt></dl></dd><dt>ACL, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a>, <a class="indexterm" href="kerberos.html#id2613658">Checkpoint Controls</a></dt><dt>ACLs, <a class="indexterm" href="happy.html#id2583197">Key Points Learned</a>, <a class="indexterm" href="kerberos.html#id2613169">Share Access Controls</a>, <a class="indexterm" href="kerberos.html#id2613518">Share Definition Controls</a></dt><dt>acquisitions, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a></dt><dt>Act!, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>ACT! database, <a class="indexterm" href="appendix.html#id2625028">Act! Database Sharing</a></dt><dt>Act!Diag, <a class="indexterm" href="appendix.html#id2625028">Act! Database Sharing</a></dt><dt>Active Directory, <a class="indexterm" href="happy.html#id2571399">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#sbehap-locgrppol">The Local Group Policy</a>, <a class="indexterm" href="net2000users.html#id2583824">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#id2589282">Assignment Tasks</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id2594807">IDMAP_RID with Winbind</a>, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a>, <a class="indexterm" href="kerberos.html#id2615257">Key Points Learned</a>, <a class="indexterm" href="kerberos.html#id2615391">Questions and Answers</a>, <a class="indexterm" href="DomApps.html">Integrating Additional Services</a>, <a class="indexterm" href="DomApps.html#id2616051">Assignment Tasks</a>, <a class="indexterm" href="DomApps.html#id2616193">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id2617012">Samba Configuration</a>, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dd><dl><dt>authentication, <a class="indexterm" href="DomApps.html#id2617829">Squid Configuration</a></dt><dt>domain, <a class="indexterm" href="DomApps.html#id2617012">Samba Configuration</a></dt><dt>join, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>management tools, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>realm, <a class="indexterm" href="HA.html#id2619404">Bad Hostnames</a></dt><dt>Replacement, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>server, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id2616622">Kerberos Configuration</a></dt><dt>Server, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>tree, <a class="indexterm" href="DomApps.html#id2617012">Samba Configuration</a></dt></dl></dd><dt>active directory, <a class="indexterm" href="ntmigration.html#id2601658">Technical Issues</a></dt><dt>AD printer publishing, <a class="indexterm" href="happy.html#id2582625">Uploading Printer Drivers to Samba Servers</a></dt><dt>ADAM, <a class="indexterm" href="happy.html#id2571399">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#id2595411">IDMAP Storage in LDAP using Winbind</a></dt><dt>add group script, <a class="indexterm" href="upgrades.html#id2599919">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>add machine script, <a class="indexterm" href="upgrades.html#id2599919">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>Add Printer Wizard</dt><dd><dl><dt>APW, <a class="indexterm" href="happy.html#id2582625">Uploading Printer Drivers to Samba Servers</a></dt></dl></dd><dt>add user script, <a class="indexterm" href="upgrades.html#id2599919">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>add user to group script, <a class="indexterm" href="upgrades.html#id2599919">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>adduser, <a class="indexterm" href="small.html#id2555790">Implementation</a>, <a class="indexterm" href="secure.html#id2560183">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2566940">Configuration for Server: MASSIVE</a></dt><dt>adequate precautions, <a class="indexterm" href="upgrades.html#id2598125">Introduction</a></dt><dt>administrative installation, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a></dt><dt>administrative rights, <a class="indexterm" href="kerberos.html#id2613658">Checkpoint Controls</a></dt><dt>administrator, <a class="indexterm" href="small.html#id2555790">Implementation</a>, <a class="indexterm" href="secure.html#id2560183">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2566362">Server Preparation: All Servers</a></dt><dt>ADMT, <a class="indexterm" href="upgrades.html#id2601160">Migration of Samba Accounts to Active Directory</a></dt><dt>ADS, <a class="indexterm" href="unixclients.html#id2595411">IDMAP Storage in LDAP using Winbind</a>, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id2616622">Kerberos Configuration</a>, <a class="indexterm" href="HA.html#id2619404">Bad Hostnames</a></dt><dd><dl><dt>server, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt></dl></dd><dt>ADS Domain, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>affordability, <a class="indexterm" href="net2000users.html#id2584231">The Nature of Windows Networking Protocols</a></dt><dt>alarm, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a></dt><dt>algorithm, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>allow trusted domains, <a class="indexterm" href="unixclients.html#id2594807">IDMAP_RID with Winbind</a></dt><dt>alternative, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a></dt><dt>analysis, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>anonymous connection, <a class="indexterm" href="small.html#id2557337">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>Apache Web server, <a class="indexterm" href="DomApps.html#id2618286">Questions and Answers</a></dt><dt>appliance mode, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a></dt><dt>application server, <a class="indexterm" href="secure.html#id2558863">Technical Issues</a>, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a></dt><dt>application servers, <a class="indexterm" href="net2000users.html#id2584231">The Nature of Windows Networking Protocols</a></dt><dt>application/octet-stream, <a class="indexterm" href="simple.html#id2551953">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id2555790">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id2566362">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>APW, <a class="indexterm" href="happy.html#id2582625">Uploading Printer Drivers to Samba Servers</a></dt><dt>arp, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>assessment, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a></dt><dt>assistance, <a class="indexterm" href="ch14.html#id2620874">Free Support</a></dt><dt>assumptions, <a class="indexterm" href="HA.html#id2620704">Key Points Learned</a></dt><dt>authconfig, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dt>authenticate, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a>, <a class="indexterm" href="DomApps.html#id2617012">Samba Configuration</a></dt><dt>authenticated, <a class="indexterm" href="DomApps.html#id2616051">Assignment Tasks</a></dt><dt>authenticated connection, <a class="indexterm" href="small.html#id2557337">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>authentication, <a class="indexterm" href="net2000users.html#id2584231">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id2606228">Dissection and Discussion</a>, <a class="indexterm" href="DomApps.html">Integrating Additional Services</a>, <a class="indexterm" href="DomApps.html#id2616193">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id2617564">NSS Configuration</a>, <a class="indexterm" href="DomApps.html#id2618286">Questions and Answers</a></dt><dd><dl><dt>plain-text, <a class="indexterm" href="DomApps.html#id2618286">Questions and Answers</a></dt></dl></dd><dt>authentication process, <a class="indexterm" href="unixclients.html#id2590094">Implementation</a></dt><dt>authentication protocols, <a class="indexterm" href="DomApps.html#id2618225">Key Points Learned</a></dt><dt>authoritative, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a></dt><dt>authorized location, <a class="indexterm" href="kerberos.html#id2612822">Kerberos Exposed</a></dt><dt>auto-generated SID, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a></dt><dt>automatically allocate, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a></dt><dt>availability, <a class="indexterm" href="HA.html">Performance, Reliability, and Availability</a></dt></dl></div><div class="indexdiv"><h3>B</h3><dl><dt>backends, <a class="indexterm" href="DomApps.html">Integrating Additional Services</a></dt><dt>background communication, <a class="indexterm" href="net2000users.html#id2588370">Questions and Answers</a></dt><dt>Backup, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a></dt><dt>Backup Domain Controller (see BDC)</dt><dt>bandwidth, <a class="indexterm" href="DomApps.html#id2616051">Assignment Tasks</a></dt><dd><dl><dt>requirements, <a class="indexterm" href="net2000users.html#id2584137">User Needs</a></dt></dl></dd><dt>bandwidth calculations, <a class="indexterm" href="secure.html#id2559135">Hardware Requirements</a></dt><dt>BDC, <a class="indexterm" href="Big500users.html#id2565409">Technical Issues</a>, <a class="indexterm" href="happy.html">Making Happy Users</a>, <a class="indexterm" href="happy.html#id2571262">Assignment Tasks</a>, <a class="indexterm" href="happy.html#id2571399">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#id2573925">Samba Server Implementation</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="net2000users.html#id2584231">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="net2000users.html#id2588223">Key Points Learned</a>, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a>, <a class="indexterm" href="ntmigration.html#id2604606">NT4 Migration Using tdbsam Backend</a>, <a class="indexterm" href="HA.html#id2620205">Use and Location of BDCs</a></dt><dt>benefit, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a></dt><dt>best practices, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a></dt><dt>bias, <a class="indexterm" href="kerberos.html#id2615391">Questions and Answers</a></dt><dt>binary database, <a class="indexterm" href="secure.html#id2559329">Implementation</a></dt><dt>binary files, <a class="indexterm" href="upgrades.html#id2600427">Updating a Samba-3 Installation</a></dt><dt>binary package, <a class="indexterm" href="upgrades.html#id2600427">Updating a Samba-3 Installation</a></dt><dt>bind interfaces only, <a class="indexterm" href="secure.html#id2559329">Implementation</a></dt><dt>broadcast, <a class="indexterm" href="HA.html#id2619596">Routed Networks</a>, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dd><dl><dt>directed, <a class="indexterm" href="net2000users.html#id2584231">The Nature of Windows Networking Protocols</a></dt><dt>mailslot, <a class="indexterm" href="net2000users.html#id2584231">The Nature of Windows Networking Protocols</a></dt></dl></dd><dt>broadcast messages, <a class="indexterm" href="secure.html#id2559329">Implementation</a></dt><dt>broadcast storms, <a class="indexterm" href="HA.html#id2619769">Network Collisions</a></dt><dt>broken, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a></dt><dt>broken behavior, <a class="indexterm" href="HA.html#id2618892">Dissection and Discussion</a></dt><dt>browse, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>browse master, <a class="indexterm" href="primer.html#id2625878">Findings</a></dt><dt>Browse Master, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dt>browse.dat, <a class="indexterm" href="upgrades.html#id2600758">Replacing a Domain Member Server</a></dt><dt>Browser Election Service, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dt>browsing, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id2616193">Technical Issues</a>, <a class="indexterm" href="primer.html#id2625502">Assignment Tasks</a></dt><dt>budgetted, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a></dt><dt>bug fixes, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a></dt><dt>bug report, <a class="indexterm" href="ch14.html#id2620874">Free Support</a></dt></dl></div><div class="indexdiv"><h3>C</h3><dl><dt>cache, <a class="indexterm" href="appendix.html#id2625113">Opportunistic Locking Controls</a></dt><dt>cache directories, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>caching, <a class="indexterm" href="HA.html#id2619868">Samba Configuration</a></dt><dt>case-sensitive, <a class="indexterm" href="DomApps.html#id2616622">Kerberos Configuration</a></dt><dt>centralized storage, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a></dt><dt>character set, <a class="indexterm" href="upgrades.html#id2599385">International Language Support</a></dt><dt>check samba daemons, <a class="indexterm" href="small.html#id2557337">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>check-point, <a class="indexterm" href="kerberos.html#id2613518">Share Definition Controls</a></dt><dt>check-point controls, <a class="indexterm" href="kerberos.html#id2613658">Checkpoint Controls</a></dt><dt>Checkpoint Controls, <a class="indexterm" href="kerberos.html#id2613658">Checkpoint Controls</a></dt><dt>chgrp, <a class="indexterm" href="DomApps.html#id2617012">Samba Configuration</a></dt><dt>chkconfig, <a class="indexterm" href="simple.html#id2551061">Implementation</a>, <a class="indexterm" href="simple.html#id2551953">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id2555790">Implementation</a>, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a>, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a>, <a class="indexterm" href="net2000users.html#id2585064">Implementation</a></dt><dt>chmod, <a class="indexterm" href="DomApps.html#id2617012">Samba Configuration</a></dt><dt>choice, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>chown, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>CIFS, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a>, <a class="indexterm" href="primer.html#id2625878">Findings</a></dt><dt>cifsfs, <a class="indexterm" href="HA.html#id2618892">Dissection and Discussion</a></dt><dt>clean database, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a></dt><dt>clients per DC, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>Clock skew, <a class="indexterm" href="DomApps.html#id2616622">Kerberos Configuration</a></dt><dt>cluster, <a class="indexterm" href="HA.html#id2618805">Introduction</a></dt><dt>clustering, <a class="indexterm" href="HA.html#id2618805">Introduction</a>, <a class="indexterm" href="HA.html#id2620303">For Scalability, Use SAN-Based Storage on Samba Servers</a></dt><dt>code maintainer, <a class="indexterm" href="ch14.html#id2620874">Free Support</a></dt><dt>codepage, <a class="indexterm" href="upgrades.html#id2599385">International Language Support</a></dt><dt>collision rates, <a class="indexterm" href="HA.html#id2619769">Network Collisions</a></dt><dt>commercial, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a></dt><dt>commercial software, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a></dt><dt>commercial support, <a class="indexterm" href="ch14.html">Samba Support</a>, <a class="indexterm" href="ch14.html#id2621092">Commercial Support</a></dt><dt>Common Internet File System (see CIFS)</dt><dt>comparison</dt><dd><dl><dt>Active Directory & OpenLDAP, <a class="indexterm" href="happy.html#id2571399">Dissection and Discussion</a></dt></dl></dd><dt>compat, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>compatible, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>compile-time, <a class="indexterm" href="upgrades.html#sbeug1">Location of config files</a></dt><dt>complexities, <a class="indexterm" href="HA.html#id2618892">Dissection and Discussion</a></dt><dt>compromise, <a class="indexterm" href="happy.html#id2571164">Introduction</a>, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a>, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>computer account, <a class="indexterm" href="DomApps.html#id2617012">Samba Configuration</a></dt><dt>Computer Management, <a class="indexterm" href="kerberos.html#id2613169">Share Access Controls</a>, <a class="indexterm" href="kerberos.html#id2615391">Questions and Answers</a></dt><dt>computer name, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a></dt><dt>condemns, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>conferences, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>configuration files, <a class="indexterm" href="upgrades.html#id2598125">Introduction</a></dt><dt>configure.pl, <a class="indexterm" href="ntmigration.html#id2602148">NT4 Migration Using LDAP Backend</a></dt><dt>connection, <a class="indexterm" href="kerberos.html#id2613169">Share Access Controls</a></dt><dt>connectivity, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a></dt><dt>consequential risk, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>consultant, <a class="indexterm" href="simple.html#id2550925">Drafting Office</a>, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a>, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a></dt><dt>consumer, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>consumer expects, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>contiguous directory, <a class="indexterm" href="net2000users.html#id2585064">Implementation</a></dt><dt>contributions, <a class="indexterm" href="upgrades.html">Updating Samba-3</a></dt><dt>control files, <a class="indexterm" href="upgrades.html#id2600427">Updating a Samba-3 Installation</a></dt><dt>convmv, <a class="indexterm" href="upgrades.html#id2599385">International Language Support</a></dt><dt>copy, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a></dt><dt>corrective action, <a class="indexterm" href="HA.html#id2620452">Hardware Problems</a></dt><dt>cost, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a></dt><dt>cost-benefit, <a class="indexterm" href="nw4migration.html#id2606137">Assignment Tasks</a></dt><dt>country of origin, <a class="indexterm" href="ch14.html#id2621092">Commercial Support</a></dt><dt>Courier-IMAP, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a></dt><dt>credential, <a class="indexterm" href="kerberos.html#id2613518">Share Definition Controls</a></dt><dt>credentials, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>crippled, <a class="indexterm" href="ntmigration.html#id2601472">Dissection and Discussion</a></dt><dt>criticism, <a class="indexterm" href="kerberos.html">Active Directory, Kerberos, and Security</a>, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a></dt><dt>Critics, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>Cryptographic, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>CUPS, <a class="indexterm" href="simple.html#id2551758">Dissection and Discussion</a>, <a class="indexterm" href="small.html#id2555570">Technical Issues</a>, <a class="indexterm" href="small.html#id2555790">Implementation</a>, <a class="indexterm" href="small.html#id2558010">Key Points Learned</a>, <a class="indexterm" href="secure.html#id2559329">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id2566362">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#id2571262">Assignment Tasks</a>, <a class="indexterm" href="happy.html#id2572816">Installation of Printer Driver Auto-Download</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dd><dl><dt>queue, <a class="indexterm" href="small.html#id2555790">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id2566362">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt></dl></dd><dt>cupsd, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a></dt><dt>customer expected, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>customers, <a class="indexterm" href="ch14.html">Samba Support</a></dt></dl></div><div class="indexdiv"><h3>D</h3><dl><dt>daemon, <a class="indexterm" href="simple.html#validate1">Validation</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a>, <a class="indexterm" href="DomApps.html#id2616193">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id2618286">Questions and Answers</a>, <a class="indexterm" href="appendix.html#id2622232">Starting Samba</a></dt><dt>daemon control, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dt>data</dt><dd><dl><dt>corruption, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>integrity, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a></dt></dl></dd><dt>data corruption, <a class="indexterm" href="HA.html#id2620452">Hardware Problems</a>, <a class="indexterm" href="appendix.html#id2625028">Act! Database Sharing</a></dt><dt>data integrity, <a class="indexterm" href="HA.html#id2620452">Hardware Problems</a>, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>data storage, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a></dt><dt>database, <a class="indexterm" href="net2000users.html#id2583824">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id2588370">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id2606228">Dissection and Discussion</a></dt><dt>database applications, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>DB_CONFIG, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>DCE, <a class="indexterm" href="kerberos.html#id2612822">Kerberos Exposed</a></dt><dt>DDNS (see dynamic DNS)</dt><dt>Debian, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>default installation, <a class="indexterm" href="appendix.html#id2621811">Samba System File Location</a></dt><dt>default password, <a class="indexterm" href="appendix.html#id2623411">The LDAP Account Manager</a></dt><dt>default profile, <a class="indexterm" href="happy.html#id2571262">Assignment Tasks</a>, <a class="indexterm" href="happy.html#id2571856">Technical Issues</a></dt><dt>Default User, <a class="indexterm" href="happy.html#id2572664">Profile Changes</a>, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>defective</dt><dd><dl><dt>cables, <a class="indexterm" href="HA.html#id2620452">Hardware Problems</a></dt><dt>HUBs, <a class="indexterm" href="HA.html#id2620452">Hardware Problems</a></dt><dt>switches, <a class="indexterm" href="HA.html#id2620452">Hardware Problems</a></dt></dl></dd><dt>defects, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>defensible standards, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>defragmentation, <a class="indexterm" href="secure.html#ch4wincfg">Windows Client Configuration</a></dt><dt>delete group script, <a class="indexterm" href="upgrades.html#id2599919">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>delete user from group script, <a class="indexterm" href="upgrades.html#id2599919">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>delimiter, <a class="indexterm" href="kerberos.html#id2613658">Checkpoint Controls</a></dt><dt>dependability, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>deployment, <a class="indexterm" href="ch14.html#id2620874">Free Support</a></dt><dt>desired security setting, <a class="indexterm" href="kerberos.html#id2615047">Setting Posix ACLs in UNIX/Linux</a></dt><dt>development, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>DHCP, <a class="indexterm" href="small.html#id2555570">Technical Issues</a>, <a class="indexterm" href="small.html#id2555790">Implementation</a>, <a class="indexterm" href="small.html#id2558010">Key Points Learned</a>, <a class="indexterm" href="secure.html#ch4wincfg">Windows Client Configuration</a>, <a class="indexterm" href="Big500users.html#ch5wincfg">Windows Client Configuration</a>, <a class="indexterm" href="net2000users.html#id2584231">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="net2000users.html#id2588370">Questions and Answers</a></dt><dd><dl><dt>client, <a class="indexterm" href="HA.html#id2619404">Bad Hostnames</a></dt><dt>relay, <a class="indexterm" href="Big500users.html#id2565409">Technical Issues</a></dt><dt>Relay Agent, <a class="indexterm" href="net2000users.html#id2588370">Questions and Answers</a></dt><dt>request, <a class="indexterm" href="net2000users.html#id2588370">Questions and Answers</a></dt><dt>requests, <a class="indexterm" href="Big500users.html#id2565409">Technical Issues</a></dt><dt>servers, <a class="indexterm" href="net2000users.html#id2588370">Questions and Answers</a></dt><dt>traffic, <a class="indexterm" href="net2000users.html#id2588370">Questions and Answers</a></dt></dl></dd><dt>dhcp client validation, <a class="indexterm" href="small.html#id2557337">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>DHCP Server, <a class="indexterm" href="small.html#id2555790">Implementation</a></dt><dt>DHCP server, <a class="indexterm" href="secure.html#id2558863">Technical Issues</a></dt><dt>diagnostic, <a class="indexterm" href="unixclients.html#id2595411">IDMAP Storage in LDAP using Winbind</a></dt><dt>diffusion, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>digital rights, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>digital sign'n'seal, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>digits, <a class="indexterm" href="HA.html#id2619404">Bad Hostnames</a></dt><dt>diligence, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>directory, <a class="indexterm" href="net2000users.html#id2583824">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#id2589994">Political Issues</a>, <a class="indexterm" href="upgrades.html#sbeug1">Location of config files</a></dt><dd><dl><dt>Computers container, <a class="indexterm" href="happy.html#id2576821">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>management, <a class="indexterm" href="happy.html#id2571399">Dissection and Discussion</a></dt><dt>People container, <a class="indexterm" href="happy.html#id2576821">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>replication, <a class="indexterm" href="happy.html#id2571399">Dissection and Discussion</a></dt><dt>schema, <a class="indexterm" href="happy.html#id2571399">Dissection and Discussion</a></dt><dt>server, <a class="indexterm" href="happy.html#id2571856">Technical Issues</a></dt><dt>synchronization, <a class="indexterm" href="happy.html#id2571399">Dissection and Discussion</a></dt></dl></dd><dt>directory tree, <a class="indexterm" href="kerberos.html#id2615047">Setting Posix ACLs in UNIX/Linux</a></dt><dt>disable, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a></dt><dt>disaster recovery, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a></dt><dt>disk image, <a class="indexterm" href="happy.html#id2571262">Assignment Tasks</a></dt><dt>disruptive, <a class="indexterm" href="ntmigration.html#id2601472">Dissection and Discussion</a></dt><dt>distributed, <a class="indexterm" href="net2000users.html#id2584570">Identity Management Needs</a>, <a class="indexterm" href="net2000users.html#id2585064">Implementation</a>, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a>, <a class="indexterm" href="HA.html#id2620352">Distribute Network Load with MSDFS</a></dt><dt>distributed domain, <a class="indexterm" href="net2000users.html#id2584570">Identity Management Needs</a></dt><dt>DMB, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dt>DMS, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id2600758">Replacing a Domain Member Server</a></dt><dt>DNS, <a class="indexterm" href="small.html#id2555570">Technical Issues</a>, <a class="indexterm" href="small.html#id2555790">Implementation</a>, <a class="indexterm" href="secure.html#id2558863">Technical Issues</a>, <a class="indexterm" href="net2000users.html#id2584231">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a>, <a class="indexterm" href="HA.html#id2619404">Bad Hostnames</a>, <a class="indexterm" href="HA.html#id2619596">Routed Networks</a>, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dd><dl><dt>configuration, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a></dt><dt>Dynamic, <a class="indexterm" href="net2000users.html#id2588370">Questions and Answers</a></dt><dt>dynamic, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dt>lookup, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a>, <a class="indexterm" href="DomApps.html#id2616622">Kerberos Configuration</a></dt><dt>name lookup, <a class="indexterm" href="HA.html#id2619404">Bad Hostnames</a></dt><dt>SRV records, <a class="indexterm" href="DomApps.html#id2616622">Kerberos Configuration</a></dt><dt>suffix, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt></dl></dd><dt>DNS server, <a class="indexterm" href="small.html#id2555790">Implementation</a>, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></dt><dt>document the settings, <a class="indexterm" href="HA.html#id2619868">Samba Configuration</a></dt><dt>documentation, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>documented, <a class="indexterm" href="HA.html#id2619868">Samba Configuration</a></dt><dt>Domain, <a class="indexterm" href="small.html#id2555570">Technical Issues</a></dt><dd><dl><dt>groups, <a class="indexterm" href="small.html#id2555570">Technical Issues</a></dt></dl></dd><dt>domain</dt><dd><dl><dt>Active Directory, <a class="indexterm" href="DomApps.html#id2616193">Technical Issues</a></dt><dt>controller, <a class="indexterm" href="upgrades.html#id2600960">Replacing a Domain Controller</a></dt><dt>joining, <a class="indexterm" href="appendix.html">A Collection of Useful Tidbits</a></dt><dt>trusted, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a></dt></dl></dd><dt>Domain accounts, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a></dt><dt>Domain Administrator, <a class="indexterm" href="kerberos.html#id2613169">Share Access Controls</a></dt><dt>Domain Controller, <a class="indexterm" href="small.html#id2558010">Key Points Learned</a>, <a class="indexterm" href="net2000users.html#id2584231">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2590094">Implementation</a>, <a class="indexterm" href="HA.html#id2620205">Use and Location of BDCs</a></dt><dd><dl><dt>closest, <a class="indexterm" href="net2000users.html#id2584231">The Nature of Windows Networking Protocols</a></dt></dl></dd><dt>domain controller, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id2599919">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>domain controllers, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a></dt><dt>Domain Controllers, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a></dt><dt>Domain Groups</dt><dd><dl><dt>well-known, <a class="indexterm" href="appendix.html#id2622851">Initialization of the LDAP Database</a></dt></dl></dd><dt>Domain join, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>domain master, <a class="indexterm" href="ntmigration.html#id2602148">NT4 Migration Using LDAP Backend</a>, <a class="indexterm" href="ntmigration.html#id2604606">NT4 Migration Using tdbsam Backend</a></dt><dt>Domain Master Browser (see DMB)</dt><dt>Domain Member, <a class="indexterm" href="HA.html#id2620205">Use and Location of BDCs</a></dt><dd><dl><dt>authoritative</dt><dd><dl><dt>local accounts, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a></dt></dl></dd><dt>client, <a class="indexterm" href="unixclients.html#id2590094">Implementation</a></dt><dt>desktop, <a class="indexterm" href="unixclients.html#id2589228">Introduction</a></dt><dt>server, <a class="indexterm" href="unixclients.html#id2589228">Introduction</a>, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2590094">Implementation</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>servers, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2613658">Checkpoint Controls</a></dt><dt>workstations, <a class="indexterm" href="unixclients.html#id2590094">Implementation</a></dt></dl></dd><dt>domain member</dt><dd><dl><dt>servers, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a></dt></dl></dd><dt>Domain Member server, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2615391">Questions and Answers</a></dt><dt>Domain Member servers, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a></dt><dt>domain members, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a></dt><dt>domain name space, <a class="indexterm" href="net2000users.html#id2584570">Identity Management Needs</a></dt><dt>domain replication, <a class="indexterm" href="net2000users.html#id2588370">Questions and Answers</a></dt><dt>domain SID, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a></dt><dt>Domain SID, <a class="indexterm" href="ntmigration.html#id2601658">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a></dt><dt>domain tree, <a class="indexterm" href="net2000users.html#id2584570">Identity Management Needs</a></dt><dt>Domain User Manager, <a class="indexterm" href="happy.html#id2580886">Configuring Profile Directories</a></dt><dt>Domain users, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>DOS, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a></dt><dt>dos2unix, <a class="indexterm" href="secure.html#id2560183">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2566940">Configuration for Server: MASSIVE</a></dt><dt>down-grade, <a class="indexterm" href="upgrades.html#id2598125">Introduction</a></dt><dt>drive letters, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a></dt><dt>drive mapping, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>dumb printing, <a class="indexterm" href="happy.html#id2572816">Installation of Printer Driver Auto-Download</a></dt><dt>dump, <a class="indexterm" href="ntmigration.html#id2601658">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a></dt><dt>duplicate accounts, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt><dt>dynamic DNS, <a class="indexterm" href="secure.html#id2558863">Technical Issues</a></dt></dl></div><div class="indexdiv"><h3>E</h3><dl><dt>e-Directory, <a class="indexterm" href="nw4migration.html#id2606228">Dissection and Discussion</a></dt><dt>Easy Software Products, <a class="indexterm" href="happy.html#id2572816">Installation of Printer Driver Auto-Download</a></dt><dt>economically sustainable, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a></dt><dt>eDirectory, <a class="indexterm" href="happy.html#id2571399">Dissection and Discussion</a></dt><dt>education, <a class="indexterm" href="net2000users.html#id2584570">Identity Management Needs</a></dt><dt>election, <a class="indexterm" href="primer.html#id2625878">Findings</a></dt><dt>employment, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a>, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a></dt><dt>enable, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a></dt><dt>encrypted, <a class="indexterm" href="primer.html#id2627129">Findings and Comments</a></dt><dt>encrypted password, <a class="indexterm" href="primer.html#id2627394">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>encrypted passwords, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a></dt><dt>End User License Agreement (see EULA)</dt><dt>enumerating, <a class="indexterm" href="DomApps.html#id2617012">Samba Configuration</a></dt><dt>essential, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a></dt><dt>ethereal, <a class="indexterm" href="primer.html#id2625618">Exercises</a></dt><dt>Ethernet switch, <a class="indexterm" href="small.html#id2555570">Technical Issues</a></dt><dt>ethernet switch, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>EULA, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a></dt><dt>Everyone, <a class="indexterm" href="kerberos.html#id2613169">Share Access Controls</a></dt><dt>Excel, <a class="indexterm" href="kerberos.html#id2614131">Share Point Directory and File Permissions</a></dt><dt>exclusive open, <a class="indexterm" href="appendix.html#id2624881">Microsoft Access</a></dt><dt>experiment, <a class="indexterm" href="kerberos.html">Active Directory, Kerberos, and Security</a></dt><dt>export, <a class="indexterm" href="ntmigration.html#id2601658">Technical Issues</a></dt><dt>extent, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a></dt><dt>External Domains, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a></dt><dt>extreme demand, <a class="indexterm" href="HA.html#id2619366">Guidelines for Reliable Samba Operation</a></dt></dl></div><div class="indexdiv"><h3>F</h3><dl><dt>fail, <a class="indexterm" href="net2000users.html#id2584231">The Nature of Windows Networking Protocols</a></dt><dt>fail-over, <a class="indexterm" href="net2000users.html#id2584570">Identity Management Needs</a>, <a class="indexterm" href="net2000users.html#id2585064">Implementation</a></dt><dt>failed, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>failed join, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id2594807">IDMAP_RID with Winbind</a></dt><dt>failure, <a class="indexterm" href="DomApps.html#id2617012">Samba Configuration</a></dt><dt>familiar, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>fatal problem, <a class="indexterm" href="HA.html#id2619868">Samba Configuration</a></dt><dt>fear, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>fears, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>Fedora, <a class="indexterm" href="simple.html#id2550925">Drafting Office</a></dt><dt>FHS, <a class="indexterm" href="appendix.html#id2621811">Samba System File Location</a></dt><dt>file and print server, <a class="indexterm" href="DomApps.html#id2618286">Questions and Answers</a></dt><dt>file and print service, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a></dt><dt>file caching, <a class="indexterm" href="HA.html#id2619868">Samba Configuration</a>, <a class="indexterm" href="appendix.html#id2625113">Opportunistic Locking Controls</a></dt><dt>File Hierarchy System (see FHS)</dt><dt>file locations, <a class="indexterm" href="appendix.html#id2621811">Samba System File Location</a></dt><dt>file permissions, <a class="indexterm" href="appendix.html#id2623411">The LDAP Account Manager</a></dt><dt>file server</dt><dd><dl><dt>read-only, <a class="indexterm" href="simple.html#id2551005">Dissection and Discussion</a></dt></dl></dd><dt>file servers, <a class="indexterm" href="happy.html#id2573925">Samba Server Implementation</a></dt><dt>file system, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dd><dl><dt>access control, <a class="indexterm" href="secure.html#id2560183">Samba Configuration</a></dt><dt>Ext3, <a class="indexterm" href="simple.html#id2551061">Implementation</a></dt><dt>permissions, <a class="indexterm" href="secure.html#id2560183">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2566940">Configuration for Server: MASSIVE</a></dt></dl></dd><dt>file system security, <a class="indexterm" href="kerberos.html#id2615391">Questions and Answers</a></dt><dt>filter, <a class="indexterm" href="kerberos.html#id2613169">Share Access Controls</a></dt><dt>financial responsibility, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a></dt><dt>firewall, <a class="indexterm" href="secure.html#id2558863">Technical Issues</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a></dt><dt>fix, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a></dt><dt>flaws, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a></dt><dt>flexibility, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>flush</dt><dd><dl><dt>cache memory, <a class="indexterm" href="appendix.html#id2625113">Opportunistic Locking Controls</a></dt></dl></dd><dt>folder redirection, <a class="indexterm" href="happy.html#id2571856">Technical Issues</a>, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a>, <a class="indexterm" href="net2000users.html#id2588370">Questions and Answers</a></dt><dt>force group, <a class="indexterm" href="kerberos.html#id2613970">Override Controls</a>, <a class="indexterm" href="kerberos.html#id2615391">Questions and Answers</a></dt><dt>force user, <a class="indexterm" href="simple.html#id2551758">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id2613970">Override Controls</a>, <a class="indexterm" href="kerberos.html#id2615391">Questions and Answers</a></dt><dt>forced settings, <a class="indexterm" href="kerberos.html#id2613970">Override Controls</a></dt><dt>foreign, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>foreign SID, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>forwarded, <a class="indexterm" href="HA.html#id2619596">Routed Networks</a></dt><dt>foundation members, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>Free Standards Group (see FSG)</dt><dt>free support, <a class="indexterm" href="ch14.html">Samba Support</a>, <a class="indexterm" href="ch14.html#id2620874">Free Support</a></dt><dt>front-end, <a class="indexterm" href="HA.html#id2618892">Dissection and Discussion</a></dt><dd><dl><dt>server, <a class="indexterm" href="HA.html#id2620352">Distribute Network Load with MSDFS</a></dt></dl></dd><dt>frustration, <a class="indexterm" href="upgrades.html#id2598125">Introduction</a></dt><dt>FSG, <a class="indexterm" href="appendix.html#id2621811">Samba System File Location</a></dt><dt>FTP</dt><dd><dl><dt>proxy, <a class="indexterm" href="DomApps.html#id2618286">Questions and Answers</a></dt></dl></dd><dt>full control, <a class="indexterm" href="kerberos.html#id2613169">Share Access Controls</a>, <a class="indexterm" href="kerberos.html#id2614876">Using MS Windows Explorer (File Manager)</a></dt><dt>fully qualified, <a class="indexterm" href="kerberos.html#id2613658">Checkpoint Controls</a></dt><dt>functional differences, <a class="indexterm" href="upgrades.html#id2598221">Cautions and Notes</a></dt></dl></div><div class="indexdiv"><h3>G</h3><dl><dt>generation, <a class="indexterm" href="upgrades.html#id2598221">Cautions and Notes</a></dt><dt>Gentoo, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>getent, <a class="indexterm" href="happy.html#id2576821">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id2594807">IDMAP_RID with Winbind</a></dt><dt>getfacl, <a class="indexterm" href="kerberos.html#id2615047">Setting Posix ACLs in UNIX/Linux</a></dt><dt>getgrnam, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a></dt><dt>getpwnam, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>getpwnam(), <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a></dt><dt>GID, <a class="indexterm" href="net2000users.html#id2585064">Implementation</a>, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a></dt><dt>Goettingen, <a class="indexterm" href="DomApps.html#id2618286">Questions and Answers</a></dt><dt>government, <a class="indexterm" href="net2000users.html#id2584570">Identity Management Needs</a></dt><dt>GPL, <a class="indexterm" href="secure.html#id2564093">Comments Regarding Software Terms of Use</a></dt><dt>group account, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>group management, <a class="indexterm" href="secure.html#id2559329">Implementation</a></dt><dt>group mapping, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a></dt><dt>group membership, <a class="indexterm" href="small.html#id2555790">Implementation</a>, <a class="indexterm" href="secure.html#id2560183">Samba Configuration</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="kerberos.html#id2614131">Share Point Directory and File Permissions</a></dt><dt>group names, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a></dt><dt>group policies, <a class="indexterm" href="ntmigration.html#id2601332">Introduction</a></dt><dt>Group Policy, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dt>Group Policy editor, <a class="indexterm" href="happy.html#sbehap-locgrppol">The Local Group Policy</a></dt><dt>Group Policy Objects, <a class="indexterm" href="happy.html#sbehap-locgrppol">The Local Group Policy</a></dt><dt>groupadd, <a class="indexterm" href="simple.html#id2551953">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="upgrades.html#id2599919">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a></dt><dt>groupdel, <a class="indexterm" href="upgrades.html#id2599919">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a></dt><dt>groupmem, <a class="indexterm" href="ntmigration.html#id2602148">NT4 Migration Using LDAP Backend</a></dt><dt>groupmod, <a class="indexterm" href="upgrades.html#id2599919">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a></dt><dt>GSS-API, <a class="indexterm" href="primer.html#id2627394">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>guest account, <a class="indexterm" href="primer.html#id2627129">Findings and Comments</a>, <a class="indexterm" href="primer.html#chap01conc">Dissection and Discussion</a>, <a class="indexterm" href="primer.html#id2628077">Technical Issues</a>, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt></dl></div><div class="indexdiv"><h3>H</h3><dl><dt>hackers, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a></dt><dt>hardware prices, <a class="indexterm" href="HA.html#id2620452">Hardware Problems</a></dt><dt>hardware problems, <a class="indexterm" href="HA.html#id2620452">Hardware Problems</a></dt><dt>Heimdal, <a class="indexterm" href="DomApps.html#id2616373">Implementation</a>, <a class="indexterm" href="DomApps.html#id2616622">Kerberos Configuration</a></dt><dt>Heimdal Kerberos, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="kerberos.html#id2612822">Kerberos Exposed</a></dt><dt>Heimdal kerberos, <a class="indexterm" href="unixclients.html#id2595411">IDMAP Storage in LDAP using Winbind</a></dt><dt>help, <a class="indexterm" href="ch14.html#id2620874">Free Support</a></dt><dt>helper agent, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>hesiod, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>hierarchy of control, <a class="indexterm" href="kerberos.html#id2613518">Share Definition Controls</a></dt><dt>high availability, <a class="indexterm" href="happy.html#id2571399">Dissection and Discussion</a></dt><dt>hire, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a></dt><dt>HKEY_CURRENT_USER, <a class="indexterm" href="happy.html#id2572363">Roaming Profile Background</a></dt><dt>HKEY_LOCAL_MACHINE, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>HKEY_LOCAL_USER, <a class="indexterm" href="net2000users.html#id2588370">Questions and Answers</a></dt><dt>host announcement, <a class="indexterm" href="primer.html#id2625502">Assignment Tasks</a>, <a class="indexterm" href="primer.html#id2626531">Findings</a></dt><dt>hostname, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a></dt><dt>hosts, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a></dt><dt>HUB, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>Hybrid, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dt>hypothetical, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a></dt></dl></div><div class="indexdiv"><h3>I</h3><dl><dt>Idealx, <a class="indexterm" href="upgrades.html#id2599919">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id2602148">NT4 Migration Using LDAP Backend</a></dt><dd><dl><dt>smbldap-tools, <a class="indexterm" href="happy.html#sbeidealx">Install and Configure Idealx smbldap-tools Scripts</a>, <a class="indexterm" href="happy.html#id2576821">LDAP Initialization and Creation of User and Group Accounts</a></dt></dl></dd><dt>identifiers, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a></dt><dt>identity, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2612822">Kerberos Exposed</a></dt><dd><dl><dt>management, <a class="indexterm" href="happy.html#id2571856">Technical Issues</a></dt></dl></dd><dt>identity management, <a class="indexterm" href="Big500users.html#id2565409">Technical Issues</a>, <a class="indexterm" href="net2000users.html#id2583824">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#id2589994">Political Issues</a>, <a class="indexterm" href="nw4migration.html#id2606228">Dissection and Discussion</a></dt><dt>Identity Management, <a class="indexterm" href="happy.html#id2571399">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id2584231">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="net2000users.html#id2584570">Identity Management Needs</a></dt><dt>Identity management, <a class="indexterm" href="unixclients.html#id2596343">UNIX/Linux Client Domain Member</a></dt><dt>Identity resolution, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id2596343">UNIX/Linux Client Domain Member</a>, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a></dt><dt>Identity resolver, <a class="indexterm" href="DomApps.html#id2618286">Questions and Answers</a></dt><dt>IDMAP, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#id2594807">IDMAP_RID with Winbind</a></dt><dt>idmap backend, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a></dt><dt>IDMAP backend, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a></dt><dt>idmap gid, <a class="indexterm" href="unixclients.html#id2594807">IDMAP_RID with Winbind</a></dt><dt>idmap uid, <a class="indexterm" href="unixclients.html#id2594807">IDMAP_RID with Winbind</a></dt><dt>idmap_rid, <a class="indexterm" href="unixclients.html#id2594807">IDMAP_RID with Winbind</a></dt><dt>IMAP, <a class="indexterm" href="nw4migration.html#id2606305">Technical Issues</a></dt><dt>import, <a class="indexterm" href="ntmigration.html#id2601658">Technical Issues</a></dt><dt>income, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a></dt><dt>independent expert, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a></dt><dt>inetd, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a></dt><dt>inetOrgPerson, <a class="indexterm" href="nw4migration.html#id2606305">Technical Issues</a></dt><dt>inheritance, <a class="indexterm" href="kerberos.html#id2615047">Setting Posix ACLs in UNIX/Linux</a></dt><dt>initGrps.sh, <a class="indexterm" href="small.html#id2555790">Implementation</a>, <a class="indexterm" href="secure.html#id2560183">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2566940">Configuration for Server: MASSIVE</a></dt><dt>initial credentials, <a class="indexterm" href="DomApps.html#id2616622">Kerberos Configuration</a></dt><dt>inoperative, <a class="indexterm" href="ntmigration.html#id2601472">Dissection and Discussion</a></dt><dt>install, <a class="indexterm" href="upgrades.html">Updating Samba-3</a></dt><dt>installation, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a></dt><dt>integrate, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a></dt><dt>integrity, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a>, <a class="indexterm" href="kerberos.html#id2612822">Kerberos Exposed</a></dt><dt>inter-domain, <a class="indexterm" href="upgrades.html#id2599919">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>inter-operability, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2615257">Key Points Learned</a>, <a class="indexterm" href="DomApps.html#id2618286">Questions and Answers</a></dt><dt>interactive help, <a class="indexterm" href="ch14.html#id2620874">Free Support</a></dt><dt>interdomain trusts, <a class="indexterm" href="net2000users.html#id2584570">Identity Management Needs</a></dt><dt>interfaces, <a class="indexterm" href="secure.html#id2559329">Implementation</a></dt><dt>intermittent, <a class="indexterm" href="HA.html#id2620452">Hardware Problems</a></dt><dt>internationalization, <a class="indexterm" href="upgrades.html#id2599385">International Language Support</a></dt><dt>Internet Explorer, <a class="indexterm" href="DomApps.html#id2616193">Technical Issues</a></dt><dt>Internet Information Server, <a class="indexterm" href="DomApps.html#id2618286">Questions and Answers</a></dt><dt>interoperability, <a class="indexterm" href="happy.html#id2571399">Dissection and Discussion</a></dt><dt>IP forwarding, <a class="indexterm" href="small.html#id2555790">Implementation</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="Big500users.html#id2566940">Configuration for Server: MASSIVE</a></dt><dt>IPC$, <a class="indexterm" href="primer.html#id2627129">Findings and Comments</a></dt><dt>iptables, <a class="indexterm" href="secure.html#id2558863">Technical Issues</a></dt><dt>IRC, <a class="indexterm" href="ch14.html#id2620874">Free Support</a></dt><dt>isolated, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a></dt><dt>Italian, <a class="indexterm" href="DomApps.html#id2618286">Questions and Answers</a></dt></dl></div><div class="indexdiv"><h3>J</h3><dl><dt>jobs, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a></dt><dt>joining a domain, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt></dl></div><div class="indexdiv"><h3>K</h3><dl><dt>KDC, <a class="indexterm" href="DomApps.html#id2616622">Kerberos Configuration</a></dt><dt>Kerberos, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a>, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2615257">Key Points Learned</a>, <a class="indexterm" href="DomApps.html#id2616193">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id2616373">Implementation</a>, <a class="indexterm" href="DomApps.html#id2616622">Kerberos Configuration</a></dt><dd><dl><dt>Heimdal, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>interoperability, <a class="indexterm" href="kerberos.html#id2612822">Kerberos Exposed</a></dt><dt>libraries, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>MIT, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>unspecified fields, <a class="indexterm" href="kerberos.html#id2612822">Kerberos Exposed</a></dt></dl></dd><dt>kerberos, <a class="indexterm" href="kerberos.html#id2612822">Kerberos Exposed</a></dt><dd><dl><dt>server, <a class="indexterm" href="kerberos.html#id2612822">Kerberos Exposed</a></dt></dl></dd><dt>Kerberos ticket, <a class="indexterm" href="DomApps.html#id2617012">Samba Configuration</a></dt><dt>kinit, <a class="indexterm" href="DomApps.html#id2616622">Kerberos Configuration</a></dt><dt>Kixtart, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a></dt><dt>klist, <a class="indexterm" href="DomApps.html#id2616622">Kerberos Configuration</a></dt><dt>krb5, <a class="indexterm" href="DomApps.html#id2616373">Implementation</a></dt><dt>krb5.conf, <a class="indexterm" href="DomApps.html#id2616622">Kerberos Configuration</a></dt></dl></div><div class="indexdiv"><h3>L</h3><dl><dt>LAM, <a class="indexterm" href="appendix.html#id2623411">The LDAP Account Manager</a></dt><dd><dl><dt>configuration editor, <a class="indexterm" href="appendix.html#id2623411">The LDAP Account Manager</a></dt><dt>configuration file, <a class="indexterm" href="appendix.html#id2623411">The LDAP Account Manager</a></dt><dt>login screen, <a class="indexterm" href="appendix.html#id2623411">The LDAP Account Manager</a></dt><dt>opening screen, <a class="indexterm" href="appendix.html#id2623411">The LDAP Account Manager</a></dt><dt>profile, <a class="indexterm" href="appendix.html#id2623411">The LDAP Account Manager</a></dt><dt>wizard, <a class="indexterm" href="appendix.html#id2623411">The LDAP Account Manager</a></dt></dl></dd><dt>large domain, <a class="indexterm" href="unixclients.html#id2594807">IDMAP_RID with Winbind</a></dt><dt>LDAP, <a class="indexterm" href="Big500users.html#id2565409">Technical Issues</a>, <a class="indexterm" href="happy.html#id2571262">Assignment Tasks</a>, <a class="indexterm" href="happy.html#id2571399">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#id2571856">Technical Issues</a>, <a class="indexterm" href="happy.html#id2573007">Preliminary Advice: Dangers Can Be Avoided</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="net2000users.html#id2583726">Introduction</a>, <a class="indexterm" href="net2000users.html#id2583824">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id2584570">Identity Management Needs</a>, <a class="indexterm" href="net2000users.html#id2585064">Implementation</a>, <a class="indexterm" href="net2000users.html#id2588223">Key Points Learned</a>, <a class="indexterm" href="net2000users.html#id2588370">Questions and Answers</a>, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id2599919">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id2601417">Assignment Tasks</a>, <a class="indexterm" href="ntmigration.html#id2601658">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id2606228">Dissection and Discussion</a>, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a>, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dd><dl><dt>backend, <a class="indexterm" href="net2000users.html#id2584570">Identity Management Needs</a></dt><dt>database, <a class="indexterm" href="happy.html#id2576821">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="net2000users.html#id2584570">Identity Management Needs</a>, <a class="indexterm" href="net2000users.html#id2588370">Questions and Answers</a>, <a class="indexterm" href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></dt><dt>directory, <a class="indexterm" href="happy.html#id2571022">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="net2000users.html#id2584570">Identity Management Needs</a></dt><dt>fail-over, <a class="indexterm" href="net2000users.html#id2585064">Implementation</a></dt><dt>initial configuration, <a class="indexterm" href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></dt><dt>master, <a class="indexterm" href="net2000users.html#id2584570">Identity Management Needs</a></dt><dt>master/slave</dt><dd><dl><dt>background communication, <a class="indexterm" href="net2000users.html#id2588370">Questions and Answers</a></dt></dl></dd><dt>preload, <a class="indexterm" href="net2000users.html#id2585064">Implementation</a></dt><dt>schema, <a class="indexterm" href="upgrades.html#id2600576">Updating from Samba Versions between 3.0.6 and 3.0.10</a></dt><dt>secure, <a class="indexterm" href="happy.html#id2571856">Technical Issues</a></dt><dt>server, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a></dt><dt>slave, <a class="indexterm" href="net2000users.html#id2584570">Identity Management Needs</a></dt><dt>updates, <a class="indexterm" href="net2000users.html#id2584570">Identity Management Needs</a></dt></dl></dd><dt>ldap, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>LDAP Account Manager (see LAM)</dt><dt>LDAP backend, <a class="indexterm" href="ntmigration.html#id2601658">Technical Issues</a></dt><dt>LDAP database, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a></dt><dt>LDAP Interchange Format (see LDIF)</dt><dt>LDAP server, <a class="indexterm" href="net2000users.html#id2584570">Identity Management Needs</a></dt><dt>LDAP-transfer-LDIF.txt, <a class="indexterm" href="net2000users.html#id2585064">Implementation</a></dt><dt>ldap.conf, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>ldapadd, <a class="indexterm" href="happy.html#id2576821">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>ldapsam, <a class="indexterm" href="happy.html#id2576821">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="net2000users.html#id2583824">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="upgrades.html#id2600576">Updating from Samba Versions between 3.0.6 and 3.0.10</a>, <a class="indexterm" href="ntmigration.html#id2601417">Assignment Tasks</a>, <a class="indexterm" href="DomApps.html">Integrating Additional Services</a></dt><dt>ldapsam backend, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>ldapsearch, <a class="indexterm" href="happy.html#id2576821">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>LDIF, <a class="indexterm" href="happy.html#id2571856">Technical Issues</a>, <a class="indexterm" href="net2000users.html#id2585064">Implementation</a>, <a class="indexterm" href="nw4migration.html#id2606305">Technical Issues</a>, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a>, <a class="indexterm" href="appendix.html#id2622851">Initialization of the LDAP Database</a></dt><dt>leadership, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>Lightweight Directory Access Protocol (see LDAP)</dt><dt>limit, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a></dt><dt>Linux desktop, <a class="indexterm" href="unixclients.html#id2589228">Introduction</a></dt><dt>Linux Standards Base (see LSB)</dt><dt>LMB, <a class="indexterm" href="primer.html#id2625878">Findings</a>, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dt>LMHOSTS, <a class="indexterm" href="HA.html#id2619596">Routed Networks</a></dt><dt>load distribution, <a class="indexterm" href="HA.html#id2620303">For Scalability, Use SAN-Based Storage on Samba Servers</a></dt><dt>local accounts, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a></dt><dt>Local Group Policy, <a class="indexterm" href="happy.html#id2572363">Roaming Profile Background</a></dt><dt>Local Master Announcement, <a class="indexterm" href="primer.html#id2626531">Findings</a></dt><dt>Local Master Browser (see LMB)</dt><dt>localhost, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="HA.html#id2619404">Bad Hostnames</a></dt><dt>lock directory, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></dt><dt>locking</dt><dd><dl><dt>Application level, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>Client side, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>Server side, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt></dl></dd><dt>logging, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>login, <a class="indexterm" href="secure.html#id2558863">Technical Issues</a></dt><dt>loglevel, <a class="indexterm" href="happy.html#id2573240">Debugging LDAP</a></dt><dt>logon credentials, <a class="indexterm" href="DomApps.html#id2618286">Questions and Answers</a></dt><dt>logon hours, <a class="indexterm" href="ntmigration.html#id2601658">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2615257">Key Points Learned</a></dt><dt>logon machines, <a class="indexterm" href="ntmigration.html#id2601658">Technical Issues</a></dt><dt>logon path, <a class="indexterm" href="secure.html#id2559329">Implementation</a></dt><dt>logon process, <a class="indexterm" href="unixclients.html#id2590094">Implementation</a></dt><dt>logon scrip, <a class="indexterm" href="secure.html#id2560183">Samba Configuration</a></dt><dt>logon script, <a class="indexterm" href="secure.html#id2559329">Implementation</a>, <a class="indexterm" href="happy.html#id2571856">Technical Issues</a>, <a class="indexterm" href="happy.html#id2581130">Preparation of Logon Scripts</a>, <a class="indexterm" href="ntmigration.html#id2601658">Technical Issues</a></dt><dt>logon server, <a class="indexterm" href="net2000users.html#id2584231">The Nature of Windows Networking Protocols</a></dt><dt>logon services, <a class="indexterm" href="secure.html#id2559329">Implementation</a></dt><dt>logon time, <a class="indexterm" href="happy.html#id2571262">Assignment Tasks</a></dt><dt>logon traffic, <a class="indexterm" href="net2000users.html#id2584231">The Nature of Windows Networking Protocols</a></dt><dt>logon.kix, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a></dt><dt>loopback, <a class="indexterm" href="simple.html#validate1">Validation</a></dt><dt>low performance, <a class="indexterm" href="HA.html#id2620452">Hardware Problems</a></dt><dt>lower-case, <a class="indexterm" href="ntmigration.html#id2602007">Implementation</a></dt><dt>lpadmin, <a class="indexterm" href="simple.html#id2551953">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id2555790">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>LSB, <a class="indexterm" href="appendix.html#id2621811">Samba System File Location</a></dt></dl></div><div class="indexdiv"><h3>M</h3><dl><dt>machine, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a></dt><dt>machine account, <a class="indexterm" href="happy.html#id2571022">Regarding LDAP Directories and Windows Computer Accounts</a></dt><dt>machine accounts, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a></dt><dt>machine secret password, <a class="indexterm" href="Big500users.html#id2565409">Technical Issues</a></dt><dt>MACHINE.SID, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a></dt><dt>mailing list, <a class="indexterm" href="ch14.html#id2620874">Free Support</a></dt><dt>mailing lists, <a class="indexterm" href="ch14.html#id2620874">Free Support</a></dt><dt>managed, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>management, <a class="indexterm" href="unixclients.html#id2589994">Political Issues</a>, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a></dt><dd><dl><dt>group, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>User, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt></dl></dd><dt>mandatory profile, <a class="indexterm" href="happy.html#id2571856">Technical Issues</a>, <a class="indexterm" href="happy.html#id2580886">Configuring Profile Directories</a></dt><dt>Mandrake, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>mapped drives, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a></dt><dt>mapping, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id2616622">Kerberos Configuration</a></dt><dd><dl><dt>consistent, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt></dl></dd><dt>Mars_NWE, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>master, <a class="indexterm" href="net2000users.html#id2583824">Dissection and Discussion</a></dt><dt>material, <a class="indexterm" href="appendix.html">A Collection of Useful Tidbits</a></dt><dt>memberUID, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a></dt><dt>memory requirements, <a class="indexterm" href="secure.html#id2559135">Hardware Requirements</a></dt><dt>merge, <a class="indexterm" href="ntmigration.html#id2601658">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a></dt><dt>merged, <a class="indexterm" href="ntmigration.html#id2601658">Technical Issues</a></dt><dt>meta-directory, <a class="indexterm" href="net2000users.html#id2588370">Questions and Answers</a></dt><dt>meta-service, <a class="indexterm" href="kerberos.html#id2615391">Questions and Answers</a></dt><dt>Microsoft Access, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>Microsoft Excel, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>Microsoft ISA, <a class="indexterm" href="DomApps.html#id2616051">Assignment Tasks</a></dt><dt>Microsoft Management Console (see MMC)</dt><dt>Microsoft Office, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a>, <a class="indexterm" href="kerberos.html#id2614131">Share Point Directory and File Permissions</a></dt><dt>Microsoft Outlook</dt><dd><dl><dt>PST files, <a class="indexterm" href="net2000users.html#id2588370">Questions and Answers</a></dt></dl></dd><dt>migrate, <a class="indexterm" href="upgrades.html">Updating Samba-3</a>, <a class="indexterm" href="ntmigration.html#id2601658">Technical Issues</a></dt><dt>migration, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id2555790">Implementation</a>, <a class="indexterm" href="happy.html#id2571262">Assignment Tasks</a>, <a class="indexterm" href="ntmigration.html#id2601332">Introduction</a>, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dd><dl><dt>objectives, <a class="indexterm" href="ntmigration.html#id2601472">Dissection and Discussion</a></dt></dl></dd><dt>Migration speed, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a></dt><dt>mime type, <a class="indexterm" href="simple.html#id2551953">Implementation</a>, <a class="indexterm" href="small.html#id2555790">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id2566362">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>mime types, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a></dt><dt>missing RPC's, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>MIT, <a class="indexterm" href="DomApps.html#id2616373">Implementation</a>, <a class="indexterm" href="DomApps.html#id2616622">Kerberos Configuration</a></dt><dt>MIT Kerberos, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="kerberos.html#id2612822">Kerberos Exposed</a></dt><dt>MIT kerberos, <a class="indexterm" href="unixclients.html#id2595411">IDMAP Storage in LDAP using Winbind</a></dt><dt>MIT KRB5, <a class="indexterm" href="DomApps.html#id2617012">Samba Configuration</a></dt><dt>mixed mode, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>mixed-mode, <a class="indexterm" href="kerberos.html#id2615391">Questions and Answers</a></dt><dt>MMC, <a class="indexterm" href="happy.html#id2582445">Configure Delete Cached Profiles on Logout</a>, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2615391">Questions and Answers</a></dt><dt>mobile computing, <a class="indexterm" href="small.html#id2555522">Dissection and Discussion</a></dt><dt>mobility, <a class="indexterm" href="net2000users.html#id2584098">Technical Issues</a></dt><dt>modularization, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>modules, <a class="indexterm" href="DomApps.html#id2618286">Questions and Answers</a></dt><dt>MS Access</dt><dd><dl><dt>validate, <a class="indexterm" href="appendix.html#id2624881">Microsoft Access</a></dt></dl></dd><dt>MS Outlook, <a class="indexterm" href="happy.html#id2582129">Configuration of MS Outlook to Relocate PST File</a></dt><dd><dl><dt>PST, <a class="indexterm" href="happy.html#id2582129">Configuration of MS Outlook to Relocate PST File</a></dt><dt>PST file, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>MS Windows Server 2003, <a class="indexterm" href="DomApps.html#id2616373">Implementation</a></dt><dt>MS Word, <a class="indexterm" href="kerberos.html#id2614131">Share Point Directory and File Permissions</a></dt><dt>MSDFS, <a class="indexterm" href="HA.html#id2620352">Distribute Network Load with MSDFS</a></dt><dt>multi-subnet, <a class="indexterm" href="HA.html#id2619596">Routed Networks</a></dt><dt>multi-user</dt><dd><dl><dt>access, <a class="indexterm" href="appendix.html#id2624881">Microsoft Access</a></dt><dt>data access, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt></dl></dd><dt>multiple directories, <a class="indexterm" href="net2000users.html#id2584570">Identity Management Needs</a></dt><dt>multiple domain controllers, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>multiple group mappings, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a></dt><dt>mutual assistance, <a class="indexterm" href="ch14.html#id2620874">Free Support</a></dt><dt>My Documents, <a class="indexterm" href="happy.html#id2572363">Roaming Profile Background</a></dt><dt>My Network Places, <a class="indexterm" href="simple.html#id2551953">Implementation</a></dt><dt>mysqlsam, <a class="indexterm" href="net2000users.html#id2585064">Implementation</a></dt></dl></div><div class="indexdiv"><h3>N</h3><dl><dt>name resolution, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a>, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a>, <a class="indexterm" href="primer.html#id2625502">Assignment Tasks</a></dt><dd><dl><dt>Defective, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt></dl></dd><dt>name resolve order, <a class="indexterm" href="secure.html#id2559329">Implementation</a></dt><dt>name service switch, <a class="indexterm" href="small.html#id2555790">Implementation</a> (see NSS)</dt><dt>named, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="Big500users.html#id2566362">Server Preparation: All Servers</a></dt><dt>NAT, <a class="indexterm" href="secure.html#id2558863">Technical Issues</a></dt><dt>native, <a class="indexterm" href="kerberos.html#id2615391">Questions and Answers</a></dt><dt>net</dt><dd><dl><dt>ads</dt><dd><dl><dt>info, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>join, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a>, <a class="indexterm" href="DomApps.html#id2617012">Samba Configuration</a></dt><dt>status, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt></dl></dd><dt>getlocalsid, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a></dt><dt>group, <a class="indexterm" href="ntmigration.html#id2604606">NT4 Migration Using tdbsam Backend</a></dt><dt>groupmap</dt><dd><dl><dt>add, <a class="indexterm" href="secure.html#id2560183">Samba Configuration</a></dt><dt>list, <a class="indexterm" href="secure.html#id2560183">Samba Configuration</a>, <a class="indexterm" href="happy.html#id2576821">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>modify, <a class="indexterm" href="secure.html#id2560183">Samba Configuration</a></dt></dl></dd><dt>rpc</dt><dd><dl><dt>info, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a></dt><dt>join, <a class="indexterm" href="Big500users.html#ch5-domsvrspec">Configuration Specific to Domain Member Servers: BLDG1, BLDG2</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id2604606">NT4 Migration Using tdbsam Backend</a></dt><dt>vampire, <a class="indexterm" href="upgrades.html">Updating Samba-3</a>, <a class="indexterm" href="ntmigration.html#id2604606">NT4 Migration Using tdbsam Backend</a></dt></dl></dd><dt>setlocalsid, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a></dt></dl></dd><dt>NetBIOS, <a class="indexterm" href="net2000users.html#id2584231">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a>, <a class="indexterm" href="HA.html#id2619404">Bad Hostnames</a>, <a class="indexterm" href="HA.html#id2619596">Routed Networks</a>, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dd><dl><dt>name cache, <a class="indexterm" href="net2000users.html#id2588370">Questions and Answers</a></dt><dt>name resolution</dt><dd><dl><dt>delays, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>Node Type, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt></dl></dd><dt>netbios</dt><dd><dl><dt>machine name, <a class="indexterm" href="upgrades.html#id2599053">Change of hostname</a></dt></dl></dd><dt>netbios forwarding, <a class="indexterm" href="HA.html#id2619769">Network Collisions</a></dt><dt>NetBIOS name, <a class="indexterm" href="DomApps.html#id2616622">Kerberos Configuration</a></dt><dd><dl><dt>aliases, <a class="indexterm" href="net2000users.html#id2584570">Identity Management Needs</a></dt></dl></dd><dt>netbios name, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id2599053">Change of hostname</a>, <a class="indexterm" href="HA.html#id2619404">Bad Hostnames</a></dt><dt>NETLOGON, <a class="indexterm" href="happy.html#id2572758">Using a Network Default User Profile</a>, <a class="indexterm" href="happy.html#id2581375">Windows Client Configuration</a></dt><dt>netlogon, <a class="indexterm" href="net2000users.html#id2584231">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a></dt><dt>Netlogon, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dt>netmask, <a class="indexterm" href="simple.html#id2551061">Implementation</a></dt><dt>Netware, <a class="indexterm" href="small.html">Small Office Networking</a></dt><dt>NetWare, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a>, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a></dt><dt>network</dt><dd><dl><dt>administrators, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>analyzer, <a class="indexterm" href="primer.html#id2625502">Assignment Tasks</a></dt><dt>bandwidth, <a class="indexterm" href="net2000users.html#id2584570">Identity Management Needs</a>, <a class="indexterm" href="net2000users.html#id2588370">Questions and Answers</a></dt><dt>broadcast, <a class="indexterm" href="primer.html#id2625441">Introduction</a></dt><dt>captures, <a class="indexterm" href="primer.html#id2625280">Requirements and Notes</a></dt><dt>collisions, <a class="indexterm" href="HA.html#id2619769">Network Collisions</a></dt><dt>load, <a class="indexterm" href="HA.html#id2619769">Network Collisions</a></dt><dt>logon, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>logon scripts, <a class="indexterm" href="ntmigration.html#id2601472">Dissection and Discussion</a></dt><dt>management, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a></dt><dt>multi-segment, <a class="indexterm" href="happy.html#id2571164">Introduction</a></dt><dt>overload, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>performance, <a class="indexterm" href="HA.html#id2619868">Samba Configuration</a></dt><dt>routed, <a class="indexterm" href="net2000users.html#id2583824">Dissection and Discussion</a></dt><dt>secure, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a></dt><dt>segment, <a class="indexterm" href="happy.html#id2571399">Dissection and Discussion</a></dt><dt>services, <a class="indexterm" href="DomApps.html#id2618286">Questions and Answers</a></dt><dt>sniffer, <a class="indexterm" href="primer.html#id2625280">Requirements and Notes</a></dt><dt>timeout, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>timeouts, <a class="indexterm" href="HA.html#id2619769">Network Collisions</a></dt><dt>trace, <a class="indexterm" href="primer.html#id2625502">Assignment Tasks</a></dt><dt>traffic</dt><dd><dl><dt>observation, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt></dl></dd><dt>wide-area, <a class="indexterm" href="happy.html#id2571399">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt></dl></dd><dt>Network Address Translation (see NAT)</dt><dt>network administrators, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>network attached storage (see NAS)</dt><dt>network bandwidth</dt><dd><dl><dt>utilization, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>Network Default Profile, <a class="indexterm" href="happy.html#id2572363">Roaming Profile Background</a></dt><dt>network hardware</dt><dd><dl><dt>defective, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>network hygiene, <a class="indexterm" href="HA.html#id2618892">Dissection and Discussion</a></dt><dt>network Identities, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a></dt><dt>network load factors, <a class="indexterm" href="Big500users.html#id2565373">Dissection and Discussion</a></dt><dt>Network Neighborhood, <a class="indexterm" href="simple.html#validate1">Validation</a>, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>network segment, <a class="indexterm" href="HA.html#id2620205">Use and Location of BDCs</a></dt><dt>network segments, <a class="indexterm" href="secure.html#id2559135">Hardware Requirements</a></dt><dt>network share, <a class="indexterm" href="happy.html#id2571262">Assignment Tasks</a></dt><dt>networking</dt><dd><dl><dt>client, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a></dt></dl></dd><dt>networking hardware</dt><dd><dl><dt>defective, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>networking protocols, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>next generation, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>NextFreeUnixId, <a class="indexterm" href="ntmigration.html#id2602148">NT4 Migration Using LDAP Backend</a></dt><dt>NFS server, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></dt><dt>NICs, <a class="indexterm" href="HA.html#id2620452">Hardware Problems</a></dt><dt>NIS, <a class="indexterm" href="happy.html#id2576821">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="net2000users.html#id2584570">Identity Management Needs</a>, <a class="indexterm" href="net2000users.html#id2588370">Questions and Answers</a>, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2589994">Political Issues</a>, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a></dt><dt>nis, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>NIS schema, <a class="indexterm" href="net2000users.html#id2588370">Questions and Answers</a></dt><dt>NIS server, <a class="indexterm" href="net2000users.html#id2588370">Questions and Answers</a></dt><dt>NIS+, <a class="indexterm" href="net2000users.html#id2584570">Identity Management Needs</a></dt><dt>nisplus, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>NLM, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>nmap, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>nmbd, <a class="indexterm" href="small.html#id2557337">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="upgrades.html#id2600758">Replacing a Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id2617012">Samba Configuration</a>, <a class="indexterm" href="appendix.html#id2622232">Starting Samba</a></dt><dt>nobody, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a class="indexterm" href="primer.html#id2627129">Findings and Comments</a></dt><dt>Novell, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a>, <a class="indexterm" href="nw4migration.html#id2606026">Introduction</a></dt><dt>Novell SUSE SLES 9, <a class="indexterm" href="ntmigration.html#id2602148">NT4 Migration Using LDAP Backend</a></dt><dt>NSS, <a class="indexterm" href="happy.html#id2571022">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="happy.html#id2571856">Technical Issues</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#id2594807">IDMAP_RID with Winbind</a>, <a class="indexterm" href="unixclients.html#id2596343">UNIX/Linux Client Domain Member</a>, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a>, <a class="indexterm" href="DomApps.html#id2617564">NSS Configuration</a> (see same service switch)</dt><dt>nss_ldap, <a class="indexterm" href="happy.html#id2571022">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="happy.html#id2571856">Technical Issues</a>, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="happy.html#id2576821">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#id2596006">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a class="indexterm" href="upgrades.html#id2600758">Replacing a Domain Member Server</a>, <a class="indexterm" href="ntmigration.html#id2602148">NT4 Migration Using LDAP Backend</a></dt><dt>nt acl support, <a class="indexterm" href="simple.html#id2551758">Dissection and Discussion</a></dt><dt>NT4 registry, <a class="indexterm" href="ntmigration.html#id2601472">Dissection and Discussion</a></dt><dt>NTLM, <a class="indexterm" href="DomApps.html#id2616193">Technical Issues</a></dt><dt>NTLM authentication daemon, <a class="indexterm" href="DomApps.html#id2616193">Technical Issues</a></dt><dt>NTLMSSP, <a class="indexterm" href="DomApps.html#id2618225">Key Points Learned</a>, <a class="indexterm" href="DomApps.html#id2618286">Questions and Answers</a>, <a class="indexterm" href="primer.html#id2627394">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>NTLMSSP_AUTH, <a class="indexterm" href="primer.html#id2627394">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>ntlm_auth, <a class="indexterm" href="DomApps.html#id2617012">Samba Configuration</a>, <a class="indexterm" href="DomApps.html#id2618286">Questions and Answers</a></dt><dt>NTP, <a class="indexterm" href="DomApps.html#id2616622">Kerberos Configuration</a></dt><dt>NTUSER.DAT, <a class="indexterm" href="happy.html#id2572363">Roaming Profile Background</a>, <a class="indexterm" href="happy.html#id2572664">Profile Changes</a>, <a class="indexterm" href="happy.html#id2572758">Using a Network Default User Profile</a>, <a class="indexterm" href="net2000users.html#id2588370">Questions and Answers</a></dt><dt>NULL connection, <a class="indexterm" href="simple.html#validate1">Validation</a></dt><dt>NULL session, <a class="indexterm" href="primer.html#id2627129">Findings and Comments</a></dt><dt>NULL-Session, <a class="indexterm" href="primer.html#id2627931">Discussion</a></dt></dl></div><div class="indexdiv"><h3>O</h3><dl><dt>objectClass, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a></dt><dt>off-site storage, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a></dt><dt>Open Magazine, <a class="indexterm" href="unixclients.html">Adding Domain Member Servers and Clients</a></dt><dt>Open Source, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a></dt><dt>OpenLDAP, <a class="indexterm" href="happy.html#id2571399">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id2583824">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id2588370">Questions and Answers</a>, <a class="indexterm" href="unixclients.html#id2589994">Political Issues</a>, <a class="indexterm" href="nw4migration.html#id2606305">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a>, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2615257">Key Points Learned</a>, <a class="indexterm" href="appendix.html#id2623411">The LDAP Account Manager</a></dt><dt>openldap, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>OpenOffice, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a></dt><dt>operating profiles, <a class="indexterm" href="appendix.html#id2623411">The LDAP Account Manager</a></dt><dt>oplock break, <a class="indexterm" href="kerberos.html#id2613970">Override Controls</a></dt><dt>oplocks, <a class="indexterm" href="HA.html#id2619868">Samba Configuration</a></dt><dt>Oplocks</dt><dd><dl><dt>disabled, <a class="indexterm" href="appendix.html#id2625113">Opportunistic Locking Controls</a></dt></dl></dd><dt>opportunistic</dt><dd><dl><dt>locking, <a class="indexterm" href="kerberos.html#id2613970">Override Controls</a></dt></dl></dd><dt>opportunistic locking, <a class="indexterm" href="secure.html#id2559329">Implementation</a>, <a class="indexterm" href="HA.html#id2619868">Samba Configuration</a>, <a class="indexterm" href="appendix.html#id2625028">Act! Database Sharing</a></dt><dt>optimized, <a class="indexterm" href="HA.html#id2619868">Samba Configuration</a></dt><dt>organizational units, <a class="indexterm" href="appendix.html#id2623411">The LDAP Account Manager</a></dt><dt>OS/2, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a></dt><dt>Outlook</dt><dd><dl><dt>PST, <a class="indexterm" href="happy.html#id2582129">Configuration of MS Outlook to Relocate PST File</a></dt></dl></dd><dt>Outlook Address Book, <a class="indexterm" href="happy.html#id2582129">Configuration of MS Outlook to Relocate PST File</a></dt><dt>Outlook Express, <a class="indexterm" href="secure.html#id2559289">Political Issues</a>, <a class="indexterm" href="happy.html#id2582129">Configuration of MS Outlook to Relocate PST File</a></dt><dt>over-ride, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>over-ride controls, <a class="indexterm" href="kerberos.html#id2613970">Override Controls</a></dt><dt>over-rule, <a class="indexterm" href="kerberos.html#id2613169">Share Access Controls</a>, <a class="indexterm" href="kerberos.html#id2614876">Using MS Windows Explorer (File Manager)</a></dt><dt>overheads, <a class="indexterm" href="kerberos.html#id2613970">Override Controls</a></dt><dt>ownership, <a class="indexterm" href="kerberos.html#id2614131">Share Point Directory and File Permissions</a></dt></dl></div><div class="indexdiv"><h3>P</h3><dl><dt>package, <a class="indexterm" href="simple.html#id2551061">Implementation</a></dt><dt>package names, <a class="indexterm" href="appendix.html#id2621811">Samba System File Location</a></dt><dt>packages, <a class="indexterm" href="upgrades.html#id2600427">Updating a Samba-3 Installation</a></dt><dt>PADL, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2595411">IDMAP Storage in LDAP using Winbind</a></dt><dt>PADL LDAP tools, <a class="indexterm" href="happy.html#id2571856">Technical Issues</a></dt><dt>PADL Software, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>paid-for support, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>PAM, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="unixclients.html#id2596343">UNIX/Linux Client Domain Member</a>, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a></dt><dt>pam_ldap, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>pam_ldap.so, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dt>pam_unix2.so, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dd><dl><dt>use_ldap, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt></dl></dd><dt>parameters, <a class="indexterm" href="upgrades.html#id2599919">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>passdb backend, <a class="indexterm" href="secure.html#id2559329">Implementation</a>, <a class="indexterm" href="Big500users.html">The 500-User Office</a>, <a class="indexterm" href="happy.html#id2571399">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id2583824">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id2585064">Implementation</a>, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a>, <a class="indexterm" href="upgrades.html">Updating Samba-3</a>, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id2599919">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="upgrades.html#id2600576">Updating from Samba Versions between 3.0.6 and 3.0.10</a>, <a class="indexterm" href="ntmigration.html#id2601417">Assignment Tasks</a>, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a></dt><dt>passdb.tdb, <a class="indexterm" href="ntmigration.html#id2601658">Technical Issues</a></dt><dt>passwd, <a class="indexterm" href="simple.html#id2551953">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="secure.html#id2560183">Samba Configuration</a></dt><dt>password</dt><dd><dl><dt>backend, <a class="indexterm" href="small.html#id2555790">Implementation</a>, <a class="indexterm" href="secure.html#id2560183">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2566940">Configuration for Server: MASSIVE</a></dt></dl></dd><dt>password caching, <a class="indexterm" href="simple.html#id2551953">Implementation</a></dt><dt>password change, <a class="indexterm" href="kerberos.html#id2615257">Key Points Learned</a></dt><dt>password length, <a class="indexterm" href="primer.html#id2626892">Simple Windows Client Connection Characteristics</a>, <a class="indexterm" href="primer.html#id2627394">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>payroll, <a class="indexterm" href="nw4migration.html#id2606026">Introduction</a></dt><dt>pdbedit, <a class="indexterm" href="happy.html#id2576821">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a class="indexterm" href="ntmigration.html#id2604606">NT4 Migration Using tdbsam Backend</a>, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a></dt><dt>PDC, <a class="indexterm" href="Big500users.html#id2565274">Assignment Tasks</a>, <a class="indexterm" href="Big500users.html#id2565409">Technical Issues</a>, <a class="indexterm" href="happy.html">Making Happy Users</a>, <a class="indexterm" href="happy.html#id2571856">Technical Issues</a>, <a class="indexterm" href="happy.html#sbehap-locgrppol">The Local Group Policy</a>, <a class="indexterm" href="net2000users.html#id2584231">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id2599919">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id2602007">Implementation</a>, <a class="indexterm" href="ntmigration.html#id2602148">NT4 Migration Using LDAP Backend</a>, <a class="indexterm" href="ntmigration.html#id2604606">NT4 Migration Using tdbsam Backend</a>, <a class="indexterm" href="HA.html#id2620205">Use and Location of BDCs</a></dt><dt>PDC/BDC ratio, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>PDF, <a class="indexterm" href="appendix.html#id2623411">The LDAP Account Manager</a></dt><dt>performance, <a class="indexterm" href="happy.html#id2571399">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id2615391">Questions and Answers</a>, <a class="indexterm" href="HA.html">Performance, Reliability, and Availability</a>, <a class="indexterm" href="HA.html#id2618805">Introduction</a>, <a class="indexterm" href="HA.html#id2619769">Network Collisions</a></dt><dt>performance degradation, <a class="indexterm" href="kerberos.html#id2613970">Override Controls</a>, <a class="indexterm" href="HA.html#id2619868">Samba Configuration</a></dt><dt>Perl, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a>, <a class="indexterm" href="appendix.html#id2623411">The LDAP Account Manager</a></dt><dt>permission, <a class="indexterm" href="kerberos.html#id2614131">Share Point Directory and File Permissions</a></dt><dt>permissions, <a class="indexterm" href="simple.html#id2551953">Implementation</a>, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2613169">Share Access Controls</a>, <a class="indexterm" href="kerberos.html#id2613658">Checkpoint Controls</a>, <a class="indexterm" href="kerberos.html#id2614131">Share Point Directory and File Permissions</a>, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dd><dl><dt>excessive, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>group, <a class="indexterm" href="kerberos.html#id2614131">Share Point Directory and File Permissions</a></dt><dt>user, <a class="indexterm" href="kerberos.html#id2614131">Share Point Directory and File Permissions</a></dt></dl></dd><dt>Permissions, <a class="indexterm" href="kerberos.html#id2614585">Using the MMC Computer Management Interface</a></dt><dt>permits, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>permitted group, <a class="indexterm" href="kerberos.html#id2614585">Using the MMC Computer Management Interface</a></dt><dt>PHP, <a class="indexterm" href="appendix.html#id2623411">The LDAP Account Manager</a></dt><dt>PHP4, <a class="indexterm" href="appendix.html#id2623411">The LDAP Account Manager</a></dt><dt>pile-driver, <a class="indexterm" href="kerberos.html#id2613518">Share Definition Controls</a></dt><dt>ping, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>pitfalls, <a class="indexterm" href="appendix.html#id2623411">The LDAP Account Manager</a></dt><dt>plain-text, <a class="indexterm" href="DomApps.html#id2618286">Questions and Answers</a></dt><dt>Pluggable Authentication Modules (see PAM)</dt><dt>policy, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a></dt><dt>poor performance, <a class="indexterm" href="HA.html#id2618892">Dissection and Discussion</a></dt><dt>POP3, <a class="indexterm" href="nw4migration.html#id2606305">Technical Issues</a></dt><dt>Posix, <a class="indexterm" href="simple.html#id2551758">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#id2571856">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id2602007">Implementation</a>, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a>, <a class="indexterm" href="appendix.html#id2623411">The LDAP Account Manager</a></dt><dt>POSIX, <a class="indexterm" href="happy.html#id2571022">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a></dt><dt>Posix accounts, <a class="indexterm" href="happy.html#id2576821">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a></dt><dt>Posix ACLs, <a class="indexterm" href="kerberos.html#id2614530">Managing Windows 200x ACLs</a></dt><dt>PosixAccount, <a class="indexterm" href="happy.html#id2576821">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>posixAccount, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a></dt><dt>Postfix, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a></dt><dt>Postscript, <a class="indexterm" href="happy.html#id2572816">Installation of Printer Driver Auto-Download</a></dt><dt>powers, <a class="indexterm" href="kerberos.html#id2613518">Share Definition Controls</a></dt><dt>practices, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a></dt><dt>precaution, <a class="indexterm" href="upgrades.html#id2598125">Introduction</a></dt><dt>presence and leadership, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>price paid, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a></dt><dt>primary group, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="kerberos.html#id2614131">Share Point Directory and File Permissions</a></dt><dt>principals, <a class="indexterm" href="kerberos.html#id2612822">Kerberos Exposed</a></dt><dt>print filter, <a class="indexterm" href="small.html#id2555790">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id2566362">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>print queue, <a class="indexterm" href="simple.html#id2551634">Charity Administration Office</a>, <a class="indexterm" href="simple.html#id2551758">Dissection and Discussion</a></dt><dt>print spooler, <a class="indexterm" href="simple.html#id2551634">Charity Administration Office</a></dt><dt>Print Test Page, <a class="indexterm" href="happy.html#id2582625">Uploading Printer Drivers to Samba Servers</a></dt><dt>printcap name, <a class="indexterm" href="secure.html#id2559329">Implementation</a></dt><dt>printer validation, <a class="indexterm" href="small.html#id2557337">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>printers</dt><dd><dl><dt>Advanced, <a class="indexterm" href="happy.html#id2582625">Uploading Printer Drivers to Samba Servers</a></dt><dt>Default Settings, <a class="indexterm" href="happy.html#id2582625">Uploading Printer Drivers to Samba Servers</a></dt><dt>General, <a class="indexterm" href="happy.html#id2582625">Uploading Printer Drivers to Samba Servers</a></dt><dt>Properties, <a class="indexterm" href="happy.html#id2582625">Uploading Printer Drivers to Samba Servers</a></dt><dt>Security, <a class="indexterm" href="happy.html#id2582625">Uploading Printer Drivers to Samba Servers</a></dt><dt>Sharing, <a class="indexterm" href="happy.html#id2582625">Uploading Printer Drivers to Samba Servers</a></dt></dl></dd><dt>printing, <a class="indexterm" href="secure.html#id2559329">Implementation</a></dt><dd><dl><dt>drag-and-drop, <a class="indexterm" href="happy.html#id2572816">Installation of Printer Driver Auto-Download</a>, <a class="indexterm" href="happy.html#id2582625">Uploading Printer Drivers to Samba Servers</a></dt><dt>dumb, <a class="indexterm" href="happy.html#id2572816">Installation of Printer Driver Auto-Download</a></dt><dt>point-n-click, <a class="indexterm" href="happy.html#id2572816">Installation of Printer Driver Auto-Download</a></dt><dt>raw, <a class="indexterm" href="simple.html#id2551758">Dissection and Discussion</a></dt></dl></dd><dt>privacy, <a class="indexterm" href="net2000users.html#id2584570">Identity Management Needs</a></dt><dt>Privilege Attribute Certificates (see PAC)</dt><dt>privilege controls, <a class="indexterm" href="kerberos.html#id2614131">Share Point Directory and File Permissions</a></dt><dt>privileged pipe, <a class="indexterm" href="DomApps.html#id2617012">Samba Configuration</a></dt><dt>privileges, <a class="indexterm" href="net2000users.html#id2584570">Identity Management Needs</a>, <a class="indexterm" href="upgrades.html#id2600654">Updating from Samba Versions after 3.0.6 to a Current Release</a>, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2613518">Share Definition Controls</a></dt><dt>problem report, <a class="indexterm" href="ch14.html#id2620874">Free Support</a></dt><dt>problem resolution, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>product defects, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a></dt><dt>professional support, <a class="indexterm" href="ch14.html#id2620874">Free Support</a></dt><dt>profile</dt><dd><dl><dt>default, <a class="indexterm" href="happy.html#id2571262">Assignment Tasks</a></dt><dt>mandatory, <a class="indexterm" href="net2000users.html#id2584231">The Nature of Windows Networking Protocols</a></dt><dt>roaming, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>profile path, <a class="indexterm" href="ntmigration.html#id2601658">Technical Issues</a></dt><dt>profile share, <a class="indexterm" href="secure.html#id2559329">Implementation</a></dt><dt>profiles, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a></dt><dt>profiles share, <a class="indexterm" href="ntmigration.html#id2601472">Dissection and Discussion</a></dt><dt>programmer, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a></dt><dt>project, <a class="indexterm" href="ch14.html#id2620874">Free Support</a></dt><dt>project maintainers, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>Properties, <a class="indexterm" href="kerberos.html#id2614585">Using the MMC Computer Management Interface</a></dt><dt>proprietary, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>protected, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>protection, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>protocol</dt><dd><dl><dt>negotiation, <a class="indexterm" href="net2000users.html#id2584231">The Nature of Windows Networking Protocols</a></dt></dl></dd><dt>protocol analysis, <a class="indexterm" href="primer.html#id2625280">Requirements and Notes</a></dt><dt>protocols, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>provided services, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>proxy, <a class="indexterm" href="DomApps.html#id2616051">Assignment Tasks</a>, <a class="indexterm" href="DomApps.html#id2616193">Technical Issues</a></dt><dt>PST file, <a class="indexterm" href="happy.html#id2582129">Configuration of MS Outlook to Relocate PST File</a></dt><dt>public specifications, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>purchase support, <a class="indexterm" href="ch14.html#id2620874">Free Support</a></dt></dl></div><div class="indexdiv"><h3>Q</h3><dl><dt>Qbasic, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a></dt><dt>qualified problem, <a class="indexterm" href="ch14.html#id2620874">Free Support</a></dt></dl></div><div class="indexdiv"><h3>R</h3><dl><dt>RAID, <a class="indexterm" href="secure.html#id2559135">Hardware Requirements</a></dt><dt>RAID controllers, <a class="indexterm" href="HA.html#id2620452">Hardware Problems</a></dt><dt>Raw Print Through, <a class="indexterm" href="happy.html#id2572816">Installation of Printer Driver Auto-Download</a></dt><dt>raw printing, <a class="indexterm" href="small.html#id2555790">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id2566362">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>Rbase, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a></dt><dt>rcldap, <a class="indexterm" href="net2000users.html#id2585064">Implementation</a></dt><dt>realm, <a class="indexterm" href="unixclients.html#id2594807">IDMAP_RID with Winbind</a>, <a class="indexterm" href="unixclients.html#id2595411">IDMAP Storage in LDAP using Winbind</a>, <a class="indexterm" href="DomApps.html#id2616622">Kerberos Configuration</a></dt><dt>recognize, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>record locking, <a class="indexterm" href="appendix.html#id2624881">Microsoft Access</a></dt><dt>recursively, <a class="indexterm" href="kerberos.html#id2615047">Setting Posix ACLs in UNIX/Linux</a></dt><dt>Red Hat, <a class="indexterm" href="simple.html#id2550925">Drafting Office</a>, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>Red Hat Fedora Linux, <a class="indexterm" href="DomApps.html#id2617012">Samba Configuration</a></dt><dt>Red Hat Linux, <a class="indexterm" href="simple.html#id2551758">Dissection and Discussion</a>, <a class="indexterm" href="simple.html#AccountingOffice">Accounting Office</a>, <a class="indexterm" href="happy.html#id2573925">Samba Server Implementation</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="net2000users.html#id2585064">Implementation</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id2616373">Implementation</a>, <a class="indexterm" href="DomApps.html#id2617012">Samba Configuration</a></dt><dt>redirected folders, <a class="indexterm" href="happy.html#id2572363">Roaming Profile Background</a>, <a class="indexterm" href="net2000users.html#id2584231">The Nature of Windows Networking Protocols</a></dt><dt>refereed standards, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>regedit, <a class="indexterm" href="simple.html#id2551953">Implementation</a></dt><dt>regedt32, <a class="indexterm" href="happy.html#id2572664">Profile Changes</a>, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>registry, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a></dt><dd><dl><dt>keys</dt><dd><dl><dt>SAM, <a class="indexterm" href="ntmigration.html#id2601472">Dissection and Discussion</a></dt><dt>SECURITY, <a class="indexterm" href="ntmigration.html#id2601472">Dissection and Discussion</a></dt></dl></dd></dl></dd><dt>registry change, <a class="indexterm" href="kerberos.html#id2615391">Questions and Answers</a></dt><dt>Registry Editor, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>registry hacks, <a class="indexterm" href="kerberos.html#id2615391">Questions and Answers</a></dt><dt>registry keys, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>reimburse, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a></dt><dt>rejected, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="kerberos.html#id2613169">Share Access Controls</a></dt><dt>rejoin, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a></dt><dt>reliability, <a class="indexterm" href="HA.html">Performance, Reliability, and Availability</a></dt><dt>remote announce, <a class="indexterm" href="HA.html#id2619596">Routed Networks</a></dt><dt>remote browse sync, <a class="indexterm" href="HA.html#id2619596">Routed Networks</a></dt><dt>remote procedure call (see RPC)</dt><dt>replicate, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a>, <a class="indexterm" href="HA.html#id2620407">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></dt><dt>replicated, <a class="indexterm" href="net2000users.html#id2583824">Dissection and Discussion</a></dt><dt>requesting payment, <a class="indexterm" href="ch14.html#id2620874">Free Support</a></dt><dt>resilient, <a class="indexterm" href="HA.html#id2619366">Guidelines for Reliable Samba Operation</a></dt><dt>resolution, <a class="indexterm" href="upgrades.html#id2600758">Replacing a Domain Member Server</a></dt><dt>resolve, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a>, <a class="indexterm" href="HA.html#id2619404">Bad Hostnames</a></dt><dt>response, <a class="indexterm" href="unixclients.html#id2594807">IDMAP_RID with Winbind</a></dt><dt>responsibility, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a></dt><dt>responsible, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>restrict anonymous, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>restricted export, <a class="indexterm" href="kerberos.html#id2612822">Kerberos Exposed</a></dt><dt>Restrictive security, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>reverse DNS, <a class="indexterm" href="DomApps.html#id2616622">Kerberos Configuration</a></dt><dt>rfc2307bis, <a class="indexterm" href="unixclients.html#id2596006">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a></dt><dt>RID, <a class="indexterm" href="unixclients.html#id2594807">IDMAP_RID with Winbind</a>, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a></dt><dt>risk, <a class="indexterm" href="secure.html#id2558863">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a></dt><dt>road-map, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dd><dl><dt>published, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt></dl></dd><dt>roaming profile, <a class="indexterm" href="happy.html#id2571856">Technical Issues</a>, <a class="indexterm" href="happy.html#id2572363">Roaming Profile Background</a>, <a class="indexterm" href="happy.html#id2580886">Configuring Profile Directories</a>, <a class="indexterm" href="net2000users.html#id2584137">User Needs</a>, <a class="indexterm" href="net2000users.html#id2588370">Questions and Answers</a></dt><dt>roaming profiles, <a class="indexterm" href="secure.html#id2558863">Technical Issues</a>, <a class="indexterm" href="secure.html#id2559329">Implementation</a>, <a class="indexterm" href="happy.html#id2572363">Roaming Profile Background</a></dt><dt>routed network, <a class="indexterm" href="HA.html#id2620205">Use and Location of BDCs</a></dt><dt>router, <a class="indexterm" href="small.html#id2555790">Implementation</a></dt><dt>routers, <a class="indexterm" href="net2000users.html#id2588370">Questions and Answers</a>, <a class="indexterm" href="HA.html#id2619596">Routed Networks</a></dt><dt>RPC, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="kerberos.html#id2612822">Kerberos Exposed</a></dt><dt>rpc, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a></dt><dt>rpcclient, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a></dt><dt>RPM, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="nw4migration.html#id2606228">Dissection and Discussion</a></dt><dd><dl><dt>install, <a class="indexterm" href="simple.html#id2551061">Implementation</a></dt></dl></dd><dt>rpm, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a class="indexterm" href="appendix.html#id2621811">Samba System File Location</a></dt><dt>RPMs, <a class="indexterm" href="DomApps.html#id2617012">Samba Configuration</a></dt><dt>rpms, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>rsync, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a>, <a class="indexterm" href="HA.html#id2620407">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></dt><dt>rsyncd.conf, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a></dt><dt>run-time control files, <a class="indexterm" href="appendix.html#id2621811">Samba System File Location</a></dt></dl></div><div class="indexdiv"><h3>S</h3><dl><dt>safe-guards, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>SAM, <a class="indexterm" href="ntmigration.html#id2601472">Dissection and Discussion</a></dt><dt>samba, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dd><dl><dt>starting samba, <a class="indexterm" href="simple.html#id2551061">Implementation</a></dt></dl></dd><dt>Samba, <a class="indexterm" href="DomApps.html#id2617012">Samba Configuration</a></dt><dt>Samba accounts, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a></dt><dt>samba cluster, <a class="indexterm" href="HA.html#id2618805">Introduction</a></dt><dt>samba control script, <a class="indexterm" href="appendix.html#id2622232">Starting Samba</a></dt><dt>Samba Domain, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a></dt><dt>Samba Domain server, <a class="indexterm" href="kerberos.html#id2614585">Using the MMC Computer Management Interface</a></dt><dt>Samba RPM Packages, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></dt><dt>Samba Tea, <a class="indexterm" href="DomApps.html#id2617012">Samba Configuration</a></dt><dt>sambaDomainName, <a class="indexterm" href="ntmigration.html#id2602148">NT4 Migration Using LDAP Backend</a></dt><dt>sambaGroupMapping, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a></dt><dt>SambaSAMAccount, <a class="indexterm" href="happy.html#id2571022">Regarding LDAP Directories and Windows Computer Accounts</a></dt><dt>SambaSamAccount, <a class="indexterm" href="happy.html#id2576821">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>sambaSamAccount, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a></dt><dt>SambaXP conference, <a class="indexterm" href="DomApps.html#id2618286">Questions and Answers</a></dt><dt>SAN, <a class="indexterm" href="HA.html#id2620303">For Scalability, Use SAN-Based Storage on Samba Servers</a></dt><dt>SAS, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a></dt><dt>scalability, <a class="indexterm" href="HA.html#id2618805">Introduction</a></dt><dt>scalable, <a class="indexterm" href="net2000users.html#id2584570">Identity Management Needs</a></dt><dt>schannel, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2615257">Key Points Learned</a>, <a class="indexterm" href="kerberos.html#id2615391">Questions and Answers</a></dt><dt>schema, <a class="indexterm" href="unixclients.html#id2596006">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id2600245">Samba-2.x with LDAP Support</a>, <a class="indexterm" href="upgrades.html#id2600576">Updating from Samba Versions between 3.0.6 and 3.0.10</a></dt><dt>scripts, <a class="indexterm" href="appendix.html#id2623411">The LDAP Account Manager</a></dt><dt>secondary group, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>secret, <a class="indexterm" href="kerberos.html#id2612822">Kerberos Exposed</a></dt><dt>secrets.tdb, <a class="indexterm" href="happy.html#id2571856">Technical Issues</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#sbeug1">Location of config files</a></dt><dt>secure, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a></dt><dt>secure account password, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a></dt><dt>secure connections, <a class="indexterm" href="appendix.html#id2623411">The LDAP Account Manager</a></dt><dt>secure networking, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>secure networking protocols, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>security, <a class="indexterm" href="happy.html#id2571856">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a>, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a>, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2614131">Share Point Directory and File Permissions</a>, <a class="indexterm" href="kerberos.html#id2615391">Questions and Answers</a></dt><dd><dl><dt>identifier, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a></dt><dt>share mode, <a class="indexterm" href="simple.html#id2551758">Dissection and Discussion</a></dt><dt>user mode, <a class="indexterm" href="simple.html#id2553799">Dissection and Discussion</a></dt></dl></dd><dt>Security, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2614585">Using the MMC Computer Management Interface</a></dt><dt>Security Account Manager (see SAM)</dt><dt>security controls, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>security descriptors, <a class="indexterm" href="ntmigration.html#id2601472">Dissection and Discussion</a></dt><dt>security fixes, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>security updates, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>SerNet, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id2617012">Samba Configuration</a></dt><dt>server</dt><dd><dl><dt>domain member, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a></dt><dt>stand-alone, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a></dt></dl></dd><dt>service, <a class="indexterm" href="net2000users.html#id2585064">Implementation</a></dt><dd><dl><dt>smb</dt><dd><dl><dt>start, <a class="indexterm" href="Big500users.html#ch5-domsvrspec">Configuration Specific to Domain Member Servers: BLDG1, BLDG2</a></dt></dl></dd></dl></dd><dt>Service Packs, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a></dt><dt>services, <a class="indexterm" href="DomApps.html#id2618225">Key Points Learned</a></dt><dt>services provided, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>session setup, <a class="indexterm" href="primer.html#id2626892">Simple Windows Client Connection Characteristics</a>, <a class="indexterm" href="primer.html#id2627394">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>Session Setup, <a class="indexterm" href="primer.html#id2626892">Simple Windows Client Connection Characteristics</a></dt><dt>SessionSetUpAndX, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a></dt><dt>set primary group script, <a class="indexterm" href="upgrades.html#id2599919">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>setfacl, <a class="indexterm" href="kerberos.html#id2615047">Setting Posix ACLs in UNIX/Linux</a></dt><dt>severely degrade, <a class="indexterm" href="HA.html#id2619868">Samba Configuration</a></dt><dt>SFU, <a class="indexterm" href="unixclients.html#id2596292">IDMAP, Active Directory, and MS Services for UNIX 3.5</a></dt><dt>SGID, <a class="indexterm" href="simple.html#id2551758">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id2614131">Share Point Directory and File Permissions</a>, <a class="indexterm" href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></dt><dt>shadow-utils, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a></dt><dt>Share Access Controls, <a class="indexterm" href="kerberos.html#id2613169">Share Access Controls</a></dt><dt>share ACLs, <a class="indexterm" href="kerberos.html#id2615391">Questions and Answers</a></dt><dt>share definition, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>Share Definition</dt><dd><dl><dt>Controls, <a class="indexterm" href="kerberos.html#id2613518">Share Definition Controls</a></dt></dl></dd><dt>share definition controls, <a class="indexterm" href="kerberos.html#id2613518">Share Definition Controls</a>, <a class="indexterm" href="kerberos.html#id2613658">Checkpoint Controls</a>, <a class="indexterm" href="kerberos.html#id2614131">Share Point Directory and File Permissions</a>, <a class="indexterm" href="kerberos.html#id2615391">Questions and Answers</a></dt><dt>share level access controls, <a class="indexterm" href="kerberos.html#id2615391">Questions and Answers</a></dt><dt>share level ACL, <a class="indexterm" href="kerberos.html#id2615391">Questions and Answers</a></dt><dt>Share Permissions, <a class="indexterm" href="kerberos.html#id2613169">Share Access Controls</a></dt><dt>shared resource, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2615047">Setting Posix ACLs in UNIX/Linux</a></dt><dt>shares, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>SID, <a class="indexterm" href="secure.html#ch4wincfg">Windows Client Configuration</a>, <a class="indexterm" href="happy.html#id2571022">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="net2000users.html#id2584570">Identity Management Needs</a>, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2594807">IDMAP_RID with Winbind</a>, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id2599119">Change of Workgroup (Domain) Name</a>, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a>, <a class="indexterm" href="appendix.html#id2622851">Initialization of the LDAP Database</a></dt><dt>side effects, <a class="indexterm" href="kerberos.html#id2614530">Managing Windows 200x ACLs</a></dt><dt>Sign'n'seal, <a class="indexterm" href="kerberos.html#id2615257">Key Points Learned</a>, <a class="indexterm" href="kerberos.html#id2615391">Questions and Answers</a></dt><dt>silent return, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>simple, <a class="indexterm" href="HA.html#id2618892">Dissection and Discussion</a></dt><dt>Single Sign-On (see SSO)</dt><dt>slapcat, <a class="indexterm" href="happy.html#id2576821">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a></dt><dt>slapd, <a class="indexterm" href="happy.html#id2573240">Debugging LDAP</a></dt><dt>slapd.conf, <a class="indexterm" href="ntmigration.html#id2602148">NT4 Migration Using LDAP Backend</a></dt><dt>slave, <a class="indexterm" href="net2000users.html#id2583824">Dissection and Discussion</a></dt><dt>slow logon, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>slow network, <a class="indexterm" href="HA.html#id2620452">Hardware Problems</a></dt><dt>slurpd, <a class="indexterm" href="net2000users.html#id2585064">Implementation</a>, <a class="indexterm" href="net2000users.html#id2588370">Questions and Answers</a></dt><dt>smart printing, <a class="indexterm" href="happy.html#id2571399">Dissection and Discussion</a></dt><dt>SMB, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a></dt><dt>SMB passwords, <a class="indexterm" href="net2000users.html#id2585064">Implementation</a></dt><dt>SMB/CIFS, <a class="indexterm" href="DomApps.html#id2618286">Questions and Answers</a></dt><dt>smbclient, <a class="indexterm" href="simple.html#validate1">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="happy.html#id2576821">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="DomApps.html#id2618286">Questions and Answers</a></dt><dt>smbd, <a class="indexterm" href="simple.html#validate1">Validation</a>, <a class="indexterm" href="simple.html#id2551953">Implementation</a>, <a class="indexterm" href="small.html#id2557337">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#sbeug1">Location of config files</a>, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="upgrades.html#id2600758">Replacing a Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id2617012">Samba Configuration</a>, <a class="indexterm" href="DomApps.html#id2618286">Questions and Answers</a>, <a class="indexterm" href="appendix.html#id2622232">Starting Samba</a></dt><dd><dl><dt>location of files, <a class="indexterm" href="appendix.html#id2621811">Samba System File Location</a></dt></dl></dd><dt>smbfs, <a class="indexterm" href="HA.html#id2618892">Dissection and Discussion</a></dt><dt>smbldap-groupadd, <a class="indexterm" href="happy.html#id2576821">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a></dt><dt>smbldap-groupmod, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a></dt><dt>smbldap-passwd, <a class="indexterm" href="happy.html#id2576821">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>smbldap-populate, <a class="indexterm" href="happy.html#id2576821">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>smbldap-tools, <a class="indexterm" href="ntmigration.html#id2602148">NT4 Migration Using LDAP Backend</a>, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a>, <a class="indexterm" href="appendix.html#id2623411">The LDAP Account Manager</a></dt><dt>smbldap-tools updating, <a class="indexterm" href="ntmigration.html#id2602148">NT4 Migration Using LDAP Backend</a></dt><dt>smbldap-useradd, <a class="indexterm" href="happy.html#id2576821">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="net2000users.html#id2585064">Implementation</a></dt><dt>smbldap-usermod, <a class="indexterm" href="happy.html#id2576821">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a></dt><dt>smbmnt, <a class="indexterm" href="HA.html#id2618892">Dissection and Discussion</a></dt><dt>smbmount, <a class="indexterm" href="HA.html#id2618892">Dissection and Discussion</a></dt><dt>smbpasswd, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id2555570">Technical Issues</a>, <a class="indexterm" href="small.html#id2555790">Implementation</a>, <a class="indexterm" href="secure.html#id2558863">Technical Issues</a>, <a class="indexterm" href="secure.html#id2560183">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2566362">Server Preparation: All Servers</a>, <a class="indexterm" href="Big500users.html#id2566940">Configuration for Server: MASSIVE</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="happy.html#id2576821">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a class="indexterm" href="net2000users.html#id2583824">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id2585064">Implementation</a>, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a>, <a class="indexterm" href="upgrades.html">Updating Samba-3</a>, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id2599919">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id2601658">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a>, <a class="indexterm" href="DomApps.html">Integrating Additional Services</a></dt><dt>smbumnt, <a class="indexterm" href="HA.html#id2618892">Dissection and Discussion</a></dt><dt>smbumount, <a class="indexterm" href="HA.html#id2618892">Dissection and Discussion</a></dt><dt>SMTP, <a class="indexterm" href="nw4migration.html#id2606305">Technical Issues</a></dt><dt>snap-shot, <a class="indexterm" href="ntmigration.html#id2601472">Dissection and Discussion</a></dt><dt>socket address, <a class="indexterm" href="HA.html#id2619868">Samba Configuration</a></dt><dt>socket options, <a class="indexterm" href="HA.html#id2619868">Samba Configuration</a></dt><dt>software, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a></dt><dt>solve, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a></dt><dt>source code, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a></dt><dt>SPNEGO, <a class="indexterm" href="primer.html#id2627394">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>SQL, <a class="indexterm" href="net2000users.html#id2583824">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id2588370">Questions and Answers</a></dt><dt>Squid, <a class="indexterm" href="DomApps.html#id2616373">Implementation</a>, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a class="indexterm" href="DomApps.html#id2617012">Samba Configuration</a>, <a class="indexterm" href="DomApps.html#id2617829">Squid Configuration</a></dt><dt>squid, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a class="indexterm" href="DomApps.html#id2617012">Samba Configuration</a></dt><dt>Squid proxy, <a class="indexterm" href="DomApps.html#id2616193">Technical Issues</a></dt><dt>SRVTOOLS.EXE, <a class="indexterm" href="secure.html#id2559329">Implementation</a>, <a class="indexterm" href="happy.html#id2580886">Configuring Profile Directories</a>, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2615391">Questions and Answers</a></dt><dt>SSL, <a class="indexterm" href="appendix.html#id2623411">The LDAP Account Manager</a></dt><dt>stand-alone server, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a></dt><dt>starting CUPS, <a class="indexterm" href="simple.html#id2551953">Implementation</a>, <a class="indexterm" href="small.html#id2555790">Implementation</a>, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a>, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dt>starting dhcpd, <a class="indexterm" href="small.html#id2555790">Implementation</a>, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a>, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dt>starting samba, <a class="indexterm" href="simple.html#id2551061">Implementation</a>, <a class="indexterm" href="simple.html#id2551953">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id2555790">Implementation</a>, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a>, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dd><dl><dt>nmbd, <a class="indexterm" href="appendix.html#id2622232">Starting Samba</a></dt><dt>smbd, <a class="indexterm" href="appendix.html#id2622232">Starting Samba</a></dt><dt>winbindd, <a class="indexterm" href="appendix.html#id2622232">Starting Samba</a></dt></dl></dd><dt>startingCUPS, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a></dt><dt>startup script, <a class="indexterm" href="appendix.html#id2622232">Starting Samba</a></dt><dt>sticky bit, <a class="indexterm" href="small.html#id2555790">Implementation</a></dt><dt>storage capacity, <a class="indexterm" href="secure.html#id2559135">Hardware Requirements</a></dt><dt>strategic, <a class="indexterm" href="ntmigration.html#id2601658">Technical Issues</a></dt><dt>strategy, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a></dt><dt>straw-man, <a class="indexterm" href="kerberos.html">Active Directory, Kerberos, and Security</a></dt><dt>strict sync, <a class="indexterm" href="HA.html#id2619868">Samba Configuration</a></dt><dt>stripped, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></dt><dt>strong cryptography, <a class="indexterm" href="kerberos.html#id2612822">Kerberos Exposed</a></dt><dt>subscription, <a class="indexterm" href="ch14.html#id2620874">Free Support</a></dt><dt>SUID, <a class="indexterm" href="simple.html#id2551758">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id2615391">Questions and Answers</a>, <a class="indexterm" href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></dt><dt>Sun ONE Identity Server, <a class="indexterm" href="happy.html#id2571399">Dissection and Discussion</a></dt><dt>super daemon, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a></dt><dt>support, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a>, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>survey, <a class="indexterm" href="unixclients.html">Adding Domain Member Servers and Clients</a></dt><dt>SUSE, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>SUSE Enterprise Linux Server, <a class="indexterm" href="simple.html#id2551634">Charity Administration Office</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="DomApps.html#id2616373">Implementation</a></dt><dt>SUSE Linux, <a class="indexterm" href="simple.html#id2551758">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#id2573925">Samba Server Implementation</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="net2000users.html#id2585064">Implementation</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id2616373">Implementation</a>, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>SWAT, <a class="indexterm" href="appendix.html#id2621811">Samba System File Location</a></dt><dt>sync always, <a class="indexterm" href="HA.html#id2619868">Samba Configuration</a></dt><dt>synchronization, <a class="indexterm" href="DomApps.html#id2616622">Kerberos Configuration</a>, <a class="indexterm" href="HA.html#id2620303">For Scalability, Use SAN-Based Storage on Samba Servers</a></dt><dt>synchronize, <a class="indexterm" href="net2000users.html#id2584137">User Needs</a>, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a></dt><dt>synchronized, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a></dt><dt>syslog, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>system level logins, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a></dt><dt>system security, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt></dl></div><div class="indexdiv"><h3>T</h3><dl><dt>tattooing, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a></dt><dt>TCP/IP, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a></dt><dt>tdbdump, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="ntmigration.html#id2602148">NT4 Migration Using LDAP Backend</a></dt><dt>tdbsam, <a class="indexterm" href="secure.html#id2558863">Technical Issues</a>, <a class="indexterm" href="secure.html#id2559329">Implementation</a>, <a class="indexterm" href="Big500users.html">The 500-User Office</a>, <a class="indexterm" href="happy.html#id2571262">Assignment Tasks</a>, <a class="indexterm" href="net2000users.html#id2583824">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id2585064">Implementation</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id2599919">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="upgrades.html#id2600576">Updating from Samba Versions between 3.0.6 and 3.0.10</a>, <a class="indexterm" href="ntmigration.html#id2601658">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a></dt><dt>testparm, <a class="indexterm" href="small.html#id2557337">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="HA.html#id2619868">Samba Configuration</a></dt><dt>ticket, <a class="indexterm" href="DomApps.html#id2617012">Samba Configuration</a></dt><dt>time server, <a class="indexterm" href="secure.html#id2559329">Implementation</a></dt><dt>Tivoli Directory Server, <a class="indexterm" href="happy.html#id2571399">Dissection and Discussion</a></dt><dt>TLS, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a></dt><dt>token, <a class="indexterm" href="DomApps.html#id2616193">Technical Issues</a></dt><dt>tool, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a></dt><dt>TOSHARG2, <a class="indexterm" href="simple.html#id2551953">Implementation</a></dt><dt>track record, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a></dt><dt>traffic collisions, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>transaction processing, <a class="indexterm" href="net2000users.html#id2583824">Dissection and Discussion</a></dt><dt>transactional, <a class="indexterm" href="net2000users.html#id2588370">Questions and Answers</a></dt><dt>transfer, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a></dt><dt>translate, <a class="indexterm" href="kerberos.html#id2614530">Managing Windows 200x ACLs</a></dt><dt>traverse, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt><dt>tree, <a class="indexterm" href="nw4migration.html#id2606228">Dissection and Discussion</a></dt><dt>Tree Connect, <a class="indexterm" href="primer.html#id2626892">Simple Windows Client Connection Characteristics</a></dt><dt>trust account, <a class="indexterm" href="happy.html#id2571022">Regarding LDAP Directories and Windows Computer Accounts</a></dt><dt>trusted computing, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a></dt><dt>Trusted Domains, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a></dt><dt>trusted domains, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a></dt><dt>trusted third-party, <a class="indexterm" href="kerberos.html#id2612822">Kerberos Exposed</a></dt><dt>trusting, <a class="indexterm" href="kerberos.html#id2612822">Kerberos Exposed</a></dt><dt>turn-around time, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt></dl></div><div class="indexdiv"><h3>U</h3><dl><dt>UDP</dt><dd><dl><dt>broadcast, <a class="indexterm" href="HA.html#id2619596">Routed Networks</a></dt></dl></dd><dt>UID, <a class="indexterm" href="simple.html#id2551758">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#id2571022">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="happy.html#id2571856">Technical Issues</a>, <a class="indexterm" href="net2000users.html#id2585064">Implementation</a>, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a></dt><dt>un-join, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a></dt><dt>unauthorized activities, <a class="indexterm" href="kerberos.html#id2612822">Kerberos Exposed</a></dt><dt>UNC name, <a class="indexterm" href="net2000users.html#id2588370">Questions and Answers</a></dt><dt>unencrypted, <a class="indexterm" href="appendix.html#id2623411">The LDAP Account Manager</a></dt><dt>Unicast, <a class="indexterm" href="net2000users.html#id2584231">The Nature of Windows Networking Protocols</a></dt><dt>unicode, <a class="indexterm" href="upgrades.html#id2599385">International Language Support</a></dt><dt>Universal Naming Convention (see UNC name)</dt><dt>UNIX, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a></dt><dd><dl><dt>groups, <a class="indexterm" href="small.html#id2555570">Technical Issues</a>, <a class="indexterm" href="small.html#id2555790">Implementation</a></dt></dl></dd><dt>UNIX accounts, <a class="indexterm" href="happy.html#id2571856">Technical Issues</a></dt><dt>UNIX/Linux server, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>unix2dos, <a class="indexterm" href="secure.html#id2560183">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2566940">Configuration for Server: MASSIVE</a></dt><dt>unknown, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>unsupported software, <a class="indexterm" href="ch14.html#id2621092">Commercial Support</a></dt><dt>update, <a class="indexterm" href="upgrades.html#id2598125">Introduction</a>, <a class="indexterm" href="upgrades.html#id2598221">Cautions and Notes</a></dt><dt>updates, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a>, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>updating smbldap-tools, <a class="indexterm" href="ntmigration.html#id2602148">NT4 Migration Using LDAP Backend</a></dt><dt>upgrade, <a class="indexterm" href="upgrades.html#id2598125">Introduction</a>, <a class="indexterm" href="upgrades.html#id2598221">Cautions and Notes</a>, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a></dt><dt>uppercase, <a class="indexterm" href="ntmigration.html#id2602007">Implementation</a></dt><dt>user</dt><dd><dl><dt>management, <a class="indexterm" href="small.html#id2555790">Implementation</a>, <a class="indexterm" href="secure.html#id2560183">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2566940">Configuration for Server: MASSIVE</a></dt></dl></dd><dt>user account, <a class="indexterm" href="happy.html">Making Happy Users</a>, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>User and Group Controls, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>user credentials, <a class="indexterm" href="net2000users.html#id2584570">Identity Management Needs</a>, <a class="indexterm" href="unixclients.html#id2596343">UNIX/Linux Client Domain Member</a></dt><dt>user errors, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a></dt><dt>user groups, <a class="indexterm" href="ch14.html#id2620874">Free Support</a></dt><dt>user identities, <a class="indexterm" href="unixclients.html#id2590094">Implementation</a></dt><dt>user logins, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a></dt><dt>user management, <a class="indexterm" href="secure.html#id2559329">Implementation</a></dt><dt>User Manager, <a class="indexterm" href="ntmigration.html#id2602148">NT4 Migration Using LDAP Backend</a></dt><dt>User Mode, <a class="indexterm" href="secure.html#id2559329">Implementation</a>, <a class="indexterm" href="primer.html#id2626892">Simple Windows Client Connection Characteristics</a>, <a class="indexterm" href="primer.html#id2627394">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>useradd, <a class="indexterm" href="simple.html#id2551953">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id2555790">Implementation</a>, <a class="indexterm" href="secure.html#id2560183">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2566940">Configuration for Server: MASSIVE</a>, <a class="indexterm" href="upgrades.html#id2599919">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>userdel, <a class="indexterm" href="upgrades.html#id2599919">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>usermod, <a class="indexterm" href="upgrades.html#id2599919">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id2602148">NT4 Migration Using LDAP Backend</a></dt><dt>username, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a></dt><dt>username map, <a class="indexterm" href="small.html#id2555790">Implementation</a>, <a class="indexterm" href="secure.html#id2560183">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id2566362">Server Preparation: All Servers</a></dt><dt>UTF-8, <a class="indexterm" href="upgrades.html#id2599385">International Language Support</a></dt><dt>utilities, <a class="indexterm" href="DomApps.html#id2618286">Questions and Answers</a></dt></dl></div><div class="indexdiv"><h3>V</h3><dl><dt>valid users, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2613658">Checkpoint Controls</a>, <a class="indexterm" href="kerberos.html#id2615391">Questions and Answers</a></dt><dt>validate, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2613658">Checkpoint Controls</a></dt><dt>validated, <a class="indexterm" href="net2000users.html#id2584570">Identity Management Needs</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a></dt><dt>validation, <a class="indexterm" href="simple.html#validate1">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="DomApps.html#id2618286">Questions and Answers</a></dt><dt>vampire, <a class="indexterm" href="ntmigration.html#id2605051">Questions and Answers</a></dt><dt>vendor, <a class="indexterm" href="kerberos.html#id2611154">Dissection and Discussion</a></dt><dt>vendors, <a class="indexterm" href="upgrades.html#id2600427">Updating a Samba-3 Installation</a></dt><dt>VFS modules, <a class="indexterm" href="appendix.html#id2621811">Samba System File Location</a></dt><dt>virus, <a class="indexterm" href="secure.html#id2559329">Implementation</a></dt><dt>VPN, <a class="indexterm" href="net2000users.html#id2583756">Assignment Tasks</a></dt><dt>vulnerabilities, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a></dt></dl></div><div class="indexdiv"><h3>W</h3><dl><dt>wbinfo, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id2617012">Samba Configuration</a></dt><dt>weakness, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a></dt><dt>web</dt><dd><dl><dt>caching, <a class="indexterm" href="DomApps.html#id2616051">Assignment Tasks</a></dt><dt>proxying, <a class="indexterm" href="DomApps.html#id2616051">Assignment Tasks</a></dt></dl></dd><dt>Web</dt><dd><dl><dt>proxy, <a class="indexterm" href="DomApps.html#id2618286">Questions and Answers</a></dt><dd><dl><dt>access, <a class="indexterm" href="DomApps.html#id2618225">Key Points Learned</a></dt></dl></dd></dl></dd><dt>Web browsers, <a class="indexterm" href="DomApps.html#id2618225">Key Points Learned</a></dt><dt>WebClient, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>WHATSNEW.txt, <a class="indexterm" href="upgrades.html#id2600245">Samba-2.x with LDAP Support</a></dt><dt>white-pages, <a class="indexterm" href="nw4migration.html#id2606305">Technical Issues</a>, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a></dt><dt>wide-area, <a class="indexterm" href="net2000users.html#id2584137">User Needs</a>, <a class="indexterm" href="net2000users.html#id2584570">Identity Management Needs</a>, <a class="indexterm" href="net2000users.html#id2588223">Key Points Learned</a>, <a class="indexterm" href="net2000users.html#id2588370">Questions and Answers</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt><dt>wide-area network, <a class="indexterm" href="HA.html#id2620205">Use and Location of BDCs</a>, <a class="indexterm" href="HA.html#id2620407">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></dt><dt>winbind, <a class="indexterm" href="net2000users.html#id2585064">Implementation</a>, <a class="indexterm" href="unixclients.html#id2589317">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a>, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id2616193">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id2617012">Samba Configuration</a>, <a class="indexterm" href="DomApps.html#id2617564">NSS Configuration</a></dt><dt>Winbind, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id2611545">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id2615257">Key Points Learned</a></dt><dt>winbind trusted domains only, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a></dt><dt>winbind use default domain, <a class="indexterm" href="kerberos.html#id2613658">Checkpoint Controls</a></dt><dt>winbindd, <a class="indexterm" href="small.html#id2557337">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="Big500users.html#id2565409">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="upgrades.html#id2600654">Updating from Samba Versions after 3.0.6 to a Current Release</a>, <a class="indexterm" href="upgrades.html#id2600758">Replacing a Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id2617012">Samba Configuration</a>, <a class="indexterm" href="DomApps.html#id2618286">Questions and Answers</a>, <a class="indexterm" href="appendix.html#id2622232">Starting Samba</a></dt><dt>winbindd_cache.tdb, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a></dt><dt>winbindd_idmap.tdb, <a class="indexterm" href="unixclients.html#id2589345">Technical Issues</a></dt><dt>Windows, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a></dt><dd><dl><dt>client, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a></dt><dt>NT, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a></dt></dl></dd><dt>Windows 2000 ACLs, <a class="indexterm" href="kerberos.html#id2614530">Managing Windows 200x ACLs</a></dt><dt>Windows 2003 Serve, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a></dt><dt>Windows 200x ACLs, <a class="indexterm" href="kerberos.html#id2615391">Questions and Answers</a></dt><dt>Windows accounts, <a class="indexterm" href="happy.html#id2571856">Technical Issues</a></dt><dt>Windows ACLs, <a class="indexterm" href="kerberos.html#id2615047">Setting Posix ACLs in UNIX/Linux</a></dt><dt>Windows Address Book, <a class="indexterm" href="nw4migration.html#id2606568">LDAP Server Configuration</a></dt><dt>Windows ADS Domain, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt><dt>Windows clients, <a class="indexterm" href="DomApps.html#id2618286">Questions and Answers</a></dt><dt>Windows Explorer, <a class="indexterm" href="simple.html#validate1">Validation</a></dt><dt>Windows explorer, <a class="indexterm" href="DomApps.html#id2618286">Questions and Answers</a></dt><dt>Windows security identifier (see SID)</dt><dt>Windows Servers, <a class="indexterm" href="kerberos.html#id2610496">Introduction</a></dt><dt>Windows Services for UNIX (see SUS)</dt><dt>Windows XP, <a class="indexterm" href="small.html#id2555462">Assignment Tasks</a></dt><dt>WINS, <a class="indexterm" href="simple.html#id2551953">Implementation</a>, <a class="indexterm" href="small.html#id2555570">Technical Issues</a>, <a class="indexterm" href="small.html#id2555790">Implementation</a>, <a class="indexterm" href="secure.html#ch4wincfg">Windows Client Configuration</a>, <a class="indexterm" href="Big500users.html#id2565409">Technical Issues</a>, <a class="indexterm" href="Big500users.html#ch5wincfg">Windows Client Configuration</a>, <a class="indexterm" href="net2000users.html#id2584231">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="net2000users.html#id2584570">Identity Management Needs</a>, <a class="indexterm" href="net2000users.html#id2588370">Questions and Answers</a>, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dd><dl><dt>lookup, <a class="indexterm" href="unixclients.html#id2596972">Questions and Answers</a></dt><dt>name resolution, <a class="indexterm" href="HA.html#id2619596">Routed Networks</a></dt><dt>server, <a class="indexterm" href="happy.html">Making Happy Users</a>, <a class="indexterm" href="HA.html#id2619596">Routed Networks</a></dt></dl></dd><dt>WINS server, <a class="indexterm" href="Big500users.html">The 500-User Office</a>, <a class="indexterm" href="net2000users.html#id2588370">Questions and Answers</a></dt><dt>WINS serving, <a class="indexterm" href="secure.html#id2559329">Implementation</a></dt><dt>wins support, <a class="indexterm" href="secure.html#id2559329">Implementation</a></dt><dt>wins.dat, <a class="indexterm" href="net2000users.html#id2584570">Identity Management Needs</a>, <a class="indexterm" href="upgrades.html#id2600758">Replacing a Domain Member Server</a></dt><dt>Wireshark, <a class="indexterm" href="primer.html#id2625280">Requirements and Notes</a></dt><dt>wireshark, <a class="indexterm" href="primer.html#id2625618">Exercises</a></dt><dt>Word, <a class="indexterm" href="kerberos.html#id2614131">Share Point Directory and File Permissions</a></dt><dt>workgroup, <a class="indexterm" href="simple.html#id2551061">Implementation</a>, <a class="indexterm" href="upgrades.html#id2598325">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id2599119">Change of Workgroup (Domain) Name</a></dt><dt>Workgroup Announcement, <a class="indexterm" href="primer.html#id2626531">Findings</a></dt><dt>workstation, <a class="indexterm" href="unixclients.html#id2590094">Implementation</a></dt><dt>wrapper, <a class="indexterm" href="DomApps.html#id2618286">Questions and Answers</a></dt><dt>write lock, <a class="indexterm" href="appendix.html#id2625113">Opportunistic Locking Controls</a></dt></dl></div><div class="indexdiv"><h3>X</h3><dl><dt>xinetd, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a></dt><dt>XML, <a class="indexterm" href="net2000users.html#id2583824">Dissection and Discussion</a></dt><dt>xmlsam, <a class="indexterm" href="net2000users.html#id2585064">Implementation</a></dt></dl></div><div class="indexdiv"><h3>Y</h3><dl><dt>YaST, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dt>Yellow Pages, <a class="indexterm" href="net2000users.html#id2584570">Identity Management Needs</a></dt><dt>yellow pages (see NIS)</dt></dl></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="go01.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> </td></tr><tr><td width="40%" align="left" valign="top">Glossary </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> </td></tr></table></div></body></html>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Index</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="go01.html" title="Glossary"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Index</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="go01.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> </td></tr></table><hr></div><div class="index" title="Index"><div class="titlepage"><div><div><h2 class="title"><a name="id395334"></a>Index</h2></div></div></div><div class="index"><div class="indexdiv"><h3>Symbols</h3><dl><dt>%LOGONSERVER%, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>%USERNAME%, <a class="indexterm" href="happy.html#id342548">Roaming Profile Background</a>, <a class="indexterm" href="happy.html#id342818">Profile Changes</a></dt><dt>%USERPROFILE%, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>/data/ldap, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>/etc/cups/mime.convs, <a class="indexterm" href="simple.html#id324064">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a></dt><dt>/etc/cups/mime.types, <a class="indexterm" href="simple.html#id324064">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a></dt><dt>/etc/dhcpd.conf, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="small.html#id329058">Validation</a>, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>/etc/exports, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></dt><dt>/etc/group, <a class="indexterm" href="happy.html#id342070">Technical Issues</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="upgrades.html#id368475">Replacing a Domain Member Server</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a>, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>/etc/hosts, <a class="indexterm" href="simple.html#id323262">Implementation</a>, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="Big500users.html#id337052">Server Preparation: All Servers</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a>, <a class="indexterm" href="HA.html#id385379">Bad Hostnames</a></dt><dt>/etc/krb5.conf, <a class="indexterm" href="unixclients.html#id363637">IDMAP Storage in LDAP using Winbind</a>, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dt>/etc/ldap.conf, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="unixclients.html#id363637">IDMAP Storage in LDAP using Winbind</a>, <a class="indexterm" href="unixclients.html#id364188">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>/etc/mime.convs, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id337052">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>/etc/mime.types, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id337052">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>/etc/named.conf, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></dt><dt>/etc/nsswitch.conf, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="Big500users.html#id337579">Configuration for Server: MASSIVE</a>, <a class="indexterm" href="Big500users.html#ch5-domsvrspec">Configuration Specific to Domain Member Servers: BLDG1, BLDG2</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#id363067">IDMAP_RID with Winbind</a>, <a class="indexterm" href="unixclients.html#id364188">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></dt><dt>/etc/openldap/slapd.conf, <a class="indexterm" href="happy.html#id343291">Debugging LDAP</a>, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a>, <a class="indexterm" href="net2000users.html#id354011">Implementation</a></dt><dt>/etc/passwd, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id337579">Configuration for Server: MASSIVE</a>, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id368475">Replacing a Domain Member Server</a>, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id373431">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id380465">Share Point Directory and File Permissions</a>, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a class="indexterm" href="primer.html#id392350">Findings and Comments</a></dt><dt>/etc/rc.d/boot.local, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="Big500users.html#id337579">Configuration for Server: MASSIVE</a></dt><dt>/etc/rc.d/rc.local, <a class="indexterm" href="small.html#id327606">Implementation</a></dt><dt>/etc/resolv.conf, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a>, <a class="indexterm" href="Big500users.html#id337052">Server Preparation: All Servers</a></dt><dt>/etc/samba, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>/etc/samba/secrets.tdb, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>/etc/samba/smbusers, <a class="indexterm" href="Big500users.html#id337052">Server Preparation: All Servers</a></dt><dt>/etc/shadow, <a class="indexterm" href="upgrades.html#id368475">Replacing a Domain Member Server</a>, <a class="indexterm" href="nw4migration.html#id373431">Technical Issues</a></dt><dt>/etc/squid/squid.conf, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>/etc/syslog.conf, <a class="indexterm" href="happy.html#id343291">Debugging LDAP</a></dt><dt>/etc/xinetd.d, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a>, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dt>/lib/libnss_ldap.so.2, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dt>/opt/IDEALX/sbin, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></dt><dt>/proc/sys/net/ipv4/ip_forward, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a></dt><dt>/usr/bin, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>/usr/lib/samba, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>/usr/local, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>/usr/local/samba, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>/usr/local/samba/var/locks, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></dt><dt>/usr/sbin, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>/usr/share, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>/usr/share/samba/swat, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>/usr/share/swat, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>/var/cache/samba, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></dt><dt>/var/lib/samba, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>/var/log/ldaplogs, <a class="indexterm" href="happy.html#id343291">Debugging LDAP</a></dt><dt>/var/log/samba, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>8-bit, <a class="indexterm" href="upgrades.html#id367266">International Language Support</a></dt></dl></div><div class="indexdiv"><h3></h3><dl><dt>, <a class="indexterm" href="simple.html#id323262">Implementation</a>, <a class="indexterm" href="simple.html#id324064">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a>, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a>, <a class="indexterm" href="Big500users.html#id336338">Implementation</a>, <a class="indexterm" href="happy.html#sbehap-ppc">Addition of Machines to the Domain</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a class="indexterm" href="net2000users.html#id354011">Implementation</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id363067">IDMAP_RID with Winbind</a>, <a class="indexterm" href="unixclients.html#id363637">IDMAP Storage in LDAP using Winbind</a>, <a class="indexterm" href="unixclients.html#id364188">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a class="indexterm" href="upgrades.html#sbeug1">Location of config files</a>, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a>, <a class="indexterm" href="DomApps.html#id383649">NSS Configuration</a></dt><dd><dl><dt>Domain account, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>liability, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>logon, <a class="indexterm" href="simple.html#id324064">Implementation</a></dt><dt>problem, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>transparent inter-operability, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt></dl></dd></dl></div><div class="indexdiv"><h3>A</h3><dl><dt>abmas-netfw.sh, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a></dt><dt>accept, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a></dt><dt>accepts liability, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>access, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id380037">Checkpoint Controls</a></dt><dt>access control, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a>, <a class="indexterm" href="kerberos.html#id380879">Using the MMC Computer Management Interface</a></dt><dt>Access Control Lists (see ACLs)</dt><dt>access control settings, <a class="indexterm" href="kerberos.html#id379573">Share Access Controls</a></dt><dt>access controls, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id379908">Share Definition Controls</a></dt><dt>accessible, <a class="indexterm" href="kerberos.html#id380465">Share Point Directory and File Permissions</a></dt><dt>account, <a class="indexterm" href="happy.html#id341339">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="kerberos.html#id379573">Share Access Controls</a></dt><dd><dl><dt>ADS Domain, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt></dl></dd><dt>account credentials, <a class="indexterm" href="primer.html#id392350">Findings and Comments</a></dt><dt>account information, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>account names, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>account policies, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>accountable, <a class="indexterm" href="kerberos.html#id377126">Introduction</a>, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>accounts</dt><dd><dl><dt>authoritative, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt><dt>Domain, <a class="indexterm" href="ntmigration.html#id368988">Introduction</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>group, <a class="indexterm" href="ntmigration.html#id368988">Introduction</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>machine, <a class="indexterm" href="ntmigration.html#id368988">Introduction</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>manage, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>user, <a class="indexterm" href="ntmigration.html#id368988">Introduction</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt></dl></dd><dt>ACL, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a>, <a class="indexterm" href="kerberos.html#id380037">Checkpoint Controls</a></dt><dt>ACLs, <a class="indexterm" href="happy.html#id352420">Key Points Learned</a>, <a class="indexterm" href="kerberos.html#id379573">Share Access Controls</a>, <a class="indexterm" href="kerberos.html#id379908">Share Definition Controls</a></dt><dt>acquisitions, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>Act!, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>ACT! database, <a class="indexterm" href="appendix.html#id390409">Act! Database Sharing</a></dt><dt>Act!Diag, <a class="indexterm" href="appendix.html#id390409">Act! Database Sharing</a></dt><dt>Active Directory, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#sbehap-locgrppol">The Local Group Policy</a>, <a class="indexterm" href="net2000users.html#id352928">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#id357994">Assignment Tasks</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id363067">IDMAP_RID with Winbind</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id377126">Introduction</a>, <a class="indexterm" href="kerberos.html#id381514">Key Points Learned</a>, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a>, <a class="indexterm" href="DomApps.html">Integrating Additional Services</a>, <a class="indexterm" href="DomApps.html#id382248">Assignment Tasks</a>, <a class="indexterm" href="DomApps.html#id382367">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a>, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dd><dl><dt>authentication, <a class="indexterm" href="DomApps.html#id383905">Squid Configuration</a></dt><dt>domain, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>join, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>management tools, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>realm, <a class="indexterm" href="HA.html#id385379">Bad Hostnames</a></dt><dt>Replacement, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>server, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dt>Server, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>tree, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt></dl></dd><dt>active directory, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a></dt><dt>AD printer publishing, <a class="indexterm" href="happy.html#id351896">Uploading Printer Drivers to Samba Servers</a></dt><dt>ADAM, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#id363637">IDMAP Storage in LDAP using Winbind</a></dt><dt>add group script, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>add machine script, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>Add Printer Wizard</dt><dd><dl><dt>APW, <a class="indexterm" href="happy.html#id351896">Uploading Printer Drivers to Samba Servers</a></dt></dl></dd><dt>add user script, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>add user to group script, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>adduser, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id337579">Configuration for Server: MASSIVE</a></dt><dt>adequate precautions, <a class="indexterm" href="upgrades.html#id366117">Introduction</a></dt><dt>administrative installation, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a></dt><dt>administrative rights, <a class="indexterm" href="kerberos.html#id380037">Checkpoint Controls</a></dt><dt>administrator, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id337052">Server Preparation: All Servers</a></dt><dt>ADMT, <a class="indexterm" href="upgrades.html#id368842">Migration of Samba Accounts to Active Directory</a></dt><dt>ADS, <a class="indexterm" href="unixclients.html#id363637">IDMAP Storage in LDAP using Winbind</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a>, <a class="indexterm" href="HA.html#id385379">Bad Hostnames</a></dt><dd><dl><dt>server, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt></dl></dd><dt>ADS Domain, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>affordability, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a></dt><dt>alarm, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>algorithm, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>allow trusted domains, <a class="indexterm" href="unixclients.html#id363067">IDMAP_RID with Winbind</a></dt><dt>alternative, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>analysis, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>anonymous connection, <a class="indexterm" href="small.html#id329058">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>Apache Web server, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>appliance mode, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt><dt>application server, <a class="indexterm" href="secure.html#id330398">Technical Issues</a>, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a></dt><dt>application servers, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a></dt><dt>application/octet-stream, <a class="indexterm" href="simple.html#id324064">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id337052">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>APW, <a class="indexterm" href="happy.html#id351896">Uploading Printer Drivers to Samba Servers</a></dt><dt>arp, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>assessment, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>assistance, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt><dt>assumptions, <a class="indexterm" href="HA.html#id386548">Key Points Learned</a></dt><dt>authconfig, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dt>authenticate, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a>, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>authenticated, <a class="indexterm" href="DomApps.html#id382248">Assignment Tasks</a></dt><dt>authenticated connection, <a class="indexterm" href="small.html#id329058">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>authentication, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id373359">Dissection and Discussion</a>, <a class="indexterm" href="DomApps.html">Integrating Additional Services</a>, <a class="indexterm" href="DomApps.html#id382367">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id383649">NSS Configuration</a>, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dd><dl><dt>plain-text, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt></dl></dd><dt>authentication process, <a class="indexterm" href="unixclients.html#id358731">Implementation</a></dt><dt>authentication protocols, <a class="indexterm" href="DomApps.html#id384281">Key Points Learned</a></dt><dt>authoritative, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt><dt>authorized location, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt><dt>auto-generated SID, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>automatically allocate, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt><dt>availability, <a class="indexterm" href="HA.html">Performance, Reliability, and Availability</a></dt></dl></div><div class="indexdiv"><h3>B</h3><dl><dt>backends, <a class="indexterm" href="DomApps.html">Integrating Additional Services</a></dt><dt>background communication, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>Backup, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>Backup Domain Controller (see BDC)</dt><dt>bandwidth, <a class="indexterm" href="DomApps.html#id382248">Assignment Tasks</a></dt><dd><dl><dt>requirements, <a class="indexterm" href="net2000users.html#id353212">User Needs</a></dt></dl></dd><dt>bandwidth calculations, <a class="indexterm" href="secure.html#id330622">Hardware Requirements</a></dt><dt>BDC, <a class="indexterm" href="Big500users.html#id336141">Technical Issues</a>, <a class="indexterm" href="happy.html">Making Happy Users</a>, <a class="indexterm" href="happy.html#id341540">Assignment Tasks</a>, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#id343908">Samba Server Implementation</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="net2000users.html#id357027">Key Points Learned</a>, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a>, <a class="indexterm" href="ntmigration.html#id371918">NT4 Migration Using tdbsam Backend</a>, <a class="indexterm" href="HA.html#id386110">Use and Location of BDCs</a></dt><dt>benefit, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>best practices, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>bias, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>binary database, <a class="indexterm" href="secure.html#id330776">Implementation</a></dt><dt>binary files, <a class="indexterm" href="upgrades.html#id368184">Updating a Samba-3 Installation</a></dt><dt>binary package, <a class="indexterm" href="upgrades.html#id368184">Updating a Samba-3 Installation</a></dt><dt>bind interfaces only, <a class="indexterm" href="secure.html#id330776">Implementation</a></dt><dt>broadcast, <a class="indexterm" href="HA.html#id385556">Routed Networks</a>, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dd><dl><dt>directed, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a></dt><dt>mailslot, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a></dt></dl></dd><dt>broadcast messages, <a class="indexterm" href="secure.html#id330776">Implementation</a></dt><dt>broadcast storms, <a class="indexterm" href="HA.html#id385720">Network Collisions</a></dt><dt>broken, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>broken behavior, <a class="indexterm" href="HA.html#id384892">Dissection and Discussion</a></dt><dt>browse, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>browse master, <a class="indexterm" href="primer.html#id391158">Findings</a></dt><dt>Browse Master, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dt>browse.dat, <a class="indexterm" href="upgrades.html#id368475">Replacing a Domain Member Server</a></dt><dt>Browser Election Service, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dt>browsing, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id382367">Technical Issues</a>, <a class="indexterm" href="primer.html#id390813">Assignment Tasks</a></dt><dt>budgetted, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>bug fixes, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>bug report, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt></dl></div><div class="indexdiv"><h3>C</h3><dl><dt>cache, <a class="indexterm" href="appendix.html#id390484">Opportunistic Locking Controls</a></dt><dt>cache directories, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>caching, <a class="indexterm" href="HA.html#id385810">Samba Configuration</a></dt><dt>case-sensitive, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dt>centralized storage, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>character set, <a class="indexterm" href="upgrades.html#id367266">International Language Support</a></dt><dt>check samba daemons, <a class="indexterm" href="small.html#id329058">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>check-point, <a class="indexterm" href="kerberos.html#id379908">Share Definition Controls</a></dt><dt>check-point controls, <a class="indexterm" href="kerberos.html#id380037">Checkpoint Controls</a></dt><dt>Checkpoint Controls, <a class="indexterm" href="kerberos.html#id380037">Checkpoint Controls</a></dt><dt>chgrp, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>chkconfig, <a class="indexterm" href="simple.html#id323262">Implementation</a>, <a class="indexterm" href="simple.html#id324064">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a>, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a>, <a class="indexterm" href="net2000users.html#id354011">Implementation</a></dt><dt>chmod, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>choice, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>chown, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>CIFS, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a>, <a class="indexterm" href="primer.html#id391158">Findings</a></dt><dt>cifsfs, <a class="indexterm" href="HA.html#id384892">Dissection and Discussion</a></dt><dt>clean database, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>clients per DC, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>Clock skew, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dt>cluster, <a class="indexterm" href="HA.html#id384815">Introduction</a></dt><dt>clustering, <a class="indexterm" href="HA.html#id384815">Introduction</a>, <a class="indexterm" href="HA.html#id386195">For Scalability, Use SAN-Based Storage on Samba Servers</a></dt><dt>code maintainer, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt><dt>codepage, <a class="indexterm" href="upgrades.html#id367266">International Language Support</a></dt><dt>collision rates, <a class="indexterm" href="HA.html#id385720">Network Collisions</a></dt><dt>commercial, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>commercial software, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>commercial support, <a class="indexterm" href="ch14.html">Samba Support</a>, <a class="indexterm" href="ch14.html#id386894">Commercial Support</a></dt><dt>Common Internet File System (see CIFS)</dt><dt>comparison</dt><dd><dl><dt>Active Directory & OpenLDAP, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a></dt></dl></dd><dt>compat, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>compatible, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>compile-time, <a class="indexterm" href="upgrades.html#sbeug1">Location of config files</a></dt><dt>complexities, <a class="indexterm" href="HA.html#id384892">Dissection and Discussion</a></dt><dt>compromise, <a class="indexterm" href="happy.html#id341463">Introduction</a>, <a class="indexterm" href="kerberos.html#id377126">Introduction</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>computer account, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>Computer Management, <a class="indexterm" href="kerberos.html#id379573">Share Access Controls</a>, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>computer name, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>condemns, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>conferences, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>configuration files, <a class="indexterm" href="upgrades.html#id366117">Introduction</a></dt><dt>configure.pl, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></dt><dt>connection, <a class="indexterm" href="kerberos.html#id379573">Share Access Controls</a></dt><dt>connectivity, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>consequential risk, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>consultant, <a class="indexterm" href="simple.html#id323158">Drafting Office</a>, <a class="indexterm" href="kerberos.html#id377126">Introduction</a>, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>consumer, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>consumer expects, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>contiguous directory, <a class="indexterm" href="net2000users.html#id354011">Implementation</a></dt><dt>contributions, <a class="indexterm" href="upgrades.html">Updating Samba-3</a></dt><dt>control files, <a class="indexterm" href="upgrades.html#id368184">Updating a Samba-3 Installation</a></dt><dt>convmv, <a class="indexterm" href="upgrades.html#id367266">International Language Support</a></dt><dt>copy, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>corrective action, <a class="indexterm" href="HA.html#id386332">Hardware Problems</a></dt><dt>cost, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>cost-benefit, <a class="indexterm" href="nw4migration.html#id373282">Assignment Tasks</a></dt><dt>country of origin, <a class="indexterm" href="ch14.html#id386894">Commercial Support</a></dt><dt>Courier-IMAP, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>credential, <a class="indexterm" href="kerberos.html#id379908">Share Definition Controls</a></dt><dt>credentials, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>crippled, <a class="indexterm" href="ntmigration.html#id369115">Dissection and Discussion</a></dt><dt>criticism, <a class="indexterm" href="kerberos.html">Active Directory, Kerberos, and Security</a>, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>Critics, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>Cryptographic, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>CUPS, <a class="indexterm" href="simple.html#id323894">Dissection and Discussion</a>, <a class="indexterm" href="small.html#id327416">Technical Issues</a>, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="small.html#id329652">Key Points Learned</a>, <a class="indexterm" href="secure.html#id330776">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id337052">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#id341540">Assignment Tasks</a>, <a class="indexterm" href="happy.html#id342960">Installation of Printer Driver Auto-Download</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dd><dl><dt>queue, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id337052">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt></dl></dd><dt>cupsd, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a></dt><dt>customer expected, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>customers, <a class="indexterm" href="ch14.html">Samba Support</a></dt></dl></div><div class="indexdiv"><h3>D</h3><dl><dt>daemon, <a class="indexterm" href="simple.html#validate1">Validation</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a>, <a class="indexterm" href="DomApps.html#id382367">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a>, <a class="indexterm" href="appendix.html#id387952">Starting Samba</a></dt><dt>daemon control, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dt>data</dt><dd><dl><dt>corruption, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>integrity, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt></dl></dd><dt>data corruption, <a class="indexterm" href="HA.html#id386332">Hardware Problems</a>, <a class="indexterm" href="appendix.html#id390409">Act! Database Sharing</a></dt><dt>data integrity, <a class="indexterm" href="HA.html#id386332">Hardware Problems</a>, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>data storage, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a></dt><dt>database, <a class="indexterm" href="net2000users.html#id352928">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id373359">Dissection and Discussion</a></dt><dt>database applications, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>DB_CONFIG, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>DCE, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt><dt>DDNS (see dynamic DNS)</dt><dt>Debian, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>default installation, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>default password, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>default profile, <a class="indexterm" href="happy.html#id341540">Assignment Tasks</a>, <a class="indexterm" href="happy.html#id342070">Technical Issues</a></dt><dt>Default User, <a class="indexterm" href="happy.html#id342818">Profile Changes</a>, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>defective</dt><dd><dl><dt>cables, <a class="indexterm" href="HA.html#id386332">Hardware Problems</a></dt><dt>HUBs, <a class="indexterm" href="HA.html#id386332">Hardware Problems</a></dt><dt>switches, <a class="indexterm" href="HA.html#id386332">Hardware Problems</a></dt></dl></dd><dt>defects, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>defensible standards, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>defragmentation, <a class="indexterm" href="secure.html#ch4wincfg">Windows Client Configuration</a></dt><dt>delete group script, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>delete user from group script, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>delimiter, <a class="indexterm" href="kerberos.html#id380037">Checkpoint Controls</a></dt><dt>dependability, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>deployment, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt><dt>desired security setting, <a class="indexterm" href="kerberos.html#id381318">Setting Posix ACLs in UNIX/Linux</a></dt><dt>development, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>DHCP, <a class="indexterm" href="small.html#id327416">Technical Issues</a>, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="small.html#id329652">Key Points Learned</a>, <a class="indexterm" href="secure.html#ch4wincfg">Windows Client Configuration</a>, <a class="indexterm" href="Big500users.html#ch5wincfg">Windows Client Configuration</a>, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dd><dl><dt>client, <a class="indexterm" href="HA.html#id385379">Bad Hostnames</a></dt><dt>relay, <a class="indexterm" href="Big500users.html#id336141">Technical Issues</a></dt><dt>Relay Agent, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>request, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>requests, <a class="indexterm" href="Big500users.html#id336141">Technical Issues</a></dt><dt>servers, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>traffic, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt></dl></dd><dt>dhcp client validation, <a class="indexterm" href="small.html#id329058">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>DHCP Server, <a class="indexterm" href="small.html#id327606">Implementation</a></dt><dt>DHCP server, <a class="indexterm" href="secure.html#id330398">Technical Issues</a></dt><dt>diagnostic, <a class="indexterm" href="unixclients.html#id363637">IDMAP Storage in LDAP using Winbind</a></dt><dt>diffusion, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>digital rights, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>digital sign'n'seal, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>digits, <a class="indexterm" href="HA.html#id385379">Bad Hostnames</a></dt><dt>diligence, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>directory, <a class="indexterm" href="net2000users.html#id352928">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#id358646">Political Issues</a>, <a class="indexterm" href="upgrades.html#sbeug1">Location of config files</a></dt><dd><dl><dt>Computers container, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>management, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a></dt><dt>People container, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>replication, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a></dt><dt>schema, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a></dt><dt>server, <a class="indexterm" href="happy.html#id342070">Technical Issues</a></dt><dt>synchronization, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a></dt></dl></dd><dt>directory tree, <a class="indexterm" href="kerberos.html#id381318">Setting Posix ACLs in UNIX/Linux</a></dt><dt>disable, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>disaster recovery, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>disk image, <a class="indexterm" href="happy.html#id341540">Assignment Tasks</a></dt><dt>disruptive, <a class="indexterm" href="ntmigration.html#id369115">Dissection and Discussion</a></dt><dt>distributed, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a>, <a class="indexterm" href="net2000users.html#id354011">Implementation</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="HA.html#id386240">Distribute Network Load with MSDFS</a></dt><dt>distributed domain, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt><dt>DMB, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dt>DMS, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id368475">Replacing a Domain Member Server</a></dt><dt>DNS, <a class="indexterm" href="small.html#id327416">Technical Issues</a>, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#id330398">Technical Issues</a>, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a>, <a class="indexterm" href="HA.html#id385379">Bad Hostnames</a>, <a class="indexterm" href="HA.html#id385556">Routed Networks</a>, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dd><dl><dt>configuration, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>Dynamic, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>dynamic, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dt>lookup, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dt>name lookup, <a class="indexterm" href="HA.html#id385379">Bad Hostnames</a></dt><dt>SRV records, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dt>suffix, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt></dl></dd><dt>DNS server, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></dt><dt>document the settings, <a class="indexterm" href="HA.html#id385810">Samba Configuration</a></dt><dt>documentation, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>documented, <a class="indexterm" href="HA.html#id385810">Samba Configuration</a></dt><dt>Domain, <a class="indexterm" href="small.html#id327416">Technical Issues</a></dt><dd><dl><dt>groups, <a class="indexterm" href="small.html#id327416">Technical Issues</a></dt></dl></dd><dt>domain</dt><dd><dl><dt>Active Directory, <a class="indexterm" href="DomApps.html#id382367">Technical Issues</a></dt><dt>controller, <a class="indexterm" href="upgrades.html#id368664">Replacing a Domain Controller</a></dt><dt>joining, <a class="indexterm" href="appendix.html">A Collection of Useful Tidbits</a></dt><dt>trusted, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt></dl></dd><dt>Domain accounts, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt><dt>Domain Administrator, <a class="indexterm" href="kerberos.html#id379573">Share Access Controls</a></dt><dt>Domain Controller, <a class="indexterm" href="small.html#id329652">Key Points Learned</a>, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id358731">Implementation</a>, <a class="indexterm" href="HA.html#id386110">Use and Location of BDCs</a></dt><dd><dl><dt>closest, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a></dt></dl></dd><dt>domain controller, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>domain controllers, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt><dt>Domain Controllers, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>Domain Groups</dt><dd><dl><dt>well-known, <a class="indexterm" href="appendix.html#id388463">Initialization of the LDAP Database</a></dt></dl></dd><dt>Domain join, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>domain master, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a>, <a class="indexterm" href="ntmigration.html#id371918">NT4 Migration Using tdbsam Backend</a></dt><dt>Domain Master Browser (see DMB)</dt><dt>Domain Member, <a class="indexterm" href="HA.html#id386110">Use and Location of BDCs</a></dt><dd><dl><dt>authoritative</dt><dd><dl><dt>local accounts, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt></dl></dd><dt>client, <a class="indexterm" href="unixclients.html#id358731">Implementation</a></dt><dt>desktop, <a class="indexterm" href="unixclients.html#id357946">Introduction</a></dt><dt>server, <a class="indexterm" href="unixclients.html#id357946">Introduction</a>, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id358731">Implementation</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>servers, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id380037">Checkpoint Controls</a></dt><dt>workstations, <a class="indexterm" href="unixclients.html#id358731">Implementation</a></dt></dl></dd><dt>domain member</dt><dd><dl><dt>servers, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt></dl></dd><dt>Domain Member server, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>Domain Member servers, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>domain members, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>domain name space, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt><dt>domain replication, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>domain SID, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>Domain SID, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>domain tree, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt><dt>Domain User Manager, <a class="indexterm" href="happy.html#id350283">Configuring Profile Directories</a></dt><dt>Domain users, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>DOS, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>dos2unix, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id337579">Configuration for Server: MASSIVE</a></dt><dt>down-grade, <a class="indexterm" href="upgrades.html#id366117">Introduction</a></dt><dt>drive letters, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>drive mapping, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>dumb printing, <a class="indexterm" href="happy.html#id342960">Installation of Printer Driver Auto-Download</a></dt><dt>dump, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>duplicate accounts, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt><dt>dynamic DNS, <a class="indexterm" href="secure.html#id330398">Technical Issues</a></dt></dl></div><div class="indexdiv"><h3>E</h3><dl><dt>e-Directory, <a class="indexterm" href="nw4migration.html#id373359">Dissection and Discussion</a></dt><dt>Easy Software Products, <a class="indexterm" href="happy.html#id342960">Installation of Printer Driver Auto-Download</a></dt><dt>economically sustainable, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>eDirectory, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a></dt><dt>education, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt><dt>election, <a class="indexterm" href="primer.html#id391158">Findings</a></dt><dt>employment, <a class="indexterm" href="kerberos.html#id377126">Introduction</a>, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>enable, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a></dt><dt>encrypted, <a class="indexterm" href="primer.html#id392350">Findings and Comments</a></dt><dt>encrypted password, <a class="indexterm" href="primer.html#id392597">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>encrypted passwords, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>End User License Agreement (see EULA)</dt><dt>enumerating, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>essential, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>ethereal, <a class="indexterm" href="primer.html#id390920">Exercises</a></dt><dt>Ethernet switch, <a class="indexterm" href="small.html#id327416">Technical Issues</a></dt><dt>ethernet switch, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>EULA, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>Everyone, <a class="indexterm" href="kerberos.html#id379573">Share Access Controls</a></dt><dt>Excel, <a class="indexterm" href="kerberos.html#id380465">Share Point Directory and File Permissions</a></dt><dt>exclusive open, <a class="indexterm" href="appendix.html#id390270">Microsoft Access</a></dt><dt>experiment, <a class="indexterm" href="kerberos.html">Active Directory, Kerberos, and Security</a></dt><dt>export, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a></dt><dt>extent, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>External Domains, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt><dt>extreme demand, <a class="indexterm" href="HA.html#id385344">Guidelines for Reliable Samba Operation</a></dt></dl></div><div class="indexdiv"><h3>F</h3><dl><dt>fail, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a></dt><dt>fail-over, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a>, <a class="indexterm" href="net2000users.html#id354011">Implementation</a></dt><dt>failed, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>failed join, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id363067">IDMAP_RID with Winbind</a></dt><dt>failure, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>familiar, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>fatal problem, <a class="indexterm" href="HA.html#id385810">Samba Configuration</a></dt><dt>fear, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>fears, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>Fedora, <a class="indexterm" href="simple.html#id323158">Drafting Office</a></dt><dt>FHS, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>file and print server, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>file and print service, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>file caching, <a class="indexterm" href="HA.html#id385810">Samba Configuration</a>, <a class="indexterm" href="appendix.html#id390484">Opportunistic Locking Controls</a></dt><dt>File Hierarchy System (see FHS)</dt><dt>file locations, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>file permissions, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>file server</dt><dd><dl><dt>read-only, <a class="indexterm" href="simple.html#id323219">Dissection and Discussion</a></dt></dl></dd><dt>file servers, <a class="indexterm" href="happy.html#id343908">Samba Server Implementation</a></dt><dt>file system, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dd><dl><dt>access control, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a></dt><dt>Ext3, <a class="indexterm" href="simple.html#id323262">Implementation</a></dt><dt>permissions, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id337579">Configuration for Server: MASSIVE</a></dt></dl></dd><dt>file system security, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>filter, <a class="indexterm" href="kerberos.html#id379573">Share Access Controls</a></dt><dt>financial responsibility, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>firewall, <a class="indexterm" href="secure.html#id330398">Technical Issues</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>fix, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>flaws, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>flexibility, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>flush</dt><dd><dl><dt>cache memory, <a class="indexterm" href="appendix.html#id390484">Opportunistic Locking Controls</a></dt></dl></dd><dt>folder redirection, <a class="indexterm" href="happy.html#id342070">Technical Issues</a>, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a>, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>force group, <a class="indexterm" href="kerberos.html#id380322">Override Controls</a>, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>force user, <a class="indexterm" href="simple.html#id323894">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id380322">Override Controls</a>, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>forced settings, <a class="indexterm" href="kerberos.html#id380322">Override Controls</a></dt><dt>foreign, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>foreign SID, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>forwarded, <a class="indexterm" href="HA.html#id385556">Routed Networks</a></dt><dt>foundation members, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>Free Standards Group (see FSG)</dt><dt>free support, <a class="indexterm" href="ch14.html">Samba Support</a>, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt><dt>front-end, <a class="indexterm" href="HA.html#id384892">Dissection and Discussion</a></dt><dd><dl><dt>server, <a class="indexterm" href="HA.html#id386240">Distribute Network Load with MSDFS</a></dt></dl></dd><dt>frustration, <a class="indexterm" href="upgrades.html#id366117">Introduction</a></dt><dt>FSG, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>FTP</dt><dd><dl><dt>proxy, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt></dl></dd><dt>full control, <a class="indexterm" href="kerberos.html#id379573">Share Access Controls</a>, <a class="indexterm" href="kerberos.html#id381156">Using MS Windows Explorer (File Manager)</a></dt><dt>fully qualified, <a class="indexterm" href="kerberos.html#id380037">Checkpoint Controls</a></dt><dt>functional differences, <a class="indexterm" href="upgrades.html#id366200">Cautions and Notes</a></dt></dl></div><div class="indexdiv"><h3>G</h3><dl><dt>generation, <a class="indexterm" href="upgrades.html#id366200">Cautions and Notes</a></dt><dt>Gentoo, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>getent, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id363067">IDMAP_RID with Winbind</a></dt><dt>getfacl, <a class="indexterm" href="kerberos.html#id381318">Setting Posix ACLs in UNIX/Linux</a></dt><dt>getgrnam, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt><dt>getpwnam, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>getpwnam(), <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>GID, <a class="indexterm" href="net2000users.html#id354011">Implementation</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>Goettingen, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>government, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt><dt>GPL, <a class="indexterm" href="secure.html#id335012">Comments Regarding Software Terms of Use</a></dt><dt>group account, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>group management, <a class="indexterm" href="secure.html#id330776">Implementation</a></dt><dt>group mapping, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>group membership, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="kerberos.html#id380465">Share Point Directory and File Permissions</a></dt><dt>group names, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>group policies, <a class="indexterm" href="ntmigration.html#id368988">Introduction</a></dt><dt>Group Policy, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dt>Group Policy editor, <a class="indexterm" href="happy.html#sbehap-locgrppol">The Local Group Policy</a></dt><dt>Group Policy Objects, <a class="indexterm" href="happy.html#sbehap-locgrppol">The Local Group Policy</a></dt><dt>groupadd, <a class="indexterm" href="simple.html#id324064">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>groupdel, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>groupmem, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></dt><dt>groupmod, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>GSS-API, <a class="indexterm" href="primer.html#id392597">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>guest account, <a class="indexterm" href="primer.html#id392350">Findings and Comments</a>, <a class="indexterm" href="primer.html#chap01conc">Dissection and Discussion</a>, <a class="indexterm" href="primer.html#id393223">Technical Issues</a>, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt></dl></div><div class="indexdiv"><h3>H</h3><dl><dt>hackers, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>hardware prices, <a class="indexterm" href="HA.html#id386332">Hardware Problems</a></dt><dt>hardware problems, <a class="indexterm" href="HA.html#id386332">Hardware Problems</a></dt><dt>Heimdal, <a class="indexterm" href="DomApps.html#id382530">Implementation</a>, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dt>Heimdal Kerberos, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt><dt>Heimdal kerberos, <a class="indexterm" href="unixclients.html#id363637">IDMAP Storage in LDAP using Winbind</a></dt><dt>help, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt><dt>helper agent, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>hesiod, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>hierarchy of control, <a class="indexterm" href="kerberos.html#id379908">Share Definition Controls</a></dt><dt>high availability, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a></dt><dt>hire, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>HKEY_CURRENT_USER, <a class="indexterm" href="happy.html#id342548">Roaming Profile Background</a></dt><dt>HKEY_LOCAL_MACHINE, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>HKEY_LOCAL_USER, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>host announcement, <a class="indexterm" href="primer.html#id390813">Assignment Tasks</a>, <a class="indexterm" href="primer.html#id391782">Findings</a></dt><dt>hostname, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>hosts, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>HUB, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>Hybrid, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dt>hypothetical, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt></dl></div><div class="indexdiv"><h3>I</h3><dl><dt>Idealx, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></dt><dd><dl><dt>smbldap-tools, <a class="indexterm" href="happy.html#sbeidealx">Install and Configure Idealx smbldap-tools Scripts</a>, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a></dt></dl></dd><dt>identifiers, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt><dt>identity, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt><dd><dl><dt>management, <a class="indexterm" href="happy.html#id342070">Technical Issues</a></dt></dl></dd><dt>identity management, <a class="indexterm" href="Big500users.html#id336141">Technical Issues</a>, <a class="indexterm" href="net2000users.html#id352928">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#id358646">Political Issues</a>, <a class="indexterm" href="nw4migration.html#id373359">Dissection and Discussion</a></dt><dt>Identity Management, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt><dt>Identity management, <a class="indexterm" href="unixclients.html#id364506">UNIX/Linux Client Domain Member</a></dt><dt>Identity resolution, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id364506">UNIX/Linux Client Domain Member</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>Identity resolver, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>IDMAP, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#id363067">IDMAP_RID with Winbind</a></dt><dt>idmap backend, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt><dt>IDMAP backend, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>idmap gid, <a class="indexterm" href="unixclients.html#id363067">IDMAP_RID with Winbind</a></dt><dt>idmap uid, <a class="indexterm" href="unixclients.html#id363067">IDMAP_RID with Winbind</a></dt><dt>idmap_rid, <a class="indexterm" href="unixclients.html#id363067">IDMAP_RID with Winbind</a></dt><dt>IMAP, <a class="indexterm" href="nw4migration.html#id373431">Technical Issues</a></dt><dt>import, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a></dt><dt>income, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>independent expert, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>inetd, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a></dt><dt>inetOrgPerson, <a class="indexterm" href="nw4migration.html#id373431">Technical Issues</a></dt><dt>inheritance, <a class="indexterm" href="kerberos.html#id381318">Setting Posix ACLs in UNIX/Linux</a></dt><dt>initGrps.sh, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id337579">Configuration for Server: MASSIVE</a></dt><dt>initial credentials, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dt>inoperative, <a class="indexterm" href="ntmigration.html#id369115">Dissection and Discussion</a></dt><dt>install, <a class="indexterm" href="upgrades.html">Updating Samba-3</a></dt><dt>installation, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>integrate, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt><dt>integrity, <a class="indexterm" href="kerberos.html#id377126">Introduction</a>, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt><dt>inter-domain, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>inter-operability, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id381514">Key Points Learned</a>, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>interactive help, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt><dt>interdomain trusts, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt><dt>interfaces, <a class="indexterm" href="secure.html#id330776">Implementation</a></dt><dt>intermittent, <a class="indexterm" href="HA.html#id386332">Hardware Problems</a></dt><dt>internationalization, <a class="indexterm" href="upgrades.html#id367266">International Language Support</a></dt><dt>Internet Explorer, <a class="indexterm" href="DomApps.html#id382367">Technical Issues</a></dt><dt>Internet Information Server, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>interoperability, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a></dt><dt>IP forwarding, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="Big500users.html#id337579">Configuration for Server: MASSIVE</a></dt><dt>IPC$, <a class="indexterm" href="primer.html#id392350">Findings and Comments</a></dt><dt>iptables, <a class="indexterm" href="secure.html#id330398">Technical Issues</a></dt><dt>IRC, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt><dt>isolated, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>Italian, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt></dl></div><div class="indexdiv"><h3>J</h3><dl><dt>jobs, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>joining a domain, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt></dl></div><div class="indexdiv"><h3>K</h3><dl><dt>KDC, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dt>Kerberos, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id377126">Introduction</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id381514">Key Points Learned</a>, <a class="indexterm" href="DomApps.html#id382367">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id382530">Implementation</a>, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dd><dl><dt>Heimdal, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>interoperability, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt><dt>libraries, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>MIT, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>unspecified fields, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt></dl></dd><dt>kerberos, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt><dd><dl><dt>server, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt></dl></dd><dt>Kerberos ticket, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>kinit, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dt>Kixtart, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>klist, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dt>krb5, <a class="indexterm" href="DomApps.html#id382530">Implementation</a></dt><dt>krb5.conf, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt></dl></div><div class="indexdiv"><h3>L</h3><dl><dt>LAM, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dd><dl><dt>configuration editor, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>configuration file, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>login screen, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>opening screen, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>profile, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>wizard, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt></dl></dd><dt>large domain, <a class="indexterm" href="unixclients.html#id363067">IDMAP_RID with Winbind</a></dt><dt>LDAP, <a class="indexterm" href="Big500users.html#id336141">Technical Issues</a>, <a class="indexterm" href="happy.html#id341540">Assignment Tasks</a>, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#id342070">Technical Issues</a>, <a class="indexterm" href="happy.html#id343123">Preliminary Advice: Dangers Can Be Avoided</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="net2000users.html#id352846">Introduction</a>, <a class="indexterm" href="net2000users.html#id352928">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a>, <a class="indexterm" href="net2000users.html#id354011">Implementation</a>, <a class="indexterm" href="net2000users.html#id357027">Key Points Learned</a>, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a>, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id369064">Assignment Tasks</a>, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id373359">Dissection and Discussion</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dd><dl><dt>backend, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt><dt>database, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a>, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a>, <a class="indexterm" href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></dt><dt>directory, <a class="indexterm" href="happy.html#id341339">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt><dt>fail-over, <a class="indexterm" href="net2000users.html#id354011">Implementation</a></dt><dt>initial configuration, <a class="indexterm" href="appendix.html#altldapcfg">Alternative LDAP Database Initialization</a></dt><dt>master, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt><dt>master/slave</dt><dd><dl><dt>background communication, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt></dl></dd><dt>preload, <a class="indexterm" href="net2000users.html#id354011">Implementation</a></dt><dt>schema, <a class="indexterm" href="upgrades.html#id368310">Updating from Samba Versions between 3.0.6 and 3.0.10</a></dt><dt>secure, <a class="indexterm" href="happy.html#id342070">Technical Issues</a></dt><dt>server, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>slave, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt><dt>updates, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt></dl></dd><dt>ldap, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>LDAP Account Manager (see LAM)</dt><dt>LDAP backend, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a></dt><dt>LDAP database, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>LDAP Interchange Format (see LDIF)</dt><dt>LDAP server, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt><dt>LDAP-transfer-LDIF.txt, <a class="indexterm" href="net2000users.html#id354011">Implementation</a></dt><dt>ldap.conf, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>ldapadd, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>ldapsam, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="net2000users.html#id352928">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="upgrades.html#id368310">Updating from Samba Versions between 3.0.6 and 3.0.10</a>, <a class="indexterm" href="ntmigration.html#id369064">Assignment Tasks</a>, <a class="indexterm" href="DomApps.html">Integrating Additional Services</a></dt><dt>ldapsam backend, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>ldapsearch, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>LDIF, <a class="indexterm" href="happy.html#id342070">Technical Issues</a>, <a class="indexterm" href="net2000users.html#id354011">Implementation</a>, <a class="indexterm" href="nw4migration.html#id373431">Technical Issues</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a>, <a class="indexterm" href="appendix.html#id388463">Initialization of the LDAP Database</a></dt><dt>leadership, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>Lightweight Directory Access Protocol (see LDAP)</dt><dt>limit, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>Linux desktop, <a class="indexterm" href="unixclients.html#id357946">Introduction</a></dt><dt>Linux Standards Base (see LSB)</dt><dt>LMB, <a class="indexterm" href="primer.html#id391158">Findings</a>, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dt>LMHOSTS, <a class="indexterm" href="HA.html#id385556">Routed Networks</a></dt><dt>load distribution, <a class="indexterm" href="HA.html#id386195">For Scalability, Use SAN-Based Storage on Samba Servers</a></dt><dt>local accounts, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt><dt>Local Group Policy, <a class="indexterm" href="happy.html#id342548">Roaming Profile Background</a></dt><dt>Local Master Announcement, <a class="indexterm" href="primer.html#id391782">Findings</a></dt><dt>Local Master Browser (see LMB)</dt><dt>localhost, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="HA.html#id385379">Bad Hostnames</a></dt><dt>lock directory, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></dt><dt>locking</dt><dd><dl><dt>Application level, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>Client side, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>Server side, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt></dl></dd><dt>logging, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>login, <a class="indexterm" href="secure.html#id330398">Technical Issues</a></dt><dt>loglevel, <a class="indexterm" href="happy.html#id343291">Debugging LDAP</a></dt><dt>logon credentials, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>logon hours, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id381514">Key Points Learned</a></dt><dt>logon machines, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a></dt><dt>logon path, <a class="indexterm" href="secure.html#id330776">Implementation</a></dt><dt>logon process, <a class="indexterm" href="unixclients.html#id358731">Implementation</a></dt><dt>logon scrip, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a></dt><dt>logon script, <a class="indexterm" href="secure.html#id330776">Implementation</a>, <a class="indexterm" href="happy.html#id342070">Technical Issues</a>, <a class="indexterm" href="happy.html#id350512">Preparation of Logon Scripts</a>, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a></dt><dt>logon server, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a></dt><dt>logon services, <a class="indexterm" href="secure.html#id330776">Implementation</a></dt><dt>logon time, <a class="indexterm" href="happy.html#id341540">Assignment Tasks</a></dt><dt>logon traffic, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a></dt><dt>logon.kix, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>loopback, <a class="indexterm" href="simple.html#validate1">Validation</a></dt><dt>low performance, <a class="indexterm" href="HA.html#id386332">Hardware Problems</a></dt><dt>lower-case, <a class="indexterm" href="ntmigration.html#id369600">Implementation</a></dt><dt>lpadmin, <a class="indexterm" href="simple.html#id324064">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>LSB, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt></dl></div><div class="indexdiv"><h3>M</h3><dl><dt>machine, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>machine account, <a class="indexterm" href="happy.html#id341339">Regarding LDAP Directories and Windows Computer Accounts</a></dt><dt>machine accounts, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>machine secret password, <a class="indexterm" href="Big500users.html#id336141">Technical Issues</a></dt><dt>MACHINE.SID, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>mailing list, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt><dt>mailing lists, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt><dt>managed, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>management, <a class="indexterm" href="unixclients.html#id358646">Political Issues</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dd><dl><dt>group, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>User, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt></dl></dd><dt>mandatory profile, <a class="indexterm" href="happy.html#id342070">Technical Issues</a>, <a class="indexterm" href="happy.html#id350283">Configuring Profile Directories</a></dt><dt>Mandrake, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>mapped drives, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>mapping, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dd><dl><dt>consistent, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt></dl></dd><dt>Mars_NWE, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>master, <a class="indexterm" href="net2000users.html#id352928">Dissection and Discussion</a></dt><dt>material, <a class="indexterm" href="appendix.html">A Collection of Useful Tidbits</a></dt><dt>memberUID, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>memory requirements, <a class="indexterm" href="secure.html#id330622">Hardware Requirements</a></dt><dt>merge, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>merged, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a></dt><dt>meta-directory, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>meta-service, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>Microsoft Access, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>Microsoft Excel, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt><dt>Microsoft ISA, <a class="indexterm" href="DomApps.html#id382248">Assignment Tasks</a></dt><dt>Microsoft Management Console (see MMC)</dt><dt>Microsoft Office, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a>, <a class="indexterm" href="kerberos.html#id380465">Share Point Directory and File Permissions</a></dt><dt>Microsoft Outlook</dt><dd><dl><dt>PST files, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt></dl></dd><dt>migrate, <a class="indexterm" href="upgrades.html">Updating Samba-3</a>, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a></dt><dt>migration, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="happy.html#id341540">Assignment Tasks</a>, <a class="indexterm" href="ntmigration.html#id368988">Introduction</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dd><dl><dt>objectives, <a class="indexterm" href="ntmigration.html#id369115">Dissection and Discussion</a></dt></dl></dd><dt>Migration speed, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>mime type, <a class="indexterm" href="simple.html#id324064">Implementation</a>, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id337052">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>mime types, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a></dt><dt>missing RPC's, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>MIT, <a class="indexterm" href="DomApps.html#id382530">Implementation</a>, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dt>MIT Kerberos, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt><dt>MIT kerberos, <a class="indexterm" href="unixclients.html#id363637">IDMAP Storage in LDAP using Winbind</a></dt><dt>MIT KRB5, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>mixed mode, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>mixed-mode, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>MMC, <a class="indexterm" href="happy.html#id351724">Configure Delete Cached Profiles on Logout</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>mobile computing, <a class="indexterm" href="small.html#id327371">Dissection and Discussion</a></dt><dt>mobility, <a class="indexterm" href="net2000users.html#id353175">Technical Issues</a></dt><dt>modularization, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>modules, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>MS Access</dt><dd><dl><dt>validate, <a class="indexterm" href="appendix.html#id390270">Microsoft Access</a></dt></dl></dd><dt>MS Outlook, <a class="indexterm" href="happy.html#id351441">Configuration of MS Outlook to Relocate PST File</a></dt><dd><dl><dt>PST, <a class="indexterm" href="happy.html#id351441">Configuration of MS Outlook to Relocate PST File</a></dt><dt>PST file, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>MS Windows Server 2003, <a class="indexterm" href="DomApps.html#id382530">Implementation</a></dt><dt>MS Word, <a class="indexterm" href="kerberos.html#id380465">Share Point Directory and File Permissions</a></dt><dt>MSDFS, <a class="indexterm" href="HA.html#id386240">Distribute Network Load with MSDFS</a></dt><dt>multi-subnet, <a class="indexterm" href="HA.html#id385556">Routed Networks</a></dt><dt>multi-user</dt><dd><dl><dt>access, <a class="indexterm" href="appendix.html#id390270">Microsoft Access</a></dt><dt>data access, <a class="indexterm" href="appendix.html#ch12dblck">Shared Data Integrity</a></dt></dl></dd><dt>multiple directories, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt><dt>multiple domain controllers, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>multiple group mappings, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>mutual assistance, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt><dt>My Documents, <a class="indexterm" href="happy.html#id342548">Roaming Profile Background</a></dt><dt>My Network Places, <a class="indexterm" href="simple.html#id324064">Implementation</a></dt><dt>mysqlsam, <a class="indexterm" href="net2000users.html#id354011">Implementation</a></dt></dl></div><div class="indexdiv"><h3>N</h3><dl><dt>name resolution, <a class="indexterm" href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="primer.html#id390813">Assignment Tasks</a></dt><dd><dl><dt>Defective, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt></dl></dd><dt>name resolve order, <a class="indexterm" href="secure.html#id330776">Implementation</a></dt><dt>name service switch, <a class="indexterm" href="small.html#id327606">Implementation</a> (see NSS)</dt><dt>named, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="Big500users.html#id337052">Server Preparation: All Servers</a></dt><dt>NAT, <a class="indexterm" href="secure.html#id330398">Technical Issues</a></dt><dt>native, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>net</dt><dd><dl><dt>ads</dt><dd><dl><dt>info, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>join, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>status, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt></dl></dd><dt>getlocalsid, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>group, <a class="indexterm" href="ntmigration.html#id371918">NT4 Migration Using tdbsam Backend</a></dt><dt>groupmap</dt><dd><dl><dt>add, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a></dt><dt>list, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a>, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>modify, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a></dt></dl></dd><dt>rpc</dt><dd><dl><dt>info, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>join, <a class="indexterm" href="Big500users.html#ch5-domsvrspec">Configuration Specific to Domain Member Servers: BLDG1, BLDG2</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id371918">NT4 Migration Using tdbsam Backend</a></dt><dt>vampire, <a class="indexterm" href="upgrades.html">Updating Samba-3</a>, <a class="indexterm" href="ntmigration.html#id371918">NT4 Migration Using tdbsam Backend</a></dt></dl></dd><dt>setlocalsid, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt></dl></dd><dt>NetBIOS, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="HA.html#id385379">Bad Hostnames</a>, <a class="indexterm" href="HA.html#id385556">Routed Networks</a>, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dd><dl><dt>name cache, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>name resolution</dt><dd><dl><dt>delays, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>Node Type, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt></dl></dd><dt>netbios</dt><dd><dl><dt>machine name, <a class="indexterm" href="upgrades.html#id366964">Change of hostname</a></dt></dl></dd><dt>netbios forwarding, <a class="indexterm" href="HA.html#id385720">Network Collisions</a></dt><dt>NetBIOS name, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dd><dl><dt>aliases, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt></dl></dd><dt>netbios name, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id366964">Change of hostname</a>, <a class="indexterm" href="HA.html#id385379">Bad Hostnames</a></dt><dt>NETLOGON, <a class="indexterm" href="happy.html#id342906">Using a Network Default User Profile</a>, <a class="indexterm" href="happy.html#id350723">Windows Client Configuration</a></dt><dt>netlogon, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>Netlogon, <a class="indexterm" href="appendix.html#domjoin">Joining a Domain: Windows 200x/XP Professional</a></dt><dt>netmask, <a class="indexterm" href="simple.html#id323262">Implementation</a></dt><dt>Netware, <a class="indexterm" href="small.html">Small Office Networking</a></dt><dt>NetWare, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>network</dt><dd><dl><dt>administrators, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>analyzer, <a class="indexterm" href="primer.html#id390813">Assignment Tasks</a></dt><dt>bandwidth, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a>, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>broadcast, <a class="indexterm" href="primer.html#id390763">Introduction</a></dt><dt>captures, <a class="indexterm" href="primer.html#id390627">Requirements and Notes</a></dt><dt>collisions, <a class="indexterm" href="HA.html#id385720">Network Collisions</a></dt><dt>load, <a class="indexterm" href="HA.html#id385720">Network Collisions</a></dt><dt>logon, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>logon scripts, <a class="indexterm" href="ntmigration.html#id369115">Dissection and Discussion</a></dt><dt>management, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>multi-segment, <a class="indexterm" href="happy.html#id341463">Introduction</a></dt><dt>overload, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>performance, <a class="indexterm" href="HA.html#id385810">Samba Configuration</a></dt><dt>routed, <a class="indexterm" href="net2000users.html#id352928">Dissection and Discussion</a></dt><dt>secure, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>segment, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a></dt><dt>services, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>sniffer, <a class="indexterm" href="primer.html#id390627">Requirements and Notes</a></dt><dt>timeout, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>timeouts, <a class="indexterm" href="HA.html#id385720">Network Collisions</a></dt><dt>trace, <a class="indexterm" href="primer.html#id390813">Assignment Tasks</a></dt><dt>traffic</dt><dd><dl><dt>observation, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt></dl></dd><dt>wide-area, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt></dl></dd><dt>Network Address Translation (see NAT)</dt><dt>network administrators, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>network attached storage (see NAS)</dt><dt>network bandwidth</dt><dd><dl><dt>utilization, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>Network Default Profile, <a class="indexterm" href="happy.html#id342548">Roaming Profile Background</a></dt><dt>network hardware</dt><dd><dl><dt>defective, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>network hygiene, <a class="indexterm" href="HA.html#id384892">Dissection and Discussion</a></dt><dt>network Identities, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>network load factors, <a class="indexterm" href="Big500users.html#id336113">Dissection and Discussion</a></dt><dt>Network Neighborhood, <a class="indexterm" href="simple.html#validate1">Validation</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>network segment, <a class="indexterm" href="HA.html#id386110">Use and Location of BDCs</a></dt><dt>network segments, <a class="indexterm" href="secure.html#id330622">Hardware Requirements</a></dt><dt>network share, <a class="indexterm" href="happy.html#id341540">Assignment Tasks</a></dt><dt>networking</dt><dd><dl><dt>client, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt></dl></dd><dt>networking hardware</dt><dd><dl><dt>defective, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>networking protocols, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>next generation, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>NextFreeUnixId, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></dt><dt>NFS server, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></dt><dt>NICs, <a class="indexterm" href="HA.html#id386332">Hardware Problems</a></dt><dt>NIS, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a>, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a>, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id358646">Political Issues</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>nis, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>NIS schema, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>NIS server, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>NIS+, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt><dt>nisplus, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>NLM, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>nmap, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>nmbd, <a class="indexterm" href="small.html#id329058">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="upgrades.html#id368475">Replacing a Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a>, <a class="indexterm" href="appendix.html#id387952">Starting Samba</a></dt><dt>nobody, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a class="indexterm" href="primer.html#id392350">Findings and Comments</a></dt><dt>Novell, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a>, <a class="indexterm" href="nw4migration.html#id373183">Introduction</a></dt><dt>Novell SUSE SLES 9, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></dt><dt>NSS, <a class="indexterm" href="happy.html#id341339">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="happy.html#id342070">Technical Issues</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#id363067">IDMAP_RID with Winbind</a>, <a class="indexterm" href="unixclients.html#id364506">UNIX/Linux Client Domain Member</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a>, <a class="indexterm" href="DomApps.html#id383649">NSS Configuration</a> (see same service switch)</dt><dt>nss_ldap, <a class="indexterm" href="happy.html#id341339">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="happy.html#id342070">Technical Issues</a>, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#id364188">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a class="indexterm" href="upgrades.html#id368475">Replacing a Domain Member Server</a>, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></dt><dt>nt acl support, <a class="indexterm" href="simple.html#id323894">Dissection and Discussion</a></dt><dt>NT4 registry, <a class="indexterm" href="ntmigration.html#id369115">Dissection and Discussion</a></dt><dt>NTLM, <a class="indexterm" href="DomApps.html#id382367">Technical Issues</a></dt><dt>NTLM authentication daemon, <a class="indexterm" href="DomApps.html#id382367">Technical Issues</a></dt><dt>NTLMSSP, <a class="indexterm" href="DomApps.html#id384281">Key Points Learned</a>, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a>, <a class="indexterm" href="primer.html#id392597">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>NTLMSSP_AUTH, <a class="indexterm" href="primer.html#id392597">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>ntlm_auth, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a>, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>NTP, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dt>NTUSER.DAT, <a class="indexterm" href="happy.html#id342548">Roaming Profile Background</a>, <a class="indexterm" href="happy.html#id342818">Profile Changes</a>, <a class="indexterm" href="happy.html#id342906">Using a Network Default User Profile</a>, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>NULL connection, <a class="indexterm" href="simple.html#validate1">Validation</a></dt><dt>NULL session, <a class="indexterm" href="primer.html#id392350">Findings and Comments</a></dt><dt>NULL-Session, <a class="indexterm" href="primer.html#id393094">Discussion</a></dt></dl></div><div class="indexdiv"><h3>O</h3><dl><dt>objectClass, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>off-site storage, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>Open Magazine, <a class="indexterm" href="unixclients.html">Adding Domain Member Servers and Clients</a></dt><dt>Open Source, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>OpenLDAP, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id352928">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a>, <a class="indexterm" href="unixclients.html#id358646">Political Issues</a>, <a class="indexterm" href="nw4migration.html#id373431">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id377126">Introduction</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id381514">Key Points Learned</a>, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>openldap, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>OpenOffice, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a></dt><dt>operating profiles, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>oplock break, <a class="indexterm" href="kerberos.html#id380322">Override Controls</a></dt><dt>oplocks, <a class="indexterm" href="HA.html#id385810">Samba Configuration</a></dt><dt>Oplocks</dt><dd><dl><dt>disabled, <a class="indexterm" href="appendix.html#id390484">Opportunistic Locking Controls</a></dt></dl></dd><dt>opportunistic</dt><dd><dl><dt>locking, <a class="indexterm" href="kerberos.html#id380322">Override Controls</a></dt></dl></dd><dt>opportunistic locking, <a class="indexterm" href="secure.html#id330776">Implementation</a>, <a class="indexterm" href="HA.html#id385810">Samba Configuration</a>, <a class="indexterm" href="appendix.html#id390409">Act! Database Sharing</a></dt><dt>optimized, <a class="indexterm" href="HA.html#id385810">Samba Configuration</a></dt><dt>organizational units, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>OS/2, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>Outlook</dt><dd><dl><dt>PST, <a class="indexterm" href="happy.html#id351441">Configuration of MS Outlook to Relocate PST File</a></dt></dl></dd><dt>Outlook Address Book, <a class="indexterm" href="happy.html#id351441">Configuration of MS Outlook to Relocate PST File</a></dt><dt>Outlook Express, <a class="indexterm" href="secure.html#id330742">Political Issues</a>, <a class="indexterm" href="happy.html#id351441">Configuration of MS Outlook to Relocate PST File</a></dt><dt>over-ride, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>over-ride controls, <a class="indexterm" href="kerberos.html#id380322">Override Controls</a></dt><dt>over-rule, <a class="indexterm" href="kerberos.html#id379573">Share Access Controls</a>, <a class="indexterm" href="kerberos.html#id381156">Using MS Windows Explorer (File Manager)</a></dt><dt>overheads, <a class="indexterm" href="kerberos.html#id380322">Override Controls</a></dt><dt>ownership, <a class="indexterm" href="kerberos.html#id380465">Share Point Directory and File Permissions</a></dt></dl></div><div class="indexdiv"><h3>P</h3><dl><dt>package, <a class="indexterm" href="simple.html#id323262">Implementation</a></dt><dt>package names, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>packages, <a class="indexterm" href="upgrades.html#id368184">Updating a Samba-3 Installation</a></dt><dt>PADL, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id363637">IDMAP Storage in LDAP using Winbind</a></dt><dt>PADL LDAP tools, <a class="indexterm" href="happy.html#id342070">Technical Issues</a></dt><dt>PADL Software, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>paid-for support, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>PAM, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="unixclients.html#id364506">UNIX/Linux Client Domain Member</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>pam_ldap, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>pam_ldap.so, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dt>pam_unix2.so, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dd><dl><dt>use_ldap, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt></dl></dd><dt>parameters, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>passdb backend, <a class="indexterm" href="secure.html#id330776">Implementation</a>, <a class="indexterm" href="Big500users.html">The 500-User Office</a>, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id352928">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id354011">Implementation</a>, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="upgrades.html">Updating Samba-3</a>, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="upgrades.html#id368310">Updating from Samba Versions between 3.0.6 and 3.0.10</a>, <a class="indexterm" href="ntmigration.html#id369064">Assignment Tasks</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>passdb.tdb, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a></dt><dt>passwd, <a class="indexterm" href="simple.html#id324064">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a></dt><dt>password</dt><dd><dl><dt>backend, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id337579">Configuration for Server: MASSIVE</a></dt></dl></dd><dt>password caching, <a class="indexterm" href="simple.html#id324064">Implementation</a></dt><dt>password change, <a class="indexterm" href="kerberos.html#id381514">Key Points Learned</a></dt><dt>password length, <a class="indexterm" href="primer.html#id392130">Simple Windows Client Connection Characteristics</a>, <a class="indexterm" href="primer.html#id392597">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>payroll, <a class="indexterm" href="nw4migration.html#id373183">Introduction</a></dt><dt>pdbedit, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a class="indexterm" href="ntmigration.html#id371918">NT4 Migration Using tdbsam Backend</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>PDC, <a class="indexterm" href="Big500users.html#id336038">Assignment Tasks</a>, <a class="indexterm" href="Big500users.html#id336141">Technical Issues</a>, <a class="indexterm" href="happy.html">Making Happy Users</a>, <a class="indexterm" href="happy.html#id342070">Technical Issues</a>, <a class="indexterm" href="happy.html#sbehap-locgrppol">The Local Group Policy</a>, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id369600">Implementation</a>, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a>, <a class="indexterm" href="ntmigration.html#id371918">NT4 Migration Using tdbsam Backend</a>, <a class="indexterm" href="HA.html#id386110">Use and Location of BDCs</a></dt><dt>PDC/BDC ratio, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>PDF, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>performance, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a>, <a class="indexterm" href="HA.html">Performance, Reliability, and Availability</a>, <a class="indexterm" href="HA.html#id384815">Introduction</a>, <a class="indexterm" href="HA.html#id385720">Network Collisions</a></dt><dt>performance degradation, <a class="indexterm" href="kerberos.html#id380322">Override Controls</a>, <a class="indexterm" href="HA.html#id385810">Samba Configuration</a></dt><dt>Perl, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a>, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>permission, <a class="indexterm" href="kerberos.html#id380465">Share Point Directory and File Permissions</a></dt><dt>permissions, <a class="indexterm" href="simple.html#id324064">Implementation</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id379573">Share Access Controls</a>, <a class="indexterm" href="kerberos.html#id380037">Checkpoint Controls</a>, <a class="indexterm" href="kerberos.html#id380465">Share Point Directory and File Permissions</a>, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dd><dl><dt>excessive, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>group, <a class="indexterm" href="kerberos.html#id380465">Share Point Directory and File Permissions</a></dt><dt>user, <a class="indexterm" href="kerberos.html#id380465">Share Point Directory and File Permissions</a></dt></dl></dd><dt>Permissions, <a class="indexterm" href="kerberos.html#id380879">Using the MMC Computer Management Interface</a></dt><dt>permits, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>permitted group, <a class="indexterm" href="kerberos.html#id380879">Using the MMC Computer Management Interface</a></dt><dt>PHP, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>PHP4, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>pile-driver, <a class="indexterm" href="kerberos.html#id379908">Share Definition Controls</a></dt><dt>ping, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>pitfalls, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>plain-text, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>Pluggable Authentication Modules (see PAM)</dt><dt>policy, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>poor performance, <a class="indexterm" href="HA.html#id384892">Dissection and Discussion</a></dt><dt>POP3, <a class="indexterm" href="nw4migration.html#id373431">Technical Issues</a></dt><dt>Posix, <a class="indexterm" href="simple.html#id323894">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#id342070">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id369600">Implementation</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a>, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>POSIX, <a class="indexterm" href="happy.html#id341339">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>Posix accounts, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt><dt>Posix ACLs, <a class="indexterm" href="kerberos.html#id380830">Managing Windows 200x ACLs</a></dt><dt>PosixAccount, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>posixAccount, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>Postfix, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>Postscript, <a class="indexterm" href="happy.html#id342960">Installation of Printer Driver Auto-Download</a></dt><dt>powers, <a class="indexterm" href="kerberos.html#id379908">Share Definition Controls</a></dt><dt>practices, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>precaution, <a class="indexterm" href="upgrades.html#id366117">Introduction</a></dt><dt>presence and leadership, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>price paid, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>primary group, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="kerberos.html#id380465">Share Point Directory and File Permissions</a></dt><dt>principals, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt><dt>print filter, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id337052">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>print queue, <a class="indexterm" href="simple.html#id323803">Charity Administration Office</a>, <a class="indexterm" href="simple.html#id323894">Dissection and Discussion</a></dt><dt>print spooler, <a class="indexterm" href="simple.html#id323803">Charity Administration Office</a></dt><dt>Print Test Page, <a class="indexterm" href="happy.html#id351896">Uploading Printer Drivers to Samba Servers</a></dt><dt>printcap name, <a class="indexterm" href="secure.html#id330776">Implementation</a></dt><dt>printer validation, <a class="indexterm" href="small.html#id329058">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a></dt><dt>printers</dt><dd><dl><dt>Advanced, <a class="indexterm" href="happy.html#id351896">Uploading Printer Drivers to Samba Servers</a></dt><dt>Default Settings, <a class="indexterm" href="happy.html#id351896">Uploading Printer Drivers to Samba Servers</a></dt><dt>General, <a class="indexterm" href="happy.html#id351896">Uploading Printer Drivers to Samba Servers</a></dt><dt>Properties, <a class="indexterm" href="happy.html#id351896">Uploading Printer Drivers to Samba Servers</a></dt><dt>Security, <a class="indexterm" href="happy.html#id351896">Uploading Printer Drivers to Samba Servers</a></dt><dt>Sharing, <a class="indexterm" href="happy.html#id351896">Uploading Printer Drivers to Samba Servers</a></dt></dl></dd><dt>printing, <a class="indexterm" href="secure.html#id330776">Implementation</a></dt><dd><dl><dt>drag-and-drop, <a class="indexterm" href="happy.html#id342960">Installation of Printer Driver Auto-Download</a>, <a class="indexterm" href="happy.html#id351896">Uploading Printer Drivers to Samba Servers</a></dt><dt>dumb, <a class="indexterm" href="happy.html#id342960">Installation of Printer Driver Auto-Download</a></dt><dt>point-n-click, <a class="indexterm" href="happy.html#id342960">Installation of Printer Driver Auto-Download</a></dt><dt>raw, <a class="indexterm" href="simple.html#id323894">Dissection and Discussion</a></dt></dl></dd><dt>privacy, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt><dt>Privilege Attribute Certificates (see PAC)</dt><dt>privilege controls, <a class="indexterm" href="kerberos.html#id380465">Share Point Directory and File Permissions</a></dt><dt>privileged pipe, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>privileges, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a>, <a class="indexterm" href="upgrades.html#id368384">Updating from Samba Versions after 3.0.6 to a Current Release</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id379908">Share Definition Controls</a></dt><dt>problem report, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt><dt>problem resolution, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>product defects, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>professional support, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt><dt>profile</dt><dd><dl><dt>default, <a class="indexterm" href="happy.html#id341540">Assignment Tasks</a></dt><dt>mandatory, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a></dt><dt>roaming, <a class="indexterm" href="happy.html">Making Happy Users</a></dt></dl></dd><dt>profile path, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a></dt><dt>profile share, <a class="indexterm" href="secure.html#id330776">Implementation</a></dt><dt>profiles, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>profiles share, <a class="indexterm" href="ntmigration.html#id369115">Dissection and Discussion</a></dt><dt>programmer, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>project, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt><dt>project maintainers, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>Properties, <a class="indexterm" href="kerberos.html#id380879">Using the MMC Computer Management Interface</a></dt><dt>proprietary, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>protected, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>protection, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>protocol</dt><dd><dl><dt>negotiation, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a></dt></dl></dd><dt>protocol analysis, <a class="indexterm" href="primer.html#id390627">Requirements and Notes</a></dt><dt>protocols, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>provided services, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>proxy, <a class="indexterm" href="DomApps.html#id382248">Assignment Tasks</a>, <a class="indexterm" href="DomApps.html#id382367">Technical Issues</a></dt><dt>PST file, <a class="indexterm" href="happy.html#id351441">Configuration of MS Outlook to Relocate PST File</a></dt><dt>public specifications, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>purchase support, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt></dl></div><div class="indexdiv"><h3>Q</h3><dl><dt>Qbasic, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>qualified problem, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt></dl></div><div class="indexdiv"><h3>R</h3><dl><dt>RAID, <a class="indexterm" href="secure.html#id330622">Hardware Requirements</a></dt><dt>RAID controllers, <a class="indexterm" href="HA.html#id386332">Hardware Problems</a></dt><dt>Raw Print Through, <a class="indexterm" href="happy.html#id342960">Installation of Printer Driver Auto-Download</a></dt><dt>raw printing, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#ch4ptrcfg">Printer Configuration</a>, <a class="indexterm" href="Big500users.html#id337052">Server Preparation: All Servers</a>, <a class="indexterm" href="happy.html#sbehap-ptrcfg">Printer Configuration</a></dt><dt>Rbase, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>rcldap, <a class="indexterm" href="net2000users.html#id354011">Implementation</a></dt><dt>realm, <a class="indexterm" href="unixclients.html#id363067">IDMAP_RID with Winbind</a>, <a class="indexterm" href="unixclients.html#id363637">IDMAP Storage in LDAP using Winbind</a>, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dt>recognize, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>record locking, <a class="indexterm" href="appendix.html#id390270">Microsoft Access</a></dt><dt>recursively, <a class="indexterm" href="kerberos.html#id381318">Setting Posix ACLs in UNIX/Linux</a></dt><dt>Red Hat, <a class="indexterm" href="simple.html#id323158">Drafting Office</a>, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>Red Hat Fedora Linux, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>Red Hat Linux, <a class="indexterm" href="simple.html#id323894">Dissection and Discussion</a>, <a class="indexterm" href="simple.html#AccountingOffice">Accounting Office</a>, <a class="indexterm" href="happy.html#id343908">Samba Server Implementation</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="net2000users.html#id354011">Implementation</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id382530">Implementation</a>, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>redirected folders, <a class="indexterm" href="happy.html#id342548">Roaming Profile Background</a>, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a></dt><dt>refereed standards, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>regedit, <a class="indexterm" href="simple.html#id324064">Implementation</a></dt><dt>regedt32, <a class="indexterm" href="happy.html#id342818">Profile Changes</a>, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>registry, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dd><dl><dt>keys</dt><dd><dl><dt>SAM, <a class="indexterm" href="ntmigration.html#id369115">Dissection and Discussion</a></dt><dt>SECURITY, <a class="indexterm" href="ntmigration.html#id369115">Dissection and Discussion</a></dt></dl></dd></dl></dd><dt>registry change, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>Registry Editor, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>registry hacks, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>registry keys, <a class="indexterm" href="happy.html#redirfold">Configuration of Default Profile with Folder Redirection</a></dt><dt>reimburse, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>rejected, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="kerberos.html#id379573">Share Access Controls</a></dt><dt>rejoin, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>reliability, <a class="indexterm" href="HA.html">Performance, Reliability, and Availability</a></dt><dt>remote announce, <a class="indexterm" href="HA.html#id385556">Routed Networks</a></dt><dt>remote browse sync, <a class="indexterm" href="HA.html#id385556">Routed Networks</a></dt><dt>remote procedure call (see RPC)</dt><dt>replicate, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="HA.html#id386291">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></dt><dt>replicated, <a class="indexterm" href="net2000users.html#id352928">Dissection and Discussion</a></dt><dt>requesting payment, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt><dt>resilient, <a class="indexterm" href="HA.html#id385344">Guidelines for Reliable Samba Operation</a></dt><dt>resolution, <a class="indexterm" href="upgrades.html#id368475">Replacing a Domain Member Server</a></dt><dt>resolve, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a>, <a class="indexterm" href="HA.html#id385379">Bad Hostnames</a></dt><dt>response, <a class="indexterm" href="unixclients.html#id363067">IDMAP_RID with Winbind</a></dt><dt>responsibility, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>responsible, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>restrict anonymous, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>restricted export, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt><dt>Restrictive security, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>reverse DNS, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a></dt><dt>rfc2307bis, <a class="indexterm" href="unixclients.html#id364188">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a></dt><dt>RID, <a class="indexterm" href="unixclients.html#id363067">IDMAP_RID with Winbind</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>risk, <a class="indexterm" href="secure.html#id330398">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>road-map, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dd><dl><dt>published, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt></dl></dd><dt>roaming profile, <a class="indexterm" href="happy.html#id342070">Technical Issues</a>, <a class="indexterm" href="happy.html#id342548">Roaming Profile Background</a>, <a class="indexterm" href="happy.html#id350283">Configuring Profile Directories</a>, <a class="indexterm" href="net2000users.html#id353212">User Needs</a>, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>roaming profiles, <a class="indexterm" href="secure.html#id330398">Technical Issues</a>, <a class="indexterm" href="secure.html#id330776">Implementation</a>, <a class="indexterm" href="happy.html#id342548">Roaming Profile Background</a></dt><dt>routed network, <a class="indexterm" href="HA.html#id386110">Use and Location of BDCs</a></dt><dt>router, <a class="indexterm" href="small.html#id327606">Implementation</a></dt><dt>routers, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a>, <a class="indexterm" href="HA.html#id385556">Routed Networks</a></dt><dt>RPC, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt><dt>rpc, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>rpcclient, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>RPM, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="nw4migration.html#id373359">Dissection and Discussion</a></dt><dd><dl><dt>install, <a class="indexterm" href="simple.html#id323262">Implementation</a></dt></dl></dd><dt>rpm, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>RPMs, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>rpms, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>rsync, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a>, <a class="indexterm" href="HA.html#id386291">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></dt><dt>rsyncd.conf, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>run-time control files, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt></dl></div><div class="indexdiv"><h3>S</h3><dl><dt>safe-guards, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>SAM, <a class="indexterm" href="ntmigration.html#id369115">Dissection and Discussion</a></dt><dt>samba, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dd><dl><dt>starting samba, <a class="indexterm" href="simple.html#id323262">Implementation</a></dt></dl></dd><dt>Samba, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>Samba accounts, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt><dt>samba cluster, <a class="indexterm" href="HA.html#id384815">Introduction</a></dt><dt>samba control script, <a class="indexterm" href="appendix.html#id387952">Starting Samba</a></dt><dt>Samba Domain, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>Samba Domain server, <a class="indexterm" href="kerberos.html#id380879">Using the MMC Computer Management Interface</a></dt><dt>Samba RPM Packages, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a></dt><dt>Samba Tea, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>sambaDomainName, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></dt><dt>sambaGroupMapping, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>SambaSAMAccount, <a class="indexterm" href="happy.html#id341339">Regarding LDAP Directories and Windows Computer Accounts</a></dt><dt>SambaSamAccount, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>sambaSamAccount, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>SambaXP conference, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>SAN, <a class="indexterm" href="HA.html#id386195">For Scalability, Use SAN-Based Storage on Samba Servers</a></dt><dt>SAS, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>scalability, <a class="indexterm" href="HA.html#id384815">Introduction</a></dt><dt>scalable, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt><dt>schannel, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id381514">Key Points Learned</a>, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>schema, <a class="indexterm" href="unixclients.html#id364188">IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id368069">Samba-2.x with LDAP Support</a>, <a class="indexterm" href="upgrades.html#id368310">Updating from Samba Versions between 3.0.6 and 3.0.10</a></dt><dt>scripts, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>secondary group, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></dt><dt>secret, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt><dt>secrets.tdb, <a class="indexterm" href="happy.html#id342070">Technical Issues</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#sbeug1">Location of config files</a></dt><dt>secure, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>secure account password, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>secure connections, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>secure networking, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>secure networking protocols, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>security, <a class="indexterm" href="happy.html#id342070">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a>, <a class="indexterm" href="kerberos.html#id377126">Introduction</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id380465">Share Point Directory and File Permissions</a>, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dd><dl><dt>identifier, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>share mode, <a class="indexterm" href="simple.html#id323894">Dissection and Discussion</a></dt><dt>user mode, <a class="indexterm" href="simple.html#id325807">Dissection and Discussion</a></dt></dl></dd><dt>Security, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id380879">Using the MMC Computer Management Interface</a></dt><dt>Security Account Manager (see SAM)</dt><dt>security controls, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>security descriptors, <a class="indexterm" href="ntmigration.html#id369115">Dissection and Discussion</a></dt><dt>security fixes, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>security updates, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>SerNet, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>server</dt><dd><dl><dt>domain member, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>stand-alone, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt></dl></dd><dt>service, <a class="indexterm" href="net2000users.html#id354011">Implementation</a></dt><dd><dl><dt>smb</dt><dd><dl><dt>start, <a class="indexterm" href="Big500users.html#ch5-domsvrspec">Configuration Specific to Domain Member Servers: BLDG1, BLDG2</a></dt></dl></dd></dl></dd><dt>Service Packs, <a class="indexterm" href="secure.html#ch4appscfg">Application Share Configuration</a></dt><dt>services, <a class="indexterm" href="DomApps.html#id384281">Key Points Learned</a></dt><dt>services provided, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>session setup, <a class="indexterm" href="primer.html#id392130">Simple Windows Client Connection Characteristics</a>, <a class="indexterm" href="primer.html#id392597">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>Session Setup, <a class="indexterm" href="primer.html#id392130">Simple Windows Client Connection Characteristics</a></dt><dt>SessionSetUpAndX, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>set primary group script, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>setfacl, <a class="indexterm" href="kerberos.html#id381318">Setting Posix ACLs in UNIX/Linux</a></dt><dt>severely degrade, <a class="indexterm" href="HA.html#id385810">Samba Configuration</a></dt><dt>SFU, <a class="indexterm" href="unixclients.html#id364460">IDMAP, Active Directory, and MS Services for UNIX 3.5</a></dt><dt>SGID, <a class="indexterm" href="simple.html#id323894">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id380465">Share Point Directory and File Permissions</a>, <a class="indexterm" href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></dt><dt>shadow-utils, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>Share Access Controls, <a class="indexterm" href="kerberos.html#id379573">Share Access Controls</a></dt><dt>share ACLs, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>share definition, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>Share Definition</dt><dd><dl><dt>Controls, <a class="indexterm" href="kerberos.html#id379908">Share Definition Controls</a></dt></dl></dd><dt>share definition controls, <a class="indexterm" href="kerberos.html#id379908">Share Definition Controls</a>, <a class="indexterm" href="kerberos.html#id380037">Checkpoint Controls</a>, <a class="indexterm" href="kerberos.html#id380465">Share Point Directory and File Permissions</a>, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>share level access controls, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>share level ACL, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>Share Permissions, <a class="indexterm" href="kerberos.html#id379573">Share Access Controls</a></dt><dt>shared resource, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id381318">Setting Posix ACLs in UNIX/Linux</a></dt><dt>shares, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>SID, <a class="indexterm" href="secure.html#ch4wincfg">Windows Client Configuration</a>, <a class="indexterm" href="happy.html#id341339">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a>, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id363067">IDMAP_RID with Winbind</a>, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id367023">Change of Workgroup (Domain) Name</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a>, <a class="indexterm" href="appendix.html#id388463">Initialization of the LDAP Database</a></dt><dt>side effects, <a class="indexterm" href="kerberos.html#id380830">Managing Windows 200x ACLs</a></dt><dt>Sign'n'seal, <a class="indexterm" href="kerberos.html#id381514">Key Points Learned</a>, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>silent return, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></dt><dt>simple, <a class="indexterm" href="HA.html#id384892">Dissection and Discussion</a></dt><dt>Single Sign-On (see SSO)</dt><dt>slapcat, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>slapd, <a class="indexterm" href="happy.html#id343291">Debugging LDAP</a></dt><dt>slapd.conf, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></dt><dt>slave, <a class="indexterm" href="net2000users.html#id352928">Dissection and Discussion</a></dt><dt>slow logon, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>slow network, <a class="indexterm" href="HA.html#id386332">Hardware Problems</a></dt><dt>slurpd, <a class="indexterm" href="net2000users.html#id354011">Implementation</a>, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>smart printing, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a></dt><dt>SMB, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>SMB passwords, <a class="indexterm" href="net2000users.html#id354011">Implementation</a></dt><dt>SMB/CIFS, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>smbclient, <a class="indexterm" href="simple.html#validate1">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>smbd, <a class="indexterm" href="simple.html#validate1">Validation</a>, <a class="indexterm" href="simple.html#id324064">Implementation</a>, <a class="indexterm" href="small.html#id329058">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#sbeug1">Location of config files</a>, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="upgrades.html#id368475">Replacing a Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a>, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a>, <a class="indexterm" href="appendix.html#id387952">Starting Samba</a></dt><dd><dl><dt>location of files, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt></dl></dd><dt>smbfs, <a class="indexterm" href="HA.html#id384892">Dissection and Discussion</a></dt><dt>smbldap-groupadd, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>smbldap-groupmod, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>smbldap-passwd, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>smbldap-populate, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a></dt><dt>smbldap-tools, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a>, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>smbldap-tools updating, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></dt><dt>smbldap-useradd, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="net2000users.html#id354011">Implementation</a></dt><dt>smbldap-usermod, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>smbmnt, <a class="indexterm" href="HA.html#id384892">Dissection and Discussion</a></dt><dt>smbmount, <a class="indexterm" href="HA.html#id384892">Dissection and Discussion</a></dt><dt>smbpasswd, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id327416">Technical Issues</a>, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#id330398">Technical Issues</a>, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id337052">Server Preparation: All Servers</a>, <a class="indexterm" href="Big500users.html#id337579">Configuration for Server: MASSIVE</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="happy.html#id346546">LDAP Initialization and Creation of User and Group Accounts</a>, <a class="indexterm" href="happy.html#sbehap-bldg1">Samba-3 BDC Configuration</a>, <a class="indexterm" href="net2000users.html#id352928">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id354011">Implementation</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="upgrades.html">Updating Samba-3</a>, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a>, <a class="indexterm" href="DomApps.html">Integrating Additional Services</a></dt><dt>smbumnt, <a class="indexterm" href="HA.html#id384892">Dissection and Discussion</a></dt><dt>smbumount, <a class="indexterm" href="HA.html#id384892">Dissection and Discussion</a></dt><dt>SMTP, <a class="indexterm" href="nw4migration.html#id373431">Technical Issues</a></dt><dt>snap-shot, <a class="indexterm" href="ntmigration.html#id369115">Dissection and Discussion</a></dt><dt>socket address, <a class="indexterm" href="HA.html#id385810">Samba Configuration</a></dt><dt>socket options, <a class="indexterm" href="HA.html#id385810">Samba Configuration</a></dt><dt>software, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>solve, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>source code, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>SPNEGO, <a class="indexterm" href="primer.html#id392597">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>SQL, <a class="indexterm" href="net2000users.html#id352928">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>Squid, <a class="indexterm" href="DomApps.html#id382530">Implementation</a>, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a>, <a class="indexterm" href="DomApps.html#id383905">Squid Configuration</a></dt><dt>squid, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a>, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>Squid proxy, <a class="indexterm" href="DomApps.html#id382367">Technical Issues</a></dt><dt>SRVTOOLS.EXE, <a class="indexterm" href="secure.html#id330776">Implementation</a>, <a class="indexterm" href="happy.html#id350283">Configuring Profile Directories</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>SSL, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>stand-alone server, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>starting CUPS, <a class="indexterm" href="simple.html#id324064">Implementation</a>, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a>, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dt>starting dhcpd, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a>, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dt>starting samba, <a class="indexterm" href="simple.html#id323262">Implementation</a>, <a class="indexterm" href="simple.html#id324064">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a>, <a class="indexterm" href="Big500users.html#ch5-procstart">Process Startup Configuration</a></dt><dd><dl><dt>nmbd, <a class="indexterm" href="appendix.html#id387952">Starting Samba</a></dt><dt>smbd, <a class="indexterm" href="appendix.html#id387952">Starting Samba</a></dt><dt>winbindd, <a class="indexterm" href="appendix.html#id387952">Starting Samba</a></dt></dl></dd><dt>startingCUPS, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a></dt><dt>startup script, <a class="indexterm" href="appendix.html#id387952">Starting Samba</a></dt><dt>sticky bit, <a class="indexterm" href="small.html#id327606">Implementation</a></dt><dt>storage capacity, <a class="indexterm" href="secure.html#id330622">Hardware Requirements</a></dt><dt>strategic, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a></dt><dt>strategy, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>straw-man, <a class="indexterm" href="kerberos.html">Active Directory, Kerberos, and Security</a></dt><dt>strict sync, <a class="indexterm" href="HA.html#id385810">Samba Configuration</a></dt><dt>stripped, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></dt><dt>strong cryptography, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt><dt>subscription, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt><dt>SUID, <a class="indexterm" href="simple.html#id323894">Dissection and Discussion</a>, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a>, <a class="indexterm" href="appendix.html#ch12-SUIDSGID">Effect of Setting File and Directory SUID/SGID Permissions Explained</a></dt><dt>Sun ONE Identity Server, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a></dt><dt>super daemon, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a></dt><dt>support, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a>, <a class="indexterm" href="ch14.html">Samba Support</a></dt><dt>survey, <a class="indexterm" href="unixclients.html">Adding Domain Member Servers and Clients</a></dt><dt>SUSE, <a class="indexterm" href="nw4migration.html">Migrating NetWare Server to Samba-3</a></dt><dt>SUSE Enterprise Linux Server, <a class="indexterm" href="simple.html#id323803">Charity Administration Office</a>, <a class="indexterm" href="secure.html#ch4bsc">Basic System Configuration</a>, <a class="indexterm" href="DomApps.html#id382530">Implementation</a></dt><dt>SUSE Linux, <a class="indexterm" href="simple.html#id323894">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#id343908">Samba Server Implementation</a>, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a>, <a class="indexterm" href="net2000users.html#id354011">Implementation</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id382530">Implementation</a>, <a class="indexterm" href="DomApps.html#ch10-one">Removal of Pre-Existing Conflicting RPMs</a></dt><dt>SWAT, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>sync always, <a class="indexterm" href="HA.html#id385810">Samba Configuration</a></dt><dt>synchronization, <a class="indexterm" href="DomApps.html#id382764">Kerberos Configuration</a>, <a class="indexterm" href="HA.html#id386195">For Scalability, Use SAN-Based Storage on Samba Servers</a></dt><dt>synchronize, <a class="indexterm" href="net2000users.html#id353212">User Needs</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>synchronized, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>syslog, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>system level logins, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>system security, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt></dl></div><div class="indexdiv"><h3>T</h3><dl><dt>tattooing, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>TCP/IP, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>tdbdump, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></dt><dt>tdbsam, <a class="indexterm" href="secure.html#id330398">Technical Issues</a>, <a class="indexterm" href="secure.html#id330776">Implementation</a>, <a class="indexterm" href="Big500users.html">The 500-User Office</a>, <a class="indexterm" href="happy.html#id341540">Assignment Tasks</a>, <a class="indexterm" href="net2000users.html#id352928">Dissection and Discussion</a>, <a class="indexterm" href="net2000users.html#id354011">Implementation</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="upgrades.html#id368310">Updating from Samba Versions between 3.0.6 and 3.0.10</a>, <a class="indexterm" href="ntmigration.html#id369276">Technical Issues</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>testparm, <a class="indexterm" href="small.html#id329058">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="happy.html#sbehap-massive">Samba-3 PDC Configuration</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="HA.html#id385810">Samba Configuration</a></dt><dt>ticket, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>time server, <a class="indexterm" href="secure.html#id330776">Implementation</a></dt><dt>Tivoli Directory Server, <a class="indexterm" href="happy.html#id341668">Dissection and Discussion</a></dt><dt>TLS, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>token, <a class="indexterm" href="DomApps.html#id382367">Technical Issues</a></dt><dt>tool, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>TOSHARG2, <a class="indexterm" href="simple.html#id324064">Implementation</a></dt><dt>track record, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>traffic collisions, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>transaction processing, <a class="indexterm" href="net2000users.html#id352928">Dissection and Discussion</a></dt><dt>transactional, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>transfer, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>translate, <a class="indexterm" href="kerberos.html#id380830">Managing Windows 200x ACLs</a></dt><dt>traverse, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt><dt>tree, <a class="indexterm" href="nw4migration.html#id373359">Dissection and Discussion</a></dt><dt>Tree Connect, <a class="indexterm" href="primer.html#id392130">Simple Windows Client Connection Characteristics</a></dt><dt>trust account, <a class="indexterm" href="happy.html#id341339">Regarding LDAP Directories and Windows Computer Accounts</a></dt><dt>trusted computing, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>Trusted Domains, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt><dt>trusted domains, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>trusted third-party, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt><dt>trusting, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt><dt>turn-around time, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt></dl></div><div class="indexdiv"><h3>U</h3><dl><dt>UDP</dt><dd><dl><dt>broadcast, <a class="indexterm" href="HA.html#id385556">Routed Networks</a></dt></dl></dd><dt>UID, <a class="indexterm" href="simple.html#id323894">Dissection and Discussion</a>, <a class="indexterm" href="happy.html#id341339">Regarding LDAP Directories and Windows Computer Accounts</a>, <a class="indexterm" href="happy.html#id342070">Technical Issues</a>, <a class="indexterm" href="net2000users.html#id354011">Implementation</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>un-join, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>unauthorized activities, <a class="indexterm" href="kerberos.html#id379276">Kerberos Exposed</a></dt><dt>UNC name, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>unencrypted, <a class="indexterm" href="appendix.html#id388919">The LDAP Account Manager</a></dt><dt>Unicast, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a></dt><dt>unicode, <a class="indexterm" href="upgrades.html#id367266">International Language Support</a></dt><dt>Universal Naming Convention (see UNC name)</dt><dt>UNIX, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dd><dl><dt>groups, <a class="indexterm" href="small.html#id327416">Technical Issues</a>, <a class="indexterm" href="small.html#id327606">Implementation</a></dt></dl></dd><dt>UNIX accounts, <a class="indexterm" href="happy.html#id342070">Technical Issues</a></dt><dt>UNIX/Linux server, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>unix2dos, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id337579">Configuration for Server: MASSIVE</a></dt><dt>unknown, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>unsupported software, <a class="indexterm" href="ch14.html#id386894">Commercial Support</a></dt><dt>update, <a class="indexterm" href="upgrades.html#id366117">Introduction</a>, <a class="indexterm" href="upgrades.html#id366200">Cautions and Notes</a></dt><dt>updates, <a class="indexterm" href="kerberos.html#id377126">Introduction</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>updating smbldap-tools, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></dt><dt>upgrade, <a class="indexterm" href="upgrades.html#id366117">Introduction</a>, <a class="indexterm" href="upgrades.html#id366200">Cautions and Notes</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>uppercase, <a class="indexterm" href="ntmigration.html#id369600">Implementation</a></dt><dt>user</dt><dd><dl><dt>management, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id337579">Configuration for Server: MASSIVE</a></dt></dl></dd><dt>user account, <a class="indexterm" href="happy.html">Making Happy Users</a>, <a class="indexterm" href="happy.html#ldapsetup">OpenLDAP Server Configuration</a></dt><dt>User and Group Controls, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>user credentials, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a>, <a class="indexterm" href="unixclients.html#id364506">UNIX/Linux Client Domain Member</a></dt><dt>user errors, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>user groups, <a class="indexterm" href="ch14.html#id386696">Free Support</a></dt><dt>user identities, <a class="indexterm" href="unixclients.html#id358731">Implementation</a></dt><dt>user logins, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>user management, <a class="indexterm" href="secure.html#id330776">Implementation</a></dt><dt>User Manager, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></dt><dt>User Mode, <a class="indexterm" href="secure.html#id330776">Implementation</a>, <a class="indexterm" href="primer.html#id392130">Simple Windows Client Connection Characteristics</a>, <a class="indexterm" href="primer.html#id392597">Windows 200x/XP Client Interaction with Samba-3</a></dt><dt>useradd, <a class="indexterm" href="simple.html#id324064">Implementation</a>, <a class="indexterm" href="simple.html#AcctgNet">Implementation</a>, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id337579">Configuration for Server: MASSIVE</a>, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>userdel, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a></dt><dt>usermod, <a class="indexterm" href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a>, <a class="indexterm" href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></dt><dt>username, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>username map, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#id331530">Samba Configuration</a>, <a class="indexterm" href="Big500users.html#id337052">Server Preparation: All Servers</a></dt><dt>UTF-8, <a class="indexterm" href="upgrades.html#id367266">International Language Support</a></dt><dt>utilities, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt></dl></div><div class="indexdiv"><h3>V</h3><dl><dt>valid users, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id380037">Checkpoint Controls</a>, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>validate, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id380037">Checkpoint Controls</a></dt><dt>validated, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>validation, <a class="indexterm" href="simple.html#validate1">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>vampire, <a class="indexterm" href="ntmigration.html#id372297">Questions and Answers</a></dt><dt>vendor, <a class="indexterm" href="kerberos.html#id377723">Dissection and Discussion</a></dt><dt>vendors, <a class="indexterm" href="upgrades.html#id368184">Updating a Samba-3 Installation</a></dt><dt>VFS modules, <a class="indexterm" href="appendix.html#id387559">Samba System File Location</a></dt><dt>virus, <a class="indexterm" href="secure.html#id330776">Implementation</a></dt><dt>VPN, <a class="indexterm" href="net2000users.html#id352871">Assignment Tasks</a></dt><dt>vulnerabilities, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt></dl></div><div class="indexdiv"><h3>W</h3><dl><dt>wbinfo, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a></dt><dt>weakness, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a></dt><dt>web</dt><dd><dl><dt>caching, <a class="indexterm" href="DomApps.html#id382248">Assignment Tasks</a></dt><dt>proxying, <a class="indexterm" href="DomApps.html#id382248">Assignment Tasks</a></dt></dl></dd><dt>Web</dt><dd><dl><dt>proxy, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dd><dl><dt>access, <a class="indexterm" href="DomApps.html#id384281">Key Points Learned</a></dt></dl></dd></dl></dd><dt>Web browsers, <a class="indexterm" href="DomApps.html#id384281">Key Points Learned</a></dt><dt>WebClient, <a class="indexterm" href="happy.html">Making Happy Users</a></dt><dt>WHATSNEW.txt, <a class="indexterm" href="upgrades.html#id368069">Samba-2.x with LDAP Support</a></dt><dt>white-pages, <a class="indexterm" href="nw4migration.html#id373431">Technical Issues</a>, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>wide-area, <a class="indexterm" href="net2000users.html#id353212">User Needs</a>, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a>, <a class="indexterm" href="net2000users.html#id357027">Key Points Learned</a>, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt><dt>wide-area network, <a class="indexterm" href="HA.html#id386110">Use and Location of BDCs</a>, <a class="indexterm" href="HA.html#id386291">Replicate Data to Conserve Peak-Demand Wide-Area Bandwidth</a></dt><dt>winbind, <a class="indexterm" href="net2000users.html#id354011">Implementation</a>, <a class="indexterm" href="unixclients.html#id358022">Dissection and Discussion</a>, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id377126">Introduction</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id382367">Technical Issues</a>, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a>, <a class="indexterm" href="DomApps.html#id383649">NSS Configuration</a></dt><dt>Winbind, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="kerberos.html#id378089">Technical Issues</a>, <a class="indexterm" href="kerberos.html#id381514">Key Points Learned</a></dt><dt>winbind trusted domains only, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>winbind use default domain, <a class="indexterm" href="kerberos.html#id380037">Checkpoint Controls</a></dt><dt>winbindd, <a class="indexterm" href="small.html#id329058">Validation</a>, <a class="indexterm" href="secure.html#ch4valid">Validation</a>, <a class="indexterm" href="Big500users.html#id336141">Technical Issues</a>, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a>, <a class="indexterm" href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a>, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a>, <a class="indexterm" href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a>, <a class="indexterm" href="upgrades.html#id368384">Updating from Samba Versions after 3.0.6 to a Current Release</a>, <a class="indexterm" href="upgrades.html#id368475">Replacing a Domain Member Server</a>, <a class="indexterm" href="DomApps.html#id383127">Samba Configuration</a>, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a>, <a class="indexterm" href="appendix.html#id387952">Starting Samba</a></dt><dt>winbindd_cache.tdb, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt><dt>winbindd_idmap.tdb, <a class="indexterm" href="unixclients.html#id358046">Technical Issues</a></dt><dt>Windows, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dd><dl><dt>client, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt><dt>NT, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a></dt></dl></dd><dt>Windows 2000 ACLs, <a class="indexterm" href="kerberos.html#id380830">Managing Windows 200x ACLs</a></dt><dt>Windows 2003 Serve, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>Windows 200x ACLs, <a class="indexterm" href="kerberos.html#id381636">Questions and Answers</a></dt><dt>Windows accounts, <a class="indexterm" href="happy.html#id342070">Technical Issues</a></dt><dt>Windows ACLs, <a class="indexterm" href="kerberos.html#id381318">Setting Posix ACLs in UNIX/Linux</a></dt><dt>Windows Address Book, <a class="indexterm" href="nw4migration.html#id373667">LDAP Server Configuration</a></dt><dt>Windows ADS Domain, <a class="indexterm" href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></dt><dt>Windows clients, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>Windows Explorer, <a class="indexterm" href="simple.html#validate1">Validation</a></dt><dt>Windows explorer, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>Windows security identifier (see SID)</dt><dt>Windows Servers, <a class="indexterm" href="kerberos.html#id377126">Introduction</a></dt><dt>Windows Services for UNIX (see SUS)</dt><dt>Windows XP, <a class="indexterm" href="small.html#id327326">Assignment Tasks</a></dt><dt>WINS, <a class="indexterm" href="simple.html#id324064">Implementation</a>, <a class="indexterm" href="small.html#id327416">Technical Issues</a>, <a class="indexterm" href="small.html#id327606">Implementation</a>, <a class="indexterm" href="secure.html#ch4wincfg">Windows Client Configuration</a>, <a class="indexterm" href="Big500users.html#id336141">Technical Issues</a>, <a class="indexterm" href="Big500users.html#ch5wincfg">Windows Client Configuration</a>, <a class="indexterm" href="net2000users.html#id353288">The Nature of Windows Networking Protocols</a>, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a>, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a>, <a class="indexterm" href="primer.html#chap01qa">Questions and Answers</a></dt><dd><dl><dt>lookup, <a class="indexterm" href="unixclients.html#id365047">Questions and Answers</a></dt><dt>name resolution, <a class="indexterm" href="HA.html#id385556">Routed Networks</a></dt><dt>server, <a class="indexterm" href="happy.html">Making Happy Users</a>, <a class="indexterm" href="HA.html#id385556">Routed Networks</a></dt></dl></dd><dt>WINS server, <a class="indexterm" href="Big500users.html">The 500-User Office</a>, <a class="indexterm" href="net2000users.html#id357166">Questions and Answers</a></dt><dt>WINS serving, <a class="indexterm" href="secure.html#id330776">Implementation</a></dt><dt>wins support, <a class="indexterm" href="secure.html#id330776">Implementation</a></dt><dt>wins.dat, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a>, <a class="indexterm" href="upgrades.html#id368475">Replacing a Domain Member Server</a></dt><dt>Wireshark, <a class="indexterm" href="primer.html#id390627">Requirements and Notes</a></dt><dt>wireshark, <a class="indexterm" href="primer.html#id390920">Exercises</a></dt><dt>Word, <a class="indexterm" href="kerberos.html#id380465">Share Point Directory and File Permissions</a></dt><dt>workgroup, <a class="indexterm" href="simple.html#id323262">Implementation</a>, <a class="indexterm" href="upgrades.html#id366291">Security Identifiers (SIDs)</a>, <a class="indexterm" href="upgrades.html#id367023">Change of Workgroup (Domain) Name</a></dt><dt>Workgroup Announcement, <a class="indexterm" href="primer.html#id391782">Findings</a></dt><dt>workstation, <a class="indexterm" href="unixclients.html#id358731">Implementation</a></dt><dt>wrapper, <a class="indexterm" href="DomApps.html#id384336">Questions and Answers</a></dt><dt>write lock, <a class="indexterm" href="appendix.html#id390484">Opportunistic Locking Controls</a></dt></dl></div><div class="indexdiv"><h3>X</h3><dl><dt>xinetd, <a class="indexterm" href="secure.html#procstart">Process Startup Configuration</a></dt><dt>XML, <a class="indexterm" href="net2000users.html#id352928">Dissection and Discussion</a></dt><dt>xmlsam, <a class="indexterm" href="net2000users.html#id354011">Implementation</a></dt></dl></div><div class="indexdiv"><h3>Y</h3><dl><dt>YaST, <a class="indexterm" href="happy.html#sbehap-PAM-NSS">PAM and NSS Client Configuration</a></dt><dt>Yellow Pages, <a class="indexterm" href="net2000users.html#id353585">Identity Management Needs</a></dt><dt>yellow pages (see NIS)</dt></dl></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="go01.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> </td></tr><tr><td width="40%" align="left" valign="top">Glossary </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> </td></tr></table></div></body></html> -
trunk/server/docs/htmldocs/Samba3-ByExample/kerberos.html
r414 r599 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 11. Active Directory, Kerberos, and Security</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 4.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="RefSection.html" title="Part III. Reference Section"><link rel="next" href="DomApps.html" title="Chapter 12. Integrating Additional Services"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 11. Active Directory, Kerberos, and Security</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="RefSection.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="DomApps.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="kerberos"></a>Chapter 11. Active Directory, Kerberos, and Security</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="kerberos.html#id2610496">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2611138">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id2611154">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2611545">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#ch10expl">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id2613169">Share Access Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2613518">Share Definition Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2614131">Share Point Directory and File Permissions</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2614530">Managing Windows 200x ACLs</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id2615257">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id2615391">Questions and Answers</a></span></dt></dl></div><p><a class="indexterm" name="id2610431"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 11. Active Directory, Kerberos, and Security</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="RefSection.html" title="Part III. Reference Section"><link rel="next" href="DomApps.html" title="Chapter 12. Integrating Additional Services"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 11. Active Directory, Kerberos, and Security</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="RefSection.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="DomApps.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 11. Active Directory, Kerberos, and Security"><div class="titlepage"><div><div><h2 class="title"><a name="kerberos"></a>Chapter 11. Active Directory, Kerberos, and Security</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="kerberos.html#id377126">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id377710">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id377723">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id378089">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#ch10expl">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="kerberos.html#id379573">Share Access Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id379908">Share Definition Controls</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id380465">Share Point Directory and File Permissions</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id380830">Managing Windows 200x ACLs</a></span></dt><dt><span class="sect2"><a href="kerberos.html#id381514">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="kerberos.html#id381636">Questions and Answers</a></span></dt></dl></div><p><a class="indexterm" name="id377075"></a> 2 2 By this point in the book, you have been exposed to many Samba-3 features and capabilities. 3 3 More importantly, if you have implemented the examples given, you are well on your way to becoming … … 5 5 practice, you likely have thought of improvements and scenarios with which you can experiment. You 6 6 are rather well plugged in to the many flexible ways Samba can be used. 7 </p><p><a class="indexterm" name="id 2610450"></a>7 </p><p><a class="indexterm" name="id377090"></a> 8 8 This is a book about Samba-3. Understandably, its intent is to present it in a positive light. 9 9 The casual observer might conclude that this book is one-eyed about Samba. It is what … … 14 14 decision. Criticism can be expected from the outside. Let's see how the interesting dynamic of 15 15 criticism develops with respect to Abmas. 16 </p><p><a class="indexterm" name="id 2610478"></a>16 </p><p><a class="indexterm" name="id377113"></a> 17 17 This chapter provides a shameless self-promotion of Samba-3. The objections raised were not pulled 18 18 out of thin air. They were drawn from comments made by Samba users and from criticism during … … 20 20 as possible that of the original. The case presented is a straw-man example that is designed to 21 21 permit each objection to be answered as it might occur in real life. 22 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2610496"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id2610502"></a><a class="indexterm" name="id2610510"></a><a class="indexterm" name="id2610518"></a><a class="indexterm" name="id2610526"></a><a class="indexterm" name="id2610534"></a>22 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id377126"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id377133"></a><a class="indexterm" name="id377141"></a><a class="indexterm" name="id377148"></a><a class="indexterm" name="id377156"></a><a class="indexterm" name="id377164"></a> 23 23 Abmas is continuing its meteoric growth with yet further acquisitions. The investment community took 24 24 note of the spectacular projection of Abmas onto the global business stage. Abmas is building an … … 29 29 During the time that the acquisition was closing, the Video Rentals business upgraded its Windows 30 30 NT4-based network to Windows 2003 Server and Active Directory. 31 </p><p><a class="indexterm" name="id 2610558"></a>31 </p><p><a class="indexterm" name="id377182"></a> 32 32 You have accepted the fact that Abmas Video Rentals will use Microsoft Active Directory. 33 33 The IT team, led by Stan Soroka, is committed to Samba-3 and to maintaining a uniform technology platform. 34 34 Stan Soroka's team voiced its disapproval over the decision to permit this business to continue to 35 operate with a solution that is viewed by Christine and her group as “<span class="quote">an island of broken36 technologies.</span>” This comment was made by one of Christine's staff as they were installing a new35 operate with a solution that is viewed by Christine and her group as <span class="quote">“<span class="quote">an island of broken 36 technologies.</span>”</span> This comment was made by one of Christine's staff as they were installing a new 37 37 Samba-3 server at the new business. 38 </p><p><a class="indexterm" name="id 2610581"></a><a class="indexterm" name="id2610589"></a>38 </p><p><a class="indexterm" name="id377201"></a><a class="indexterm" name="id377209"></a> 39 39 Abmas Video Rentals' head of IT heard of this criticism. He was offended that a junior engineer 40 40 should make such a comment. He felt that he had to prepare in case he might be criticized for his 41 41 decision to use Active Directory. He decided he would defend his decision by hiring the services 42 of an outside security systems consultant to report<sup>[<a name="id 2610604" href="#ftn.id2610604" class="footnote">12</a>]</sup> on his unit's operations42 of an outside security systems consultant to report<sup>[<a name="id377221" href="#ftn.id377221" class="footnote">12</a>]</sup> on his unit's operations 43 43 and to investigate the role of Samba at his site. Here are key extracts from this hypothetical 44 44 report: 45 </p><div class="blockquote"><blockquote class="blockquote"><p><a class="indexterm" name="id 2610616"></a><a class="indexterm" name="id2610624"></a><a class="indexterm" name="id2610632"></a><a class="indexterm" name="id2610640"></a>45 </p><div class="blockquote"><blockquote class="blockquote"><p><a class="indexterm" name="id377230"></a><a class="indexterm" name="id377238"></a><a class="indexterm" name="id377246"></a><a class="indexterm" name="id377254"></a> 46 46 ... the implementation of Microsoft Active Directory at the Abmas Video Rentals, Bamingsham site, 47 47 has been examined. We find no evidence to support a notion that vulnerabilities exist at your site. … … 50 50 </p><p> 51 51 ... 52 </p><p><a class="indexterm" name="id 2610661"></a><a class="indexterm" name="id2610672"></a><a class="indexterm" name="id2610683"></a><a class="indexterm" name="id2610691"></a><a class="indexterm" name="id2610699"></a><a class="indexterm" name="id2610707"></a>52 </p><p><a class="indexterm" name="id377272"></a><a class="indexterm" name="id377283"></a><a class="indexterm" name="id377294"></a><a class="indexterm" name="id377302"></a><a class="indexterm" name="id377310"></a><a class="indexterm" name="id377318"></a> 53 53 User and group accounts, and respective privileges, have been well thought out. File system shares are 54 54 appropriately secured. Backup and disaster recovery plans are well managed and validated regularly, and 55 55 effective off-site storage practices are considered to exceed industry norms. 56 </p><p><a class="indexterm" name="id 2610723"></a><a class="indexterm" name="id2610731"></a><a class="indexterm" name="id2610739"></a>56 </p><p><a class="indexterm" name="id377332"></a><a class="indexterm" name="id377340"></a><a class="indexterm" name="id377347"></a> 57 57 Your staff are justifiably concerned that the use of Samba may compromise their good efforts to maintain 58 58 a secure network. 59 </p><p><a class="indexterm" name="id 2610756"></a><a class="indexterm" name="id2610764"></a><a class="indexterm" name="id2610772"></a><a class="indexterm" name="id2610779"></a>59 </p><p><a class="indexterm" name="id377363"></a><a class="indexterm" name="id377371"></a><a class="indexterm" name="id377379"></a><a class="indexterm" name="id377387"></a> 60 60 The recently installed Linux file and application server uses a tool called <code class="literal">winbind</code> 61 61 that is indiscriminate about security. All user accounts in Active Directory can be used to access data … … 64 64 to great lengths to set fine-grained controls that limit information access to those who need access. 65 65 It seems incongruous to us that Samba winbind should be permitted to be used considering that it voids this fine work. 66 </p><p><a class="indexterm" name="id 2610810"></a><a class="indexterm" name="id2610818"></a><a class="indexterm" name="id2610826"></a>66 </p><p><a class="indexterm" name="id377412"></a><a class="indexterm" name="id377420"></a><a class="indexterm" name="id377428"></a> 67 67 Graham Judd [head of network administration] has locked down the security of all systems and is following 68 68 the latest Microsoft guidelines. ... null session connections have been disabled ... the internal network … … 73 73 </p><p> 74 74 ... 75 </p><p><a class="indexterm" name="id 2610851"></a><a class="indexterm" name="id2610859"></a><a class="indexterm" name="id2610866"></a><a class="indexterm" name="id2610874"></a>75 </p><p><a class="indexterm" name="id377448"></a><a class="indexterm" name="id377456"></a><a class="indexterm" name="id377464"></a><a class="indexterm" name="id377471"></a> 76 76 Regarding the use of Samba, we offer the following comments: Samba is in use in nearly half of 77 77 all sites we have surveyed. ... It is our opinion that Samba offers no better security than Microsoft … … 81 81 Samba is not at the full capabilities of Microsoft Windows NT4 server. Microsoft has moved well beyond that 82 82 with trusted computing initiatives that the Samba developers do not participate in. 83 </p><p><a class="indexterm" name="id 2610898"></a><a class="indexterm" name="id2610906"></a><a class="indexterm" name="id2610913"></a><a class="indexterm" name="id2610921"></a><a class="indexterm" name="id2610929"></a><a class="indexterm" name="id2610937"></a><a class="indexterm" name="id2610945"></a>83 </p><p><a class="indexterm" name="id377489"></a><a class="indexterm" name="id377496"></a><a class="indexterm" name="id377504"></a><a class="indexterm" name="id377512"></a><a class="indexterm" name="id377520"></a><a class="indexterm" name="id377528"></a><a class="indexterm" name="id377536"></a> 84 84 One wonders about the integrity of an open source program that is developed by a team of hackers 85 85 who cannot be held accountable for the flaws in their code. The sheer number of updates and bug 86 86 fixes they have released should ring alarm bells in any business. 87 </p><p><a class="indexterm" name="id 2610960"></a><a class="indexterm" name="id2610968"></a><a class="indexterm" name="id2610976"></a>87 </p><p><a class="indexterm" name="id377549"></a><a class="indexterm" name="id377557"></a><a class="indexterm" name="id377565"></a> 88 88 Another factor that should be considered is that buying Microsoft products and services helps to 89 89 provide employment in the IT industry. Samba and Open Source software place those jobs at risk. 90 </p></blockquote></div><p><a class="indexterm" name="id 2610991"></a><a class="indexterm" name="id2610999"></a>90 </p></blockquote></div><p><a class="indexterm" name="id377578"></a><a class="indexterm" name="id377586"></a> 91 91 This is also a challenge to rise above the trouble spot. You call Stan's team together for a simple 92 92 discussion, but it gets further out of hand. When you return to your office, you find the following … … 101 101 across all systems. I concur with the desire to improve security. One of the new guys who is championing 102 102 the move to Kerberos was responsible for the comment that caused the embarrassment. 103 </p><p><a class="indexterm" name="id 2611036"></a><a class="indexterm" name="id2611043"></a><a class="indexterm" name="id2611051"></a><a class="indexterm" name="id2611059"></a>103 </p><p><a class="indexterm" name="id377616"></a><a class="indexterm" name="id377624"></a><a class="indexterm" name="id377632"></a><a class="indexterm" name="id377640"></a> 104 104 I am experiencing difficulty in handling the sharp push for Kerberos. He claims that Kerberos, OpenLDAP, 105 105 plus Samba-3 will seamlessly replace Microsoft Active Directory. I am a little out of my depth with respect 106 106 to the feasibility of such a move, but have taken steps to pull both of them into line. With your consent, 107 107 I would like to hire the services of a well-known Samba consultant to set the record straight. 108 </p><p><a class="indexterm" name="id 2611078"></a><a class="indexterm" name="id2611085"></a><a class="indexterm" name="id2611093"></a><a class="indexterm" name="id2611101"></a><a class="indexterm" name="id2611109"></a><a class="indexterm" name="id2611117"></a>108 </p><p><a class="indexterm" name="id377655"></a><a class="indexterm" name="id377662"></a><a class="indexterm" name="id377670"></a><a class="indexterm" name="id377678"></a><a class="indexterm" name="id377686"></a><a class="indexterm" name="id377694"></a> 109 109 I intend to use this report to answer the criticism raised and would like to establish a policy that we 110 110 will approve the use of Microsoft Windows Servers (and Active Directory) subject to all costs being covered … … 113 113 use of any centrally proposed standards, but make all noncompliance the financial responsibility of the 114 114 out-of-step division. Hopefully, this will encourage all divisions to walk with us and not alone. 115 </p></td><td width="10%" valign="top"> </td></tr><tr><td width="10%" valign="top"> </td><td colspan="2" align="right" valign="top">--<span class="attribution">Stan</span></td></tr></table></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2611138"></a>Assignment Tasks</h3></div></div></div><p>115 </p></td><td width="10%" valign="top"> </td></tr><tr><td width="10%" valign="top"> </td><td colspan="2" align="right" valign="top">--<span class="attribution">Stan</span></td></tr></table></div><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id377710"></a>Assignment Tasks</h3></div></div></div><p> 116 116 You agreed with Stan's recommendations and hired a consultant to help defuse the powder 117 117 keg. The consultant's task is to provide a tractable answer to each of the issues raised. The consultant must be able 118 118 to support his or her claims, keep emotions to the side, and answer technically. 119 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2611154"></a>Dissection and Discussion</h2></div></div></div><p><a class="indexterm" name="id2611161"></a><a class="indexterm" name="id2611169"></a><a class="indexterm" name="id2611177"></a><a class="indexterm" name="id2611185"></a><a class="indexterm" name="id2611193"></a><a class="indexterm" name="id2611201"></a><a class="indexterm" name="id2611209"></a>119 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id377723"></a>Dissection and Discussion</h2></div></div></div><p><a class="indexterm" name="id377730"></a><a class="indexterm" name="id377738"></a><a class="indexterm" name="id377746"></a><a class="indexterm" name="id377754"></a><a class="indexterm" name="id377761"></a><a class="indexterm" name="id377769"></a><a class="indexterm" name="id377777"></a> 120 120 Samba-3 is a tool. No one is pounding your door to make you use Samba. That is a choice that you are free to 121 121 make or reject. It is likely that your decision to use Samba can greatly benefit your company. … … 125 125 money saved by not spending in the IT area can be spent elsewhere in the business. All money saved 126 126 or spent creates employment. 127 </p><p><a class="indexterm" name="id 2611230"></a><a class="indexterm" name="id2611238"></a><a class="indexterm" name="id2611246"></a><a class="indexterm" name="id2611254"></a><a class="indexterm" name="id2611262"></a>127 </p><p><a class="indexterm" name="id377794"></a><a class="indexterm" name="id377802"></a><a class="indexterm" name="id377809"></a><a class="indexterm" name="id377817"></a><a class="indexterm" name="id377825"></a> 128 128 In the long term, the use of Samba must be economically sustainable. In some situations, Samba is adopted 129 129 purely to provide file and print service interoperability on platforms that otherwise cannot provide … … 131 131 effect a reduction in the cost of providing IT services. Obviously, it is also used by some as an 132 132 alternative to the use of a Microsoft file and print serving platforms with no consideration of costs. 133 </p><p><a class="indexterm" name="id 2611282"></a><a class="indexterm" name="id2611290"></a><a class="indexterm" name="id2611298"></a><a class="indexterm" name="id2611306"></a>133 </p><p><a class="indexterm" name="id377841"></a><a class="indexterm" name="id377848"></a><a class="indexterm" name="id377856"></a><a class="indexterm" name="id377864"></a> 134 134 It would be foolish to adopt a technology that might put any data or users at risk. Security affects 135 135 everyone. The Samba-Team is fully cognizant of the responsibility they have to their users. 136 136 The Samba documentation clearly reveals that full responsibility is accepted to fix anything 137 137 that is broken. 138 </p><p><a class="indexterm" name="id 2611322"></a><a class="indexterm" name="id2611330"></a><a class="indexterm" name="id2611338"></a><a class="indexterm" name="id2611346"></a><a class="indexterm" name="id2611358"></a><a class="indexterm" name="id2611366"></a><a class="indexterm" name="id2611374"></a><a class="indexterm" name="id2611382"></a><a class="indexterm" name="id2611389"></a><a class="indexterm" name="id2611397"></a><a class="indexterm" name="id2611405"></a>138 </p><p><a class="indexterm" name="id377878"></a><a class="indexterm" name="id377886"></a><a class="indexterm" name="id377894"></a><a class="indexterm" name="id377902"></a><a class="indexterm" name="id377913"></a><a class="indexterm" name="id377921"></a><a class="indexterm" name="id377929"></a><a class="indexterm" name="id377937"></a><a class="indexterm" name="id377945"></a><a class="indexterm" name="id377952"></a><a class="indexterm" name="id377960"></a> 139 139 There is a mistaken perception in the IT industry that commercial software providers are fully 140 140 accountable for the defects in products. Open Source software comes with no warranty, so it is … … 144 144 commercial software vendors are willingly accountable for product defects. In many cases, the 145 145 commercial vendor accepts liability only to reimburse the price paid for the software. 146 </p><p><a class="indexterm" name="id 2611428"></a><a class="indexterm" name="id2611435"></a><a class="indexterm" name="id2611443"></a><a class="indexterm" name="id2611451"></a><a class="indexterm" name="id2611459"></a><a class="indexterm" name="id2611467"></a>146 </p><p><a class="indexterm" name="id377977"></a><a class="indexterm" name="id377985"></a><a class="indexterm" name="id377993"></a><a class="indexterm" name="id378001"></a><a class="indexterm" name="id378009"></a><a class="indexterm" name="id378016"></a> 147 147 The real issues that a consumer (like you) needs answered are What is the way of escape from technical 148 148 problems, and how long will it take? The average problem turnaround time in the Open Source community is 149 149 approximately 48 hours. What does the EULA offer? What is the track record in the commercial software 150 150 industry? What happens when your commercial vendor decides to cease providing support? 151 </p><p><a class="indexterm" name="id 2611485"></a><a class="indexterm" name="id2611493"></a><a class="indexterm" name="id2611501"></a><a class="indexterm" name="id2611509"></a><a class="indexterm" name="id2611517"></a><a class="indexterm" name="id2611524"></a><a class="indexterm" name="id2611532"></a>151 </p><p><a class="indexterm" name="id378031"></a><a class="indexterm" name="id378039"></a><a class="indexterm" name="id378047"></a><a class="indexterm" name="id378055"></a><a class="indexterm" name="id378062"></a><a class="indexterm" name="id378070"></a><a class="indexterm" name="id378078"></a> 152 152 Open Source software at least puts you in possession of the source code. This means that when 153 153 all else fails, you can hire a programmer to solve the problem. 154 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2611545"></a>Technical Issues</h3></div></div></div><p>154 </p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id378089"></a>Technical Issues</h3></div></div></div><p> 155 155 Each issue is now discussed and, where appropriate, example implementation steps are 156 156 provided. 157 </p><div class="variablelist"><dl><dt><span class="term">Winbind and Security</span></dt><dd><p><a class="indexterm" name="id 2611566"></a><a class="indexterm" name="id2611574"></a><a class="indexterm" name="id2611582"></a><a class="indexterm" name="id2611593"></a><a class="indexterm" name="id2611601"></a><a class="indexterm" name="id2611609"></a><a class="indexterm" name="id2611617"></a><a class="indexterm" name="id2611625"></a><a class="indexterm" name="id2611633"></a><a class="indexterm" name="id2611641"></a>157 </p><div class="variablelist"><dl><dt><span class="term">Winbind and Security</span></dt><dd><p><a class="indexterm" name="id378109"></a><a class="indexterm" name="id378117"></a><a class="indexterm" name="id378125"></a><a class="indexterm" name="id378136"></a><a class="indexterm" name="id378144"></a><a class="indexterm" name="id378152"></a><a class="indexterm" name="id378160"></a><a class="indexterm" name="id378168"></a><a class="indexterm" name="id378175"></a><a class="indexterm" name="id378183"></a> 158 158 Windows network administrators may be dismayed to find that <code class="literal">winbind</code> 159 159 exposes all domain users so that they may use their domain account credentials to … … 161 161 UNIX/Linux server in their Network Neighborhood and can browse the shares on the 162 162 server seems to excite them further. 163 </p><p><a class="indexterm" name="id 2611664"></a><a class="indexterm" name="id2611673"></a><a class="indexterm" name="id2611680"></a><a class="indexterm" name="id2611688"></a>163 </p><p><a class="indexterm" name="id378204"></a><a class="indexterm" name="id378212"></a><a class="indexterm" name="id378220"></a><a class="indexterm" name="id378227"></a> 164 164 <code class="literal">winbind</code> provides for the UNIX/Linux domain member server or 165 165 client, the same as one would obtain by adding a Microsoft Windows server or … … 167 167 and therefore requires handling a little differently from the familiar Windows systems. 168 168 One must recognize fear of the unknown. 169 </p><p><a class="indexterm" name="id 2611711"></a><a class="indexterm" name="id2611719"></a><a class="indexterm" name="id2611727"></a><a class="indexterm" name="id2611735"></a><a class="indexterm" name="id2611743"></a><a class="indexterm" name="id2611755"></a>169 </p><p><a class="indexterm" name="id378247"></a><a class="indexterm" name="id378255"></a><a class="indexterm" name="id378263"></a><a class="indexterm" name="id378271"></a><a class="indexterm" name="id378279"></a><a class="indexterm" name="id378290"></a> 170 170 Windows network administrators need to recognize that <code class="literal">winbind</code> does 171 171 not, and cannot, override account controls set using the Active Directory management 172 172 tools. The control is the same. Have no fear. 173 </p><p><a class="indexterm" name="id 2611775"></a><a class="indexterm" name="id2611783"></a><a class="indexterm" name="id2611794"></a><a class="indexterm" name="id2611802"></a><a class="indexterm" name="id2611810"></a><a class="indexterm" name="id2611818"></a><a class="indexterm" name="id2611826"></a><a class="indexterm" name="id2611834"></a><a class="indexterm" name="id2611842"></a><a class="indexterm" name="id2611850"></a>173 </p><p><a class="indexterm" name="id378309"></a><a class="indexterm" name="id378317"></a><a class="indexterm" name="id378328"></a><a class="indexterm" name="id378336"></a><a class="indexterm" name="id378344"></a><a class="indexterm" name="id378352"></a><a class="indexterm" name="id378360"></a><a class="indexterm" name="id378368"></a><a class="indexterm" name="id378375"></a><a class="indexterm" name="id378383"></a> 174 174 Where Samba and the ADS domain account information obtained through the use of 175 175 <code class="literal">winbind</code> permits access, by browsing or by the drive mapping to … … 177 177 controls have not been properly implemented. Samba permits access controls to be set 178 178 on: 179 </p><div class="itemizedlist"><ul type="disc"><li><p>Shares themselves (i.e., the logical share itself)</p></li><li><p>The share definition in <code class="filename">smb.conf</code></p></li><li><p>The shared directories and files using UNIX permissions</p></li><li><p>Using Windows 2000 ACLs if the file system is POSIX enabled</p></li></ul></div><p>179 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Shares themselves (i.e., the logical share itself)</p></li><li class="listitem"><p>The share definition in <code class="filename">smb.conf</code></p></li><li class="listitem"><p>The shared directories and files using UNIX permissions</p></li><li class="listitem"><p>Using Windows 2000 ACLs if the file system is POSIX enabled</p></li></ul></div><p> 180 180 Examples of each are given in <a class="link" href="kerberos.html#ch10expl" title="Implementation">“Implementation”</a>. 181 </p></dd><dt><span class="term">User and Group Controls</span></dt><dd><p><a class="indexterm" name="id 2611924"></a><a class="indexterm" name="id2611932"></a><a class="indexterm" name="id2611943"></a><a class="indexterm" name="id2611954"></a><a class="indexterm" name="id2611962"></a><a class="indexterm" name="id2611970"></a><a class="indexterm" name="id2611978"></a><a class="indexterm" name="id2611986"></a><a class="indexterm" name="id2611994"></a>181 </p></dd><dt><span class="term">User and Group Controls</span></dt><dd><p><a class="indexterm" name="id378452"></a><a class="indexterm" name="id378460"></a><a class="indexterm" name="id378471"></a><a class="indexterm" name="id378483"></a><a class="indexterm" name="id378490"></a><a class="indexterm" name="id378498"></a><a class="indexterm" name="id378506"></a><a class="indexterm" name="id378514"></a><a class="indexterm" name="id378522"></a> 182 182 User and group management facilities as known in the Windows ADS environment may be 183 183 used to provide equivalent access control constraints or to provide equivalent … … 186 186 Windows 200x/XP. For example, access controls on a Samba server may be set within 187 187 the share definition in a manner for which Windows has no equivalent. 188 </p><p><a class="indexterm" name="id 2612014"></a><a class="indexterm" name="id2612022"></a><a class="indexterm" name="id2612030"></a><a class="indexterm" name="id2612037"></a><a class="indexterm" name="id2612049"></a><a class="indexterm" name="id2612057"></a><a class="indexterm" name="id2612065"></a>188 </p><p><a class="indexterm" name="id378537"></a><a class="indexterm" name="id378545"></a><a class="indexterm" name="id378553"></a><a class="indexterm" name="id378561"></a><a class="indexterm" name="id378572"></a><a class="indexterm" name="id378580"></a><a class="indexterm" name="id378588"></a> 189 189 In any serious analysis of system security, it is important to examine the safeguards 190 190 that remain when all other protective measures fail. An administrator may inadvertently … … 194 194 possible to guard against that by enforcing controls on the share definition itself. You 195 195 see a practical example of this a little later in this chapter. 196 </p><p><a class="indexterm" name="id 2612097"></a><a class="indexterm" name="id2612105"></a>196 </p><p><a class="indexterm" name="id378610"></a><a class="indexterm" name="id378618"></a> 197 197 The report that is critical of Samba really ought to have exercised greater due 198 198 diligence: the real weakness is on the side of a Microsoft Windows environment. 199 </p></dd><dt><span class="term">Security Overall</span></dt><dd><p><a class="indexterm" name="id 2612127"></a>199 </p></dd><dt><span class="term">Security Overall</span></dt><dd><p><a class="indexterm" name="id378638"></a> 200 200 Samba is designed in such a manner that weaknesses inherent in the design of 201 201 Microsoft Windows networking ought not to expose the underlying UNIX/Linux file 202 202 system in any way. All software has potential defects, and Samba is no exception. 203 203 What matters more is how defects that are discovered get dealt with. 204 </p><p><a class="indexterm" name="id 2612144"></a><a class="indexterm" name="id2612151"></a><a class="indexterm" name="id2612159"></a><a class="indexterm" name="id2612167"></a>204 </p><p><a class="indexterm" name="id378652"></a><a class="indexterm" name="id378660"></a><a class="indexterm" name="id378668"></a><a class="indexterm" name="id378676"></a> 205 205 The Samba Team totally agrees with the necessity to observe and fully implement 206 206 every security facility to provide a level of protection and security that is necessary … … 209 209 security be publicly condoned; yet this is the practice by many Windows network 210 210 administrators just to make happy users who have no notion of consequential risk. 211 </p><p><a class="indexterm" name="id 2612187"></a><a class="indexterm" name="id2612195"></a><a class="indexterm" name="id2612203"></a><a class="indexterm" name="id2612211"></a><a class="indexterm" name="id2612219"></a><a class="indexterm" name="id2612227"></a><a class="indexterm" name="id2612235"></a>211 </p><p><a class="indexterm" name="id378691"></a><a class="indexterm" name="id378699"></a><a class="indexterm" name="id378707"></a><a class="indexterm" name="id378715"></a><a class="indexterm" name="id378723"></a><a class="indexterm" name="id378730"></a><a class="indexterm" name="id378738"></a> 212 212 The report condemns Samba for releasing updates and security fixes, yet Microsoft 213 213 online updates need to be applied almost weekly. The answer to the criticism … … 215 215 user needs are being increasingly met or exceeded, and security updates are issued 216 216 with a short turnaround time. 217 </p><p><a class="indexterm" name="id 2612252"></a><a class="indexterm" name="id2612260"></a><a class="indexterm" name="id2612268"></a><a class="indexterm" name="id2612276"></a><a class="indexterm" name="id2612284"></a>217 </p><p><a class="indexterm" name="id378753"></a><a class="indexterm" name="id378761"></a><a class="indexterm" name="id378768"></a><a class="indexterm" name="id378776"></a><a class="indexterm" name="id378784"></a> 218 218 The release of Samba-4 is expected around late 2004 to early 2005 and involves a near 219 219 complete rewrite to permit extensive modularization and to prepare Samba for new … … 222 222 degree of dependability and on charter development consistent with published 223 223 roadmap projections. 224 </p><p><a class="indexterm" name="id 2612307"></a><a class="indexterm" name="id2612315"></a><a class="indexterm" name="id2612326"></a><a class="indexterm" name="id2612338"></a><a class="indexterm" name="id2612346"></a><a class="indexterm" name="id2612354"></a><a class="indexterm" name="id2612362"></a>224 </p><p><a class="indexterm" name="id378803"></a><a class="indexterm" name="id378811"></a><a class="indexterm" name="id378822"></a><a class="indexterm" name="id378833"></a><a class="indexterm" name="id378841"></a><a class="indexterm" name="id378849"></a><a class="indexterm" name="id378857"></a> 225 225 Not well published is the fact that Microsoft was a foundation member of 226 226 the Common Internet File System (CIFS) initiative, together with the participation … … 231 231 CIFS conferences and at the interoperability laboratories run concurrently with 232 232 them. 233 </p></dd><dt><span class="term">Cryptographic Controls (schannel, sign'n'seal)</span></dt><dd><p><a class="indexterm" name="id 2612391"></a><a class="indexterm" name="id2612399"></a><a class="indexterm" name="id2612407"></a>233 </p></dd><dt><span class="term">Cryptographic Controls (schannel, sign'n'seal)</span></dt><dd><p><a class="indexterm" name="id378881"></a><a class="indexterm" name="id378889"></a><a class="indexterm" name="id378897"></a> 234 234 The report correctly mentions that Samba did not support the most recent 235 235 <code class="constant">schannel</code> and <code class="constant">digital sign'n'seal</code> features … … 239 239 pathology report they reflect accurately (at best) status at a snapshot in time. 240 240 Meanwhile, the world moves on. 241 </p><p><a class="indexterm" name="id 2612437"></a><a class="indexterm" name="id2612445"></a><a class="indexterm" name="id2612453"></a><a class="indexterm" name="id2612460"></a><a class="indexterm" name="id2612468"></a><a class="indexterm" name="id2612483"></a><a class="indexterm" name="id2612491"></a>241 </p><p><a class="indexterm" name="id378923"></a><a class="indexterm" name="id378930"></a><a class="indexterm" name="id378938"></a><a class="indexterm" name="id378946"></a><a class="indexterm" name="id378953"></a><a class="indexterm" name="id378968"></a><a class="indexterm" name="id378976"></a> 242 242 It should be pointed out that had clear public specifications for the protocols 243 243 been published, it would have been much easier to implement these features and would have … … 247 247 and defensible standards is obvious to all and would have enabled more secure networking 248 248 for everyone. 249 </p><p><a class="indexterm" name="id 2612512"></a><a class="indexterm" name="id2612520"></a>249 </p><p><a class="indexterm" name="id378992"></a><a class="indexterm" name="id379000"></a> 250 250 Critics of Samba often ignore fundamental problems that may plague (or may have plagued) 251 251 the users of Microsoft's products also. Those who are first to criticize Samba … … 259 259 Windows networking sites. From notes such as this it is clear that there are benefits 260 260 from not rushing new technology out of the door too soon. 261 </p><p><a class="indexterm" name="id 2612560"></a><a class="indexterm" name="id2612568"></a><a class="indexterm" name="id2612576"></a><a class="indexterm" name="id2612584"></a><a class="indexterm" name="id2612592"></a><a class="indexterm" name="id2612600"></a><a class="indexterm" name="id2612608"></a><a class="indexterm" name="id2612616"></a><a class="indexterm" name="id2612624"></a>261 </p><p><a class="indexterm" name="id379032"></a><a class="indexterm" name="id379040"></a><a class="indexterm" name="id379048"></a><a class="indexterm" name="id379056"></a><a class="indexterm" name="id379064"></a><a class="indexterm" name="id379072"></a><a class="indexterm" name="id379080"></a><a class="indexterm" name="id379088"></a><a class="indexterm" name="id379096"></a> 262 262 One final comment is warranted. If companies want more secure networking protocols, 263 263 the most effective method by which this can be achieved is by users seeking … … 268 268 help the consumer to make a better choice. 269 269 </p></dd><dt><span class="term">Active Directory Replacement with Kerberos, LDAP, and Samba 270 <a class="indexterm" name="id 2612649"></a><a class="indexterm" name="id2612661"></a><a class="indexterm" name="id2612669"></a><a class="indexterm" name="id2612677"></a>270 <a class="indexterm" name="id379116"></a><a class="indexterm" name="id379128"></a><a class="indexterm" name="id379136"></a><a class="indexterm" name="id379143"></a> 271 271 272 272 </span></dt><dd><p> … … 278 278 and yet by which they are made to interoperate in ways that the components do not 279 279 support. 280 </p><p><a class="indexterm" name="id 2612711"></a><a class="indexterm" name="id2612723"></a><a class="indexterm" name="id2612731"></a><a class="indexterm" name="id2612739"></a><a class="indexterm" name="id2612747"></a>280 </p><p><a class="indexterm" name="id379174"></a><a class="indexterm" name="id379185"></a><a class="indexterm" name="id379193"></a><a class="indexterm" name="id379201"></a><a class="indexterm" name="id379209"></a> 281 281 In order to make the popular request for Samba to be an Active Directory Server a 282 282 reality, it is necessary to add to OpenLDAP, Kerberos, as well as Samba, RPC calls … … 286 286 the Samba Team does not make it a priority to absorb Kerberos and LDAP functionality 287 287 into the Samba project, this dream request cannot become a reality. 288 </p><p><a class="indexterm" name="id 2612768"></a><a class="indexterm" name="id2612776"></a><a class="indexterm" name="id2612784"></a><a class="indexterm" name="id2612795"></a><a class="indexterm" name="id2612802"></a>288 </p><p><a class="indexterm" name="id379225"></a><a class="indexterm" name="id379233"></a><a class="indexterm" name="id379241"></a><a class="indexterm" name="id379252"></a><a class="indexterm" name="id379260"></a> 289 289 At this time, the integration of LDAP, Kerberos, and the missing RPCs is not on the 290 290 Samba development roadmap. If it is not on the published roadmap, it cannot be delivered … … 292 292 The Samba Team is most committed to permitting Samba to be a full ADS domain member 293 293 that is increasingly capable of being managed using Microsoft Windows MMC tools. 294 </p></dd></dl></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2612822"></a>Kerberos Exposed</h4></div></div></div><p><a class="indexterm" name="id2612829"></a><a class="indexterm" name="id2612837"></a><a class="indexterm" name="id2612845"></a>294 </p></dd></dl></div><div class="sect3" title="Kerberos Exposed"><div class="titlepage"><div><div><h4 class="title"><a name="id379276"></a>Kerberos Exposed</h4></div></div></div><p><a class="indexterm" name="id379282"></a><a class="indexterm" name="id379290"></a><a class="indexterm" name="id379298"></a> 295 295 Kerberos is a network authentication protocol that provides secure authentication for 296 296 client-server applications by using secret-key cryptography. Firewalls are an insufficient … … 298 298 traffic but cannot prevent network traffic that comes from authorized locations from 299 299 performing unauthorized activities. 300 </p><p><a class="indexterm" name="id 2612863"></a><a class="indexterm" name="id2612871"></a><a class="indexterm" name="id2612879"></a>300 </p><p><a class="indexterm" name="id379312"></a><a class="indexterm" name="id379320"></a><a class="indexterm" name="id379328"></a> 301 301 Kerberos was created by MIT as a solution to network security problems. The Kerberos protocol uses 302 302 strong cryptography so that a client can prove its identity to a server (and vice versa) across an … … 304 304 they can also encrypt all of their communications to assure privacy and data integrity as they go 305 305 about their business. 306 </p><p><a class="indexterm" name="id 2612897"></a><a class="indexterm" name="id2612905"></a><a class="indexterm" name="id2612913"></a><a class="indexterm" name="id2612921"></a><a class="indexterm" name="id2612932"></a>306 </p><p><a class="indexterm" name="id379343"></a><a class="indexterm" name="id379351"></a><a class="indexterm" name="id379359"></a><a class="indexterm" name="id379367"></a><a class="indexterm" name="id379378"></a> 307 307 Kerberos is a trusted third-party service. That means that there is a third party (the kerberos 308 308 server) that is trusted by all the entities on the network (users and services, usually called … … 311 311 trusting the kerberos server, users and services can authenticate each other. 312 312 </p><p> 313 <a class="indexterm" name="id 2612952"></a>314 <a class="indexterm" name="id 2612959"></a>315 <a class="indexterm" name="id 2612966"></a>313 <a class="indexterm" name="id379394"></a> 314 <a class="indexterm" name="id379401"></a> 315 <a class="indexterm" name="id379408"></a> 316 316 Kerberos was, until recently, a technology that was restricted from being exported from the United States. 317 317 For many years that hindered global adoption of more secure networking technologies both within the United States … … 323 323 and use of Kerberos across the spectrum of the information technology industry. 324 324 </p><p> 325 <a class="indexterm" name="id 2612995"></a>325 <a class="indexterm" name="id379430"></a> 326 326 A storm has broken out concerning interoperability between MIT Kerberos and Microsofts' implementation 327 327 of it. For example, a 2002 328 328 <a class="ulink" href="http://www.idg.com.sg/idgwww.nsf/0/5DDA8D153A7505A748256BAB000D992A?OpenDocument" target="_top">IDG</a> 329 report<sup>[<a name="id 2613014" href="#ftn.id2613014" class="footnote">13</a>]</sup> by329 report<sup>[<a name="id379447" href="#ftn.id379447" class="footnote">13</a>]</sup> by 330 330 states: 331 331 </p><div class="blockquote"><blockquote class="blockquote"><p> … … 335 335 use of the Kerberos authentication specification, not everyone agrees. 336 336 </p><p> 337 <a class="indexterm" name="id 2613041"></a>337 <a class="indexterm" name="id379470"></a> 338 338 Robert Short, vice president of Windows core technology at Microsoft, wrote in his direct testimony prepared 339 339 before his appearance that non-Microsoft operating systems can disregard the portion of the Kerberos version … … 343 343 that software developers could add their own authorization information, he said. 344 344 </p></blockquote></div><p> 345 <a class="indexterm" name="id 2613065"></a>346 <a class="indexterm" name="id 2613071"></a>345 <a class="indexterm" name="id379488"></a> 346 <a class="indexterm" name="id379494"></a> 347 347 It so happens that Microsoft Windows clients depend on and expect the contents of the <span class="emphasis"><em>unspecified 348 348 fields</em></span> in the Kerberos 5 communications data stream for their Windows interoperability, … … 356 356 <a class="ulink" href="http://www.microsoft.com/technet/itsolutions/interop/mgmt/kerberos.asp" target="_top"> 357 357 technet</a> article: 358 </p><div class="blockquote"><blockquote class="blockquote"><p><a class="indexterm" name="id 2613106"></a><a class="indexterm" name="id2613118"></a>358 </p><div class="blockquote"><blockquote class="blockquote"><p><a class="indexterm" name="id379523"></a><a class="indexterm" name="id379535"></a> 359 359 The DCE Security Services are also layered on the Kerberos protocol. DCE authentication services use RPC 360 360 representation of Kerberos protocol messages. In addition, DCE uses the authorization data field in Kerberos … … 364 364 is not an issue with Kerberos interoperability, but rather an issue of interoperability between DCE and 365 365 Windows NT access control information. 366 </p></blockquote></div></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="ch10expl"></a>Implementation</h2></div></div></div><p>366 </p></blockquote></div></div></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="ch10expl"></a>Implementation</h2></div></div></div><p> 367 367 The following procedures outline the implementation of the security measures discussed so far. 368 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2613169"></a>Share Access Controls</h3></div></div></div><p><a class="indexterm" name="id2613176"></a><a class="indexterm" name="id2613184"></a><a class="indexterm" name="id2613192"></a>368 </p><div class="sect2" title="Share Access Controls"><div class="titlepage"><div><div><h3 class="title"><a name="id379573"></a>Share Access Controls</h3></div></div></div><p><a class="indexterm" name="id379580"></a><a class="indexterm" name="id379588"></a><a class="indexterm" name="id379596"></a> 369 369 Access control entries placed on the share itself act as a filter at the time a when CIFS/SMB client (such as 370 370 Windows XP Pro) attempts to make a connection to the Samba server. 371 </p><div class="procedure" ><a name="id2613205"></a><p class="title"><b>Procedure 11.1. Create/Edit/Delete Share ACLs</b></p><ol type="1"><li><p><a class="indexterm" name="id2613216"></a><a class="indexterm" name="id2613224"></a>371 </p><div class="procedure" title="Procedure 11.1. Create/Edit/Delete Share ACLs"><a name="id379607"></a><p class="title"><b>Procedure 11.1. Create/Edit/Delete Share ACLs</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p><a class="indexterm" name="id379617"></a><a class="indexterm" name="id379625"></a> 372 372 From a Windows 200x/XP Professional workstation, log on to the domain using the Domain Administrator 373 373 account (on Samba domains, this is usually the account called <code class="constant">root</code>). 374 </p></li><li ><p>374 </p></li><li class="step" title="Step 2"><p> 375 375 Click 376 376 <span class="guimenu">Start</span> → <span class="guimenuitem">Settings</span> → <span class="guimenuitem">Control Panel</span> → <span class="guimenuitem">Administrative Tools</span> → <span class="guimenuitem">Computer Management</span>. 377 </p></li><li ><p>377 </p></li><li class="step" title="Step 3"><p> 378 378 In the left panel, 379 379 <span class="guimenu">[Right mouse menu item] Computer Management (Local)</span> → <span class="guimenuitem">Connect to another computer ...</span> → <span class="guimenuitem">Browse...</span> → <span class="guimenuitem">Advanced</span> → <span class="guimenuitem">Find Now</span>. In the lower panel, click on the name of the server you wish to 380 administer. Click <span class="guimenu">OK</span> → <span class="guimenuitem">OK</span> → <span class="guimenuitem">OK</span>.<a class="indexterm" name="id 2613347"></a>380 administer. Click <span class="guimenu">OK</span> → <span class="guimenuitem">OK</span> → <span class="guimenuitem">OK</span>.<a class="indexterm" name="id379745"></a> 381 381 In the left panel, the entry <span class="guimenu">Computer Management (Local)</span> should now reflect 382 382 the change made. For example, if the server you are administering is called <code class="constant">FRODO</code>, 383 383 the Computer Management entry should now say <span class="guimenu">Computer Management (FRODO)</span>. 384 </p></li><li ><p>384 </p></li><li class="step" title="Step 4"><p> 385 385 In the left panel, click <span class="guimenu">Computer Management (FRODO)</span> → <span class="guimenuitem">[+] Shared Folders</span> → <span class="guimenuitem">Shares</span>. 386 </p></li><li ><p><a class="indexterm" name="id2613411"></a><a class="indexterm" name="id2613419"></a>386 </p></li><li class="step" title="Step 5"><p><a class="indexterm" name="id379806"></a><a class="indexterm" name="id379814"></a> 387 387 In the right panel, double-click on the share on which you wish to set/edit ACLs. This 388 388 will bring up the Properties panel. Click the <span class="guimenu">Share Permissions</span> tab. 389 </p></li><li ><p><a class="indexterm" name="id2613442"></a><a class="indexterm" name="id2613450"></a><a class="indexterm" name="id2613458"></a><a class="indexterm" name="id2613466"></a><a class="indexterm" name="id2613474"></a><a class="indexterm" name="id2613482"></a>389 </p></li><li class="step" title="Step 6"><p><a class="indexterm" name="id379836"></a><a class="indexterm" name="id379844"></a><a class="indexterm" name="id379852"></a><a class="indexterm" name="id379860"></a><a class="indexterm" name="id379868"></a><a class="indexterm" name="id379875"></a> 390 390 You may now edit/add/remove access control settings. Be very careful. Many problems have been 391 391 created by people who decided that everyone should be rejected but one particular group should … … 393 393 belong to the group <code class="constant">Everyone</code>, which therefore overrules any permissions 394 394 set for the permitted group. 395 </p></li><li ><p>395 </p></li><li class="step" title="Step 7"><p> 396 396 When you are done with editing, close all panels by clicking through the <span class="guimenu">OK</span> 397 397 buttons. 398 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2613518"></a>Share Definition Controls</h3></div></div></div><p><a class="indexterm" name="id2613525"></a><a class="indexterm" name="id2613536"></a><a class="indexterm" name="id2613544"></a><a class="indexterm" name="id2613552"></a><a class="indexterm" name="id2613560"></a><a class="indexterm" name="id2613568"></a>398 </p></li></ol></div></div><div class="sect2" title="Share Definition Controls"><div class="titlepage"><div><div><h3 class="title"><a name="id379908"></a>Share Definition Controls</h3></div></div></div><p><a class="indexterm" name="id379914"></a><a class="indexterm" name="id379926"></a><a class="indexterm" name="id379934"></a><a class="indexterm" name="id379942"></a><a class="indexterm" name="id379949"></a><a class="indexterm" name="id379957"></a> 399 399 Share-definition-based access controls can be used like a checkpoint or like a pile-driver. Just as a 400 400 checkpoint can be used to require someone who wants to get through to meet certain requirements, so … … 403 403 credential-related objectives, the user can be granted powers and privileges that would not normally be 404 404 available under default settings. 405 </p><p><a class="indexterm" name="id 2613588"></a><a class="indexterm" name="id2613596"></a><a class="indexterm" name="id2613604"></a><a class="indexterm" name="id2613612"></a>405 </p><p><a class="indexterm" name="id379973"></a><a class="indexterm" name="id379981"></a><a class="indexterm" name="id379989"></a><a class="indexterm" name="id379997"></a> 406 406 It must be emphasized that the controls discussed here can act as a filter or give rights of passage 407 407 that act as a superstructure over normal directory and file access controls. However, share-level … … 409 409 share-level controls to get to the share-definition controls. The proper hierarchy of controls implemented 410 410 by Samba and Windows networking consists of: 411 </p><div class="orderedlist"><ol type="1"><li><p>Share-level ACLs</p></li><li><p>Share-definition controls</p></li><li><p>Directory and file permissions</p></li><li><p>Directory and file POSIX ACLs</p></li></ol></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2613658"></a>Checkpoint Controls</h4></div></div></div><p><a class="indexterm" name="id2613664"></a>411 </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p>Share-level ACLs</p></li><li class="listitem"><p>Share-definition controls</p></li><li class="listitem"><p>Directory and file permissions</p></li><li class="listitem"><p>Directory and file POSIX ACLs</p></li></ol></div><div class="sect3" title="Checkpoint Controls"><div class="titlepage"><div><div><h4 class="title"><a name="id380037"></a>Checkpoint Controls</h4></div></div></div><p><a class="indexterm" name="id380044"></a> 412 412 Consider the following extract from a <code class="filename">smb.conf</code> file defining the share called <code class="constant">Apps</code>: 413 413 </p><pre class="screen"> … … 420 420 This definition permits only those who are members of the group called <code class="constant">Employees</code> to 421 421 access the share. 422 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p><a class="indexterm" name="id2613700"></a><a class="indexterm" name="id2613711"></a><a class="indexterm" name="id2613720"></a><a class="indexterm" name="id2613728"></a><a class="indexterm" name="id2613735"></a>422 </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p><a class="indexterm" name="id380077"></a><a class="indexterm" name="id380088"></a><a class="indexterm" name="id380096"></a><a class="indexterm" name="id380104"></a><a class="indexterm" name="id380112"></a> 423 423 On domain member servers and clients, even when the <em class="parameter"><code>winbind use default domain</code></em> has 424 424 been specified, the use of domain accounts in security controls requires fully qualified domain specification, … … 426 426 Note the necessity to use the double quotes to avoid having the space in the Windows group name interpreted as a 427 427 delimiter. 428 </p></div><p><a class="indexterm" name="id 2613771"></a><a class="indexterm" name="id2613778"></a><a class="indexterm" name="id2613786"></a>428 </p></div><p><a class="indexterm" name="id380145"></a><a class="indexterm" name="id380152"></a><a class="indexterm" name="id380160"></a> 429 429 If there is an ACL on the share itself to permit read/write access for all <code class="constant">Employees</code> 430 430 as well as read/write for the group <code class="constant">Doctors</code>, both groups are permitted through … … 432 432 the group <code class="constant">Doctors</code>, who is not also a member of the group <code class="constant">Employees</code>, 433 433 would immediately fail to validate. 434 </p><p><a class="indexterm" name="id 2613817"></a>434 </p><p><a class="indexterm" name="id380188"></a> 435 435 Consider another example. In this case, you want to permit all members of the group <code class="constant">Employees</code> 436 436 except the user <code class="constant">patrickj</code> to access the <code class="constant">Apps</code> share. This can be … … 445 445 invalid users = patrickj 446 446 </pre><p> 447 <a class="indexterm" name="id 2613858"></a>447 <a class="indexterm" name="id380224"></a> 448 448 Let us assume that you want to permit the user <code class="constant">gbshaw</code> to manage any file in the 449 449 UNIX/Linux file system directory <code class="filename">/data/apps</code>, but you do not want to grant any write … … 457 457 admin users = gbshaw 458 458 </pre><p> 459 <a class="indexterm" name="id 2613888"></a>459 <a class="indexterm" name="id380251"></a> 460 460 Now we have a set of controls that permits only <code class="constant">Employees</code> who are also members of 461 461 the group <code class="constant">Doctors</code>, excluding the user <code class="constant">patrickj</code>, to have … … 479 479 write list = peters 480 480 </pre><p> 481 <a class="indexterm" name="id 2613948"></a>481 <a class="indexterm" name="id380303"></a> 482 482 This is a particularly complex example at this point, but it begins to demonstrate the possibilities. 483 483 You should refer to the online manual page for the <code class="filename">smb.conf</code> file for more information regarding 484 484 the checkpoint controls that Samba implements. 485 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2613970"></a>Override Controls</h4></div></div></div><p><a class="indexterm" name="id2613977"></a>485 </p></div><div class="sect3" title="Override Controls"><div class="titlepage"><div><div><h4 class="title"><a name="id380322"></a>Override Controls</h4></div></div></div><p><a class="indexterm" name="id380328"></a> 486 486 Override controls implemented by Samba permit actions like the adoption of a different identity 487 487 during file system operations, the forced overwriting of normal file and directory permissions, … … 501 501 force group = Mentors 502 502 </pre><p> 503 <a class="indexterm" name="id 2614020"></a><a class="indexterm" name="id2614028"></a>503 <a class="indexterm" name="id380366"></a><a class="indexterm" name="id380374"></a> 504 504 That is all there is to it. Well, it is almost that simple. The downside of this method is that 505 505 users are logged onto the Windows client as themselves, and then immediately before accessing the … … 508 508 This imposes significant overhead on Samba. The alternative way to effectively achieve the same result 509 509 (but with lower system CPU overheads) is described next. 510 </p><p><a class="indexterm" name="id 2614049"></a><a class="indexterm" name="id2614057"></a><a class="indexterm" name="id2614065"></a><a class="indexterm" name="id2614076"></a><a class="indexterm" name="id2614084"></a>510 </p><p><a class="indexterm" name="id380389"></a><a class="indexterm" name="id380397"></a><a class="indexterm" name="id380405"></a><a class="indexterm" name="id380416"></a><a class="indexterm" name="id380424"></a> 511 511 The use of the <em class="parameter"><code>force user</code></em> or the <em class="parameter"><code>force group</code></em> may 512 512 also have a severe impact on system (particularly on Windows client) performance. If opportunistic … … 518 518 apparent performance degradation as the client continually attempts to reconnect to overcome the 519 519 effect of the lost <code class="constant">oplock break</code>, or time-out. 520 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2614131"></a>Share Point Directory and File Permissions</h3></div></div></div><p><a class="indexterm" name="id2614138"></a><a class="indexterm" name="id2614146"></a><a class="indexterm" name="id2614154"></a><a class="indexterm" name="id2614162"></a>520 </p></div></div><div class="sect2" title="Share Point Directory and File Permissions"><div class="titlepage"><div><div><h3 class="title"><a name="id380465"></a>Share Point Directory and File Permissions</h3></div></div></div><p><a class="indexterm" name="id380472"></a><a class="indexterm" name="id380480"></a><a class="indexterm" name="id380488"></a><a class="indexterm" name="id380496"></a> 521 521 Samba has been designed and implemented so that it respects as far as is feasible the security and 522 522 user privilege controls that are built into the UNIX/Linux operating system. Samba does nothing … … 526 526 from a basic UNIX training guide. Instead, one common example of a typical problem is used 527 527 to demonstrate the most effective solution referred to in the immediately preceding paragraph. 528 </p><p><a class="indexterm" name="id 2614185"></a><a class="indexterm" name="id2614193"></a><a class="indexterm" name="id2614201"></a>528 </p><p><a class="indexterm" name="id380512"></a><a class="indexterm" name="id380520"></a><a class="indexterm" name="id380528"></a> 529 529 One of the common issues that repeatedly pops up on the Samba mailing lists involves the saving of 530 530 Microsoft Office files (Word and Excel) to a network drive. Here is the typical sequence: 531 </p><div class="orderedlist"><ol type="1"><li><p>531 </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p> 532 532 A user opens a Word document from a network drive. The file was owned by user <code class="constant">janetp</code> 533 533 and <code class="constant">users</code>, and was set read/write-enabled for everyone. 534 </p></li><li ><p>534 </p></li><li class="listitem"><p> 535 535 File changes and edits are made. 536 </p></li><li ><p>536 </p></li><li class="listitem"><p> 537 537 The file is saved, and MS Word is closed. 538 </p></li><li ><p>538 </p></li><li class="listitem"><p> 539 539 The file is now owned by the user <code class="constant">billc</code> and group <code class="constant">doctors</code>, 540 540 and is set read/write by <code class="constant">billc</code>, read-only by <code class="constant">doctors</code>, and 541 541 no access by everyone. 542 </p></li><li ><p>543 The original owner cannot now access her own file and is “<span class="quote">justifiably</span>”upset.542 </p></li><li class="listitem"><p> 543 The original owner cannot now access her own file and is <span class="quote">“<span class="quote">justifiably</span>”</span> upset. 544 544 </p></li></ol></div><p> 545 545 There have been many postings over the years that report the same basic problem. Frequently Samba users 546 want to know when this “<span class="quote">bug</span>”will be fixed. The fact is, this is not a bug in Samba at all.546 want to know when this <span class="quote">“<span class="quote">bug</span>”</span> will be fixed. The fact is, this is not a bug in Samba at all. 547 547 Here is the real sequence of what happens in this case. 548 </p><p><a class="indexterm" name="id 2614288"></a><a class="indexterm" name="id2614296"></a><a class="indexterm" name="id2614304"></a>548 </p><p><a class="indexterm" name="id380609"></a><a class="indexterm" name="id380617"></a><a class="indexterm" name="id380624"></a> 549 549 When the user saves a file, MS Word creates a new (temporary) file. This file is naturally owned 550 550 by the user who creates the file (<code class="constant">billc</code>) and has the permissions that follow … … 559 559 operations. 560 560 </p><p> 561 The question is, “<span class="quote">How can we solve the problem?</span>”561 The question is, <span class="quote">“<span class="quote">How can we solve the problem?</span>”</span> 562 562 </p><p> 563 563 The solution is simple. Use UNIX file system permissions and controls to your advantage. Follow these 564 564 simple steps to create a share in which all files will consistently be owned by the same user and the 565 565 same group: 566 </p><div class="procedure" ><a name="id2614351"></a><p class="title"><b>Procedure 11.2. Using Directory Permissions to Force File User and Group Ownership</b></p><ol type="1"><li><p>566 </p><div class="procedure" title="Procedure 11.2. Using Directory Permissions to Force File User and Group Ownership"><a name="id380661"></a><p class="title"><b>Procedure 11.2. Using Directory Permissions to Force File User and Group Ownership</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 567 567 Change your share definition so that it matches this pattern: 568 568 </p><pre class="screen"> … … 572 572 read only = No 573 573 </pre><p> 574 </p></li><li ><p><a class="indexterm" name="id2614377"></a><a class="indexterm" name="id2614388"></a>574 </p></li><li class="step" title="Step 2"><p><a class="indexterm" name="id380685"></a><a class="indexterm" name="id380696"></a> 575 575 Set consistent user and group permissions recursively down the directory tree as shown here: 576 576 </p><pre class="screen"> 577 577 <code class="prompt">root# </code> chown -R janetp.users /usr/data/finance 578 578 </pre><p> 579 </p></li><li ><p><a class="indexterm" name="id2614420"></a>579 </p></li><li class="step" title="Step 3"><p><a class="indexterm" name="id380727"></a> 580 580 Set the files and directory permissions to be read/write for owner and group, and not accessible 581 581 to others (everyone), using the following command: … … 583 583 <code class="prompt">root# </code> chmod ug+rwx,o-rwx /usr/data/finance 584 584 </pre><p> 585 </p></li><li ><p><a class="indexterm" name="id2614449"></a>585 </p></li><li class="step" title="Step 4"><p><a class="indexterm" name="id380754"></a> 586 586 Set the SGID (supergroup) bit on all directories from the top down. This means all files 587 587 can be created with the permissions of the group set on the directory. It means all users … … 593 593 </pre><p> 594 594 595 </p></li><li ><p><a class="indexterm" name="id2614489"></a><a class="indexterm" name="id2614497"></a><a class="indexterm" name="id2614505"></a>595 </p></li><li class="step" title="Step 5"><p><a class="indexterm" name="id380791"></a><a class="indexterm" name="id380799"></a><a class="indexterm" name="id380807"></a> 596 596 Make sure all users that must have read/write access to the directory have 597 597 <code class="constant">finance</code> group membership as their primary group, 598 598 for example, the group they belong to in <code class="filename">/etc/passwd</code>. 599 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2614530"></a>Managing Windows 200x ACLs</h3></div></div></div><p><a class="indexterm" name="id2614537"></a><a class="indexterm" name="id2614545"></a><a class="indexterm" name="id2614553"></a><a class="indexterm" name="id2614561"></a>599 </p></li></ol></div></div><div class="sect2" title="Managing Windows 200x ACLs"><div class="titlepage"><div><div><h3 class="title"><a name="id380830"></a>Managing Windows 200x ACLs</h3></div></div></div><p><a class="indexterm" name="id380837"></a><a class="indexterm" name="id380845"></a><a class="indexterm" name="id380853"></a><a class="indexterm" name="id380860"></a> 600 600 Samba must translate Windows 2000 ACLs to UNIX POSIX ACLs. This has some interesting side effects because 601 601 there is not a one-to-one equivalence between them. The as-close-as-possible ACLs match means … … 605 605 There are two possible ways to set ACLs on UNIX/Linux file systems from a Windows network workstation, 606 606 either via File Manager or via the Microsoft Management Console (MMC) Computer Management interface. 607 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2614585"></a>Using the MMC Computer Management Interface</h4></div></div></div><div class="procedure"><ol type="1"><li><p>607 </p><div class="sect3" title="Using the MMC Computer Management Interface"><div class="titlepage"><div><div><h4 class="title"><a name="id380879"></a>Using the MMC Computer Management Interface</h4></div></div></div><div class="procedure"><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 608 608 From a Windows 200x/XP Professional workstation, log on to the domain using the Domain Administrator 609 609 account (on Samba domains, this is usually the account called <code class="constant">root</code>). 610 </p></li><li ><p>610 </p></li><li class="step" title="Step 2"><p> 611 611 Click 612 612 <span class="guimenu">Start</span> → <span class="guimenuitem">Settings</span> → <span class="guimenuitem">Control Panel</span> → <span class="guimenuitem">Administrative Tools</span> → <span class="guimenuitem">Computer Management</span>. 613 </p></li><li ><p>613 </p></li><li class="step" title="Step 3"><p> 614 614 In the left panel, 615 615 <span class="guimenu">[Right mouse menu item] Computer Management (Local)</span> → <span class="guimenuitem">Connect to another computer ...</span> → <span class="guimenuitem">Browse...</span> → <span class="guimenuitem">Advanced</span> → <span class="guimenuitem">Find Now</span>. In the lower panel, click on the name of the server you wish to … … 618 618 the change made. For example, if the server you are administering is called <code class="constant">FRODO</code>, 619 619 the Computer Management entry should now say: <span class="guimenu">Computer Management (FRODO)</span>. 620 </p></li><li ><p>620 </p></li><li class="step" title="Step 4"><p> 621 621 In the left panel, click <span class="guimenu">Computer Management (FRODO)</span> → <span class="guimenuitem">[+] Shared Folders</span> → <span class="guimenuitem">Shares</span>. 622 </p></li><li ><p><a class="indexterm" name="id2614768"></a><a class="indexterm" name="id2614776"></a><a class="indexterm" name="id2614783"></a><a class="indexterm" name="id2614791"></a>622 </p></li><li class="step" title="Step 5"><p><a class="indexterm" name="id381056"></a><a class="indexterm" name="id381064"></a><a class="indexterm" name="id381072"></a><a class="indexterm" name="id381080"></a> 623 623 In the right panel, double-click on the share on which you wish to set/edit ACLs. This 624 624 brings up the Properties panel. Click the <span class="guimenu">Security</span> tab. It is best … … 627 627 functionality under the <code class="constant">Permissions</code> tab can be utilized with respect 628 628 to a Samba domain server. 629 </p></li><li ><p><a class="indexterm" name="id2614831"></a><a class="indexterm" name="id2614839"></a>629 </p></li><li class="step" title="Step 6"><p><a class="indexterm" name="id381116"></a><a class="indexterm" name="id381124"></a> 630 630 You may now edit/add/remove access control settings. Be very careful. Many problems have been 631 631 created by people who decided that everyone should be rejected but one particular group should … … 633 633 belong to the group <code class="constant">Everyone</code>, which therefore overrules any permissions 634 634 set for the permitted group. 635 </p></li><li ><p>635 </p></li><li class="step" title="Step 7"><p> 636 636 When you are done with editing, close all panels by clicking through the <span class="guimenu">OK</span> 637 637 buttons until the last panel closes. 638 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2614876"></a>Using MS Windows Explorer (File Manager)</h4></div></div></div><p>638 </p></li></ol></div></div><div class="sect3" title="Using MS Windows Explorer (File Manager)"><div class="titlepage"><div><div><h4 class="title"><a name="id381156"></a>Using MS Windows Explorer (File Manager)</h4></div></div></div><p> 639 639 The following alternative method may be used from a Windows workstation. In this example we work 640 640 with a domain called <code class="constant">MEGANET</code>, a server called <code class="constant">MASSIVE</code>, and a 641 641 share called <code class="constant">Apps</code>. The underlying UNIX/Linux share point for this share is 642 642 <code class="filename">/data/apps</code>. 643 </p><div class="procedure"><ol type="1"><li><p>643 </p><div class="procedure"><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 644 644 Click <span class="guimenu">Start</span> → <span class="guimenuitem">[right-click] My Computer</span> → <span class="guimenuitem">Explore</span> → <span class="guimenuitem">[left panel] [+] My Network Places</span> → <span class="guimenuitem">[+] Entire Network</span> → <span class="guimenuitem">[+] Microsoft Windows Network</span> → <span class="guimenuitem">[+] Meganet</span> → <span class="guimenuitem">[+] Massive</span> → <span class="guimenuitem">[right-click] Apps</span> → <span class="guimenuitem">Properties</span> → <span class="guimenuitem">Security</span> → <span class="guimenuitem">Advanced</span>. This opens a panel that has four tabs. Only the functionality under the 645 645 <code class="constant">Permissions</code> tab can be utilized for a Samba domain server. 646 </p></li><li ><p><a class="indexterm" name="id2615000"></a><a class="indexterm" name="id2615008"></a>646 </p></li><li class="step" title="Step 2"><p><a class="indexterm" name="id381277"></a><a class="indexterm" name="id381285"></a> 647 647 You may now edit/add/remove access control settings. Be very careful. Many problems have been 648 648 created by people who decided that everyone should be rejected but one particular group should … … 650 650 belong to the group <code class="constant">Everyone</code>, which therefore overrules any permissions 651 651 set for the permitted group. 652 </p></li><li ><p>652 </p></li><li class="step" title="Step 3"><p> 653 653 When you are done with editing, close all panels by clicking through the <span class="guimenu">OK</span> 654 654 buttons until the last panel closes. 655 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2615047"></a>Setting Posix ACLs in UNIX/Linux</h4></div></div></div><p><a class="indexterm" name="id2615054"></a><a class="indexterm" name="id2615062"></a>655 </p></li></ol></div></div><div class="sect3" title="Setting Posix ACLs in UNIX/Linux"><div class="titlepage"><div><div><h4 class="title"><a name="id381318"></a>Setting Posix ACLs in UNIX/Linux</h4></div></div></div><p><a class="indexterm" name="id381325"></a><a class="indexterm" name="id381333"></a> 656 656 Yet another alternative method for setting desired security settings on the shared resource files and 657 657 directories can be achieved by logging into UNIX/Linux and setting POSIX ACLs directly using command-line 658 658 tools. Here is an example session on the same resource as in the immediately preceding example on a SUSE 9 659 659 Linux system: 660 </p><div class="procedure"><ol type="1"><li><p>660 </p><div class="procedure"><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 661 661 Log into the Linux system as the user <code class="constant">root</code>. 662 </p></li><li ><p>662 </p></li><li class="step" title="Step 2"><p> 663 663 Change directory to the location of the exported (shared) Windows file share (Apps), which is in 664 664 the directory <code class="filename">/data</code>. Execute the following: … … 676 676 other::r-x 677 677 </pre><p> 678 </p></li><li ><p><a class="indexterm" name="id2615136"></a>678 </p></li><li class="step" title="Step 3"><p><a class="indexterm" name="id381401"></a> 679 679 You want to add permission for <code class="constant">AppsMgrs</code> to enable them to 680 680 manage the applications (apps) share. It is important to set the ACL recursively … … 699 699 </pre><p> 700 700 This confirms that the change of POSIX ACL permissions has been effective. 701 </p></li><li ><p><a class="indexterm" name="id2615192"></a><a class="indexterm" name="id2615199"></a><a class="indexterm" name="id2615207"></a><a class="indexterm" name="id2615215"></a><a class="indexterm" name="id2615223"></a>701 </p></li><li class="step" title="Step 4"><p><a class="indexterm" name="id381451"></a><a class="indexterm" name="id381459"></a><a class="indexterm" name="id381467"></a><a class="indexterm" name="id381475"></a><a class="indexterm" name="id381483"></a> 702 702 It is highly recommended that you read the online manual page for the <code class="literal">setfacl</code> 703 703 and <code class="literal">getfacl</code> commands. This provides information regarding how to set/read the default 704 704 ACLs and how that may be propagated through the directory tree. In Windows ACLs terms, this is the equivalent 705 705 of setting <code class="constant">inheritance</code> properties. 706 </p></li></ol></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2615257"></a>Key Points Learned</h3></div></div></div><p>706 </p></li></ol></div></div></div><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id381514"></a>Key Points Learned</h3></div></div></div><p> 707 707 The mish-mash of issues were thrown together into one chapter because it seemed like a good idea. 708 708 Looking back, this chapter could be broken into two, but it's too late now. It has been done. 709 709 The highlights covered are as follows: 710 </p><div class="itemizedlist"><ul type="disc"><li><p><a class="indexterm" name="id2615274"></a><a class="indexterm" name="id2615282"></a><a class="indexterm" name="id2615290"></a><a class="indexterm" name="id2615298"></a>710 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p><a class="indexterm" name="id381529"></a><a class="indexterm" name="id381537"></a><a class="indexterm" name="id381545"></a><a class="indexterm" name="id381553"></a> 711 711 Winbind honors and does not override account controls set in Active Directory. 712 712 This means that password change, logon hours, and so on, are (or soon will be) enforced … … 714 714 change is enforced. At this time, if logon hours expire, the user is not forcibly 715 715 logged off. That may be implemented at some later date. 716 </p></li><li ><p><a class="indexterm" name="id2615317"></a><a class="indexterm" name="id2615325"></a>716 </p></li><li class="listitem"><p><a class="indexterm" name="id381568"></a><a class="indexterm" name="id381576"></a> 717 717 Sign'n'seal (plus schannel support) has been implemented in Samba-3. Beware of potential 718 718 problems acknowledged by Microsoft as having been fixed but reported by some as still 719 719 possibly an open issue. 720 </p></li><li ><p><a class="indexterm" name="id2615341"></a><a class="indexterm" name="id2615349"></a><a class="indexterm" name="id2615356"></a><a class="indexterm" name="id2615364"></a>720 </p></li><li class="listitem"><p><a class="indexterm" name="id381590"></a><a class="indexterm" name="id381598"></a><a class="indexterm" name="id381606"></a><a class="indexterm" name="id381614"></a> 721 721 The combination of Kerberos 5, plus OpenLDAP, plus Samba, cannot replace Microsoft 722 722 Active Directory. The possibility to do this is not planned in the current Samba-3 723 723 roadmap. Samba-3 does aim to provide further improvements in interoperability so that 724 724 UNIX/Linux systems may be fully integrated into Active Directory domains. 725 </p></li><li ><p>725 </p></li><li class="listitem"><p> 726 726 This chapter reviewed mechanisms by which Samba servers may be kept secure. Each of 727 727 the four key methodologies was reviewed with specific reference to example deployment 728 728 techniques. 729 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2615391"></a>Questions and Answers</h2></div></div></div><p>730 </p><div class="qandaset" ><dl><dt> <a href="kerberos.html#id2615407">729 </p></li></ul></div></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id381636"></a>Questions and Answers</h2></div></div></div><p> 730 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id381645"></a><dl><dt> <a href="kerberos.html#id381651"> 731 731 Does Samba-3 require the Sign'n'seal registry hacks needed by Samba-2? 732 </a></dt><dt> <a href="kerberos.html#id 2615477">732 </a></dt><dt> <a href="kerberos.html#id381720"> 733 733 Does Samba-3 support Active Directory? 734 </a></dt><dt> <a href="kerberos.html#id 2615508">734 </a></dt><dt> <a href="kerberos.html#id381747"> 735 735 When Samba-3 is used with Active Directory, is it necessary to run mixed-mode operation, as was 736 736 necessary with Samba-2? 737 </a></dt><dt> <a href="kerberos.html#id 2615547">737 </a></dt><dt> <a href="kerberos.html#id381782"> 738 738 Is it safe to set share-level access controls in Samba? 739 </a></dt><dt> <a href="kerberos.html#id 2615576">739 </a></dt><dt> <a href="kerberos.html#id381809"> 740 740 Is it mandatory to set share ACLs to get a secure Samba-3 server? 741 </a></dt><dt> <a href="kerberos.html#id 2615653">741 </a></dt><dt> <a href="kerberos.html#id381882"> 742 742 The valid users did not work on the [homes]. 743 743 Has this functionality been restored yet? 744 </a></dt><dt> <a href="kerberos.html#id 2615719">744 </a></dt><dt> <a href="kerberos.html#id381944"> 745 745 Is the bias against use of the force user and force group 746 746 really warranted? 747 </a></dt><dt> <a href="kerberos.html#id 2615782">747 </a></dt><dt> <a href="kerberos.html#id382006"> 748 748 The example given for file and directory access control forces all files to be owned by one 749 749 particular user. I do not like that. Is there any way I can see who created the file? 750 </a></dt><dt> <a href="kerberos.html#id 2615830">750 </a></dt><dt> <a href="kerberos.html#id382050"> 751 751 In the book, “The Official Samba-3 HOWTO and Reference Guide”, you recommended use 752 752 of the Windows NT4 Server Manager (part of the SRVTOOLS.EXE) utility. Why 753 753 have you mentioned only the use of the Windows 200x/XP MMC Computer Management utility? 754 </a></dt><dt> <a href="kerberos.html#id 2615896">754 </a></dt><dt> <a href="kerberos.html#id382110"> 755 755 I tried to set valid users = @Engineers, but it does not work. My Samba 756 756 server is an Active Directory domain member server. Has this been fixed now? 757 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2615407"></a><a name="id2615409"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2615412"></a><a class="indexterm" name="id2615420"></a>757 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id381651"></a><a name="id381654"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id381657"></a><a class="indexterm" name="id381665"></a> 758 758 Does Samba-3 require the <code class="constant">Sign'n'seal</code> registry hacks needed by Samba-2? 759 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id 2615440"></a><a class="indexterm" name="id2615447"></a><a class="indexterm" name="id2615455"></a>759 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id381683"></a><a class="indexterm" name="id381691"></a><a class="indexterm" name="id381699"></a> 760 760 No. Samba-3 fully supports <code class="constant">Sign'n'seal</code> as well as <code class="constant">schannel</code> 761 761 operation. The registry change should not be applied when Samba-3 is used as a domain controller. 762 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2615477"></a><a name="id2615480"></a></td><td align="left" valign="top"><p>762 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id381720"></a><a name="id381722"></a></td><td align="left" valign="top"><p> 763 763 Does Samba-3 support Active Directory? 764 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id 2615490"></a>764 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id381732"></a> 765 765 Yes. Samba-3 can be a fully participating native mode Active Directory client. Samba-3 does not 766 766 provide Active Directory services. It cannot be used to replace a Microsoft Active Directory 767 767 server implementation. Samba-3 can function as an Active Directory client (workstation) toolkit, 768 768 and it can function as an Active Directory domain member server. 769 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2615508"></a><a name="id2615511"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2615514"></a>769 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id381747"></a><a name="id381749"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id381752"></a> 770 770 When Samba-3 is used with Active Directory, is it necessary to run mixed-mode operation, as was 771 771 necessary with Samba-2? 772 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id 2615530"></a>772 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id381768"></a> 773 773 No. Samba-3 can be used with NetBIOS over TCP/IP disabled, just as can be done with Windows 200x 774 774 Server and 200x/XPPro client products. It is no longer necessary to run mixed-mode operation, 775 775 because Samba-3 can join a native Windows 2003 Server ADS domain. 776 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2615547"></a><a name="id2615549"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2615552"></a>776 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id381782"></a><a name="id381785"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id381788"></a> 777 777 Is it safe to set share-level access controls in Samba? 778 778 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 780 780 very mature technology. Not enough sites make use of this powerful capability, neither on 781 781 Windows server or with Samba servers. 782 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2615576"></a><a name="id2615578"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2615582"></a>782 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id381809"></a><a name="id381811"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id381814"></a> 783 783 Is it mandatory to set share ACLs to get a secure Samba-3 server? 784 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id 2615597"></a><a class="indexterm" name="id2615605"></a><a class="indexterm" name="id2615613"></a><a class="indexterm" name="id2615622"></a><a class="indexterm" name="id2615630"></a>784 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id381829"></a><a class="indexterm" name="id381837"></a><a class="indexterm" name="id381845"></a><a class="indexterm" name="id381853"></a><a class="indexterm" name="id381861"></a> 785 785 No. Samba-3 honors UNIX/Linux file system security, supports Windows 200x ACLs, and provides 786 786 means of securing shares through share definition controls in the <code class="filename">smb.conf</code> file. The additional 787 787 support for share-level ACLs is like frosting on the cake. It adds to security but is not essential 788 788 to it. 789 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2615653"></a><a name="id2615655"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2615658"></a>789 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id381882"></a><a name="id381884"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id381887"></a> 790 790 The <em class="parameter"><code>valid users</code></em> did not work on the <em class="parameter"><code>[homes]</code></em>. 791 791 Has this functionality been restored yet? 792 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id 2615686"></a>792 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id381914"></a> 793 793 Yes. This was fixed in Samba-3.0.2. The use of this parameter is strongly recommended as a safeguard 794 794 on the <em class="parameter"><code>[homes]</code></em> meta-service. The correct way to specify this is: 795 795 <a class="link" href="smb.conf.5.html#VALIDUSERS" target="_top">valid users = %S</a>. 796 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2615719"></a><a name="id2615721"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2615724"></a><a class="indexterm" name="id2615732"></a><a class="indexterm" name="id2615740"></a>796 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id381944"></a><a name="id381947"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id381950"></a><a class="indexterm" name="id381958"></a><a class="indexterm" name="id381966"></a> 797 797 Is the bias against use of the <em class="parameter"><code>force user</code></em> and <em class="parameter"><code>force group</code></em> 798 798 really warranted? 799 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id 2615767"></a>799 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id381992"></a> 800 800 There is no bias. There is a determination to recommend the right tool for the task at hand. 801 801 After all, it is better than putting users through performance problems, isn't it? 802 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2615782"></a><a name="id2615784"></a></td><td align="left" valign="top"><p>802 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id382006"></a><a name="id382008"></a></td><td align="left" valign="top"><p> 803 803 The example given for file and directory access control forces all files to be owned by one 804 804 particular user. I do not like that. Is there any way I can see who created the file? 805 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id 2615797"></a>805 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id382019"></a> 806 806 Sure. You do not have to set the SUID bit on the directory. Simply execute the following command 807 807 to permit file ownership to be retained by the user who created it: … … 811 811 Note that this required no more than removing the <code class="constant">u</code> argument so that the 812 812 SUID bit is not set for the owner. 813 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2615830"></a><a name="id2615832"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2615835"></a>814 In the book, “<span class="quote">The Official Samba-3 HOWTO and Reference Guide</span>”, you recommended use813 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id382050"></a><a name="id382052"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id382055"></a> 814 In the book, <span class="quote">“<span class="quote">The Official Samba-3 HOWTO and Reference Guide</span>”</span>, you recommended use 815 815 of the Windows NT4 Server Manager (part of the <code class="filename">SRVTOOLS.EXE</code>) utility. Why 816 816 have you mentioned only the use of the Windows 200x/XP MMC Computer Management utility? 817 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id 2615863"></a><a class="indexterm" name="id2615870"></a>817 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id382081"></a><a class="indexterm" name="id382088"></a> 818 818 Either tool can be used with equal effect. There is no benefit of one over the other, except that 819 819 the MMC utility is present on all Windows 200x/XP systems and does not require additional software … … 821 821 Samba-controlled domain, the only tool that permits that is the NT4 Domain User Manager, which 822 822 is provided as part of the <code class="filename">SRVTOOLS.EXE</code> utility. 823 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2615896"></a><a name="id2615898"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2615902"></a><a class="indexterm" name="id2615909"></a><a class="indexterm" name="id2615917"></a>823 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id382110"></a><a name="id382112"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id382116"></a><a class="indexterm" name="id382123"></a><a class="indexterm" name="id382130"></a> 824 824 I tried to set <em class="parameter"><code>valid users = @Engineers</code></em>, but it does not work. My Samba 825 825 server is an Active Directory domain member server. Has this been fixed now? … … 827 827 The use of this parameter has always required the full specification of the domain account, for 828 828 example, <em class="parameter"><code>valid users = @"MEGANET2\Domain Admins"</code></em>. 829 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id 2610604" href="#id2610604" class="para">12</a>] </sup>This report is entirely fictitious.830 Any resemblance to a factual report is purely coincidental.</p></div><div class="footnote"><p><sup>[<a name="ftn.id 2613014" href="#id2613014" class="para">13</a>] </sup>Note: This link is no longer active. The same article is still829 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id377221" href="#id377221" class="para">12</a>] </sup>This report is entirely fictitious. 830 Any resemblance to a factual report is purely coincidental.</p></div><div class="footnote"><p><sup>[<a name="ftn.id379447" href="#id379447" class="para">13</a>] </sup>Note: This link is no longer active. The same article is still 831 831 available from <a class="ulink" href="http://199.105.191.226/Man/2699/020430msdoj/" target="_top">ITWorld.com</a> (July 5, 2005)</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="RefSection.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="RefSection.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="DomApps.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Part III. Reference Section </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 12. Integrating Additional Services</td></tr></table></div></body></html> -
trunk/server/docs/htmldocs/Samba3-ByExample/net2000users.html
r414 r599 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 6. A Distributed 2000-User Network</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 4.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="happy.html" title="Chapter 5. Making Happy Users"><link rel="next" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 6. A Distributed 2000-User Network</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="happy.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="DMSMig.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="net2000users"></a>Chapter 6. A Distributed 2000-User Network</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="net2000users.html#id2583726">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id2583756">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id2583824">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id2584098">Technical Issues</a></span></dt><dt><span class="sect2"><a href="net2000users.html#id2585046">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id2585064">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id2588223">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id2588370">Questions and Answers</a></span></dt></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 6. A Distributed 2000-User Network</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="happy.html" title="Chapter 5. Making Happy Users"><link rel="next" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 6. A Distributed 2000-User Network</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="happy.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="DMSMig.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 6. A Distributed 2000-User Network"><div class="titlepage"><div><div><h2 class="title"><a name="net2000users"></a>Chapter 6. A Distributed 2000-User Network</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="net2000users.html#id352846">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id352871">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id352928">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id353175">Technical Issues</a></span></dt><dt><span class="sect2"><a href="net2000users.html#id353997">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id354011">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="net2000users.html#id357027">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="net2000users.html#id357166">Questions and Answers</a></span></dt></dl></div><p> 2 2 There is something indeed mystical about things that are 3 3 big. Large networks exhibit a certain magnetism and exude a sense of … … 31 31 specifics of implementing LDAP changes, Samba changes, and approach and 32 32 design of the solution and its deployment. 33 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2583726"></a>Introduction</h2></div></div></div><p>33 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id352846"></a>Introduction</h2></div></div></div><p> 34 34 Abmas is a miracle company. Most businesses would have collapsed under 35 35 the weight of rapid expansion that this company has experienced. Samba … … 40 40 Samba server just to change the way your network should function. 41 41 </p><p> 42 <a class="indexterm" name="id 2583745"></a>42 <a class="indexterm" name="id352861"></a> 43 43 Network growth is common to all organizations. In this exercise, 44 44 your preoccupation is with the mechanics of implementing Samba and 45 45 LDAP so that network users on each network segment can work 46 46 without impediment. 47 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2583756"></a>Assignment Tasks</h3></div></div></div><p>47 </p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id352871"></a>Assignment Tasks</h3></div></div></div><p> 48 48 Starting with the configuration files for the server called 49 49 <code class="constant">MASSIVE</code> in <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>, you now deal with the … … 52 52 alternatives, and then design and implement a solution. 53 53 </p><p> 54 <a class="indexterm" name="id 2583784"></a>54 <a class="indexterm" name="id352896"></a> 55 55 Remember, you have users based in London (UK), Los Angeles, 56 56 Washington. DC, and, three buildings in New York. A significant portion … … 73 73 DirectPointe. Your concern is server maintenance and third-level 74 74 support. Build a plan and show what must be done. 75 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2583824"></a>Dissection and Discussion</h2></div></div></div><p>76 <a class="indexterm" name="id 2583832"></a>77 <a class="indexterm" name="id 2583839"></a>75 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id352928"></a>Dissection and Discussion</h2></div></div></div><p> 76 <a class="indexterm" name="id352936"></a> 77 <a class="indexterm" name="id352942"></a> 78 78 In <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>, you implemented an LDAP server that provided the 79 79 <em class="parameter"><code>passdb backend</code></em> for the Samba servers. You … … 81 81 took control of network performance. 82 82 </p><p> 83 <a class="indexterm" name="id 2583864"></a>84 <a class="indexterm" name="id 2583871"></a>85 <a class="indexterm" name="id 2583878"></a>86 <a class="indexterm" name="id 2583884"></a>83 <a class="indexterm" name="id352966"></a> 84 <a class="indexterm" name="id352972"></a> 85 <a class="indexterm" name="id352979"></a> 86 <a class="indexterm" name="id352986"></a> 87 87 The implementation of an LDAP-based passdb backend (known as 88 88 <span class="emphasis"><em>ldapsam</em></span> in Samba parlance), or some form of database … … 97 97 managers. 98 98 </p><p> 99 <a class="indexterm" name="id 2583924"></a>100 <a class="indexterm" name="id 2583931"></a>99 <a class="indexterm" name="id353021"></a> 100 <a class="indexterm" name="id353028"></a> 101 101 The new <span class="emphasis"><em>tdbsam</em></span> facility supports functionality 102 102 that is similar to an <span class="emphasis"><em>ldapsam</em></span>, but the lack of … … 106 106 backend? Is support for these tools broken? Answers to these 107 107 questions require a bit of background.</p><p> 108 <a class="indexterm" name="id 2583954"></a>109 <a class="indexterm" name="id 2583961"></a>110 <a class="indexterm" name="id 2583968"></a>111 <a class="indexterm" name="id 2583975"></a>108 <a class="indexterm" name="id353049"></a> 109 <a class="indexterm" name="id353055"></a> 110 <a class="indexterm" name="id353062"></a> 111 <a class="indexterm" name="id353069"></a> 112 112 <span class="emphasis"><em>What is a directory?</em></span> A directory is a 113 113 collection of information regarding objects that can be accessed to … … 117 117 information is organized to facilitate read access rather than to 118 118 support transaction processing.</p><p> 119 <a class="indexterm" name="id 2583995"></a>120 <a class="indexterm" name="id 2584005"></a>121 <a class="indexterm" name="id 2584012"></a>122 <a class="indexterm" name="id 2584019"></a>119 <a class="indexterm" name="id353086"></a> 120 <a class="indexterm" name="id353095"></a> 121 <a class="indexterm" name="id353102"></a> 122 <a class="indexterm" name="id353109"></a> 123 123 The Lightweight Directory Access Protocol (LDAP) differs 124 124 considerably from a traditional database. It has a simple search … … 127 127 the data repository and for keeping all copies (slaves) in sync with 128 128 the master repository.</p><p> 129 <a class="indexterm" name="id 2584035"></a>130 <a class="indexterm" name="id 2584042"></a>131 <a class="indexterm" name="id 2584049"></a>129 <a class="indexterm" name="id353122"></a> 130 <a class="indexterm" name="id353129"></a> 131 <a class="indexterm" name="id353135"></a> 132 132 Samba is a flexible and powerful file and print sharing 133 133 technology. It can use many external authentication sources and can be … … 137 137 avoid the proprietary implications of Microsoft Active Directory 138 138 naturally gravitate toward OpenLDAP.</p><p> 139 <a class="indexterm" name="id 2584066"></a>139 <a class="indexterm" name="id353149"></a> 140 140 In <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>, you had to deal with a locally routed 141 141 network. All deployment concerns focused around making users happy, … … 148 148 access information globally. And you must make the network robust 149 149 enough so that it can sustain partial breakdown without causing loss of 150 productivity.</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2584098"></a>Technical Issues</h3></div></div></div><p>150 productivity.</p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id353175"></a>Technical Issues</h3></div></div></div><p> 151 151 There are at least three areas that need to be addressed as you 152 152 approach the challenge of designing a network solution for the newly 153 153 expanded business: 154 </p><div class="itemizedlist"><ul type="disc"><li><p><a class="indexterm" name="id2584114"></a>155 User needs such as mobility and data access</p></li><li ><p>The nature of Windows networking protocols</p></li><li><p>Identity management infrastructure needs</p></li></ul></div><p>Let's look at each in turn.</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2584137"></a>User Needs</h4></div></div></div><p>154 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p><a class="indexterm" name="id353189"></a> 155 User needs such as mobility and data access</p></li><li class="listitem"><p>The nature of Windows networking protocols</p></li><li class="listitem"><p>Identity management infrastructure needs</p></li></ul></div><p>Let's look at each in turn.</p><div class="sect3" title="User Needs"><div class="titlepage"><div><div><h4 class="title"><a name="id353212"></a>User Needs</h4></div></div></div><p> 156 156 The new company has three divisions. Staff for each division are spread across 157 157 the company. Some staff are office-bound and some are mobile users. Mobile … … 164 164 off for reasons outside the scope of this discussion. 165 165 </p><p> 166 <a class="indexterm" name="id 2584162"></a>166 <a class="indexterm" name="id353231"></a> 167 167 Decisions must be made regarding where data is to be stored, how it will be 168 168 replicated (if at all), and what the network bandwidth implications are. For … … 175 175 to the network. 176 176 </p><p> 177 <a class="indexterm" name="id 2584188"></a>178 <a class="indexterm" name="id 2584198"></a>177 <a class="indexterm" name="id353252"></a> 178 <a class="indexterm" name="id353262"></a> 179 179 No matter which way you look at this, the bandwidth requirements 180 180 for acceptable performance are substantial even if only 10 percent of … … 189 189 server to and from the client. 190 190 </p><p> 191 <a class="indexterm" name="id 2584219"></a>191 <a class="indexterm" name="id353277"></a> 192 192 Obviously then, user needs and wide-area practicalities dictate the economic and 193 193 technical aspects of your network design as well as for standard operating procedures. 194 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2584231"></a>The Nature of Windows Networking Protocols</h4></div></div></div><p>195 <a class="indexterm" name="id 2584239"></a>194 </p></div><div class="sect3" title="The Nature of Windows Networking Protocols"><div class="titlepage"><div><div><h4 class="title"><a name="id353288"></a>The Nature of Windows Networking Protocols</h4></div></div></div><p> 195 <a class="indexterm" name="id353296"></a> 196 196 Network logons that include roaming profile handling requires from 140 KB to 2 MB. 197 197 The inclusion of support for a minimal set of common desktop applications can push … … 201 201 part of a total service-level assurance program that might be implemented. 202 202 </p><p> 203 <a class="indexterm" name="id 2584260"></a>204 <a class="indexterm" name="id 2584267"></a>203 <a class="indexterm" name="id353312"></a> 204 <a class="indexterm" name="id353319"></a> 205 205 One way to reduce the network bandwidth impact of user logon 206 206 traffic is through folder redirection. In <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>, you … … 211 211 logon or logout. Redirected folders are analogous to network drive 212 212 connections. 213 </p><p><a class="indexterm" name="id 2584294"></a>213 </p><p><a class="indexterm" name="id353343"></a> 214 214 Of course, network applications should only be run off 215 215 local application servers. As a general rule, even with 2 Mb/sec … … 218 218 server that is located in New York. 219 219 </p><p> 220 <a class="indexterm" name="id 2584310"></a>220 <a class="indexterm" name="id353356"></a> 221 221 When network bandwidth becomes a precious commodity (that is most 222 222 of the time), there is a significant demand to understand network … … 226 226 When a Windows NT4/200x/XP Professional client user logs onto 227 227 the network, several important things must happen. 228 </p><div class="itemizedlist"><ul type="disc"><li><p>229 <a class="indexterm" name="id 2584332"></a>228 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 229 <a class="indexterm" name="id353375"></a> 230 230 The client obtains an IP address via DHCP. (DHCP is 231 231 necessary so that users can roam between offices.) 232 </p></li><li ><p>233 <a class="indexterm" name="id 2584345"></a>234 <a class="indexterm" name="id 2584352"></a>232 </p></li><li class="listitem"><p> 233 <a class="indexterm" name="id353387"></a> 234 <a class="indexterm" name="id353394"></a> 235 235 The client must register itself with the WINS and/or DNS server. 236 </p></li><li ><p>237 <a class="indexterm" name="id 2584364"></a>236 </p></li><li class="listitem"><p> 237 <a class="indexterm" name="id353406"></a> 238 238 The client must locate the closest domain controller. 239 </p></li><li ><p>239 </p></li><li class="listitem"><p> 240 240 The client must log onto a domain controller and obtain as part of 241 241 that process the location of the user's profile, load it, connect to 242 242 redirected folders, and establish all network drive and printer connections. 243 </p></li><li ><p>243 </p></li><li class="listitem"><p> 244 244 The domain controller must be able to resolve the user's 245 245 credentials before the logon process is fully implemented. … … 257 257 at the WINS server. 258 258 </p><p> 259 <a class="indexterm" name="id 2584411"></a>260 <a class="indexterm" name="id 2584418"></a><a class="indexterm" name="id2584427"></a>259 <a class="indexterm" name="id353444"></a> 260 <a class="indexterm" name="id353450"></a><a class="indexterm" name="id353460"></a> 261 261 Given that the client is already a domain member, it then sends 262 262 a directed (Unicast) request to the WINS server seeking the list of 263 263 IP addresses for domain controllers (NetBIOS name type 0x1C). The 264 264 WINS server replies with the information requested.</p><p> 265 <a class="indexterm" name="id 2584442"></a>266 <a class="indexterm" name="id 2584451"></a>267 <a class="indexterm" name="id 2584458"></a>265 <a class="indexterm" name="id353472"></a> 266 <a class="indexterm" name="id353481"></a> 267 <a class="indexterm" name="id353488"></a> 268 268 The client sends two netlogon mailslot broadcast requests 269 269 to the local network and to each of the IP addresses returned by … … 275 275 domain controllers. 276 276 </p><p> 277 <a class="indexterm" name="id 2584476"></a>278 <a class="indexterm" name="id 2584485"></a>279 <a class="indexterm" name="id 2584492"></a>277 <a class="indexterm" name="id353502"></a> 278 <a class="indexterm" name="id353511"></a> 279 <a class="indexterm" name="id353518"></a> 280 280 The logon process begins with negotiation of the SMB/CIFS 281 281 protocols that are to be used; this is followed by an exchange of … … 288 288 local domain controllers fail or break? 289 289 </p><p> 290 <a class="indexterm" name="id 2584511"></a>291 <a class="indexterm" name="id 2584518"></a>292 <a class="indexterm" name="id 2584525"></a>293 <a class="indexterm" name="id 2584531"></a>290 <a class="indexterm" name="id353533"></a> 291 <a class="indexterm" name="id353540"></a> 292 <a class="indexterm" name="id353546"></a> 293 <a class="indexterm" name="id353553"></a> 294 294 Under most circumstances, the nearest domain controller 295 295 responds to the netlogon mailslot broadcast. The exception to this … … 300 300 domain controllers are by definition BDCs. 301 301 </p><p> 302 <a class="indexterm" name="id 2584549"></a>303 <a class="indexterm" name="id 2584556"></a>302 <a class="indexterm" name="id353566"></a> 303 <a class="indexterm" name="id353573"></a> 304 304 The provision of sufficient servers that are BDCs is an 305 305 important design factor. The second important design factor … … 307 307 data. That is the subject of the next section, which involves key 308 308 decisions regarding Identity Management facilities. 309 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2584570"></a>Identity Management Needs</h4></div></div></div><p>310 <a class="indexterm" name="id 2584578"></a>311 <a class="indexterm" name="id 2584584"></a>312 <a class="indexterm" name="id 2584591"></a>313 <a class="indexterm" name="id 2584598"></a>309 </p></div><div class="sect3" title="Identity Management Needs"><div class="titlepage"><div><div><h4 class="title"><a name="id353585"></a>Identity Management Needs</h4></div></div></div><p> 310 <a class="indexterm" name="id353593"></a> 311 <a class="indexterm" name="id353600"></a> 312 <a class="indexterm" name="id353606"></a> 313 <a class="indexterm" name="id353613"></a> 314 314 Network managers recognize that in large organizations users 315 315 generally need to be given resource access based on needs, while … … 320 320 rights and privileges are allocated. 321 321 </p><p> 322 <a class="indexterm" name="id 2584616"></a>323 <a class="indexterm" name="id 2584622"></a>324 <a class="indexterm" name="id 2584629"></a>322 <a class="indexterm" name="id353627"></a> 323 <a class="indexterm" name="id353634"></a> 324 <a class="indexterm" name="id353640"></a> 325 325 Unfortunately, network resources tend to have their own Identity 326 326 Management facilities, the quality and manageability of which varies … … 334 334 as <code class="constant">Network Information System</code> (NIS). 335 335 </p><p> 336 <a class="indexterm" name="id 2584660"></a>336 <a class="indexterm" name="id353666"></a> 337 337 NIS gained a strong following throughout the UNIX/VMS space in a short 338 338 period of time and retained that appeal and use for over a decade. … … 344 344 other information systems is catching on. 345 345 </p><p> 346 <a class="indexterm" name="id 2584679"></a>347 <a class="indexterm" name="id 2584686"></a>348 <a class="indexterm" name="id 2584693"></a>346 <a class="indexterm" name="id353681"></a> 347 <a class="indexterm" name="id353687"></a> 348 <a class="indexterm" name="id353694"></a> 349 349 Nevertheless, both NIS and NIS+ continue to hold ground in 350 350 business areas where UNIX still has major sway. Examples of … … 354 354 focus. 355 355 </p><p> 356 <a class="indexterm" name="id 2584708"></a>357 <a class="indexterm" name="id 2584715"></a>356 <a class="indexterm" name="id353707"></a> 357 <a class="indexterm" name="id353714"></a> 358 358 Today's networking world needs a scalable, distributed Identity 359 359 Management infrastructure, commonly called a directory. The most … … 361 361 and a number of LDAP implementations. 362 362 </p><p> 363 <a class="indexterm" name="id 2584729"></a>363 <a class="indexterm" name="id353726"></a> 364 364 The problem of managing multiple directories has become a focal 365 365 point over the past decade, creating a large market for … … 370 370 having to remember and deal with fewer login identities and 371 371 passwords.</p><p> 372 <a class="indexterm" name="id 2584747"></a>372 <a class="indexterm" name="id353740"></a> 373 373 The challenge of every large network is to find the optimum 374 374 balance of internal systems and facilities for Identity … … 376 376 implemented has potentially significant impact on network bandwidth 377 377 and systems response needs.</p><p> 378 <a class="indexterm" name="id 2584764"></a>379 <a class="indexterm" name="id 2584771"></a>380 <a class="indexterm" name="id 2584780"></a>378 <a class="indexterm" name="id353754"></a> 379 <a class="indexterm" name="id353761"></a> 380 <a class="indexterm" name="id353770"></a> 381 381 In <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>, you implemented a single LDAP server for the 382 382 entire network. This may work for smaller networks, but almost … … 387 387 servers within the context of a distributed 2,000-user network is a 388 388 question that remains to be answered.</p><p> 389 <a class="indexterm" name="id 2584809"></a>390 <a class="indexterm" name="id 2584816"></a>389 <a class="indexterm" name="id353796"></a> 390 <a class="indexterm" name="id353803"></a> 391 391 One possibility that has great appeal is to create a single, 392 392 large distributed domain. The practical implications of this … … 399 399 maintenance. 400 400 </p><p> 401 <a class="indexterm" name="id 2584847"></a>401 <a class="indexterm" name="id353826"></a> 402 402 The network design in <a class="link" href="net2000users.html#chap7net2" title="Figure 6.7. Network Topology 2000 User Complex Design B">“Network Topology 2000 User Complex Design B”</a> takes the approach 403 403 that management of networks that are too remote to be managed … … 410 410 in how they may access global resources. 411 411 </p><p> 412 <a class="indexterm" name="id 2584873"></a>412 <a class="indexterm" name="id353848"></a> 413 413 Desk-bound users need not be negatively affected by this design, since 414 414 the use of interdomain trusts can be used to satisfy the need for global 415 415 data sharing. 416 416 </p><p> 417 <a class="indexterm" name="id 2584886"></a>418 <a class="indexterm" name="id 2584892"></a>419 <a class="indexterm" name="id 2584902"></a>417 <a class="indexterm" name="id353859"></a> 418 <a class="indexterm" name="id353866"></a> 419 <a class="indexterm" name="id353875"></a> 420 420 When Samba-3 is configured to use an LDAP backend, it stores the domain 421 421 account information in a directory entry. This account entry contains the … … 423 423 possible to operate with more than one PDC on a distributed network. 424 424 </p><p> 425 <a class="indexterm" name="id 2584916"></a>426 <a class="indexterm" name="id 2584923"></a>427 <a class="indexterm" name="id 2584930"></a>425 <a class="indexterm" name="id353887"></a> 426 <a class="indexterm" name="id353894"></a> 427 <a class="indexterm" name="id353901"></a> 428 428 How might this peculiar feature be exploited? The answer is simple. It is 429 429 imperative that each network segment have its own WINS server. Major … … 435 435 single LDAP backend, users have unfettered ability to roam. 436 436 </p><p> 437 <a class="indexterm" name="id 2584955"></a>438 <a class="indexterm" name="id 2584964"></a>437 <a class="indexterm" name="id353921"></a> 438 <a class="indexterm" name="id353930"></a> 439 439 This concept has not been exhaustively validated, though we can see no reason 440 440 why this should not work. The important facets are the following: The name of … … 447 447 that are in fact slave LDAP servers on the local segments. 448 448 </p><p> 449 <a class="indexterm" name="id 2584986"></a>450 <a class="indexterm" name="id 2584995"></a>451 <a class="indexterm" name="id 2585002"></a>452 <a class="indexterm" name="id 2585011"></a>449 <a class="indexterm" name="id353946"></a> 450 <a class="indexterm" name="id353956"></a> 451 <a class="indexterm" name="id353962"></a> 452 <a class="indexterm" name="id353972"></a> 453 453 With a single master LDAP server, all network updates are effected on a single 454 454 server. In the event that this should become excessively fragile or network … … 464 464 procedures for managing the directory, because retroactive correction of 465 465 inconsistent directory information can be exceedingly difficult. 466 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2585046"></a>Political Issues</h3></div></div></div><p>466 </p></div></div><div class="sect2" title="Political Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id353997"></a>Political Issues</h3></div></div></div><p> 467 467 As organizations grow, the number of points of control increases 468 468 also. In a large distributed organization, it is important that the … … 472 472 minutes rather than days (the old limitation of highly manual 473 473 systems). 474 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2585064"></a>Implementation</h2></div></div></div><p>475 <a class="indexterm" name="id 2585071"></a>476 <a class="indexterm" name="id 2585078"></a>477 <a class="indexterm" name="id 2585085"></a>478 <a class="indexterm" name="id 2585092"></a>474 </p></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id354011"></a>Implementation</h2></div></div></div><p> 475 <a class="indexterm" name="id354019"></a> 476 <a class="indexterm" name="id354026"></a> 477 <a class="indexterm" name="id354032"></a> 478 <a class="indexterm" name="id354039"></a> 479 479 Samba-3 has the ability to use multiple password (authentication and 480 480 identity resolution) backends. The diagram in <a class="link" href="net2000users.html#chap7idres" title="Figure 6.1. Samba and Authentication Backend Search Pathways">“Samba and Authentication Backend Search Pathways”</a> … … 484 484 using the specific systems shown. 485 485 </p><div class="figure"><a name="chap7idres"></a><p class="title"><b>Figure 6.1. Samba and Authentication Backend Search Pathways</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap7-idresol.png" width="297" alt="Samba and Authentication Backend Search Pathways"></div></div></div><br class="figure-break"><p> 486 <a class="indexterm" name="id 2585156"></a>487 <a class="indexterm" name="id 2585163"></a>488 <a class="indexterm" name="id 2585170"></a>489 <a class="indexterm" name="id 2585177"></a>490 <a class="indexterm" name="id 2585183"></a>491 <a class="indexterm" name="id 2585190"></a>492 <a class="indexterm" name="id 2585197"></a>486 <a class="indexterm" name="id354099"></a> 487 <a class="indexterm" name="id354106"></a> 488 <a class="indexterm" name="id354113"></a> 489 <a class="indexterm" name="id354120"></a> 490 <a class="indexterm" name="id354126"></a> 491 <a class="indexterm" name="id354133"></a> 492 <a class="indexterm" name="id354140"></a> 493 493 Samba is capable of using the <code class="constant">smbpasswd</code>, 494 494 <code class="constant">tdbsam</code>, <code class="constant">xmlsam</code>, … … 498 498 operations. 499 499 </p><p> 500 <a class="indexterm" name="id 2585225"></a>500 <a class="indexterm" name="id354166"></a> 501 501 Additionally, it is possible to use multiple passdb backends 502 502 concurrently as well as have multiple LDAP backends. As a result, you … … 510 510 This configuration tells Samba to use a single LDAP server, as shown in <a class="link" href="net2000users.html#ch7singleLDAP" title="Figure 6.2. Samba Configuration to Use a Single LDAP Server">“Samba Configuration to Use a Single LDAP Server”</a>. 511 511 </p><div class="figure"><a name="ch7singleLDAP"></a><p class="title"><b>Figure 6.2. Samba Configuration to Use a Single LDAP Server</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/ch7-singleLDAP.png" width="351" alt="Samba Configuration to Use a Single LDAP Server"></div></div></div><p><br class="figure-break"> 512 <a class="indexterm" name="id 2585298"></a>513 <a class="indexterm" name="id 2585308"></a>512 <a class="indexterm" name="id354234"></a> 513 <a class="indexterm" name="id354244"></a> 514 514 The addition of a failover LDAP server can simply be done by adding a 515 515 second entry for the failover server to the single <em class="parameter"><code>ldapsam</code></em> … … 533 533 ... 534 534 </pre><p> 535 <a class="indexterm" name="id 2585394"></a>535 <a class="indexterm" name="id354323"></a> 536 536 The effect of this style of entry is that Samba lists the users 537 537 that are in both LDAP databases. If both contain the same information, … … 544 544 into one seemingly contiguous directory. Only the first database will be updated. 545 545 An example of this configuration is shown in <a class="link" href="net2000users.html#ch7dualok" title="Figure 6.5. Samba Configuration to Use Two LDAP Databases - The result is additive.">“Samba Configuration to Use Two LDAP Databases - The result is additive.”</a>. 546 </p><div class="figure"><a name="ch7dualok"></a><p class="title"><b>Figure 6.5. Samba Configuration to Use Two LDAP Databases - The result is additive.</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/ch7-dual-additive-LDAP-Ok.png" width="297" alt="Samba Configuration to Use Two LDAP Databases - The result is additive."></div></div></div><br class="figure-break"><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>546 </p><div class="figure"><a name="ch7dualok"></a><p class="title"><b>Figure 6.5. Samba Configuration to Use Two LDAP Databases - The result is additive.</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/ch7-dual-additive-LDAP-Ok.png" width="297" alt="Samba Configuration to Use Two LDAP Databases - The result is additive."></div></div></div><br class="figure-break"><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 547 547 When the use of ldapsam is specified twice, as shown here, it is imperative 548 548 that the two LDAP directories must be disjoint. If the entries are for a … … 554 554 pattern similar to what was covered in <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>. The following steps 555 555 permit the operation of a master/slave OpenLDAP arrangement. 556 </p><div class="procedure" ><a name="id2585536"></a><p class="title"><b>Procedure 6.1. Implementation Steps for an LDAP Slave Server</b></p><ol type="1"><li><p>557 <a class="indexterm" name="id 2585548"></a>558 <a class="indexterm" name="id 2585555"></a>556 </p><div class="procedure" title="Procedure 6.1. Implementation Steps for an LDAP Slave Server"><a name="id354454"></a><p class="title"><b>Procedure 6.1. Implementation Steps for an LDAP Slave Server</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 557 <a class="indexterm" name="id354465"></a> 558 <a class="indexterm" name="id354472"></a> 559 559 Log onto the master LDAP server as <code class="constant">root</code>. 560 560 You are about to change the configuration of the LDAP server, so it … … 568 568 <code class="prompt">root# </code> service ldap stop 569 569 </pre><p> 570 </p></li><li ><p>571 <a class="indexterm" name="id 2585600"></a>570 </p></li><li class="step" title="Step 2"><p> 571 <a class="indexterm" name="id354514"></a> 572 572 Edit the <code class="filename">/etc/openldap/slapd.conf</code> file so it 573 573 matches the content of <a class="link" href="net2000users.html#ch7-LDAP-master" title="Example 6.1. LDAP Master Server Configuration File /etc/openldap/slapd.conf">“LDAP Master Server Configuration File /etc/openldap/slapd.conf”</a>. 574 </p></li><li ><p>574 </p></li><li class="step" title="Step 3"><p> 575 575 Create a file called <code class="filename">admin-accts.ldif</code> with the following contents: 576 576 </p><pre class="screen"> … … 587 587 userPassword: buttercup 588 588 </pre><p> 589 </p></li><li ><p>590 Add an account called “<span class="quote">updateuser</span>”to the master LDAP server as shown here:589 </p></li><li class="step" title="Step 4"><p> 590 Add an account called <span class="quote">“<span class="quote">updateuser</span>”</span> to the master LDAP server as shown here: 591 591 </p><pre class="screen"> 592 592 <code class="prompt">root# </code> slapadd -v -l admin-accts.ldif 593 593 </pre><p> 594 </p></li><li ><p>595 <a class="indexterm" name="id 2585673"></a>596 <a class="indexterm" name="id 2585680"></a>594 </p></li><li class="step" title="Step 5"><p> 595 <a class="indexterm" name="id354583"></a> 596 <a class="indexterm" name="id354590"></a> 597 597 Change directory to a suitable place to dump the contents of the 598 598 LDAP server. The dump file (and LDIF file) is used to preload … … 602 602 </pre><p> 603 603 Each record is written to the file. 604 </p></li><li ><p>605 <a class="indexterm" name="id 2585712"></a>604 </p></li><li class="step" title="Step 6"><p> 605 <a class="indexterm" name="id354620"></a> 606 606 Copy the file <code class="filename">LDAP-transfer-LDIF.txt</code> to the intended 607 607 slave LDAP server. A good location could be in the directory 608 608 <code class="filename">/etc/openldap/preload</code>. 609 </p></li><li ><p>609 </p></li><li class="step" title="Step 7"><p> 610 610 Log onto the slave LDAP server as <code class="constant">root</code>. You can 611 611 now configure this server so the <code class="filename">/etc/openldap/slapd.conf</code> 612 612 file matches the content of <a class="link" href="net2000users.html#ch7-LDAP-slave" title="Example 6.2. LDAP Slave Configuration File /etc/openldap/slapd.conf">“LDAP Slave Configuration File /etc/openldap/slapd.conf”</a>. 613 </p></li><li ><p>613 </p></li><li class="step" title="Step 8"><p> 614 614 Change directory to the location in which you stored the 615 615 <code class="filename">LDAP-transfer-LDIF.txt</code> file (<code class="filename">/etc/openldap/preload</code>). … … 641 641 added: "cn=PIOps,ou=Groups,dc=abmas,dc=biz" (00000013) 642 642 </pre><p> 643 </p></li><li ><p>643 </p></li><li class="step" title="Step 9"><p> 644 644 Now start the LDAP server and set it to run automatically on system reboot by executing: 645 645 </p><pre class="screen"> … … 652 652 <code class="prompt">root# </code> chkconfig ldap on 653 653 </pre><p> 654 </p></li><li ><p>655 <a class="indexterm" name="id 2585885"></a>656 <a class="indexterm" name="id 2585892"></a>657 <a class="indexterm" name="id 2585899"></a>654 </p></li><li class="step" title="Step 10"><p> 655 <a class="indexterm" name="id354767"></a> 656 <a class="indexterm" name="id354774"></a> 657 <a class="indexterm" name="id354781"></a> 658 658 Go back to the master LDAP server. Execute the following to start LDAP as well 659 659 as <code class="literal">slurpd</code>, the synchronization daemon, as shown here: … … 664 664 <code class="prompt">root# </code> chkconfig slurpd on 665 665 </pre><p> 666 <a class="indexterm" name="id 2585944"></a>666 <a class="indexterm" name="id354824"></a> 667 667 On Red Hat Linux, check the equivalent command to start <code class="literal">slurpd</code>. 668 </p></li><li ><p>669 <a class="indexterm" name="id 2585965"></a>668 </p></li><li class="step" title="Step 11"><p> 669 <a class="indexterm" name="id354844"></a> 670 670 On the master LDAP server you may now add an account to validate that replication 671 671 is working. Assuming the configuration shown in <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>, execute: … … 673 673 <code class="prompt">root# </code> /var/lib/samba/sbin/smbldap-useradd -a fruitloop 674 674 </pre><p> 675 </p></li><li ><p>675 </p></li><li class="step" title="Step 12"><p> 676 676 On the slave LDAP server, change to the directory <code class="filename">/var/lib/ldap</code>. 677 677 There should now be a file called <code class="filename">replogfile</code>. If replication worked … … 697 697 - 698 698 </pre><p> 699 </p></li><li ><p>699 </p></li><li class="step" title="Step 13"><p> 700 700 Given that this first slave LDAP server is now working correctly, you may now 701 701 implement additional slave LDAP servers as required. 702 </p></li><li ><p>702 </p></li><li class="step" title="Step 14"><p> 703 703 On each machine (PDC and BDCs) after the respective <code class="filename">smb.conf</code> files have been created as shown in 704 704 <a class="link" href="net2000users.html#ch7-massmbconfA" title="Example 6.3. Primary Domain Controller smb.conf File Part A">Primary Domain Controller <code class="filename">smb.conf</code> File Part A + B + C</a> and … … 792 792 index sambaDomainName eq 793 793 index default sub 794 </pre></div></div><br class="example-break"><div class="example"><a name="ch7-massmbconfA"></a><p class="title"><b>Example 6.3. Primary Domain Controller <code class="filename">smb.conf</code> File Part A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2586228"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id2586240"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id2586252"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2586264"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2586276"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2586288"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2586299"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2586311"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2586323"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2586335"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2586347"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2586358"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2586370"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2586383"></a><em class="parameter"><code>delete user script = /opt/IDEALX/sbin/smbldap-userdel '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2586395"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd -p '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2586408"></a><em class="parameter"><code>delete group script = /opt/IDEALX/sbin/smbldap-groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2586420"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/smbldap-groupmod -m '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2586433"></a><em class="parameter"><code>delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2586446"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2586459"></a><em class="parameter"><code>add machine script = /opt/IDEALX/sbin/smbldap-useradd -w '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2586471"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id2586484"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id2586496"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2586508"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2586520"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2586531"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2586543"></a><em class="parameter"><code>domain master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2586555"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2586567"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2586578"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2586590"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2586602"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2586614"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2586626"></a><em class="parameter"><code>ldap admin dn = cn=sambaadmin,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2586639"></a><em class="parameter"><code>idmap backend = ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2586651"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2586663"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2586674"></a><em class="parameter"><code>printer admin = root</code></em></td></tr><tr><td><a class="indexterm" name="id2586686"></a><em class="parameter"><code>printing = cups</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-massmbconfB"></a><p class="title"><b>Example 6.4. Primary Domain Controller <code class="filename">smb.conf</code> File Part B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[IPC$]</code></em></td></tr><tr><td><a class="indexterm" name="id2586732"></a><em class="parameter"><code>path = /tmp</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id2586752"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id2586764"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id2586776"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id2586796"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id2586808"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id2586820"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id2586840"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id2586852"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id2586864"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2586884"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2586896"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2586908"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2586919"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2586940"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2586951"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2586963"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2586975"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2586986"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-massmbconfC"></a><p class="title"><b>Example 6.5. Primary Domain Controller <code class="filename">smb.conf</code> File Part C</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id2587032"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id2587044"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id2587055"></a><em class="parameter"><code>admin users = bjones</code></em></td></tr><tr><td><a class="indexterm" name="id2587067"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2587087"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2587099"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2587111"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id2587123"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2587135"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2587155"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2587167"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2587179"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2587190"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id2587211"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id2587223"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id2587235"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2587246"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id2587267"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2587279"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2587291"></a><em class="parameter"><code>write list = root</code></em></td></tr><tr><td><a class="indexterm" name="id2587302"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-slvsmbocnfA"></a><p class="title"><b>Example 6.6. Backup Domain Controller <code class="filename">smb.conf</code> File Part A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># # Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2587352"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id2587363"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id2587375"></a><em class="parameter"><code>netbios name = BLDG1</code></em></td></tr><tr><td><a class="indexterm" name="id2587387"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://lapdc.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2587399"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2587411"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2587423"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2587434"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2587446"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id2587458"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2587469"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2587481"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2587493"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2587505"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2587517"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2587529"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2587541"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2587553"></a><em class="parameter"><code>os level = 63</code></em></td></tr><tr><td><a class="indexterm" name="id2587564"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id2587576"></a><em class="parameter"><code>wins server = 192.168.2.1</code></em></td></tr><tr><td><a class="indexterm" name="id2587588"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2587600"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2587612"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2587624"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2587636"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2587648"></a><em class="parameter"><code>ldap admin dn = cn=sambaadmin,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2587660"></a><em class="parameter"><code>utmp = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2587671"></a><em class="parameter"><code>idmap backend = ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2587683"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2587695"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2587707"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id2587727"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id2587739"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id2587751"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id2587771"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id2587783"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id2587795"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-slvsmbocnfB"></a><p class="title"><b>Example 6.7. Backup Domain Controller <code class="filename">smb.conf</code> File Part B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id2587841"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id2587853"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id2587864"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2587884"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2587896"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2587908"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2587919"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2587940"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2587952"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2587963"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2587975"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2587987"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id2588007"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id2588019"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id2588030"></a><em class="parameter"><code>admin users = bjones</code></em></td></tr><tr><td><a class="indexterm" name="id2588042"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2588063"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2588075"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2588086"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2588098"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2588119"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2588130"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2588142"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2588154"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id2588174"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id2588186"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id2588198"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2588210"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2588223"></a>Key Points Learned</h3></div></div></div><div class="itemizedlist"><ul type="disc"><li><p>795 <a class="indexterm" name="id 2588234"></a><a class="indexterm" name="id2588239"></a>794 </pre></div></div><br class="example-break"><div class="example"><a name="ch7-massmbconfA"></a><p class="title"><b>Example 6.3. Primary Domain Controller <code class="filename">smb.conf</code> File Part A</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id355074"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id355085"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id355097"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id355108"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id355120"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id355131"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id355143"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id355154"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id355166"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id355177"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id355189"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id355200"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id355212"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id355224"></a><em class="parameter"><code>delete user script = /opt/IDEALX/sbin/smbldap-userdel '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id355236"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd -p '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id355248"></a><em class="parameter"><code>delete group script = /opt/IDEALX/sbin/smbldap-groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id355259"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/smbldap-groupmod -m '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id355272"></a><em class="parameter"><code>delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id355284"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id355296"></a><em class="parameter"><code>add machine script = /opt/IDEALX/sbin/smbldap-useradd -w '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id355308"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id355319"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id355331"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id355343"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id355354"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id355366"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id355377"></a><em class="parameter"><code>domain master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id355389"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id355400"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id355412"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id355423"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id355435"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id355447"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id355458"></a><em class="parameter"><code>ldap admin dn = cn=sambaadmin,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id355470"></a><em class="parameter"><code>idmap backend = ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id355482"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id355493"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id355505"></a><em class="parameter"><code>printer admin = root</code></em></td></tr><tr><td><a class="indexterm" name="id355516"></a><em class="parameter"><code>printing = cups</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-massmbconfB"></a><p class="title"><b>Example 6.4. Primary Domain Controller <code class="filename">smb.conf</code> File Part B</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[IPC$]</code></em></td></tr><tr><td><a class="indexterm" name="id355561"></a><em class="parameter"><code>path = /tmp</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id355581"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id355593"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id355604"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id355625"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id355636"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id355648"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id355668"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id355680"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id355691"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id355712"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id355723"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id355735"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id355746"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id355767"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id355778"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id355790"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id355801"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id355813"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-massmbconfC"></a><p class="title"><b>Example 6.5. Primary Domain Controller <code class="filename">smb.conf</code> File Part C</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id355857"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id355869"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id355880"></a><em class="parameter"><code>admin users = bjones</code></em></td></tr><tr><td><a class="indexterm" name="id355892"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id355912"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id355924"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id355936"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id355947"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id355959"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id355979"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id355990"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id356002"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id356014"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id356034"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id356046"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id356057"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id356069"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id356089"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id356101"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id356112"></a><em class="parameter"><code>write list = root</code></em></td></tr><tr><td><a class="indexterm" name="id356124"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-slvsmbocnfA"></a><p class="title"><b>Example 6.6. Backup Domain Controller <code class="filename">smb.conf</code> File Part A</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># # Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id356172"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id356183"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id356195"></a><em class="parameter"><code>netbios name = BLDG1</code></em></td></tr><tr><td><a class="indexterm" name="id356206"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://lapdc.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id356218"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id356229"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id356241"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id356252"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id356264"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id356275"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id356287"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id356298"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id356310"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id356322"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id356333"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id356345"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id356356"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id356368"></a><em class="parameter"><code>os level = 63</code></em></td></tr><tr><td><a class="indexterm" name="id356379"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id356391"></a><em class="parameter"><code>wins server = 192.168.2.1</code></em></td></tr><tr><td><a class="indexterm" name="id356402"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id356414"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id356425"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id356437"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id356449"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id356460"></a><em class="parameter"><code>ldap admin dn = cn=sambaadmin,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id356472"></a><em class="parameter"><code>utmp = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id356483"></a><em class="parameter"><code>idmap backend = ldap://massive.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id356495"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id356507"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id356518"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id356538"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id356550"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id356562"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id356582"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id356594"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id356605"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch7-slvsmbocnfB"></a><p class="title"><b>Example 6.7. Backup Domain Controller <code class="filename">smb.conf</code> File Part B</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id356650"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id356661"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id356673"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id356693"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id356705"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id356716"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id356728"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id356748"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id356760"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id356771"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id356783"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id356794"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id356815"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id356826"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id356838"></a><em class="parameter"><code>admin users = bjones</code></em></td></tr><tr><td><a class="indexterm" name="id356849"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id356870"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id356881"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id356893"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id356904"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id356925"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id356936"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id356948"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id356959"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id356980"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id356991"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id357003"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id357014"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id357027"></a>Key Points Learned</h3></div></div></div><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 795 <a class="indexterm" name="id357038"></a><a class="indexterm" name="id357043"></a> 796 796 Where Samba-3 is used as a domain controller, the use of LDAP is an 797 797 essential component to permit the use of BDCs. 798 </p></li><li ><p>799 <a class="indexterm" name="id 2588252"></a>798 </p></li><li class="listitem"><p> 799 <a class="indexterm" name="id357055"></a> 800 800 Replication of the LDAP master server to create a network of BDCs 801 801 is an important mechanism for limiting WAN traffic. 802 </p></li><li ><p>802 </p></li><li class="listitem"><p> 803 803 Network administration presents many complex challenges, most of which 804 804 can be satisfied by good design but that also require sound communication 805 805 and unification of management practices. This can be highly challenging in 806 806 a large, globally distributed network. 807 </p></li><li ><p>807 </p></li><li class="listitem"><p> 808 808 Roaming profiles must be contained to the local network segment. Any 809 809 departure from this may clog wide-area arteries and slow legitimate network 810 810 traffic to a crawl. 811 </p></li></ul></div></div><div class="figure"><a name="chap7net"></a><p class="title"><b>Figure 6.6. Network Topology 2000 User Complex Design A</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap7-net-Ar.png" width="432" alt="Network Topology 2000 User Complex Design A"></div></div></div><br class="figure-break"><div class="figure"><a name="chap7net2"></a><p class="title"><b>Figure 6.7. Network Topology 2000 User Complex Design B</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap7-net2-Br.png" width="432" alt="Network Topology 2000 User Complex Design B"></div></div></div><br class="figure-break"></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2588370"></a>Questions and Answers</h2></div></div></div><p>811 </p></li></ul></div></div><div class="figure"><a name="chap7net"></a><p class="title"><b>Figure 6.6. Network Topology 2000 User Complex Design A</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap7-net-Ar.png" width="432" alt="Network Topology 2000 User Complex Design A"></div></div></div><br class="figure-break"><div class="figure"><a name="chap7net2"></a><p class="title"><b>Figure 6.7. Network Topology 2000 User Complex Design B</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap7-net2-Br.png" width="432" alt="Network Topology 2000 User Complex Design B"></div></div></div><br class="figure-break"></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id357166"></a>Questions and Answers</h2></div></div></div><p> 812 812 There is much rumor and misinformation regarding the use of MS Windows networking protocols. 813 813 These questions are just a few of those frequently asked. 814 </p><div class="qandaset" ><dl><dt> <a href="net2000users.html#id2588388">814 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id357176"></a><dl><dt> <a href="net2000users.html#id357182"> 815 815 816 816 817 817 Is it true that DHCP uses lots of WAN bandwidth? 818 </a></dt><dt> <a href="net2000users.html#id 2588523">818 </a></dt><dt> <a href="net2000users.html#id357303"> 819 819 820 820 821 821 How much background communication takes place between a master LDAP server and its slave LDAP servers? 822 </a></dt><dt> <a href="net2000users.html#id 2588584">822 </a></dt><dt> <a href="net2000users.html#id357360"> 823 823 LDAP has a database. Is LDAP not just a fancy database front end? 824 </a></dt><dt> <a href="net2000users.html#id 2588648">824 </a></dt><dt> <a href="net2000users.html#id357417"> 825 825 826 826 Can Active Directory obtain account information from an OpenLDAP server? 827 </a></dt><dt> <a href="net2000users.html#id 2588683">827 </a></dt><dt> <a href="net2000users.html#id357449"> 828 828 What are the parts of a roaming profile? How large is each part? 829 </a></dt><dt> <a href="net2000users.html#id 2588832">829 </a></dt><dt> <a href="net2000users.html#id357590"> 830 830 Can the My Documents folder be stored on a network drive? 831 </a></dt><dt> <a href="net2000users.html#id 2588880">831 </a></dt><dt> <a href="net2000users.html#id357635"> 832 832 833 833 834 834 835 835 How much WAN bandwidth does WINS consume? 836 </a></dt><dt> <a href="net2000users.html#id 2588964">836 </a></dt><dt> <a href="net2000users.html#id357712"> 837 837 How many BDCs should I have? What is the right number of Windows clients per server? 838 </a></dt><dt> <a href="net2000users.html#id 2589000">838 </a></dt><dt> <a href="net2000users.html#id357739"> 839 839 840 840 I've heard that you can store NIS accounts in LDAP. Is LDAP not just a smarter way to 841 841 run an NIS server? 842 </a></dt><dt> <a href="net2000users.html#id 2589034">842 </a></dt><dt> <a href="net2000users.html#id357770"> 843 843 Can I use NIS in place of LDAP? 844 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2588388"></a><a name="id2588390"></a></td><td align="left" valign="top"><p>845 <a class="indexterm" name="id 2588395"></a>846 <a class="indexterm" name="id 2588401"></a>844 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id357182"></a><a name="id357185"></a></td><td align="left" valign="top"><p> 845 <a class="indexterm" name="id357189"></a> 846 <a class="indexterm" name="id357196"></a> 847 847 Is it true that DHCP uses lots of WAN bandwidth? 848 848 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 849 <a class="indexterm" name="id 2588418"></a>850 <a class="indexterm" name="id 2588427"></a>851 <a class="indexterm" name="id 2588434"></a>849 <a class="indexterm" name="id357212"></a> 850 <a class="indexterm" name="id357221"></a> 851 <a class="indexterm" name="id357228"></a> 852 852 It is a smart practice to localize DHCP servers on each network segment. As a 853 853 rule, there should be two DHCP servers per network segment. This means that if … … 856 856 routers. This makes it possible to run fewer DHCP servers. 857 857 </p><p> 858 <a class="indexterm" name="id 2588453"></a>859 <a class="indexterm" name="id 2588462"></a>858 <a class="indexterm" name="id357244"></a> 859 <a class="indexterm" name="id357253"></a> 860 860 A DHCP network address request and confirmation usually results in about six UDP packets. 861 861 The packets are from 60 to 568 bytes in length. Let us consider a site that has 300 DHCP … … 875 875 From this can be seen that the traffic impact would be minimal. 876 876 </p><p> 877 <a class="indexterm" name="id 2588500"></a>878 <a class="indexterm" name="id 2588509"></a>877 <a class="indexterm" name="id357282"></a> 878 <a class="indexterm" name="id357291"></a> 879 879 Even when DHCP is configured to do DNS update (dynamic DNS) over a wide-area link, 880 880 the impact of the update is no more than the DHCP IP address renewal traffic and thus 881 881 still insignificant for most practical purposes. 882 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2588523"></a><a name="id2588525"></a></td><td align="left" valign="top"><p>883 <a class="indexterm" name="id 2588529"></a>884 <a class="indexterm" name="id 2588536"></a>882 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id357303"></a><a name="id357305"></a></td><td align="left" valign="top"><p> 883 <a class="indexterm" name="id357310"></a> 884 <a class="indexterm" name="id357317"></a> 885 885 How much background communication takes place between a master LDAP server and its slave LDAP servers? 886 886 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 887 <a class="indexterm" name="id 2588557"></a>887 <a class="indexterm" name="id357336"></a> 888 888 The process that controls the replication of data from the master LDAP server to the slave LDAP 889 889 servers is called <code class="literal">slurpd</code>. The <code class="literal">slurpd</code> remains nascent (quiet) 890 890 until an update must be propagated. The propagation traffic per LDAP slave to update (add/modify/delete) 891 891 two user accounts requires less than 10KB traffic. 892 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2588584"></a><a name="id2588586"></a></td><td align="left" valign="top"><p>892 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id357360"></a><a name="id357362"></a></td><td align="left" valign="top"><p> 893 893 LDAP has a database. Is LDAP not just a fancy database front end? 894 894 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 895 <a class="indexterm" name="id 2588598"></a>896 <a class="indexterm" name="id 2588605"></a>897 <a class="indexterm" name="id 2588614"></a>898 <a class="indexterm" name="id 2588620"></a>895 <a class="indexterm" name="id357374"></a> 896 <a class="indexterm" name="id357381"></a> 897 <a class="indexterm" name="id357390"></a> 898 <a class="indexterm" name="id357396"></a> 899 899 LDAP does store its data in a database of sorts. In fact, the LDAP backend is an application-specific 900 900 data storage system. This type of database is indexed so that records can be rapidly located, but the … … 905 905 An LDAP front end is a purpose-built tool that has a search orientation that is designed around specific 906 906 simple queries. The term <code class="constant">database</code> is heavily overloaded and thus much misunderstood. 907 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2588648"></a><a name="id2588650"></a></td><td align="left" valign="top"><p>908 <a class="indexterm" name="id 2588654"></a>907 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id357417"></a><a name="id357419"></a></td><td align="left" valign="top"><p> 908 <a class="indexterm" name="id357423"></a> 909 909 Can Active Directory obtain account information from an OpenLDAP server? 910 910 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 911 <a class="indexterm" name="id 2588669"></a>911 <a class="indexterm" name="id357437"></a> 912 912 No, at least not directly. It is possible to provision Active Directory from and/or to an OpenLDAP 913 913 database through use of a metadirectory server. Microsoft MMS (now called MIIS) can interface 914 914 to OpenLDAP using standard LDAP queries and updates. 915 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2588683"></a><a name="id2588685"></a></td><td align="left" valign="top"><p>915 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id357449"></a><a name="id357452"></a></td><td align="left" valign="top"><p> 916 916 What are the parts of a roaming profile? How large is each part? 917 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id 2588696"></a>917 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id357462"></a> 918 918 A roaming profile consists of 919 </p><div class="itemizedlist"><ul type="disc"><li><p>919 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 920 920 Desktop folders such as <code class="constant">Desktop</code>, <code class="constant">My Documents</code>, 921 921 <code class="constant">My Pictures</code>, <code class="constant">My Music</code>, <code class="constant">Internet Files</code>, … … 923 923 <code class="constant">Local Settings,</code> and more. See <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>, <a class="link" href="happy.html#XP-screen001" title="Figure 5.3. Windows XP Professional User Shared Folders">“Windows XP Professional User Shared Folders”</a>. 924 924 </p><p> 925 <a class="indexterm" name="id 2588757"></a>925 <a class="indexterm" name="id357521"></a> 926 926 Each of these can be anywhere from a few bytes to gigabytes in capacity. Fortunately, all 927 927 such folders can be redirected to network drive resources. See <a class="link" href="happy.html#redirfold" title="Configuration of Default Profile with Folder Redirection">“Configuration of Default Profile with Folder Redirection”</a> 928 928 for more information regarding folder redirection. 929 </p></li><li ><p>929 </p></li><li class="listitem"><p> 930 930 A static or rewritable portion that is typically only a few files (2-5 KB of information). 931 </p></li><li ><p>932 <a class="indexterm" name="id 2588784"></a>933 <a class="indexterm" name="id 2588790"></a>931 </p></li><li class="listitem"><p> 932 <a class="indexterm" name="id357545"></a> 933 <a class="indexterm" name="id357551"></a> 934 934 The registry load file that modifies the <code class="constant">HKEY_LOCAL_USER</code> hive. This is 935 935 the <code class="filename">NTUSER.DAT</code> file. It can be from 0.4 to 1.5 MB. 936 936 </p></li></ul></div><p> 937 <a class="indexterm" name="id 2588813"></a>937 <a class="indexterm" name="id357573"></a> 938 938 Microsoft Outlook PST files may be stored in the <code class="constant">Local Settings\Application Data</code> 939 939 folder. It can be up to 2 GB in size per PST file. 940 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2588832"></a><a name="id2588834"></a></td><td align="left" valign="top"><p>940 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id357590"></a><a name="id357592"></a></td><td align="left" valign="top"><p> 941 941 Can the <code class="constant">My Documents</code> folder be stored on a network drive? 942 942 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 943 <a class="indexterm" name="id 2588849"></a>944 <a class="indexterm" name="id 2588856"></a>943 <a class="indexterm" name="id357607"></a> 944 <a class="indexterm" name="id357614"></a> 945 945 Yes. More correctly, such folders can be redirected to network shares. No specific network drive 946 946 connection is required. Registry settings permit this to be redirected directly to a UNC (Universal 947 947 Naming Convention) resource, though it is possible to specify a network drive letter instead of a 948 948 UNC name. See <a class="link" href="happy.html#redirfold" title="Configuration of Default Profile with Folder Redirection">“Configuration of Default Profile with Folder Redirection”</a>. 949 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2588880"></a><a name="id2588882"></a></td><td align="left" valign="top"><p>950 <a class="indexterm" name="id 2588886"></a>951 <a class="indexterm" name="id 2588893"></a>952 <a class="indexterm" name="id 2588902"></a>949 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id357635"></a><a name="id357637"></a></td><td align="left" valign="top"><p> 950 <a class="indexterm" name="id357641"></a> 951 <a class="indexterm" name="id357648"></a> 952 <a class="indexterm" name="id357657"></a> 953 953 How much WAN bandwidth does WINS consume? 954 954 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 955 <a class="indexterm" name="id 2588916"></a>956 <a class="indexterm" name="id 2588925"></a>957 <a class="indexterm" name="id 2588932"></a>955 <a class="indexterm" name="id357671"></a> 956 <a class="indexterm" name="id357680"></a> 957 <a class="indexterm" name="id357687"></a> 958 958 MS Windows clients cache information obtained from WINS lookups in a local NetBIOS name cache. 959 959 This keeps WINS lookups to a minimum. On a network with 3500 MS Windows clients and a central WINS … … 967 967 In conclusion, the total load afforded through WINS traffic is again marginal to total operational 968 968 usage as it should be. 969 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2588964"></a><a name="id2588966"></a></td><td align="left" valign="top"><p>969 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id357712"></a><a name="id357714"></a></td><td align="left" valign="top"><p> 970 970 How many BDCs should I have? What is the right number of Windows clients per server? 971 971 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 981 981 As unsatisfactory as the answer might sound, it all depends on network and server load 982 982 characteristics. 983 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2589000"></a><a name="id2589002"></a></td><td align="left" valign="top"><p>984 <a class="indexterm" name="id 2589006"></a><a class="indexterm" name="id2589012"></a>983 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id357739"></a><a name="id357741"></a></td><td align="left" valign="top"><p> 984 <a class="indexterm" name="id357745"></a><a class="indexterm" name="id357751"></a> 985 985 I've heard that you can store NIS accounts in LDAP. Is LDAP not just a smarter way to 986 986 run an NIS server? … … 989 989 a configurable schema that can store far more information for many more purposes than 990 990 just NIS. 991 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2589034"></a><a name="id2589036"></a></td><td align="left" valign="top"><p>991 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id357770"></a><a name="id357772"></a></td><td align="left" valign="top"><p> 992 992 Can I use NIS in place of LDAP? 993 993 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 994 <a class="indexterm" name="id 2589047"></a>995 <a class="indexterm" name="id 2589054"></a>994 <a class="indexterm" name="id357783"></a> 995 <a class="indexterm" name="id357790"></a> 996 996 No. The NIS database does not have provision to store Microsoft encrypted passwords and does not deal 997 997 with the types of data necessary for interoperability with Microsoft Windows networking. The use -
trunk/server/docs/htmldocs/Samba3-ByExample/ntmigration.html
r414 r599 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 9. Migrating NT4 Domain to Samba-3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 4.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="upgrades.html" title="Chapter 8. Updating Samba-3"><link rel="next" href="nw4migration.html" title="Chapter 10. Migrating NetWare Server to Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 9. Migrating NT4 Domain to Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="upgrades.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="nw4migration.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="ntmigration"></a>Chapter 9. Migrating NT4 Domain to Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ntmigration.html#id2601332">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2601417">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2601472">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2601658">Technical Issues</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2601981">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2602007">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id2602148">NT4 Migration Using LDAP Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2604606">NT4 Migration Using tdbsam Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id2605013">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id2605051">Questions and Answers</a></span></dt></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 9. Migrating NT4 Domain to Samba-3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="upgrades.html" title="Chapter 8. Updating Samba-3"><link rel="next" href="nw4migration.html" title="Chapter 10. Migrating NetWare Server to Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 9. Migrating NT4 Domain to Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="upgrades.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="nw4migration.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 9. Migrating NT4 Domain to Samba-3"><div class="titlepage"><div><div><h2 class="title"><a name="ntmigration"></a>Chapter 9. Migrating NT4 Domain to Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="ntmigration.html#id368988">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id369064">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id369115">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id369276">Technical Issues</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id369580">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id369600">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="ntmigration.html#id369724">NT4 Migration Using LDAP Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id371918">NT4 Migration Using tdbsam Backend</a></span></dt><dt><span class="sect2"><a href="ntmigration.html#id372263">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="ntmigration.html#id372297">Questions and Answers</a></span></dt></dl></div><p> 2 2 Ever since Microsoft announced that it was discontinuing support for Windows 3 3 NT4, Samba users started to ask for detailed instructions on how to migrate … … 7 7 One wonders how many NT4 systems will be left in service by the time you read this 8 8 book though. 9 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2601332"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id2601338"></a>9 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id368988"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id368994"></a> 10 10 Network administrators who want to migrate off a Windows NT4 environment know 11 11 one thing with certainty. They feel that NT4 has been abandoned, and they want … … 14 14 failure, and much more. 15 15 </p><p> 16 <a class="indexterm" name="id 2601356"></a>17 <a class="indexterm" name="id 2601363"></a>18 <a class="indexterm" name="id 2601373"></a>19 <a class="indexterm" name="id 2601382"></a>16 <a class="indexterm" name="id369009"></a> 17 <a class="indexterm" name="id369016"></a> 18 <a class="indexterm" name="id369025"></a> 19 <a class="indexterm" name="id369035"></a> 20 20 The migration from NT4 to Samba-3 can involve a number of factors, including 21 21 migration of data to another server, migration of network environment controls … … 23 23 accounts. 24 24 </p><p> 25 <a class="indexterm" name="id 2601398"></a>25 <a class="indexterm" name="id369049"></a> 26 26 It should be pointed out now that it is possible to migrate some systems from 27 27 a Windows NT4 domain environment to a Samba-3 domain environment. This is certainly … … 31 31 migration before an environment that is acceptable for immediate use 32 32 is obtained. 33 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2601417"></a>Assignment Tasks</h3></div></div></div><p>34 <a class="indexterm" name="id 2601425"></a>35 <a class="indexterm" name="id 2601432"></a>36 <a class="indexterm" name="id 2601438"></a>33 </p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id369064"></a>Assignment Tasks</h3></div></div></div><p> 34 <a class="indexterm" name="id369071"></a> 35 <a class="indexterm" name="id369078"></a> 36 <a class="indexterm" name="id369085"></a> 37 37 You are about to migrate an MS Windows NT4 domain accounts database to 38 38 a Samba-3 server. The Samba-3 server is using a … … 43 43 Your objective is to document the process of migrating user and group accounts 44 44 from several NT4 domains into a single Samba-3 LDAP backend database. 45 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2601472"></a>Dissection and Discussion</h2></div></div></div><p>46 <a class="indexterm" name="id 2601479"></a>47 <a class="indexterm" name="id 2601486"></a>48 <a class="indexterm" name="id 2601493"></a>49 <a class="indexterm" name="id 2601504"></a>50 <a class="indexterm" name="id 2601516"></a>51 <a class="indexterm" name="id 2601522"></a>45 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id369115"></a>Dissection and Discussion</h2></div></div></div><p> 46 <a class="indexterm" name="id369123"></a> 47 <a class="indexterm" name="id369129"></a> 48 <a class="indexterm" name="id369135"></a> 49 <a class="indexterm" name="id369147"></a> 50 <a class="indexterm" name="id369158"></a> 51 <a class="indexterm" name="id369165"></a> 52 52 The migration process takes a snapshot of information that is stored in the 53 53 Windows NT4 registry-based accounts database. That information resides in 54 54 the Security Account Manager (SAM) portion of the NT4 registry under keys called 55 55 <code class="constant">SAM</code> and <code class="constant">SECURITY</code>. 56 </p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>57 <a class="indexterm" name="id 2601547"></a>58 <a class="indexterm" name="id 2601554"></a>56 </p><div class="warning" title="Warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p> 57 <a class="indexterm" name="id369187"></a> 58 <a class="indexterm" name="id369194"></a> 59 59 The Windows NT4 registry keys called <code class="constant">SAM</code> and <code class="constant">SECURITY</code> 60 60 are protected so that you cannot view the contents. If you change the security setting … … 62 62 do this unless you are willing to render your domain controller inoperative. 63 63 </p></div><p> 64 <a class="indexterm" name="id 2601576"></a>65 <a class="indexterm" name="id 2601585"></a>64 <a class="indexterm" name="id369214"></a> 65 <a class="indexterm" name="id369223"></a> 66 66 Before commencing an NT4 to Samba-3 migration, you should consider what your objectives are. 67 67 While in some cases it is possible simply to migrate an NT4 domain to a single Samba-3 server, … … 71 71 interact with the network environment. 72 72 </p><p> 73 <a class="indexterm" name="id 2601604"></a>74 <a class="indexterm" name="id 2601613"></a>75 <a class="indexterm" name="id 2601620"></a>73 <a class="indexterm" name="id369237"></a> 74 <a class="indexterm" name="id369246"></a> 75 <a class="indexterm" name="id369253"></a> 76 76 MS Windows NT4 was introduced some time around 1996. Many environments in which NT4 was deployed 77 77 have done little to keep the NT4 server environment up to date with more recent Windows releases, … … 84 84 real disruption to users, but rather, with due diligence and care, should make their network experience 85 85 a much happier one. 86 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2601658"></a>Technical Issues</h3></div></div></div><p>87 <a class="indexterm" name="id 2601666"></a>88 <a class="indexterm" name="id 2601672"></a>86 </p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id369276"></a>Technical Issues</h3></div></div></div><p> 87 <a class="indexterm" name="id369284"></a> 88 <a class="indexterm" name="id369291"></a> 89 89 Migration of an NT4 domain user and group database to Samba-3 involves a certain strategic 90 90 element. Many sites have asked for instructions regarding merging of multiple NT4 … … 94 94 from a Windows NT4 domain to a Samba domain. 95 95 </p><div class="figure"><a name="ch8-migration"></a><p class="title"><b>Figure 9.1. Schematic Explaining the <code class="literal">net rpc vampire</code> Process</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/ch8-migration.png" width="297" alt="Schematic Explaining the net rpc vampire Process"></div></div></div><br class="figure-break"><p> 96 <a class="indexterm" name="id 2601746"></a>97 <a class="indexterm" name="id 2601752"></a>96 <a class="indexterm" name="id369358"></a> 97 <a class="indexterm" name="id369365"></a> 98 98 If you want to merge multiple NT4 domain account databases into one Samba domain, 99 99 you must now dump the contents of the first migration and edit it as appropriate. Now clean … … 101 101 files. You must start each migration with a new database into which you merge your NT4 102 102 domains. 103 </p><p><a class="indexterm" name="id 2601773"></a>103 </p><p><a class="indexterm" name="id369383"></a> 104 104 At this point, you are ready to perform the second migration, following the same steps as 105 105 for the first. In other words, dump the database, edit it, and then you may merge the 106 106 dump for the first and second migrations. 107 </p><p><a class="indexterm" name="id 2601788"></a><a class="indexterm" name="id2601796"></a><a class="indexterm" name="id2601804"></a>107 </p><p><a class="indexterm" name="id369396"></a><a class="indexterm" name="id369404"></a><a class="indexterm" name="id369412"></a> 108 108 You must be careful. If you choose to migrate to an LDAP backend, your dump file 109 109 now contains the full account information, including the domain SID. The domain SID for each … … 111 111 portion of the account SIDs so that all are the same. 112 112 </p><p> 113 <a class="indexterm" name="id 2601821"></a>114 <a class="indexterm" name="id 2601828"></a>115 <a class="indexterm" name="id 2601835"></a>116 <a class="indexterm" name="id 2601842"></a>117 <a class="indexterm" name="id 2601849"></a>118 <a class="indexterm" name="id 2601855"></a>119 <a class="indexterm" name="id 2601862"></a>120 <a class="indexterm" name="id 2601869"></a>121 <a class="indexterm" name="id 2601876"></a>122 <a class="indexterm" name="id 2601883"></a>123 <a class="indexterm" name="id 2601890"></a>124 <a class="indexterm" name="id 2601897"></a>113 <a class="indexterm" name="id369427"></a> 114 <a class="indexterm" name="id369433"></a> 115 <a class="indexterm" name="id369440"></a> 116 <a class="indexterm" name="id369447"></a> 117 <a class="indexterm" name="id369454"></a> 118 <a class="indexterm" name="id369461"></a> 119 <a class="indexterm" name="id369467"></a> 120 <a class="indexterm" name="id369474"></a> 121 <a class="indexterm" name="id369481"></a> 122 <a class="indexterm" name="id369488"></a> 123 <a class="indexterm" name="id369495"></a> 124 <a class="indexterm" name="id369501"></a> 125 125 If you choose to use a tdbsam (<code class="filename">passdb.tdb</code>) backend file, your best choice 126 126 is to use <code class="literal">pdbedit</code> to export the contents of the tdbsam file into an … … 132 132 may be exported or imported into either a tdbsam (<code class="filename">passdb.tdb</code>) or 133 133 an LDAP backend. 134 </p><div class="figure"><a name="NT4DUM"></a><p class="title"><b>Figure 9.2. View of Accounts in NT4 Domain User Manager</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/UserMgrNT4.png" width="270" alt="View of Accounts in NT4 Domain User Manager"></div></div></div><br class="figure-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2601981"></a>Political Issues</h3></div></div></div><p>134 </p><div class="figure"><a name="NT4DUM"></a><p class="title"><b>Figure 9.2. View of Accounts in NT4 Domain User Manager</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/UserMgrNT4.png" width="270" alt="View of Accounts in NT4 Domain User Manager"></div></div></div><br class="figure-break"></div><div class="sect2" title="Political Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id369580"></a>Political Issues</h3></div></div></div><p> 135 135 The merging of multiple Windows NT4-style domains into a single LDAP-backend-based Samba-3 136 136 domain may be seen by those who had power over them as a loss of prestige or a loss of … … 142 142 Samba-3 domain is to promote (sell) the action as one that reduces costs and delivers 143 143 greater network interoperability and manageability. 144 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2602007"></a>Implementation</h2></div></div></div><p>144 </p></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id369600"></a>Implementation</h2></div></div></div><p> 145 145 From feedback on the Samba mailing lists, it seems that most Windows NT4 migrations 146 146 to Samba-3 are being performed using a new server or a new installation of a Linux or UNIX … … 161 161 </p><p> 162 162 The migration process involves the following steps: 163 </p><div class="itemizedlist"><ul type="disc"><li><p>163 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 164 164 Prepare the target Samba-3 server. This involves configuring Samba-3 for 165 165 migration to either a tdbsam or an ldapsam backend. 166 </p></li><li ><p>167 <a class="indexterm" name="id 2602094"></a>168 <a class="indexterm" name="id 2602100"></a>169 <a class="indexterm" name="id 2602107"></a>166 </p></li><li class="listitem"><p> 167 <a class="indexterm" name="id369676"></a> 168 <a class="indexterm" name="id369682"></a> 169 <a class="indexterm" name="id369688"></a> 170 170 Clean up the source NT4 PDC. Delete all accounts that need not be migrated. 171 171 Delete all files that should not be migrated. Where possible, change NT group … … 173 173 the target UNIX host insists on POSIX-compliant all lowercase user and group 174 174 names. 175 </p></li><li ><p>175 </p></li><li class="listitem"><p> 176 176 Step through the migration process. 177 </p></li><li ><p><a class="indexterm" name="id2602128"></a>177 </p></li><li class="listitem"><p><a class="indexterm" name="id369706"></a> 178 178 Remove the NT4 PDC from the network. 179 </p></li><li ><p>179 </p></li><li class="listitem"><p> 180 180 Upgrade the Samba-3 server from a BDC to a PDC, and validate all account 181 181 information. 182 182 </p></li></ul></div><p> 183 183 It may help to use the above outline as a pre-migration checklist. 184 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2602148"></a>NT4 Migration Using LDAP Backend</h3></div></div></div><p>184 </p><div class="sect2" title="NT4 Migration Using LDAP Backend"><div class="titlepage"><div><div><h3 class="title"><a name="id369724"></a>NT4 Migration Using LDAP Backend</h3></div></div></div><p> 185 185 In this example, the migration is of an NT4 PDC to a Samba-3 PDC with an LDAP backend. The accounts about 186 186 to be migrated are shown in <a class="link" href="ntmigration.html#NT4DUM" title="Figure 9.2. View of Accounts in NT4 Domain User Manager">“View of Accounts in NT4 Domain User Manager”</a>. In this example use is made of the … … 195 195 that the deletion scripts must be commented out during migration. These should be uncommented 196 196 following successful migration of the NT4 Domain accounts. 197 </p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>197 </p><div class="warning" title="Warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p> 198 198 Under absolutely no circumstances should the Samba daemons be started until instructed to do so. 199 199 Delete the <code class="filename">/etc/samba/secrets.tdb</code> file and all Samba control tdb files 200 200 before commencing the following configuration steps. 201 </p></div><div class="table"><a name="ch8-vampire"></a><p class="title"><b>Table 9.1. Samba <code class="filename">smb.conf</code> Scripts Essential to Samba Operation</b></p><div class="table-contents"><table summary="Samba smb.conf Scripts Essential to Samba Operation" border="1"><colgroup><col align="left"><col align="center"><col align="center"></colgroup><thead><tr><th align="left">Entity</th><th align="center">ldapsam Script</th><th align="center">tdbsam Script</th></tr></thead><tbody><tr><td align="left">Add User Accounts</td><td align="center">smbldap-useradd</td><td align="center">useradd</td></tr><tr><td align="left">Delete User Accounts</td><td align="center">smbldap-userdel</td><td align="center">userdel</td></tr><tr><td align="left">Add Group Accounts</td><td align="center">smbldap-groupadd</td><td align="center">groupadd</td></tr><tr><td align="left">Delete Group Accounts</td><td align="center">smbldap-groupdel</td><td align="center">groupdel</td></tr><tr><td align="left">Add User to Group</td><td align="center">smbldap-groupmod</td><td align="center">usermod (See Note)</td></tr><tr><td align="left">Add Machine Accounts</td><td align="center">smbldap-useradd</td><td align="center">useradd</td></tr></tbody></table></div></div><br class="table-break"><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>202 <a class="indexterm" name="id 2602350"></a>203 <a class="indexterm" name="id 2602357"></a>204 <a class="indexterm" name="id 2602364"></a>201 </p></div><div class="table"><a name="ch8-vampire"></a><p class="title"><b>Table 9.1. Samba <code class="filename">smb.conf</code> Scripts Essential to Samba Operation</b></p><div class="table-contents"><table summary="Samba smb.conf Scripts Essential to Samba Operation" border="1"><colgroup><col align="left"><col align="center"><col align="center"></colgroup><thead><tr><th align="left">Entity</th><th align="center">ldapsam Script</th><th align="center">tdbsam Script</th></tr></thead><tbody><tr><td align="left">Add User Accounts</td><td align="center">smbldap-useradd</td><td align="center">useradd</td></tr><tr><td align="left">Delete User Accounts</td><td align="center">smbldap-userdel</td><td align="center">userdel</td></tr><tr><td align="left">Add Group Accounts</td><td align="center">smbldap-groupadd</td><td align="center">groupadd</td></tr><tr><td align="left">Delete Group Accounts</td><td align="center">smbldap-groupdel</td><td align="center">groupdel</td></tr><tr><td align="left">Add User to Group</td><td align="center">smbldap-groupmod</td><td align="center">usermod (See Note)</td></tr><tr><td align="left">Add Machine Accounts</td><td align="center">smbldap-useradd</td><td align="center">useradd</td></tr></tbody></table></div></div><br class="table-break"><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 202 <a class="indexterm" name="id369914"></a> 203 <a class="indexterm" name="id369921"></a> 204 <a class="indexterm" name="id369928"></a> 205 205 The UNIX/Linux <code class="literal">usermod</code> utility does not permit simple user addition to (or deletion 206 206 of users from) groups. This is a feature provided by the smbldap-tools scripts. If you want this … … 209 209 The <code class="literal">groupmem</code> utility was contributed to the shadow package but has not surfaced 210 210 in the formal commands provided by Linux distributions (March 2004). 211 </p></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>212 <a class="indexterm" name="id 2602401"></a>211 </p></div><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 212 <a class="indexterm" name="id369961"></a> 213 213 The <code class="literal">tdbdump</code> utility is a utility that you can build from the Samba source-code tree. Not all Linux binary distributions include this tool. If it is missing from your 214 214 Linux distribution, you will need to build this yourself or else forgo its use. 215 215 </p></div><p> 216 <a class="indexterm" name="id 2602421"></a>216 <a class="indexterm" name="id369979"></a> 217 217 Before starting the migration, all dead accounts were removed from the NT4 domain using the User Manager for Domains. 218 </p><div class="procedure" ><a name="id2602431"></a><p class="title"><b>Procedure 9.1. User Migration Steps</b></p><div class="example"><a name="sbent4smb"></a><p class="title"><b>Example 9.1. NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2602491"></a><em class="parameter"><code>workgroup = DAMNATION</code></em></td></tr><tr><td><a class="indexterm" name="id2602503"></a><em class="parameter"><code>netbios name = MERLIN</code></em></td></tr><tr><td><a class="indexterm" name="id2602515"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id2602527"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2602539"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2602550"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2602562"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2602574"></a><em class="parameter"><code>smb ports = 139 445</code></em></td></tr><tr><td><a class="indexterm" name="id2602585"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2602598"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2602610"></a><em class="parameter"><code>#delete user script = /opt/IDEALX/sbin/smbldap-userdel '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2602622"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2602635"></a><em class="parameter"><code>#delete group script = /opt/IDEALX/sbin/smbldap-groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2602647"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/ smbldap-groupmod -m '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2602660"></a><em class="parameter"><code>#delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2602673"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2602686"></a><em class="parameter"><code>add machine script = /opt/IDEALX/sbin/smbldap-useradd -w '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2602699"></a><em class="parameter"><code>logon script = scripts\logon.cmd</code></em></td></tr><tr><td><a class="indexterm" name="id2602711"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2602722"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2602734"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2602746"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2602758"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id2602769"></a><em class="parameter"><code>#wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2602781"></a><em class="parameter"><code>wins server = 192.168.123.124</code></em></td></tr><tr><td><a class="indexterm" name="id2602793"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=terpstra-world,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2602805"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2602817"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2602829"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2602841"></a><em class="parameter"><code>ldap passwd sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2602853"></a><em class="parameter"><code>ldap suffix = dc=terpstra-world,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id2602865"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id2602877"></a><em class="parameter"><code>ldap timeout = 20</code></em></td></tr><tr><td><a class="indexterm" name="id2602888"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2602900"></a><em class="parameter"><code>idmap backend = ldap:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id2602912"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2602924"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2602936"></a><em class="parameter"><code>winbind nested groups = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2602948"></a><em class="parameter"><code>ea support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2602960"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbent4smb2"></a><p class="title"><b>Example 9.2. NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id2603005"></a><em class="parameter"><code>comment = Application Data</code></em></td></tr><tr><td><a class="indexterm" name="id2603017"></a><em class="parameter"><code>path = /data/home/apps</code></em></td></tr><tr><td><a class="indexterm" name="id2603028"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2603049"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2603061"></a><em class="parameter"><code>path = /home/users/%U/Documents</code></em></td></tr><tr><td><a class="indexterm" name="id2603072"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2603084"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2603096"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2603116"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2603128"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2603140"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2603151"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2603163"></a><em class="parameter"><code>use client driver = No</code></em></td></tr><tr><td><a class="indexterm" name="id2603175"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2603195"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2603207"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2603219"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2603231"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2603251"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2603263"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2603275"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2603286"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id2603307"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id2603319"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id2603331"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2603342"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id2603363"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2603375"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbentslapd"></a><p class="title"><b>Example 9.3. NT4 Migration LDAP Server Configuration File: <code class="filename">/etc/openldap/slapd.conf</code> Part A</b></p><div class="example-contents"><pre class="screen">218 </p><div class="procedure" title="Procedure 9.1. User Migration Steps"><a name="id369988"></a><p class="title"><b>Procedure 9.1. User Migration Steps</b></p><div class="example"><a name="sbent4smb"></a><p class="title"><b>Example 9.1. NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: A</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id370046"></a><em class="parameter"><code>workgroup = DAMNATION</code></em></td></tr><tr><td><a class="indexterm" name="id370057"></a><em class="parameter"><code>netbios name = MERLIN</code></em></td></tr><tr><td><a class="indexterm" name="id370068"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id370080"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id370092"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id370103"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id370115"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id370126"></a><em class="parameter"><code>smb ports = 139 445</code></em></td></tr><tr><td><a class="indexterm" name="id370138"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id370149"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id370161"></a><em class="parameter"><code>#delete user script = /opt/IDEALX/sbin/smbldap-userdel '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id370173"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id370185"></a><em class="parameter"><code>#delete group script = /opt/IDEALX/sbin/smbldap-groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id370197"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/ smbldap-groupmod -m '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id370209"></a><em class="parameter"><code>#delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x '%u' '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id370221"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id370233"></a><em class="parameter"><code>add machine script = /opt/IDEALX/sbin/smbldap-useradd -w '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id370245"></a><em class="parameter"><code>logon script = scripts\logon.cmd</code></em></td></tr><tr><td><a class="indexterm" name="id370257"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id370268"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id370280"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id370291"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id370303"></a><em class="parameter"><code>domain master = No</code></em></td></tr><tr><td><a class="indexterm" name="id370314"></a><em class="parameter"><code>#wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id370326"></a><em class="parameter"><code>wins server = 192.168.123.124</code></em></td></tr><tr><td><a class="indexterm" name="id370337"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=terpstra-world,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id370349"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id370360"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id370372"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id370384"></a><em class="parameter"><code>ldap passwd sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id370395"></a><em class="parameter"><code>ldap suffix = dc=terpstra-world,dc=org</code></em></td></tr><tr><td><a class="indexterm" name="id370407"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id370418"></a><em class="parameter"><code>ldap timeout = 20</code></em></td></tr><tr><td><a class="indexterm" name="id370430"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id370441"></a><em class="parameter"><code>idmap backend = ldap:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id370453"></a><em class="parameter"><code>idmap uid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id370464"></a><em class="parameter"><code>idmap gid = 15000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id370476"></a><em class="parameter"><code>winbind nested groups = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id370487"></a><em class="parameter"><code>ea support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id370499"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbent4smb2"></a><p class="title"><b>Example 9.2. NT4 Migration Samba-3 Server <code class="filename">smb.conf</code> Part: B</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id370543"></a><em class="parameter"><code>comment = Application Data</code></em></td></tr><tr><td><a class="indexterm" name="id370555"></a><em class="parameter"><code>path = /data/home/apps</code></em></td></tr><tr><td><a class="indexterm" name="id370566"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id370587"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id370598"></a><em class="parameter"><code>path = /home/users/%U/Documents</code></em></td></tr><tr><td><a class="indexterm" name="id370610"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id370622"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id370633"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id370653"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id370665"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id370676"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id370688"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id370699"></a><em class="parameter"><code>use client driver = No</code></em></td></tr><tr><td><a class="indexterm" name="id370711"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id370731"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id370743"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id370754"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id370766"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id370786"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id370798"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id370809"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id370821"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profdata]</code></em></td></tr><tr><td><a class="indexterm" name="id370841"></a><em class="parameter"><code>comment = Profile Data Share</code></em></td></tr><tr><td><a class="indexterm" name="id370853"></a><em class="parameter"><code>path = /var/lib/samba/profdata</code></em></td></tr><tr><td><a class="indexterm" name="id370864"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id370876"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id370896"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id370908"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="sbentslapd"></a><p class="title"><b>Example 9.3. NT4 Migration LDAP Server Configuration File: <code class="filename">/etc/openldap/slapd.conf</code> Part A</b></p><div class="example-contents"><pre class="screen"> 219 219 include /etc/openldap/schema/core.schema 220 220 include /etc/openldap/schema/cosine.schema … … 331 331 #passwd_compat: ldap #Not needed. 332 332 #group_compat: ldap #Not needed. 333 </pre></div></div><br class="example-break"><ol type="1"><li><p>333 </pre></div></div><br class="example-break"><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 334 334 Configure the Samba <code class="filename">smb.conf</code> file to create a BDC. An example configuration is 335 335 given in <a class="link" href="ntmigration.html#sbent4smb" title="Example 9.1. NT4 Migration Samba-3 Server smb.conf Part: A">“NT4 Migration Samba-3 Server smb.conf Part: A”</a>. 336 336 The delete scripts are commented out so that during the process of migration 337 337 no account information can be deleted. 338 </p></li><li ><p>339 <a class="indexterm" name="id 2603393"></a>338 </p></li><li class="step" title="Step 2"><p> 339 <a class="indexterm" name="id370926"></a> 340 340 Configure OpenLDAP in preparation for the migration. An example 341 341 <code class="filename">sladp.conf</code> file is shown in <a class="link" href="ntmigration.html#sbentslapd" title="Example 9.3. NT4 Migration LDAP Server Configuration File: /etc/openldap/slapd.conf Part A">“NT4 Migration LDAP Server Configuration File: /etc/openldap/slapd.conf Part A”</a>. 342 342 The <code class="constant">rootpw</code> value is an encrypted password string that can 343 343 be obtained by executing the <code class="literal">slappasswd</code> command. 344 </p></li><li ><p>345 <a class="indexterm" name="id 2603507"></a>346 <a class="indexterm" name="id 2603514"></a>344 </p></li><li class="step" title="Step 3"><p> 345 <a class="indexterm" name="id371025"></a> 346 <a class="indexterm" name="id371032"></a> 347 347 Install the PADL <code class="literal">nss_ldap</code> tool set, then configure the <code class="filename">/etc/ldap.conf</code> 348 348 as shown in <a class="link" href="ntmigration.html#sbrntldapconf" title="Example 9.5. NT4 Migration NSS LDAP File: /etc/ldap.conf">“NT4 Migration NSS LDAP File: /etc/ldap.conf”</a>. 349 </p></li><li ><p>350 <a class="indexterm" name="id 2603574"></a>349 </p></li><li class="step" title="Step 4"><p> 350 <a class="indexterm" name="id371087"></a> 351 351 Edit the <code class="filename">/etc/nsswitch.conf</code> file so it has the entries shown 352 352 in <a class="link" href="ntmigration.html#sbentnss" title="Example 9.6. NT4 Migration NSS Control File: /etc/nsswitch.conf (Stage:1)">“NT4 Migration NSS Control File: /etc/nsswitch.conf (Stage:1)”</a>. Note that the LDAP entries have been commented out. … … 358 358 out, it is possible to avoid this gridlock situation and thus the overall 359 359 installation and configuration will progress more smoothly. 360 </p></li><li ><p>360 </p></li><li class="step" title="Step 5"><p> 361 361 Validate the the target NT4 PDC name is being correctly resolved to its IP address by 362 362 executing the following: … … 374 374 Do not proceed to the next step if this step fails. It is imperative that the name of the PDC 375 375 can be resolved to its IP address. If this is broken, fix it. 376 </p></li><li ><p>376 </p></li><li class="step" title="Step 6"><p> 377 377 Pull the domain SID from the NT4 domain that is being migrated as follows: 378 378 </p><pre class="screen"> … … 392 392 <code class="prompt">root# </code> net setlocalsid S-1-5-21-1385457007-882775198-1210191635 393 393 </pre><p> 394 </p></li><li ><p>395 <a class="indexterm" name="id 2603744"></a>396 <a class="indexterm" name="id 2603750"></a>397 <a class="indexterm" name="id 2603757"></a>398 <a class="indexterm" name="id 2603764"></a>394 </p></li><li class="step" title="Step 7"><p> 395 <a class="indexterm" name="id371235"></a> 396 <a class="indexterm" name="id371242"></a> 397 <a class="indexterm" name="id371249"></a> 398 <a class="indexterm" name="id371256"></a> 399 399 Install the Idealx <code class="literal">smbldap-tools</code> software package, following 400 400 the instructions given in <a class="link" href="happy.html#sbeidealx" title="Install and Configure Idealx smbldap-tools Scripts">“Install and Configure Idealx smbldap-tools Scripts”</a>. The resulting perl scripts … … 490 490 /etc/smbldap-tools/smbldap_bind.conf done. 491 491 </pre><p> 492 <a class="indexterm" name="id 2603914"></a>493 <a class="indexterm" name="id 2603921"></a>494 <a class="indexterm" name="id 2603928"></a>495 <a class="indexterm" name="id 2603935"></a>492 <a class="indexterm" name="id371351"></a> 493 <a class="indexterm" name="id371358"></a> 494 <a class="indexterm" name="id371365"></a> 495 <a class="indexterm" name="id371371"></a> 496 496 Note that the NT4 domain SID that was previously obtained was entered above. Also, 497 497 the sambaUnixIdPooldn object was specified as sambaDomainName=DAMNATION. This is … … 502 502 are being upgraded to version 0.9.1 it is appropriate to update this to the new location 503 503 only if the directory information is also relocated. 504 </p></li><li ><p>504 </p></li><li class="step" title="Step 8"><p> 505 505 Start the LDAP server using the system interface script. On Novell SLES9 506 506 this is done as shown here: … … 508 508 <code class="prompt">root# </code> rcldap start 509 509 </pre><p> 510 </p></li><li ><p>510 </p></li><li class="step" title="Step 9"><p> 511 511 Edit the <code class="filename">/etc/nsswitch.conf</code> file so it has the entries shown in 512 512 <a class="link" href="ntmigration.html#sbentnss2" title="Example 9.7. NT4 Migration NSS Control File: /etc/nsswitch.conf (Stage:2)">“NT4 Migration NSS Control File: /etc/nsswitch.conf (Stage:2)”</a>. Note that the LDAP entries have now been uncommented. 513 </p></li><li ><p>513 </p></li><li class="step" title="Step 10"><p> 514 514 The LDAP management password must be installed into the <code class="filename">secrets.tdb</code> 515 515 file as follows: … … 519 519 "cn=Manager,dc=terpstra-world,dc=org" in secrets.tdb 520 520 </pre><p> 521 </p></li><li ><p>521 </p></li><li class="step" title="Step 11"><p> 522 522 Populate the LDAP directory as shown here: 523 523 </p><pre class="screen"> … … 545 545 The script tries to add the ou=People container twice, hence the error message. 546 546 This is expected behavior. 547 </p></li><li ><p>548 <a class="indexterm" name="id 2604099"></a>547 </p></li><li class="step" title="Step 12"><p> 548 <a class="indexterm" name="id371510"></a> 549 549 Restart the LDAP server following initialization of the LDAP directory. Execute the 550 550 system control script provided on your system. The following steps can be used on … … 554 554 <code class="prompt">root# </code> chkconfig ldap on 555 555 </pre><p> 556 </p></li><li ><p>556 </p></li><li class="step" title="Step 13"><p> 557 557 Verify that the new user accounts that have been added to the LDAP directory can be 558 558 resolved as follows: … … 585 585 Replicators:x:552: 586 586 </pre><p> 587 In both cases the LDAP accounts follow the “<span class="quote">+::0:</span>”entry.588 </p></li><li ><p>587 In both cases the LDAP accounts follow the <span class="quote">“<span class="quote">+::0:</span>”</span> entry. 588 </p></li><li class="step" title="Step 14"><p> 589 589 Now it is time to join the Samba BDC to the target NT4 domain that is being 590 590 migrated to Samba-3 by executing the following: … … 595 595 Joined domain DAMNATION. 596 596 </pre><p> 597 </p></li><li ><p>597 </p></li><li class="step" title="Step 15"><p> 598 598 Set the new domain administrator (root) password for both UNIX and Windows as shown here: 599 599 </p><pre class="screen"> … … 605 605 Note: During account migration, the Windows Administrator account will not be migrated 606 606 to the Samba server. 607 </p></li><li ><p>607 </p></li><li class="step" title="Step 16"><p> 608 608 Now validate that these accounts can be resolved using Samba's tools as 609 609 shown here for user accounts: … … 633 633 </pre><p> 634 634 These are the expected results for a correctly configured system. 635 </p></li><li ><p>635 </p></li><li class="step" title="Step 17"><p> 636 636 Commence migration as shown here: 637 637 </p><pre class="screen"> … … 641 641 Check the vampire log to confirm that only expected errors have been 642 642 reported. See <a class="link" href="ntmigration.html#sbevam1" title="Migration Log Validation">“Migration Log Validation”</a>. 643 </p></li><li ><p>643 </p></li><li class="step" title="Step 18"><p> 644 644 The migration of user accounts can be quickly validated as follows: 645 645 </p><pre class="screen"> … … 676 676 merlin$:27:820C50523F368C54AB9D85AE603AD09D:... 677 677 </pre><p> 678 </p></li><li ><p>678 </p></li><li class="step" title="Step 19"><p> 679 679 The mapping of UNIX and Windows groups can be validated as show here: 680 680 </p><pre class="screen"> … … 708 708 It is of vital importance that the domain SID portions of all group 709 709 accounts are identical. 710 </p></li><li ><p>710 </p></li><li class="step" title="Step 20"><p> 711 711 The final responsibility in the migration process is to create identical 712 712 shares and printing resources on the new Samba-3 server, copy all data 713 713 across, set up privileges, and set share and file/directory access controls. 714 </p></li><li ><p>715 <a class="indexterm" name="id 2604414"></a>716 <a class="indexterm" name="id 2604420"></a>714 </p></li><li class="step" title="Step 21"><p> 715 <a class="indexterm" name="id371765"></a> 716 <a class="indexterm" name="id371772"></a> 717 717 Edit the <code class="filename">smb.conf</code> file to reset the parameter 718 718 <a class="link" href="smb.conf.5.html#DOMAINMASTER" target="_top">domain master = Yes</a> so that … … 737 737 Press enter to see a dump of your service definitions 738 738 </pre><p> 739 </p></li><li ><p>739 </p></li><li class="step" title="Step 22"><p> 740 740 Now shut down the old NT4 PDC. Only when the old NT4 PDC and all 741 741 NT4 BDCs have been shut down can the Samba-3 PDC be started. 742 </p></li><li ><p>742 </p></li><li class="step" title="Step 23"><p> 743 743 All workstations should function as they did with the old NT4 PDC. All 744 744 interdomain trust accounts should remain in place and fully functional. 745 745 All machine accounts and user logon accounts should also function correctly. 746 </p></li><li ><p>746 </p></li><li class="step" title="Step 24"><p> 747 747 The configuration of Samba-3 BDC servers can be accomplished now or at any 748 748 convenient time in the future. Please refer to the carefully detailed process 749 749 for doing so is outlined in <a class="link" href="happy.html#sbehap-bldg1" title="Samba-3 BDC Configuration">“Samba-3 BDC Configuration”</a>. 750 </p></li></ol></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="sbevam1"></a>Migration Log Validation</h4></div></div></div><p>750 </p></li></ol></div><div class="sect3" title="Migration Log Validation"><div class="titlepage"><div><div><h4 class="title"><a name="sbevam1"></a>Migration Log Validation</h4></div></div></div><p> 751 751 The following <code class="filename">vampire.log</code> file is typical of a valid migration. 752 752 </p><pre class="screen"> … … 842 842 Creating unix group: 'Users' 843 843 </pre><p> 844 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2604606"></a>NT4 Migration Using tdbsam Backend</h3></div></div></div><p>844 </p></div></div><div class="sect2" title="NT4 Migration Using tdbsam Backend"><div class="titlepage"><div><div><h3 class="title"><a name="id371918"></a>NT4 Migration Using tdbsam Backend</h3></div></div></div><p> 845 845 In this example, we change the domain name of the NT4 server from 846 846 <code class="constant">DRUGPREP</code> to <code class="constant">MEGANET</code> prior to the use … … 850 850 databases. These entries must therefore be present, and correct options specified, 851 851 in your <code class="filename">smb.conf</code> file, or else the migration does not work as it should. 852 </p><div class="procedure" ><a name="id2604653"></a><p class="title"><b>Procedure 9.2. Migration Steps Using tdbsam</b></p><ol type="1"><li><p>852 </p><div class="procedure" title="Procedure 9.2. Migration Steps Using tdbsam"><a name="id371961"></a><p class="title"><b>Procedure 9.2. Migration Steps Using tdbsam</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 853 853 Prepare a Samba-3 server precisely per the instructions shown in <a class="link" href="Big500users.html" title="Chapter 4. The 500-User Office">“The 500-User Office”</a>. 854 854 Set the workgroup name to <code class="constant">MEGANET</code>. 855 </p></li><li ><p><a class="indexterm" name="id2604681"></a><a class="indexterm" name="id2604689"></a>855 </p></li><li class="step" title="Step 2"><p><a class="indexterm" name="id371988"></a><a class="indexterm" name="id371996"></a> 856 856 Edit the <code class="filename">smb.conf</code> file to temporarily change the parameter 857 857 <a class="link" href="smb.conf.5.html#DOMAINMASTER" target="_top">domain master = No</a> so 858 858 the Samba server functions as a BDC for the purpose of migration. 859 </p></li><li ><p>859 </p></li><li class="step" title="Step 3"><p> 860 860 Start Samba as you have done previously. 861 </p></li><li ><p><a class="indexterm" name="id2604732"></a>861 </p></li><li class="step" title="Step 4"><p><a class="indexterm" name="id372035"></a> 862 862 Join the NT4 Domain as a BDC, as shown here: 863 863 </p><pre class="screen"> … … 865 865 Joined domain MEGANET. 866 866 </pre><p> 867 </p></li><li ><p><a class="indexterm" name="id2604766"></a>867 </p></li><li class="step" title="Step 5"><p><a class="indexterm" name="id372068"></a> 868 868 You may vampire the accounts from the NT4 PDC by executing the command, as shown here: 869 869 </p><pre class="screen"> … … 905 905 SAM_DELTA_DOMAIN_INFO not handled 906 906 </pre><p> 907 </p></li><li ><p><a class="indexterm" name="id2604820"></a>907 </p></li><li class="step" title="Step 6"><p><a class="indexterm" name="id372111"></a> 908 908 At this point, we can validate our migration. Let's look at the accounts 909 909 in the form in which they are seen in a smbpasswd file. This achieves that: … … 937 937 CF271B744F7A55AFDA277FF88D80C527:[UX ]:LCT-3E8B4270: 938 938 </pre><p> 939 </p></li><li ><p><a class="indexterm" name="id2604897"></a>939 </p></li><li class="step" title="Step 7"><p><a class="indexterm" name="id372163"></a> 940 940 An expanded view of a user account entry shows more of what was 941 941 obtained from the NT4 PDC: … … 963 963 Password must change: Mon, 18 Jan 2038 20:14:07 GMT 964 964 </pre><p> 965 </p></li><li ><p><a class="indexterm" name="id2604932"></a>965 </p></li><li class="step" title="Step 8"><p><a class="indexterm" name="id372190"></a> 966 966 The following command lists the long names of the groups that have been 967 967 imported (vampired) from the NT4 PDC: … … 980 980 </pre><p> 981 981 Everything looks well and in order. 982 </p></li><li ><p><a class="indexterm" name="id2604972"></a><a class="indexterm" name="id2604980"></a>982 </p></li><li class="step" title="Step 9"><p><a class="indexterm" name="id372225"></a><a class="indexterm" name="id372233"></a> 983 983 Edit the <code class="filename">smb.conf</code> file to reset the parameter 984 984 <a class="link" href="smb.conf.5.html#DOMAINMASTER" target="_top">domain master = Yes</a> so 985 985 the Samba server functions as a PDC for the purpose of migration. 986 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2605013"></a>Key Points Learned</h3></div></div></div><p>986 </p></li></ol></div></div><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id372263"></a>Key Points Learned</h3></div></div></div><p> 987 987 Migration of an NT4 PDC database to a Samba-3 PDC is possible. 988 </p><div class="itemizedlist"><ul type="disc"><li><p>988 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 989 989 An LDAP backend is a suitable vehicle for NT4 migrations. 990 </p></li><li ><p>990 </p></li><li class="listitem"><p> 991 991 A tdbsam backend can be used to perform a migration. 992 </p></li><li ><p>992 </p></li><li class="listitem"><p> 993 993 Multiple NT4 domains can be merged into a single Samba-3 994 994 domain. 995 </p></li><li ><p>995 </p></li><li class="listitem"><p> 996 996 The net Samba-3 domain most likely requires some 997 997 administration and updating before going live. 998 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2605051"></a>Questions and Answers</h2></div></div></div><p>999 </p><div class="qandaset" ><dl><dt> <a href="ntmigration.html#id2605066">998 </p></li></ul></div></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id372297"></a>Questions and Answers</h2></div></div></div><p> 999 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id372306"></a><dl><dt> <a href="ntmigration.html#id372313"> 1000 1000 Why must I start each migration with a clean database? 1001 </a></dt><dt> <a href="ntmigration.html#id 2605107">1001 </a></dt><dt> <a href="ntmigration.html#id372349"> 1002 1002 Is it possible to set my domain SID to anything I like? 1003 </a></dt><dt> <a href="ntmigration.html#id 2605164">1003 </a></dt><dt> <a href="ntmigration.html#id372401"> 1004 1004 When using a tdbsam passdb backend, why must I have all domain user and group accounts 1005 1005 in /etc/passwd and /etc/group? 1006 </a></dt><dt> <a href="ntmigration.html#id 2605344">1006 </a></dt><dt> <a href="ntmigration.html#id372571"> 1007 1007 Why did you validate connectivity before attempting migration? 1008 </a></dt><dt> <a href="ntmigration.html#id 2605389">1008 </a></dt><dt> <a href="ntmigration.html#id372613"> 1009 1009 How would you merge 10 tdbsam-based domains into an LDAP database? 1010 </a></dt><dt> <a href="ntmigration.html#id 2605512">1010 </a></dt><dt> <a href="ntmigration.html#id372728"> 1011 1011 I want to change my domain name after I migrate all accounts from an NT4 domain to a 1012 1012 Samba-3 domain. Does it make any sense to migrate the machine accounts in that case? 1013 </a></dt><dt> <a href="ntmigration.html#id 2605588">1013 </a></dt><dt> <a href="ntmigration.html#id372800"> 1014 1014 After merging multiple NT4 domains into a Samba-3 domain, I lost all multiple group mappings. Why? 1015 </a></dt><dt> <a href="ntmigration.html#id 2605652">1015 </a></dt><dt> <a href="ntmigration.html#id372858"> 1016 1016 How can I reset group membership after loading the account information into the LDAP database? 1017 </a></dt><dt> <a href="ntmigration.html#id 2605687">1017 </a></dt><dt> <a href="ntmigration.html#id372890"> 1018 1018 What are the limits or constraints that apply to group names? 1019 </a></dt><dt> <a href="ntmigration.html#id 2605791">1019 </a></dt><dt> <a href="ntmigration.html#id372987"> 1020 1020 My Windows NT4 PDC has 323,000 user accounts. How long will it take to migrate them to a Samba-3 1021 1021 LDAP backend system using the vampire process? 1022 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2605066"></a><a name="id2605069"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2605072"></a>1022 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id372313"></a><a name="id372315"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id372318"></a> 1023 1023 Why must I start each migration with a clean database? 1024 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id 2605087"></a>1024 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id372333"></a> 1025 1025 This is a recommendation that permits the data from each NT4 domain to 1026 1026 be kept separate until you are ready to merge them. Also, if you do not start with a clean database, … … 1029 1029 without undue errors and then to handle the merging of vampired data under 1030 1030 proper supervision. 1031 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2605107"></a><a name="id2605109"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2605112"></a>1031 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id372349"></a><a name="id372351"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id372354"></a> 1032 1032 Is it possible to set my domain SID to anything I like? 1033 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id 2605128"></a><a class="indexterm" name="id2605136"></a><a class="indexterm" name="id2605143"></a>1033 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id372369"></a><a class="indexterm" name="id372377"></a><a class="indexterm" name="id372384"></a> 1034 1034 Yes, so long as the SID you create has the same structure as an autogenerated SID. 1035 1035 The typical SID looks like this: S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX, where … … 1038 1038 You may want to set the SID to one that is already in use somewhere on your network, 1039 1039 but that is a little different from straight out creating your own domain SID. 1040 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2605164"></a><a name="id2605166"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2605169"></a><a class="indexterm" name="id2605177"></a><a class="indexterm" name="id2605184"></a><a class="indexterm" name="id2605192"></a><a class="indexterm" name="id2605200"></a><a class="indexterm" name="id2605212"></a><a class="indexterm" name="id2605223"></a>1040 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id372401"></a><a name="id372403"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id372406"></a><a class="indexterm" name="id372414"></a><a class="indexterm" name="id372422"></a><a class="indexterm" name="id372430"></a><a class="indexterm" name="id372438"></a><a class="indexterm" name="id372449"></a><a class="indexterm" name="id372460"></a> 1041 1041 When using a tdbsam passdb backend, why must I have all domain user and group accounts 1042 1042 in <code class="filename">/etc/passwd</code> and <code class="filename">/etc/group</code>? 1043 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id 2605254"></a><a class="indexterm" name="id2605262"></a><a class="indexterm" name="id2605270"></a><a class="indexterm" name="id2605277"></a><a class="indexterm" name="id2605285"></a><a class="indexterm" name="id2605293"></a>1043 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id372491"></a><a class="indexterm" name="id372499"></a><a class="indexterm" name="id372506"></a><a class="indexterm" name="id372514"></a><a class="indexterm" name="id372522"></a><a class="indexterm" name="id372530"></a> 1044 1044 Samba-3 must be able to tie all user and group account SIDs to a UNIX UID or GID. Samba 1045 1045 does not fabricate the UNIX IDs from thin air, but rather requires them to be located … … 1056 1056 In short then, all UNIX and Windows networking accounts, both in tdbsam as well as in 1057 1057 LDAP, require UIDs/GIDs. 1058 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2605344"></a><a name="id2605346"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2605349"></a><a class="indexterm" name="id2605357"></a><a class="indexterm" name="id2605365"></a>1058 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id372571"></a><a name="id372573"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id372576"></a><a class="indexterm" name="id372584"></a><a class="indexterm" name="id372592"></a> 1059 1059 Why did you validate connectivity before attempting migration? 1060 1060 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1062 1062 potential problems that may otherwise affect or impede account migration. I am always 1063 1063 mindful of the 4 P's of migration: Planning Prevents Poor Performance. 1064 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2605389"></a><a name="id2605392"></a></td><td align="left" valign="top"><p>1064 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id372613"></a><a name="id372615"></a></td><td align="left" valign="top"><p> 1065 1065 How would you merge 10 tdbsam-based domains into an LDAP database? 1066 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id 2605402"></a><a class="indexterm" name="id2605410"></a><a class="indexterm" name="id2605418"></a><a class="indexterm" name="id2605426"></a><a class="indexterm" name="id2605434"></a><a class="indexterm" name="id2605442"></a><a class="indexterm" name="id2605449"></a><a class="indexterm" name="id2605457"></a><a class="indexterm" name="id2605465"></a><a class="indexterm" name="id2605473"></a><a class="indexterm" name="id2605481"></a>1066 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id372626"></a><a class="indexterm" name="id372634"></a><a class="indexterm" name="id372642"></a><a class="indexterm" name="id372649"></a><a class="indexterm" name="id372657"></a><a class="indexterm" name="id372665"></a><a class="indexterm" name="id372672"></a><a class="indexterm" name="id372680"></a><a class="indexterm" name="id372688"></a><a class="indexterm" name="id372696"></a><a class="indexterm" name="id372704"></a> 1067 1067 If you have 10 tdbsam Samba domains, there is considerable risk that there are a number of 1068 1068 accounts that have the same UNIX identifier (UID/GID). This means that you almost … … 1074 1074 you have migrated before handing over access to a user. After all, too many users with a bad 1075 1075 migration experience may threaten your career. 1076 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2605512"></a><a name="id2605514"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2605517"></a><a class="indexterm" name="id2605525"></a>1076 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id372728"></a><a name="id372731"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id372734"></a><a class="indexterm" name="id372742"></a> 1077 1077 I want to change my domain name after I migrate all accounts from an NT4 domain to a 1078 1078 Samba-3 domain. Does it make any sense to migrate the machine accounts in that case? 1079 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id 2605546"></a><a class="indexterm" name="id2605554"></a><a class="indexterm" name="id2605562"></a><a class="indexterm" name="id2605570"></a>1079 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id372761"></a><a class="indexterm" name="id372769"></a><a class="indexterm" name="id372777"></a><a class="indexterm" name="id372785"></a> 1080 1080 I would recommend not to migrate the machine account. The machine accounts should still work, but there are registry entries 1081 1081 on each Windows NT4 and upward client that have a tattoo of the old domain name. If you 1082 1082 unjoin the domain and then rejoin the newly renamed Samba-3 domain, you can be certain to avoid 1083 1083 this tattooing effect. 1084 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2605588"></a><a name="id2605590"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2605593"></a>1084 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id372800"></a><a name="id372802"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id372805"></a> 1085 1085 After merging multiple NT4 domains into a Samba-3 domain, I lost all multiple group mappings. Why? 1086 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id 2605609"></a><a class="indexterm" name="id2605617"></a>1086 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id372820"></a><a class="indexterm" name="id372828"></a> 1087 1087 Samba-3 currently does not implement multiple group membership internally. If you use the Windows 1088 1088 NT4 Domain User Manager to manage accounts and you have an LDAP backend, the multiple group … … 1093 1093 and <code class="filename">/etc/group</code> information also. That is where the multiple group information 1094 1094 is most closely at your fingertips. 1095 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2605652"></a><a name="id2605655"></a></td><td align="left" valign="top"><p>1095 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id372858"></a><a name="id372860"></a></td><td align="left" valign="top"><p> 1096 1096 How can I reset group membership after loading the account information into the LDAP database? 1097 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id 2605666"></a>1097 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id372871"></a> 1098 1098 You can use the NT4 Domain User Manager that can be downloaded from the Microsoft Web site. The 1099 1099 installation file is called <code class="filename">SRVTOOLS.EXE</code>. 1100 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2605687"></a><a name="id2605689"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2605692"></a>1100 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id372890"></a><a name="id372892"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id372895"></a> 1101 1101 What are the limits or constraints that apply to group names? 1102 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id 2605708"></a><a class="indexterm" name="id2605715"></a><a class="indexterm" name="id2605723"></a><a class="indexterm" name="id2605731"></a><a class="indexterm" name="id2605739"></a><a class="indexterm" name="id2605747"></a>1102 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id372910"></a><a class="indexterm" name="id372918"></a><a class="indexterm" name="id372926"></a><a class="indexterm" name="id372934"></a><a class="indexterm" name="id372942"></a><a class="indexterm" name="id372950"></a> 1103 1103 A Windows 200x group name can be up to 254 characters long, while in Windows NT4 the group 1104 1104 name is limited to 20 characters. Most UNIX systems limit this to 32 characters. Windows … … 1112 1112 or user account names. You have to experiment with your system to find what its 1113 1113 peculiarities are. 1114 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2605791"></a><a name="id2605794"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2605797"></a>1114 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id372987"></a><a name="id372989"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id372992"></a> 1115 1115 My Windows NT4 PDC has 323,000 user accounts. How long will it take to migrate them to a Samba-3 1116 1116 LDAP backend system using the vampire process? … … 1121 1121 integer. UNIX/Linux systems that have a 32-bit UID/GID can easily handle this number of accounts. 1122 1122 Please check this carefully before you attempt to effect a migration using the vampire process. 1123 </p><p><a class="indexterm" name="id 2605834"></a>1123 </p><p><a class="indexterm" name="id373019"></a> 1124 1124 Migration speed depends much on the processor speed, the network speed, disk I/O capability, and 1125 1125 LDAP update overheads. On a dual processor AMD MP1600+ with 1 GB memory that was mirroring LDAP -
trunk/server/docs/htmldocs/Samba3-ByExample/nw4migration.html
r414 r599 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 10. Migrating NetWare Server to Samba-3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 4.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="ntmigration.html" title="Chapter 9. Migrating NT4 Domain to Samba-3"><link rel="next" href="RefSection.html" title="Part III. Reference Section"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 10. Migrating NetWare Server to Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="ntmigration.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="RefSection.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="nw4migration"></a>Chapter 10. Migrating NetWare Server to Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="nw4migration.html#id2606026">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id2606137">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id2606228">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id2606305">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id2606495">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id2606504">NetWare Migration Using LDAP Backend</a></span></dt></dl></dd></dl></div><p>2 <a class="indexterm" name="id 2605872"></a>3 <a class="indexterm" name="id 2605878"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 10. Migrating NetWare Server to Samba-3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="ntmigration.html" title="Chapter 9. Migrating NT4 Domain to Samba-3"><link rel="next" href="RefSection.html" title="Part III. Reference Section"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 10. Migrating NetWare Server to Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="ntmigration.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="RefSection.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 10. Migrating NetWare Server to Samba-3"><div class="titlepage"><div><div><h2 class="title"><a name="nw4migration"></a>Chapter 10. Migrating NetWare Server to Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="nw4migration.html#id373183">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id373282">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id373359">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id373431">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="nw4migration.html#id373599">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="nw4migration.html#id373608">NetWare Migration Using LDAP Backend</a></span></dt></dl></dd></dl></div><p> 2 <a class="indexterm" name="id373052"></a> 3 <a class="indexterm" name="id373059"></a> 4 4 Novell is a company any seasoned IT manager has to admire. It has become increasingly 5 5 Linux-friendly and is emerging out of a deep regression that almost saw the company … … 9 9 Meanwhile, there can be no denying that Novell is a Linux company. 10 10 </p><p> 11 <a class="indexterm" name="id 2605896"></a>12 <a class="indexterm" name="id 2605903"></a>13 <a class="indexterm" name="id 2605910"></a>14 <a class="indexterm" name="id 2605917"></a>11 <a class="indexterm" name="id373073"></a> 12 <a class="indexterm" name="id373080"></a> 13 <a class="indexterm" name="id373087"></a> 14 <a class="indexterm" name="id373093"></a> 15 15 Whatever flavor of Linux is preferred in your environment, whether Red Hat, Debian, 16 16 Gentoo, Mandrake, or SUSE (Novell), the information in this chapter should be read with … … 18 18 in this chapter should provide something of value. 19 19 </p><p> 20 <a class="indexterm" name="id 2605932"></a>20 <a class="indexterm" name="id373106"></a> 21 21 Contributions to this chapter were made by Misty Stanley-Jones, a UNIX administrator of many 22 22 years who surfaced on the Samba mailing list with a barrage of questions and who 23 23 regularly helps other administrators to solve thorny Samba migration questions. 24 24 </p><p> 25 <a class="indexterm" name="id 2605946"></a>26 <a class="indexterm" name="id 2605953"></a>27 <a class="indexterm" name="id 2605960"></a>28 <a class="indexterm" name="id 2605966"></a>25 <a class="indexterm" name="id373118"></a> 26 <a class="indexterm" name="id373125"></a> 27 <a class="indexterm" name="id373132"></a> 28 <a class="indexterm" name="id373139"></a> 29 29 One wonders how many NetWare servers remain in active service. Many are being migrated 30 30 to Samba on Linux. Red Hat Linux, SUSE Linux 9.x, and SUSE Linux Enterprise Server 9 are … … 50 50 original documentation contributed by Misty, the Courier-IMAP package had been built 51 51 directly from the original source tarball. 52 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2606026"></a>Introduction</h2></div></div></div><p>53 <a class="indexterm" name="id 2606034"></a>52 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id373183"></a>Introduction</h2></div></div></div><p> 53 <a class="indexterm" name="id373190"></a> 54 54 Misty Stanley-Jones was recruited by Abmas to administer a network that had 55 55 not received much attention for some years and was much in need of a makeover. … … 58 58 </p><p> 59 59 A site survey turned up the following details for the old NetWare server: 60 </p><table class="simplelist" border="0" summary="Simplelist"><tr><td>200 MHz MMX processor</td></tr><tr><td>512K RAM</td></tr><tr><td>24 GB disk space in RAID1</td></tr><tr><td>Novell 4.11 patched to service pack 7</td></tr><tr><td>60+ users</td></tr><tr><td>7 network-attached printers</td></tr></table><p>60 </p><table border="0" summary="Simple list" class="simplelist"><tr><td>200 MHz MMX processor</td></tr><tr><td>512K RAM</td></tr><tr><td>24 GB disk space in RAID1</td></tr><tr><td>Novell 4.11 patched to service pack 7</td></tr><tr><td>60+ users</td></tr><tr><td>7 network-attached printers</td></tr></table><p> 61 61 The company had outgrown this server several years before and was dealing with 62 62 severe growing pains. Some of the problems experienced were: 63 </p><div class="itemizedlist"><ul type="disc"><li><p>Very slow performance</p></li><li><p>Available storage hovering around the 5% range</p><div class="itemizedlist"><ul type="circle"><li><p>Extremely slow print spooling.</p></li><li><p>63 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Very slow performance</p></li><li class="listitem"><p>Available storage hovering around the 5% range</p><div class="itemizedlist"><ul class="itemizedlist" type="circle"><li class="listitem"><p>Extremely slow print spooling.</p></li><li class="listitem"><p> 64 64 Users storing information on their local hard 65 65 drives, causing backup integrity problems 66 66 </p></li></ul></div></li></ul></div><p> 67 <a class="indexterm" name="id 2606123"></a>67 <a class="indexterm" name="id373272"></a> 68 68 At one point disk space had filled up to 100 percent, causing the payroll database 69 69 to become corrupt. This caused the accounting department to be down for over … … 71 71 server was created with very poor security and design considerations from 72 72 a discarded desktop PC. 73 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2606137"></a>Assignment Tasks</h3></div></div></div><p>73 </p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id373282"></a>Assignment Tasks</h3></div></div></div><p> 74 74 Misty has provided this summary of her migration experience in the hope 75 75 that it will help someone to avoid the challenges she faced. Perhaps her … … 90 90 the overall information more useful to you. 91 91 </p><p> 92 <a class="indexterm" name="id 2606174"></a>92 <a class="indexterm" name="id373311"></a> 93 93 After management reviewed a cost-benefit report as well as an estimated 94 94 time-to-completion, approval was given proceed with the solution proposed. 95 95 The server was built from purchased components. The total project cost 96 96 was $3,000. A brief description of the configuration follows: 97 </p><table class="simplelist" border="0" summary="Simplelist"><tr><td>97 </p><table border="0" summary="Simple list" class="simplelist"><tr><td> 98 98 3.0 GHz P4 Processor 99 99 </td></tr><tr><td> … … 112 112 The new system has operated for 6 months without problems. Over the past months 113 113 much attention has been focused on cleaning up desktops and user profiles. 114 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2606228"></a>Dissection and Discussion</h2></div></div></div><p>115 <a class="indexterm" name="id 2606236"></a>116 <a class="indexterm" name="id 2606243"></a>117 <a class="indexterm" name="id 2606250"></a>118 <a class="indexterm" name="id 2606257"></a>114 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id373359"></a>Dissection and Discussion</h2></div></div></div><p> 115 <a class="indexterm" name="id373367"></a> 116 <a class="indexterm" name="id373374"></a> 117 <a class="indexterm" name="id373381"></a> 118 <a class="indexterm" name="id373388"></a> 119 119 A decision to use LDAP was made even though I knew nothing about LDAP except that 120 I had been reading the book “<span class="quote">LDAP System Administration,</span>”by Gerald Carter.120 I had been reading the book <span class="quote">“<span class="quote">LDAP System Administration,</span>”</span> by Gerald Carter. 121 121 LDAP seemed to provide some of the functionality of Novell's e-Directory Services 122 122 and would provide centralized authentication and identity management. 123 123 </p><p> 124 <a class="indexterm" name="id 2606276"></a>125 <a class="indexterm" name="id 2606282"></a>126 <a class="indexterm" name="id 2606289"></a>124 <a class="indexterm" name="id373404"></a> 125 <a class="indexterm" name="id373411"></a> 126 <a class="indexterm" name="id373417"></a> 127 127 Building the LDAP database took a while and a lot of trial and error. Following 128 the guidance I obtained from “<span class="quote">LDAP System129 Administration,</span>” I installed OpenLDAP (from RPM; later I compiled128 the guidance I obtained from <span class="quote">“<span class="quote">LDAP System 129 Administration,</span>”</span> I installed OpenLDAP (from RPM; later I compiled 130 130 a more current version from source) and built my initial LDAP tree. 131 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2606305"></a>Technical Issues</h3></div></div></div><p>132 <a class="indexterm" name="id 2606313"></a>133 <a class="indexterm" name="id 2606319"></a>134 <a class="indexterm" name="id 2606326"></a>135 <a class="indexterm" name="id 2606333"></a>136 <a class="indexterm" name="id 2606340"></a>137 <a class="indexterm" name="id 2606347"></a>138 <a class="indexterm" name="id 2606354"></a>139 <a class="indexterm" name="id 2606360"></a>140 <a class="indexterm" name="id 2606367"></a>131 </p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id373431"></a>Technical Issues</h3></div></div></div><p> 132 <a class="indexterm" name="id373439"></a> 133 <a class="indexterm" name="id373446"></a> 134 <a class="indexterm" name="id373452"></a> 135 <a class="indexterm" name="id373459"></a> 136 <a class="indexterm" name="id373466"></a> 137 <a class="indexterm" name="id373473"></a> 138 <a class="indexterm" name="id373480"></a> 139 <a class="indexterm" name="id373486"></a> 140 <a class="indexterm" name="id373493"></a> 141 141 The first challenge was to create a company white pages, followed by manually 142 142 entering everything from the printed company directory. This used only the inetOrgPerson … … 147 147 and SMTP. 148 148 </p><p> 149 Because a decision was made to use Courier-IMAP the schema “<span class="quote">authldap.schema</span>”149 Because a decision was made to use Courier-IMAP the schema <span class="quote">“<span class="quote">authldap.schema</span>”</span> 150 150 from the Courier-IMAP source, tarball is necessary to resolve Courier-specific LDAP directory 151 151 needs. Where the Courier-IMAP file provided by SUSE is used, this file is named … … 184 184 echo "userPassword: $userPassword" 185 185 done 186 </pre></div></div><br class="example-break"><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>186 </pre></div></div><br class="example-break"><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 187 187 188 188 The PADL MigrationTools are recommended for migration of the UNIX account information into … … 190 190 aliases, hosts, netgroups, networks, protocols, PRCs, and services from the existing ASCII text 191 191 files (or from a name service such as NIS). This too set can be obtained from the <a class="ulink" href="http://www.padl.com" target="_top">PADL Web site</a>. 192 </p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2606495"></a>Implementation</h2></div></div></div><p>193 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2606504"></a>NetWare Migration Using LDAP Backend</h3></div></div></div><p>192 </p></div></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id373599"></a>Implementation</h2></div></div></div><p> 193 </p><div class="sect2" title="NetWare Migration Using LDAP Backend"><div class="titlepage"><div><div><h3 class="title"><a name="id373608"></a>NetWare Migration Using LDAP Backend</h3></div></div></div><p> 194 194 The following software must be installed on the SUSE Linux Enterprise Server to perform 195 195 this migration: 196 </p><table class="simplelist" border="0" summary="Simplelist"><tr><td>courier-imap</td></tr><tr><td>courier-imap-ldap</td></tr><tr><td>nss_ldap</td></tr><tr><td>openldap2-client</td></tr><tr><td>openldap2-devel (only for Samba compilation)</td></tr><tr><td>openldap2</td></tr><tr><td>pam_ldap</td></tr><tr><td>samba-3.0.20 or later</td></tr><tr><td>samba-client-3.0.20 or later</td></tr><tr><td>samba-winbind-3.0.20 or later</td></tr><tr><td>smbldap-tools Version 0.9.1</td></tr></table><p>196 </p><table border="0" summary="Simple list" class="simplelist"><tr><td>courier-imap</td></tr><tr><td>courier-imap-ldap</td></tr><tr><td>nss_ldap</td></tr><tr><td>openldap2-client</td></tr><tr><td>openldap2-devel (only for Samba compilation)</td></tr><tr><td>openldap2</td></tr><tr><td>pam_ldap</td></tr><tr><td>samba-3.0.20 or later</td></tr><tr><td>samba-client-3.0.20 or later</td></tr><tr><td>samba-winbind-3.0.20 or later</td></tr><tr><td>smbldap-tools Version 0.9.1</td></tr></table><p> 197 197 Each software application must be carefully configured in preparation for migration. 198 198 The configuration files used at Abmas are provided as a guide and should be modified 199 199 to meet needs at your site. 200 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2606568"></a>LDAP Server Configuration</h4></div></div></div><p>200 </p><div class="sect3" title="LDAP Server Configuration"><div class="titlepage"><div><div><h4 class="title"><a name="id373667"></a>LDAP Server Configuration</h4></div></div></div><p> 201 201 The <code class="filename">/etc/openldap/slapd.conf</code> file Misty used is shown here: 202 202 </p><pre class="programlisting"> … … 363 363 </pre><p> 364 364 </p><p> 365 <a class="indexterm" name="id 2606766"></a>365 <a class="indexterm" name="id373778"></a> 366 366 The <code class="filename">/etc/ldap.conf</code> file used is listed in <a class="link" href="nw4migration.html#ch8ldap" title="Example 10.2. NSS LDAP Control File /etc/ldap.conf">“NSS LDAP Control File /etc/ldap.conf”</a>. 367 367 </p><div class="example"><a name="ch8ldap"></a><p class="title"><b>Example 10.2. NSS LDAP Control File /etc/ldap.conf</b></p><div class="example-contents"><pre class="screen"> … … 417 417 </pre><p> 418 418 </p><p> 419 <a class="indexterm" name="id 2606851"></a>420 <a class="indexterm" name="id 2606857"></a>419 <a class="indexterm" name="id373848"></a> 420 <a class="indexterm" name="id373854"></a> 421 421 In my setup, users authenticate via PAM and NSS using LDAP-based accounts. 422 422 The configuration file that controls the behavior of the PAM <code class="literal">pam_unix2</code> … … 459 459 password: use_ldap 460 460 session: none 461 </pre></div></div><br class="example-break"><a class="indexterm" name="id 2606922"></a><a class="indexterm" name="id2606929"></a><a class="indexterm" name="id2606936"></a><div class="itemizedlist"><ul type="disc"><li><p>461 </pre></div></div><br class="example-break"><a class="indexterm" name="id373906"></a><a class="indexterm" name="id373913"></a><a class="indexterm" name="id373920"></a><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 462 462 If your LDAP database goes down, nobody can authenticate except for root. 463 </p></li><li ><p>463 </p></li><li class="listitem"><p> 464 464 If failover is configured incorrectly, weird behavior can occur. For example, 465 465 DNS can fail to resolve. … … 469 469 </p><p> 470 470 The following services authenticate using LDAP: 471 </p><a class="indexterm" name="id 2606972"></a><a class="indexterm" name="id2606979"></a><a class="indexterm" name="id2606986"></a><table class="simplelist" border="0" summary="Simplelist"><tr><td>UNIX login/ssh</td></tr><tr><td>Postfix (SMTP)</td></tr><tr><td>Courier-IMAP/IMAPS/POP3/POP3S</td></tr></table><p>472 <a class="indexterm" name="id 2607011"></a>473 <a class="indexterm" name="id 2607018"></a>471 </p><a class="indexterm" name="id373952"></a><a class="indexterm" name="id373959"></a><a class="indexterm" name="id373966"></a><table border="0" summary="Simple list" class="simplelist"><tr><td>UNIX login/ssh</td></tr><tr><td>Postfix (SMTP)</td></tr><tr><td>Courier-IMAP/IMAPS/POP3/POP3S</td></tr></table><p> 472 <a class="indexterm" name="id373991"></a> 473 <a class="indexterm" name="id373998"></a> 474 474 Companywide white pages can be searched using an LDAP client 475 475 such as the one in the Windows Address Book. 476 476 </p><p> 477 <a class="indexterm" name="id 2607030"></a>478 <a class="indexterm" name="id 2607037"></a>477 <a class="indexterm" name="id374009"></a> 478 <a class="indexterm" name="id374016"></a> 479 479 Having gained a solid understanding of LDAP and a relatively workable LDAP tree 480 480 thus far, it was time to configure Samba. I compiled the latest stable Samba and … … 483 483 </p><p> 484 484 The Samba <code class="filename">smb.conf</code> file was configured as shown in <a class="link" href="nw4migration.html#ch8smbconf" title="Example 10.4. Samba Configuration File smb.conf Part A">“Samba Configuration File smb.conf Part A”</a>. 485 </p><div class="example"><a name="ch8smbconf"></a><p class="title"><b>Example 10.4. Samba Configuration File smb.conf Part A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2607107"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id2607119"></a><em class="parameter"><code>netbios name = MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id2607130"></a><em class="parameter"><code>server string = Corp File Server</code></em></td></tr><tr><td><a class="indexterm" name="id2607142"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id2607155"></a><em class="parameter"><code>pam password change = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2607166"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2607178"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2607190"></a><em class="parameter"><code>log file = /data/samba/log/%m.log</code></em></td></tr><tr><td><a class="indexterm" name="id2607202"></a><em class="parameter"><code>name resolve order = wins host bcast</code></em></td></tr><tr><td><a class="indexterm" name="id2607214"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2607226"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2607238"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2607250"></a><em class="parameter"><code>cups options = Raw</code></em></td></tr><tr><td><a class="indexterm" name="id2607261"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id2607274"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd -p "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id2607286"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/smbldap-groupmod -m "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id2607299"></a><em class="parameter"><code>delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id2607312"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g "%g" "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id2607325"></a><em class="parameter"><code>add machine script = /usr/local/sbin/smbldap-useradd -w "%m"</code></em></td></tr><tr><td><a class="indexterm" name="id2607338"></a><em class="parameter"><code>logon script = logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2607349"></a><em class="parameter"><code>logon path = \\%L\profiles\%U\%a</code></em></td></tr><tr><td><a class="indexterm" name="id2607361"></a><em class="parameter"><code>logon drive = H:</code></em></td></tr><tr><td><a class="indexterm" name="id2607373"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2607385"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2607396"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2607408"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2607420"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2607432"></a><em class="parameter"><code>ldap idmap suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2607444"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2607456"></a><em class="parameter"><code>ldap passwd sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2607468"></a><em class="parameter"><code>ldap suffix = ou=MEGANET2,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2607480"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id2607492"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2607504"></a><em class="parameter"><code>admin users = root, "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id2607516"></a><em class="parameter"><code>printer admin = "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id2607528"></a><em class="parameter"><code>force printername = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch8smbconf2"></a><p class="title"><b>Example 10.5. Samba Configuration File smb.conf Part B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2607567"></a><em class="parameter"><code>comment = Network logon service</code></em></td></tr><tr><td><a class="indexterm" name="id2607579"></a><em class="parameter"><code>path = /data/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2607591"></a><em class="parameter"><code>write list = "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id2607603"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2607623"></a><em class="parameter"><code>comment = Roaming Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2607635"></a><em class="parameter"><code>path = /data/samba/profiles/</code></em></td></tr><tr><td><a class="indexterm" name="id2607647"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2607658"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2607670"></a><em class="parameter"><code>veto files = desktop.ini</code></em></td></tr><tr><td><a class="indexterm" name="id2607682"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2607702"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2607714"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2607726"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2607737"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td><a class="indexterm" name="id2607749"></a><em class="parameter"><code>veto files = desktop.ini</code></em></td></tr><tr><td><a class="indexterm" name="id2607761"></a><em class="parameter"><code>hide files = desktop.ini</code></em></td></tr><tr><td><a class="indexterm" name="id2607772"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[software]</code></em></td></tr><tr><td><a class="indexterm" name="id2607793"></a><em class="parameter"><code>comment = Software for %a computers</code></em></td></tr><tr><td><a class="indexterm" name="id2607805"></a><em class="parameter"><code>path = /data/samba/shares/software/%a</code></em></td></tr><tr><td><a class="indexterm" name="id2607817"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[public]</code></em></td></tr><tr><td><a class="indexterm" name="id2607837"></a><em class="parameter"><code>comment = Public Files</code></em></td></tr><tr><td><a class="indexterm" name="id2607849"></a><em class="parameter"><code>path = /data/samba/shares/public</code></em></td></tr><tr><td><a class="indexterm" name="id2607861"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2607873"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[PDF]</code></em></td></tr><tr><td><a class="indexterm" name="id2607893"></a><em class="parameter"><code>comment = Location of documents printed to PDFCreator printer</code></em></td></tr><tr><td><a class="indexterm" name="id2607906"></a><em class="parameter"><code>path = /data/samba/shares/pdf</code></em></td></tr><tr><td><a class="indexterm" name="id2607917"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch8smbconf3"></a><p class="title"><b>Example 10.6. Samba Configuration File smb.conf Part C</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[EVERYTHING]</code></em></td></tr><tr><td><a class="indexterm" name="id2607956"></a><em class="parameter"><code>comment = All shares</code></em></td></tr><tr><td><a class="indexterm" name="id2607968"></a><em class="parameter"><code>path = /data/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2607980"></a><em class="parameter"><code>valid users = "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id2607992"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[CDROM]</code></em></td></tr><tr><td><a class="indexterm" name="id2608012"></a><em class="parameter"><code>comment = CD-ROM on MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id2608024"></a><em class="parameter"><code>path = /mnt</code></em></td></tr><tr><td><a class="indexterm" name="id2608035"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id2608056"></a><em class="parameter"><code>comment = Printer Drivers Share</code></em></td></tr><tr><td><a class="indexterm" name="id2608068"></a><em class="parameter"><code>path = /data/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2608079"></a><em class="parameter"><code>write list = root</code></em></td></tr><tr><td><a class="indexterm" name="id2608091"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2608112"></a><em class="parameter"><code>comment = All Printers</code></em></td></tr><tr><td><a class="indexterm" name="id2608123"></a><em class="parameter"><code>path = /data/samba/spool</code></em></td></tr><tr><td><a class="indexterm" name="id2608135"></a><em class="parameter"><code>create mask = 0644</code></em></td></tr><tr><td><a class="indexterm" name="id2608147"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2608158"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[acct_hp8500]</code></em></td></tr><tr><td><a class="indexterm" name="id2608179"></a><em class="parameter"><code>comment = "Accounting Color Laser Printer"</code></em></td></tr><tr><td><a class="indexterm" name="id2608191"></a><em class="parameter"><code>path = /data/samba/spool/private</code></em></td></tr><tr><td><a class="indexterm" name="id2608203"></a><em class="parameter"><code>valid users = @acct, @acct_admin, @hr, "@Domain Admins",@Receptionist, dwayne, terri, danae, jerry</code></em></td></tr><tr><td><a class="indexterm" name="id2608216"></a><em class="parameter"><code>create mask = 0644</code></em></td></tr><tr><td><a class="indexterm" name="id2608227"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2608239"></a><em class="parameter"><code>copy = printers</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[plotter]</code></em></td></tr><tr><td><a class="indexterm" name="id2608259"></a><em class="parameter"><code>comment = Engineering Plotter</code></em></td></tr><tr><td><a class="indexterm" name="id2608271"></a><em class="parameter"><code>path = /data/samba/spool</code></em></td></tr><tr><td><a class="indexterm" name="id2608283"></a><em class="parameter"><code>create mask = 0644</code></em></td></tr><tr><td><a class="indexterm" name="id2608295"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2608306"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2608318"></a><em class="parameter"><code>copy = printers</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch8smbconf4"></a><p class="title"><b>Example 10.7. Samba Configuration File smb.conf Part D</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[APPS]</code></em></td></tr><tr><td><a class="indexterm" name="id2608357"></a><em class="parameter"><code>path = /data/samba/shares/Apps</code></em></td></tr><tr><td><a class="indexterm" name="id2608369"></a><em class="parameter"><code>force group = "Domain Users"</code></em></td></tr><tr><td><a class="indexterm" name="id2608381"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[ACCT]</code></em></td></tr><tr><td><a class="indexterm" name="id2608402"></a><em class="parameter"><code>path = /data/samba/shares/Accounting</code></em></td></tr><tr><td><a class="indexterm" name="id2608414"></a><em class="parameter"><code>valid users = @acct, "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id2608426"></a><em class="parameter"><code>force group = acct</code></em></td></tr><tr><td><a class="indexterm" name="id2608437"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2608449"></a><em class="parameter"><code>create mask = 0660</code></em></td></tr><tr><td><a class="indexterm" name="id2608460"></a><em class="parameter"><code>directory mask = 0770</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[ACCT_ADMIN]</code></em></td></tr><tr><td><a class="indexterm" name="id2608481"></a><em class="parameter"><code>path = /data/samba/shares/Acct_Admin</code></em></td></tr><tr><td><a class="indexterm" name="id2608493"></a><em class="parameter"><code>valid users = @"acct_admin"</code></em></td></tr><tr><td><a class="indexterm" name="id2608505"></a><em class="parameter"><code>force group = acct_admin</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[HR_PR]</code></em></td></tr><tr><td><a class="indexterm" name="id2608526"></a><em class="parameter"><code>path = /data/samba/shares/HR_PR</code></em></td></tr><tr><td><a class="indexterm" name="id2608538"></a><em class="parameter"><code>valid users = @hr, @acct_admin</code></em></td></tr><tr><td><a class="indexterm" name="id2608549"></a><em class="parameter"><code>force group = hr</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[ENGR]</code></em></td></tr><tr><td><a class="indexterm" name="id2608570"></a><em class="parameter"><code>path = /data/samba/shares/Engr</code></em></td></tr><tr><td><a class="indexterm" name="id2608582"></a><em class="parameter"><code>valid users = @engr, @receptionist, @truss, "@Domain Admins", cheri</code></em></td></tr><tr><td><a class="indexterm" name="id2608594"></a><em class="parameter"><code>force group = engr</code></em></td></tr><tr><td><a class="indexterm" name="id2608606"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2608617"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[DATA]</code></em></td></tr><tr><td><a class="indexterm" name="id2608638"></a><em class="parameter"><code>path = /data/samba/shares/DATA</code></em></td></tr><tr><td><a class="indexterm" name="id2608650"></a><em class="parameter"><code>valid users = @engr, @receptionist, @truss, "@Domain Admins", cheri</code></em></td></tr><tr><td><a class="indexterm" name="id2608662"></a><em class="parameter"><code>force group = engr</code></em></td></tr><tr><td><a class="indexterm" name="id2608674"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2608685"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td><a class="indexterm" name="id2608697"></a><em class="parameter"><code>copy = engr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch8smbconf5"></a><p class="title"><b>Example 10.8. Samba Configuration File smb.conf Part E</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[X]</code></em></td></tr><tr><td><a class="indexterm" name="id2608736"></a><em class="parameter"><code>path = /data/samba/shares/X</code></em></td></tr><tr><td><a class="indexterm" name="id2608748"></a><em class="parameter"><code>valid users = @engr, @acct</code></em></td></tr><tr><td><a class="indexterm" name="id2608759"></a><em class="parameter"><code>force group = engr</code></em></td></tr><tr><td><a class="indexterm" name="id2608771"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2608782"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td><a class="indexterm" name="id2608794"></a><em class="parameter"><code>copy = engr</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[NETWORK]</code></em></td></tr><tr><td><a class="indexterm" name="id2608814"></a><em class="parameter"><code>path = /data/samba/shares/network</code></em></td></tr><tr><td><a class="indexterm" name="id2608826"></a><em class="parameter"><code>valid users = "@Domain Users"</code></em></td></tr><tr><td><a class="indexterm" name="id2608838"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2608850"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td><a class="indexterm" name="id2608861"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[UTILS]</code></em></td></tr><tr><td><a class="indexterm" name="id2608882"></a><em class="parameter"><code>path = /data/samba/shares/Utils</code></em></td></tr><tr><td><a class="indexterm" name="id2608894"></a><em class="parameter"><code>write list = "@Domain Admins"</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[SYS]</code></em></td></tr><tr><td><a class="indexterm" name="id2608915"></a><em class="parameter"><code>path = /data/samba/shares/SYS</code></em></td></tr><tr><td><a class="indexterm" name="id2608926"></a><em class="parameter"><code>valid users = chad</code></em></td></tr><tr><td><a class="indexterm" name="id2608938"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2608950"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><p>486 <a class="indexterm" name="id 2608964"></a>487 <a class="indexterm" name="id 2608971"></a>488 <a class="indexterm" name="id 2608978"></a>485 </p><div class="example"><a name="ch8smbconf"></a><p class="title"><b>Example 10.4. Samba Configuration File smb.conf Part A</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id374082"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id374094"></a><em class="parameter"><code>netbios name = MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id374105"></a><em class="parameter"><code>server string = Corp File Server</code></em></td></tr><tr><td><a class="indexterm" name="id374117"></a><em class="parameter"><code>passdb backend = ldapsam:ldap://localhost</code></em></td></tr><tr><td><a class="indexterm" name="id374128"></a><em class="parameter"><code>pam password change = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id374140"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id374152"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id374163"></a><em class="parameter"><code>log file = /data/samba/log/%m.log</code></em></td></tr><tr><td><a class="indexterm" name="id374175"></a><em class="parameter"><code>name resolve order = wins host bcast</code></em></td></tr><tr><td><a class="indexterm" name="id374186"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id374198"></a><em class="parameter"><code>printcap name = cups</code></em></td></tr><tr><td><a class="indexterm" name="id374209"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id374221"></a><em class="parameter"><code>cups options = Raw</code></em></td></tr><tr><td><a class="indexterm" name="id374232"></a><em class="parameter"><code>add user script = /opt/IDEALX/sbin/smbldap-useradd -m "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id374244"></a><em class="parameter"><code>add group script = /opt/IDEALX/sbin/smbldap-groupadd -p "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id374256"></a><em class="parameter"><code>add user to group script = /opt/IDEALX/sbin/smbldap-groupmod -m "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id374268"></a><em class="parameter"><code>delete user from group script = /opt/IDEALX/sbin/smbldap-groupmod -x "%u" "%g"</code></em></td></tr><tr><td><a class="indexterm" name="id374280"></a><em class="parameter"><code>set primary group script = /opt/IDEALX/sbin/smbldap-usermod -g "%g" "%u"</code></em></td></tr><tr><td><a class="indexterm" name="id374292"></a><em class="parameter"><code>add machine script = /usr/local/sbin/smbldap-useradd -w "%m"</code></em></td></tr><tr><td><a class="indexterm" name="id374304"></a><em class="parameter"><code>logon script = logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id374316"></a><em class="parameter"><code>logon path = \\%L\profiles\%U\%a</code></em></td></tr><tr><td><a class="indexterm" name="id374328"></a><em class="parameter"><code>logon drive = H:</code></em></td></tr><tr><td><a class="indexterm" name="id374339"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id374350"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id374362"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id374373"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id374385"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id374397"></a><em class="parameter"><code>ldap idmap suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id374408"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id374420"></a><em class="parameter"><code>ldap passwd sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id374431"></a><em class="parameter"><code>ldap suffix = ou=MEGANET2,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id374443"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id374455"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id374466"></a><em class="parameter"><code>admin users = root, "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id374478"></a><em class="parameter"><code>printer admin = "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id374489"></a><em class="parameter"><code>force printername = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch8smbconf2"></a><p class="title"><b>Example 10.5. Samba Configuration File smb.conf Part B</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id374528"></a><em class="parameter"><code>comment = Network logon service</code></em></td></tr><tr><td><a class="indexterm" name="id374540"></a><em class="parameter"><code>path = /data/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id374551"></a><em class="parameter"><code>write list = "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id374563"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id374583"></a><em class="parameter"><code>comment = Roaming Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id374595"></a><em class="parameter"><code>path = /data/samba/profiles/</code></em></td></tr><tr><td><a class="indexterm" name="id374607"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id374618"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id374630"></a><em class="parameter"><code>veto files = desktop.ini</code></em></td></tr><tr><td><a class="indexterm" name="id374641"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id374662"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id374673"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id374685"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id374696"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td><a class="indexterm" name="id374708"></a><em class="parameter"><code>veto files = desktop.ini</code></em></td></tr><tr><td><a class="indexterm" name="id374719"></a><em class="parameter"><code>hide files = desktop.ini</code></em></td></tr><tr><td><a class="indexterm" name="id374731"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[software]</code></em></td></tr><tr><td><a class="indexterm" name="id374751"></a><em class="parameter"><code>comment = Software for %a computers</code></em></td></tr><tr><td><a class="indexterm" name="id374763"></a><em class="parameter"><code>path = /data/samba/shares/software/%a</code></em></td></tr><tr><td><a class="indexterm" name="id374774"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[public]</code></em></td></tr><tr><td><a class="indexterm" name="id374795"></a><em class="parameter"><code>comment = Public Files</code></em></td></tr><tr><td><a class="indexterm" name="id374806"></a><em class="parameter"><code>path = /data/samba/shares/public</code></em></td></tr><tr><td><a class="indexterm" name="id374818"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id374829"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[PDF]</code></em></td></tr><tr><td><a class="indexterm" name="id374850"></a><em class="parameter"><code>comment = Location of documents printed to PDFCreator printer</code></em></td></tr><tr><td><a class="indexterm" name="id374862"></a><em class="parameter"><code>path = /data/samba/shares/pdf</code></em></td></tr><tr><td><a class="indexterm" name="id374873"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch8smbconf3"></a><p class="title"><b>Example 10.6. Samba Configuration File smb.conf Part C</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[EVERYTHING]</code></em></td></tr><tr><td><a class="indexterm" name="id374912"></a><em class="parameter"><code>comment = All shares</code></em></td></tr><tr><td><a class="indexterm" name="id374923"></a><em class="parameter"><code>path = /data/samba</code></em></td></tr><tr><td><a class="indexterm" name="id374934"></a><em class="parameter"><code>valid users = "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id374946"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[CDROM]</code></em></td></tr><tr><td><a class="indexterm" name="id374966"></a><em class="parameter"><code>comment = CD-ROM on MASSIVE</code></em></td></tr><tr><td><a class="indexterm" name="id374978"></a><em class="parameter"><code>path = /mnt</code></em></td></tr><tr><td><a class="indexterm" name="id374990"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id375010"></a><em class="parameter"><code>comment = Printer Drivers Share</code></em></td></tr><tr><td><a class="indexterm" name="id375022"></a><em class="parameter"><code>path = /data/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id375033"></a><em class="parameter"><code>write list = root</code></em></td></tr><tr><td><a class="indexterm" name="id375045"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id375065"></a><em class="parameter"><code>comment = All Printers</code></em></td></tr><tr><td><a class="indexterm" name="id375076"></a><em class="parameter"><code>path = /data/samba/spool</code></em></td></tr><tr><td><a class="indexterm" name="id375088"></a><em class="parameter"><code>create mask = 0644</code></em></td></tr><tr><td><a class="indexterm" name="id375100"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id375111"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[acct_hp8500]</code></em></td></tr><tr><td><a class="indexterm" name="id375131"></a><em class="parameter"><code>comment = "Accounting Color Laser Printer"</code></em></td></tr><tr><td><a class="indexterm" name="id375143"></a><em class="parameter"><code>path = /data/samba/spool/private</code></em></td></tr><tr><td><a class="indexterm" name="id375155"></a><em class="parameter"><code>valid users = @acct, @acct_admin, @hr, "@Domain Admins",@Receptionist, dwayne, terri, danae, jerry</code></em></td></tr><tr><td><a class="indexterm" name="id375167"></a><em class="parameter"><code>create mask = 0644</code></em></td></tr><tr><td><a class="indexterm" name="id375178"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id375190"></a><em class="parameter"><code>copy = printers</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[plotter]</code></em></td></tr><tr><td><a class="indexterm" name="id375210"></a><em class="parameter"><code>comment = Engineering Plotter</code></em></td></tr><tr><td><a class="indexterm" name="id375222"></a><em class="parameter"><code>path = /data/samba/spool</code></em></td></tr><tr><td><a class="indexterm" name="id375233"></a><em class="parameter"><code>create mask = 0644</code></em></td></tr><tr><td><a class="indexterm" name="id375245"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id375256"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id375268"></a><em class="parameter"><code>copy = printers</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch8smbconf4"></a><p class="title"><b>Example 10.7. Samba Configuration File smb.conf Part D</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[APPS]</code></em></td></tr><tr><td><a class="indexterm" name="id375307"></a><em class="parameter"><code>path = /data/samba/shares/Apps</code></em></td></tr><tr><td><a class="indexterm" name="id375318"></a><em class="parameter"><code>force group = "Domain Users"</code></em></td></tr><tr><td><a class="indexterm" name="id375330"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[ACCT]</code></em></td></tr><tr><td><a class="indexterm" name="id375350"></a><em class="parameter"><code>path = /data/samba/shares/Accounting</code></em></td></tr><tr><td><a class="indexterm" name="id375362"></a><em class="parameter"><code>valid users = @acct, "@Domain Admins"</code></em></td></tr><tr><td><a class="indexterm" name="id375373"></a><em class="parameter"><code>force group = acct</code></em></td></tr><tr><td><a class="indexterm" name="id375385"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id375396"></a><em class="parameter"><code>create mask = 0660</code></em></td></tr><tr><td><a class="indexterm" name="id375408"></a><em class="parameter"><code>directory mask = 0770</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[ACCT_ADMIN]</code></em></td></tr><tr><td><a class="indexterm" name="id375428"></a><em class="parameter"><code>path = /data/samba/shares/Acct_Admin</code></em></td></tr><tr><td><a class="indexterm" name="id375440"></a><em class="parameter"><code>valid users = @"acct_admin"</code></em></td></tr><tr><td><a class="indexterm" name="id375451"></a><em class="parameter"><code>force group = acct_admin</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[HR_PR]</code></em></td></tr><tr><td><a class="indexterm" name="id375472"></a><em class="parameter"><code>path = /data/samba/shares/HR_PR</code></em></td></tr><tr><td><a class="indexterm" name="id375484"></a><em class="parameter"><code>valid users = @hr, @acct_admin</code></em></td></tr><tr><td><a class="indexterm" name="id375495"></a><em class="parameter"><code>force group = hr</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[ENGR]</code></em></td></tr><tr><td><a class="indexterm" name="id375516"></a><em class="parameter"><code>path = /data/samba/shares/Engr</code></em></td></tr><tr><td><a class="indexterm" name="id375527"></a><em class="parameter"><code>valid users = @engr, @receptionist, @truss, "@Domain Admins", cheri</code></em></td></tr><tr><td><a class="indexterm" name="id375539"></a><em class="parameter"><code>force group = engr</code></em></td></tr><tr><td><a class="indexterm" name="id375550"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id375562"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[DATA]</code></em></td></tr><tr><td><a class="indexterm" name="id375582"></a><em class="parameter"><code>path = /data/samba/shares/DATA</code></em></td></tr><tr><td><a class="indexterm" name="id375594"></a><em class="parameter"><code>valid users = @engr, @receptionist, @truss, "@Domain Admins", cheri</code></em></td></tr><tr><td><a class="indexterm" name="id375606"></a><em class="parameter"><code>force group = engr</code></em></td></tr><tr><td><a class="indexterm" name="id375617"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id375629"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td><a class="indexterm" name="id375640"></a><em class="parameter"><code>copy = engr</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch8smbconf5"></a><p class="title"><b>Example 10.8. Samba Configuration File smb.conf Part E</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[X]</code></em></td></tr><tr><td><a class="indexterm" name="id375679"></a><em class="parameter"><code>path = /data/samba/shares/X</code></em></td></tr><tr><td><a class="indexterm" name="id375690"></a><em class="parameter"><code>valid users = @engr, @acct</code></em></td></tr><tr><td><a class="indexterm" name="id375702"></a><em class="parameter"><code>force group = engr</code></em></td></tr><tr><td><a class="indexterm" name="id375713"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id375725"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td><a class="indexterm" name="id375736"></a><em class="parameter"><code>copy = engr</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[NETWORK]</code></em></td></tr><tr><td><a class="indexterm" name="id375757"></a><em class="parameter"><code>path = /data/samba/shares/network</code></em></td></tr><tr><td><a class="indexterm" name="id375768"></a><em class="parameter"><code>valid users = "@Domain Users"</code></em></td></tr><tr><td><a class="indexterm" name="id375780"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id375791"></a><em class="parameter"><code>create mask = 0770</code></em></td></tr><tr><td><a class="indexterm" name="id375803"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[UTILS]</code></em></td></tr><tr><td><a class="indexterm" name="id375823"></a><em class="parameter"><code>path = /data/samba/shares/Utils</code></em></td></tr><tr><td><a class="indexterm" name="id375835"></a><em class="parameter"><code>write list = "@Domain Admins"</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[SYS]</code></em></td></tr><tr><td><a class="indexterm" name="id375855"></a><em class="parameter"><code>path = /data/samba/shares/SYS</code></em></td></tr><tr><td><a class="indexterm" name="id375867"></a><em class="parameter"><code>valid users = chad</code></em></td></tr><tr><td><a class="indexterm" name="id375878"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id375890"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><p> 486 <a class="indexterm" name="id375905"></a> 487 <a class="indexterm" name="id375911"></a> 488 <a class="indexterm" name="id375918"></a> 489 489 Most of these shares are only used by one company group, but they are required 490 490 because of some ancient Qbasic and Rbase applications were that written expecting 491 491 their own drive letters. 492 492 </p><p> 493 <a class="indexterm" name="id 2608992"></a>494 <a class="indexterm" name="id 2608998"></a>495 <a class="indexterm" name="id 2609005"></a>493 <a class="indexterm" name="id375930"></a> 494 <a class="indexterm" name="id375937"></a> 495 <a class="indexterm" name="id375944"></a> 496 496 Note: During the process of building the new server, I kept data files 497 497 up to date with the Novell server via use of <code class="literal">rsync</code>. … … 557 557 <code class="prompt">root# </code> smbpasswd -w verysecret 558 558 </pre><p> 559 where “<span class="quote">verysecret</span>”is replaced by the LDAP bind password.560 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>559 where <span class="quote">“<span class="quote">verysecret</span>”</span> is replaced by the LDAP bind password. 560 </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 561 561 The Idealx smbldap-tools package can be configured using a script called 562 562 <code class="literal">configure.pl</code> that is provided as part of the tool. See <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a> … … 740 740 smbpasswd="/usr/bin/smbpasswd" 741 741 </pre></div></div><br class="example-break"><p> 742 <a class="indexterm" name="id 2609419"></a>742 <a class="indexterm" name="id376262"></a> 743 743 Note: I chose not to take advantage of the TLS capability of this. 744 744 Eventually I may go back and tweak it. Also, I chose not to take advantage … … 814 814 </pre><p> 815 815 </p><p> 816 <a class="indexterm" name="id 2609520"></a>817 <a class="indexterm" name="id 2609527"></a>818 <a class="indexterm" name="id 2609534"></a>819 <a class="indexterm" name="id 2609540"></a>820 <a class="indexterm" name="id 2609547"></a>816 <a class="indexterm" name="id376336"></a> 817 <a class="indexterm" name="id376343"></a> 818 <a class="indexterm" name="id376350"></a> 819 <a class="indexterm" name="id376357"></a> 820 <a class="indexterm" name="id376363"></a> 821 821 With the LDAP directory now initialized, it was time to create the Windows and POSIX 822 822 (UNIX) group accounts as well as the mappings from Windows groups to UNIX groups. … … 826 826 try to do this by hand. 827 827 </p><p> 828 <a class="indexterm" name="id 2609570"></a>829 <a class="indexterm" name="id 2609577"></a>830 <a class="indexterm" name="id 2609584"></a>828 <a class="indexterm" name="id376383"></a> 829 <a class="indexterm" name="id376389"></a> 830 <a class="indexterm" name="id376396"></a> 831 831 After I had my group mappings in place, I added users to the groups (the users 832 832 don't really have to exist yet). I used the <code class="literal">smbldap-groupmod</code> … … 834 834 attributes to the group entries in LDAP. 835 835 </p><p> 836 <a class="indexterm" name="id 2609604"></a>837 <a class="indexterm" name="id 2609611"></a>838 <a class="indexterm" name="id 2609618"></a>836 <a class="indexterm" name="id376414"></a> 837 <a class="indexterm" name="id376421"></a> 838 <a class="indexterm" name="id376428"></a> 839 839 The most monumental task of all was adding the sambaSamAccount information to each 840 840 already existent posixAccount entry. I did it one at a time as I moved people onto … … 843 843 <code class="prompt">root# </code> smbldap-usermod -a -P username 844 844 </pre><p> 845 <a class="indexterm" name="id 2609640"></a>846 <a class="indexterm" name="id 2609647"></a>847 <a class="indexterm" name="id 2609654"></a>845 <a class="indexterm" name="id376448"></a> 846 <a class="indexterm" name="id376455"></a> 847 <a class="indexterm" name="id376462"></a> 848 848 I completed that step for every user after asking the person what his or her current 849 849 NetWare password was. The wiser way to have done it would probably have been to dump the … … 852 852 <code class="prompt">root# </code> slapcat > somefile.ldif 853 853 </pre><p> 854 <a class="indexterm" name="id 2609678"></a>855 <a class="indexterm" name="id 2609684"></a>854 <a class="indexterm" name="id376483"></a> 855 <a class="indexterm" name="id376490"></a> 856 856 Then update the LDIF file created by using a Perl script to parse and add the 857 857 appropriate attributes and objectClasses to each entry, followed by re-importing … … 934 934 </pre><p> 935 935 </p><p> 936 <a class="indexterm" name="id 2609789"></a>936 <a class="indexterm" name="id376575"></a> 937 937 So now I could log on with a test user from the machine w2kengrspare. It was all well and 938 938 good, but that user was in no groups yet and so had pretty boring access. I fixed that … … 943 943 I also did not have to do a logon script per user or per group. 944 944 </p><p> 945 <a class="indexterm" name="id 2609813"></a>945 <a class="indexterm" name="id376595"></a> 946 946 I downloaded Kixtart and put the following files in my netlogon share: 947 947 </p><pre class="screen"> … … 955 955 </pre><p> 956 956 </p><p> 957 <a class="indexterm" name="id 2609844"></a>957 <a class="indexterm" name="id376618"></a> 958 958 I then wrote the <code class="filename">logon.kix</code> file that is shown in 959 959 <a class="link" href="nw4migration.html#ch8kix" title="Example 10.15. Kixtart Control File File: logon.kix">“Kixtart Control File File: logon.kix”</a>. I chose to keep it all in one file, but it … … 1138 1138 so it was easier to do it by hand. 1139 1139 </p><p> 1140 <a class="indexterm" name="id 2610141"></a>1140 <a class="indexterm" name="id376842"></a> 1141 1141 At this point I was able to add the users. This is the part that really falls 1142 1142 into upgrade. I moved the users over one group at a time, starting with the … … 1152 1152 struggled with the most effective way to do it. Here is the method that worked 1153 1153 for every one of my users on Windows NT, 2000, and XP: 1154 </p><div class="procedure"><ol type="1"><li><p>1154 </p><div class="procedure"><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 1155 1155 Log in as the user on the domain. This creates the local copy 1156 1156 of the user's profile and copies it to the server as he or she logs out. 1157 </p></li><li ><p>1157 </p></li><li class="step" title="Step 2"><p> 1158 1158 Reboot the computer and log in as the local machine administrator. 1159 </p></li><li ><p>1159 </p></li><li class="step" title="Step 3"><p> 1160 1160 Right-click My Computer, click Properties, and navigate to the 1161 1161 user profiles tab (varies per version of Windows). 1162 </p></li><li ><p>1162 </p></li><li class="step" title="Step 4"><p> 1163 1163 Select the user's local profile <code class="constant">(COMPUTERNAME\username)</code>, 1164 1164 and click the <code class="literal">Copy To</code> button. 1165 </p></li><li ><p>1165 </p></li><li class="step" title="Step 5"><p> 1166 1166 In the next dialog, copy it directly to the profiles share on the 1167 1167 Samba server (in my case \\PDCname\profiles\user\<architecture>. 1168 1168 You will have had to make a connection to the share as that 1169 1169 user (e.g., Windows Explorer type \\PDCname\profiles\username). 1170 </p></li><li ><p>1170 </p></li><li class="step" title="Step 6"><p> 1171 1171 When the copy is complete (it can take a while) log out, and log back in 1172 1172 as the user. All of his or her settings and all contents of My Documents, 1173 1173 Favorites, and the registry should have been copied successfully. 1174 </p></li><li ><p>1174 </p></li><li class="step" title="Step 7"><p> 1175 1175 If it doesn't look right (the dead giveaway is the desktop background), 1176 1176 shut down the computer without logging out (power cycle) and try logging … … 1179 1179 </p></li></ol></div><p> 1180 1180 Words to the Wise: 1181 </p><div class="itemizedlist"><ul type="disc"><li><p>1181 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 1182 1182 If the user was anything other than a standard user on his or her system 1183 1183 before, you will save yourself some headaches by giving him or her identical … … 1187 1187 before logging on as that user for the first time. Otherwise the user will 1188 1188 have trouble with permissions on his or her registry keys. 1189 </p></li><li ><p>1189 </p></li><li class="listitem"><p> 1190 1190 If any application was installed for the user only, rather than for 1191 1191 the entire system, it will probably not work without being reinstalled. -
trunk/server/docs/htmldocs/Samba3-ByExample/pr01.html
r414 r599 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>About the Cover Artwork</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 4.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="index.html" title="Samba-3 by Example"><link rel="next" href="pr02.html" title="Acknowledgments"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">About the Cover Artwork</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="index.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="pr02.html">Next</a></td></tr></table><hr></div><div class="preface" lang="en-US"><div class="titlepage"><div><div><h2 class="title"><a name="id2540354"></a>About the Cover Artwork</h2></div></div></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>About the Cover Artwork</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="index.html" title="Samba-3 by Example"><link rel="next" href="pr02.html" title="Acknowledgments"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">About the Cover Artwork</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="index.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="pr02.html">Next</a></td></tr></table><hr></div><div lang="en-US" class="preface" title="About the Cover Artwork"><div class="titlepage"><div><div><h2 class="title"><a name="id281291"></a>About the Cover Artwork</h2></div></div></div><p> 2 2 The cover artwork of this book continues the freedom theme of the first 3 edition of “<span class="quote">Samba-3 by Example</span>”. The history of civilization3 edition of <span class="quote">“<span class="quote">Samba-3 by Example</span>”</span>. The history of civilization 4 4 demonstrates the fragile nature of freedom. It can be lost in a moment, 5 5 and once lost, the cost of recovering liberty can be incredible. The last -
trunk/server/docs/htmldocs/Samba3-ByExample/pr02.html
r414 r599 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Acknowledgments</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 4.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="pr01.html" title="About the Cover Artwork"><link rel="next" href="pr03.html" title="Foreword"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Acknowledgments</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="pr01.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="pr03.html">Next</a></td></tr></table><hr></div><div class="preface" lang="en-US"><div class="titlepage"><div><div><h2 class="title"><a name="id2500840"></a>Acknowledgments</h2></div></div></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Acknowledgments</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="pr01.html" title="About the Cover Artwork"><link rel="next" href="pr03.html" title="Foreword"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Acknowledgments</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="pr01.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="pr03.html">Next</a></td></tr></table><hr></div><div lang="en-US" class="preface" title="Acknowledgments"><div class="titlepage"><div><div><h2 class="title"><a name="id281791"></a>Acknowledgments</h2></div></div></div><p> 2 2 <span class="emphasis"><em>Samba-3 by Example</em></span> would not have been written except 3 3 as a result of feedback provided by reviewers and readers of the book <span class="emphasis"><em>The -
trunk/server/docs/htmldocs/Samba3-ByExample/pr03.html
r414 r599 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Foreword</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 4.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="pr02.html" title="Acknowledgments"><link rel="next" href="preface.html" title="Preface"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Foreword</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="pr02.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="preface.html">Next</a></td></tr></table><hr></div><div class="preface" lang="en-US"><div class="titlepage"><div><div><h2 class="title"><a name="id2501056"></a>Foreword</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="pr03.html#id2501062">By John M. Weathersby, Executive Director, OSSI</a></span></dt></dl></div><div class="sect1" lang="en-US"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2501062"></a>By John M. Weathersby, Executive Director, OSSI</h2></div></div></div><div class="blockquote"><blockquote class="blockquote"><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Foreword</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="pr02.html" title="Acknowledgments"><link rel="next" href="preface.html" title="Preface"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Foreword</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="pr02.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="preface.html">Next</a></td></tr></table><hr></div><div lang="en-US" class="preface" title="Foreword"><div class="titlepage"><div><div><h2 class="title"><a name="id280651"></a>Foreword</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="pr03.html#id280658">By John M. Weathersby, Executive Director, OSSI</a></span></dt></dl></div><div class="sect1" title="By John M. Weathersby, Executive Director, OSSI"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id280658"></a>By John M. Weathersby, Executive Director, OSSI</h2></div></div></div><div class="blockquote"><blockquote class="blockquote"><p> 2 2 The Open Source Software Institute (OSSI) is comprised of representatives from a broad spectrum of business and 3 3 non-business organizations that share a common interest in the promotion of development and implementation -
trunk/server/docs/htmldocs/Samba3-ByExample/preface.html
r414 r599 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Preface</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 4.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="pr03.html" title="Foreword"><link rel="next" href="ExNetworks.html" title="Part I. Example Network Configurations"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Preface</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="pr03.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="ExNetworks.html">Next</a></td></tr></table><hr></div><div class="preface" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="preface"></a>Preface</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="preface.html#id2501251">Why Is This Book Necessary?</a></span></dt><dd><dl><dt><span class="sect2"><a href="preface.html#id2498970">Samba 3.0.20 Update Edition</a></span></dt></dl></dd><dt><span class="sect1"><a href="preface.html#id2498857">Prerequisites</a></span></dt><dt><span class="sect1"><a href="preface.html#id2498889">Approach</a></span></dt><dt><span class="sect1"><a href="preface.html#id2498954">Summary of Topics</a></span></dt><dt><span class="sect1"><a href="preface.html#id2550647">Conventions Used</a></span></dt></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Preface</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="index.html" title="Samba-3 by Example"><link rel="prev" href="pr03.html" title="Foreword"><link rel="next" href="ExNetworks.html" title="Part I. Example Network Configurations"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Preface</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="pr03.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="ExNetworks.html">Next</a></td></tr></table><hr></div><div class="preface" title="Preface"><div class="titlepage"><div><div><h2 class="title"><a name="preface"></a>Preface</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="preface.html#id280788">Why Is This Book Necessary?</a></span></dt><dd><dl><dt><span class="sect2"><a href="preface.html#id280825">Samba 3.0.20 Update Edition</a></span></dt></dl></dd><dt><span class="sect1"><a href="preface.html#id280643">Prerequisites</a></span></dt><dt><span class="sect1"><a href="preface.html#id322292">Approach</a></span></dt><dt><span class="sect1"><a href="preface.html#id322341">Summary of Topics</a></span></dt><dt><span class="sect1"><a href="preface.html#id322920">Conventions Used</a></span></dt></dl></div><p> 2 2 Network administrators live busy lives. We face distractions and pressures 3 3 that drive us to seek proven, working case scenarios that can be easily … … 34 34 services and applications such as OpenLDAP, DNS and DHCP, the need for which 35 35 can be met from other resources that are dedicated to the subject. 36 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2501251"></a>Why Is This Book Necessary?</h2></div></div></div><p>36 </p><div class="sect1" title="Why Is This Book Necessary?"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id280788"></a>Why Is This Book Necessary?</h2></div></div></div><p> 37 37 This book is the result of observations and feedback. The feedback from 38 38 the Samba-HOWTO-Collection has been positive and complimentary. There 39 39 have been requests for far more worked examples, a 40 “<span class="quote">Samba Cookbook,</span>”and for training materials to40 <span class="quote">“<span class="quote">Samba Cookbook,</span>”</span> and for training materials to 41 41 help kick-start the process of mastering Samba. 42 42 </p><p> … … 54 54 on the CD-ROM. This book is descriptive, provides detailed diagrams, and 55 55 makes deployment of Samba-3 a breeze. 56 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2498970"></a>Samba 3.0.20 Update Edition</h3></div></div></div><p>56 </p><div class="sect2" title="Samba 3.0.20 Update Edition"><div class="titlepage"><div><div><h3 class="title"><a name="id280825"></a>Samba 3.0.20 Update Edition</h3></div></div></div><p> 57 57 The Samba 3.0.x series has been remarkably popular. At the time this book first 58 58 went to print samba-3.0.2 was being released. There have been significant modifications … … 112 112 <p> 113 113 Symbolically linked files and directories on the UNIX host to absolute paths will 114 now be followed. This can be turned off using “<span class="quote">wide links = No</span>”in115 the share stanza in the <code class="filename">smb.conf</code> file. Turning off “<span class="quote">wide links</span>”114 now be followed. This can be turned off using <span class="quote">“<span class="quote">wide links = No</span>”</span> in 115 the share stanza in the <code class="filename">smb.conf</code> file. Turning off <span class="quote">“<span class="quote">wide links</span>”</span> 116 116 support will degrade server performance because each path must be checked. 117 117 </p> … … 123 123 <p> 124 124 Versions of Samba prior to samba-3.0.11 required the use of the UNIX <code class="constant">root</code> 125 account from network Windows clients. The new “<span class="quote">enable privileges = Yes</span>”capability125 account from network Windows clients. The new <span class="quote">“<span class="quote">enable privileges = Yes</span>”</span> capability 126 126 means that functions such as adding machines to the domain, managing printers, etc. can now 127 127 be delegated to normal user accounts or to groups of users. 128 128 </p> 129 </td></tr></tbody></table></div></div><br class="table-break"></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2498857"></a>Prerequisites</h2></div></div></div><p>129 </td></tr></tbody></table></div></div><br class="table-break"></div></div><div class="sect1" title="Prerequisites"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id280643"></a>Prerequisites</h2></div></div></div><p> 130 130 This book is not a tutorial on UNIX or Linux administration. UNIX and Linux 131 131 training is best obtained from books dedicated to the subject. This book … … 140 140 may need to refer to administrative guides or manuals for your operating system 141 141 platform to find what is the best method to achieve what the text of this book describes. 142 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2498889"></a>Approach</h2></div></div></div><p>142 </p></div><div class="sect1" title="Approach"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id322292"></a>Approach</h2></div></div></div><p> 143 143 The first chapter deals with some rather thorny network analysis issues. Do not be 144 144 put off by this. The information you glean, even without a detailed understanding … … 168 168 Each chapter has a set of questions and answers to help you to 169 169 to understand and digest key attributes of the solutions presented. 170 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2498954"></a>Summary of Topics</h2></div></div></div><p>170 </p></div><div class="sect1" title="Summary of Topics"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id322341"></a>Summary of Topics</h2></div></div></div><p> 171 171 The contents of this second edition of <span class="emphasis"><em>Samba-3 by Example</em></span> 172 172 have been rearranged based on feedback from purchasers of the first edition. … … 188 188 soon needs to replace all servers and workstations. 189 189 </p><p><span class="emphasis"><em>TechInfo</em></span> This chapter demands: 190 </p><div class="itemizedlist"><ul type="disc"><li><p>Case 1: The simplest <code class="filename">smb.conf</code> file that may190 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Case 1: The simplest <code class="filename">smb.conf</code> file that may 191 191 reasonably be used. Works with Samba-2.x also. This 192 192 configuration uses Share Mode security. Encrypted 193 193 passwords are not used, so there is no 194 194 <code class="filename">smbpasswd</code> file. 195 </p></li><li ><p>Case 2: Another simple <code class="filename">smb.conf</code> file that adds195 </p></li><li class="listitem"><p>Case 2: Another simple <code class="filename">smb.conf</code> file that adds 196 196 WINS support and printing support. This case deals with 197 197 a special requirement that demonstrates how to deal with … … 201 201 Samba-2.x. Encrypted passwords are not used, so there is no 202 202 <code class="filename">smbpasswd</code> file. 203 </p></li><li ><p>Case 3: This <code class="filename">smb.conf</code> configuration uses User Mode203 </p></li><li class="listitem"><p>Case 3: This <code class="filename">smb.conf</code> configuration uses User Mode 204 204 security. The file share configuration demonstrates 205 205 the ability to provide master access to an administrator … … 339 339 avoid Samba configuration options that will weigh the server down. MS distributed file 340 340 services to make your network fly and much more. This chapter contains a good deal of 341 “<span class="quote">Did I tell you about this...?</span>”type of hints to help keep your name on the top341 <span class="quote">“<span class="quote">Did I tell you about this...?</span>”</span> type of hints to help keep your name on the top 342 342 performers list. 343 343 </p></dd><dt><span class="term">Chapter 14 Samba Support.</span></dt><dd><p> … … 365 365 a file and print server to create a connection over which file and print 366 366 operations may take place. 367 </p></dd></dl></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2550647"></a>Conventions Used</h2></div></div></div><p>367 </p></dd></dl></div></div><div class="sect1" title="Conventions Used"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id322920"></a>Conventions Used</h2></div></div></div><p> 368 368 The following notation conventions are used throughout this book: 369 </p><div class="itemizedlist"><ul type="disc"><li><p>370 TOSHARG2 is used as an abbreviation for the book, “<span class="quote">The Official Samba-3371 HOWTO and Reference Guide, Second Edition</span>” Editors: John H. Terpstra and Jelmer R. Vernooij,369 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 370 TOSHARG2 is used as an abbreviation for the book, <span class="quote">“<span class="quote">The Official Samba-3 371 HOWTO and Reference Guide, Second Edition</span>”</span> Editors: John H. Terpstra and Jelmer R. Vernooij, 372 372 Publisher: Prentice Hall, ISBN: 0131882228. 373 </p></li><li ><p>374 S3bE2 is used as an abbreviation for the book, “<span class="quote">Samba-3 by Example, Second Edition</span>”373 </p></li><li class="listitem"><p> 374 S3bE2 is used as an abbreviation for the book, <span class="quote">“<span class="quote">Samba-3 by Example, Second Edition</span>”</span> 375 375 Editors: John H. Terpstra, Publisher: Prentice Hall, ISBN: 013188221X. 376 </p></li><li ><p>376 </p></li><li class="listitem"><p> 377 377 Directories and filenames appear in mono-font. For example, 378 378 <code class="filename">/etc/pam.conf</code>. 379 </p></li><li ><p>379 </p></li><li class="listitem"><p> 380 380 Executable names are bolded. For example, <code class="literal">smbd</code>. 381 </p></li><li ><p>381 </p></li><li class="listitem"><p> 382 382 Menu items and buttons appear in bold. For example, click <span class="guibutton">Next</span>. 383 </p></li><li ><p>383 </p></li><li class="listitem"><p> 384 384 Selecting a menu item is indicated as: 385 385 <span class="guimenu">Start</span> → <span class="guimenuitem">Control Panel</span> → <span class="guimenuitem">Administrative Tools</span> → <span class="guimenuitem">Active Directory Users and Computers</span> -
trunk/server/docs/htmldocs/Samba3-ByExample/primer.html
r414 r599 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 16. Networking Primer</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 4.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits"><link rel="next" href="apa.html" title="Appendix A. GNU General Public License version 3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 16. Networking Primer</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="appendix.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="apa.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="primer"></a>Chapter 16. Networking Primer</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="primer.html#id2625280">Requirements and Notes</a></span></dt><dt><span class="sect1"><a href="primer.html#id2625441">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id2625502">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#id2625618">Exercises</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id2625744">Single-Machine Broadcast Activity</a></span></dt><dt><span class="sect2"><a href="primer.html#secondmachine">Second Machine Startup Broadcast Interaction</a></span></dt><dt><span class="sect2"><a href="primer.html#id2626892">Simple Windows Client Connection Characteristics</a></span></dt><dt><span class="sect2"><a href="primer.html#id2627394">Windows 200x/XP Client Interaction with Samba-3</a></span></dt><dt><span class="sect2"><a href="primer.html#id2627962">Conclusions to Exercises</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01conc">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id2628077">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01qa">Questions and Answers</a></span></dt></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 16. Networking Primer</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="RefSection.html" title="Part III. Reference Section"><link rel="prev" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits"><link rel="next" href="apa.html" title="Appendix A. GNU General Public License version 3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 16. Networking Primer</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="appendix.html">Prev</a> </td><th width="60%" align="center">Part III. Reference Section</th><td width="20%" align="right"> <a accesskey="n" href="apa.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 16. Networking Primer"><div class="titlepage"><div><div><h2 class="title"><a name="primer"></a>Chapter 16. Networking Primer</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="primer.html#id390627">Requirements and Notes</a></span></dt><dt><span class="sect1"><a href="primer.html#id390763">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id390813">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#id390920">Exercises</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id391033">Single-Machine Broadcast Activity</a></span></dt><dt><span class="sect2"><a href="primer.html#secondmachine">Second Machine Startup Broadcast Interaction</a></span></dt><dt><span class="sect2"><a href="primer.html#id392130">Simple Windows Client Connection Characteristics</a></span></dt><dt><span class="sect2"><a href="primer.html#id392597">Windows 200x/XP Client Interaction with Samba-3</a></span></dt><dt><span class="sect2"><a href="primer.html#id393121">Conclusions to Exercises</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01conc">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="primer.html#id393223">Technical Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="primer.html#chap01qa">Questions and Answers</a></span></dt></dl></div><p> 2 2 You are about to use the equivalent of a microscope to look at the information 3 3 that runs through the veins of a Windows network. We do more to observe the information than 4 4 to interrogate it. When you are done with this primer, you should have a good understanding 5 5 of the types of information that flow over the network. Do not worry, this is not 6 a biology lesson. We won't lose you in unnecessary detail. Think to yourself, “<span class="quote">This7 is easy,</span>” then tackle each exercise without fear.6 a biology lesson. We won't lose you in unnecessary detail. Think to yourself, <span class="quote">“<span class="quote">This 7 is easy,</span>”</span> then tackle each exercise without fear. 8 8 </p><p> 9 9 Samba can be configured with a minimum of complexity. Simplicity should be mastered 10 10 before you get too deeply into complexities. Let's get moving: we have work to do. 11 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2625280"></a>Requirements and Notes</h2></div></div></div><p>11 </p><div class="sect1" title="Requirements and Notes"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id390627"></a>Requirements and Notes</h2></div></div></div><p> 12 12 Successful completion of this primer requires two Microsoft Windows 9x/Me Workstations 13 13 as well as two Microsoft Windows XP Professional Workstations, each equipped with an Ethernet … … 17 17 on a quiet network where there is no other traffic. It is best to use a dedicated hub 18 18 with only the machines under test connected at the time of the exercises. 19 </p><p><a class="indexterm" name="id 2625300"></a>19 </p><p><a class="indexterm" name="id390642"></a> 20 20 Wireshark (formerly Ethereal) has become the network protocol analyzer of choice for many network administrators. 21 21 You may find more information regarding this tool from the … … 30 30 To obtain <code class="literal">Wireshark</code> for your system, please visit the Wireshark 31 31 <a class="ulink" href="http://www.wireshark.org/download.html" target="_top">download site</a>. 32 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>32 </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 33 33 The successful completion of this chapter requires that you capture network traffic 34 34 using <code class="literal">Wireshark</code>. It is recommended that you use a hub, not an … … 37 37 that is used to monitor traffic; this would not allow you to complete the projects. 38 38 </p></div><p> 39 <a class="indexterm" name="id 2625370"></a>39 <a class="indexterm" name="id390701"></a> 40 40 Do not worry too much if you do not have access to all this equipment; network captures 41 41 from the exercises are provided on the enclosed CD-ROM. This makes it possible to dive directly 42 42 into the analytical part of the exercises if you so desire. 43 </p><p><a class="indexterm" name="id 2625386"></a><a class="indexterm" name="id2625397"></a>43 </p><p><a class="indexterm" name="id390714"></a><a class="indexterm" name="id390726"></a> 44 44 Please do not be alarmed at the use of a high-powered analysis tool (Wireshark) in this 45 45 primer. We expose you only to a minimum of detail necessary to complete … … 55 55 <a class="link" href="primer.html#chap01qa" title="Questions and Answers">“Questions and Answers”</a> also provides useful information 56 56 that may help you to avoid significantly time-consuming networking problems. 57 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2625441"></a>Introduction</h2></div></div></div><p>57 </p></div><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id390763"></a>Introduction</h2></div></div></div><p> 58 58 The purpose of this chapter is to create familiarity with key aspects of Microsoft Windows 59 59 network computing. If you want a solid technical grounding, do not gloss over these exercises. 60 60 The points covered are recurrent issues on the Samba mailing lists. 61 </p><p><a class="indexterm" name="id 2625456"></a>61 </p><p><a class="indexterm" name="id390775"></a> 62 62 You can see from these exercises that Windows networking involves quite a lot of network 63 63 broadcast traffic. You can look into the contents of some packets, but only to see … … 73 73 </p><p> 74 74 Recommended preparatory reading: <span class="emphasis"><em>The Official Samba-3 HOWTO and Reference Guide, Second 75 Edition</em></span> (TOSHARG2) Chapter 9, “<span class="quote">Network Browsing,</span>”and Chapter 3,76 “<span class="quote">Server Types and Security Modes.</span>”77 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2625502"></a>Assignment Tasks</h3></div></div></div><p><a class="indexterm" name="id2625508"></a>75 Edition</em></span> (TOSHARG2) Chapter 9, <span class="quote">“<span class="quote">Network Browsing,</span>”</span> and Chapter 3, 76 <span class="quote">“<span class="quote">Server Types and Security Modes.</span>”</span> 77 </p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id390813"></a>Assignment Tasks</h3></div></div></div><p><a class="indexterm" name="id390820"></a> 78 78 You are about to witness how Microsoft Windows computer networking functions. The 79 79 exercises step through identification of how a client machine establishes a … … 81 81 each other (i.e., how browsing works) and how the two key types of user identification 82 82 (share mode security and user mode security) are affected. 83 </p><p><a class="indexterm" name="id 2625526"></a>83 </p><p><a class="indexterm" name="id390834"></a> 84 84 The networking protocols used by MS Windows networking when working with Samba 85 85 use TCP/IP as the transport protocol. The protocols that are specific to Windows 86 86 networking are encapsulated in TCP/IP. The network analyzer we use (Wireshark) 87 87 is able to show you the contents of the TCP/IP packets (or messages). 88 </p><div class="procedure" ><a name="chap01tasks"></a><p class="title"><b>Procedure 16.1. Diagnostic Tasks</b></p><ol type="1"><li><p><a class="indexterm" name="id2625559"></a><a class="indexterm" name="id2625570"></a><a class="indexterm" name="id2625578"></a>88 </p><div class="procedure" title="Procedure 16.1. Diagnostic Tasks"><a name="chap01tasks"></a><p class="title"><b>Procedure 16.1. Diagnostic Tasks</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p><a class="indexterm" name="id390864"></a><a class="indexterm" name="id390875"></a><a class="indexterm" name="id390883"></a> 89 89 Examine network traces to witness SMB broadcasts, host announcements, 90 90 and name resolution processes. 91 </p></li><li ><p>91 </p></li><li class="step" title="Step 2"><p> 92 92 Examine network traces to witness how share mode security functions. 93 </p></li><li ><p>93 </p></li><li class="step" title="Step 3"><p> 94 94 Examine network traces to witness the use of user mode security. 95 </p></li><li ><p>95 </p></li><li class="step" title="Step 4"><p> 96 96 Review traces of network logons for a Windows 9x/Me client as well as 97 97 a domain logon for a Windows XP Professional client. 98 </p></li></ol></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2625618"></a>Exercises</h2></div></div></div><p>99 <a class="indexterm" name="id 2625626"></a>98 </p></li></ol></div></div></div><div class="sect1" title="Exercises"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id390920"></a>Exercises</h2></div></div></div><p> 99 <a class="indexterm" name="id390928"></a> 100 100 You are embarking on a course of discovery. The first part of the exercise requires 101 101 two MS Windows 9x/Me systems. We called one machine <code class="constant">WINEPRESSME</code> and the … … 109 109 For these exercises, our test environment consisted of a SUSE 9.2 Professional Linux Workstation running 110 110 VMWare 4.5. The following VMWare images were prepared: 111 </p><div class="itemizedlist"><ul type="disc"><li><p>Windows 98 name: MILGATE98</p></li><li><p>Windows Me name: WINEPRESSME</p></li><li><p>Windows XP Professional name: LightrayXP</p></li><li><p>Samba-3.0.20 running on a SUSE Enterprise Linux 9</p></li></ul></div><p>111 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Windows 98 name: MILGATE98</p></li><li class="listitem"><p>Windows Me name: WINEPRESSME</p></li><li class="listitem"><p>Windows XP Professional name: LightrayXP</p></li><li class="listitem"><p>Samba-3.0.20 running on a SUSE Enterprise Linux 9</p></li></ul></div><p> 112 112 Choose a workgroup name (MIDEARTH) for each exercise. 113 113 </p><p> 114 <a class="indexterm" name="id 2625715"></a>114 <a class="indexterm" name="id391010"></a> 115 115 The network captures provided on the CD-ROM included with this book were captured using <code class="constant">Ethereal</code> 116 116 version <code class="literal">0.10.6</code>. A later version suffices without problems (i.e. you should be using Wireshark), but an earlier version may not … … 120 120 that can be derived from this book really does warrant your taking sufficient time to practice each exercise with 121 121 care and attention to detail. 122 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2625744"></a>Single-Machine Broadcast Activity</h3></div></div></div><p>122 </p><div class="sect2" title="Single-Machine Broadcast Activity"><div class="titlepage"><div><div><h3 class="title"><a name="id391033"></a>Single-Machine Broadcast Activity</h3></div></div></div><p> 123 123 In this section, we start a single Windows 9x/Me machine, then monitor network activity for 30 minutes. 124 </p><div class="procedure" ><a name="id2625755"></a><p class="title"><b>Procedure 16.2. Monitoring Windows 9x Steps</b></p><ol type="1"><li><p>124 </p><div class="procedure" title="Procedure 16.2. Monitoring Windows 9x Steps"><a name="id391043"></a><p class="title"><b>Procedure 16.2. Monitoring Windows 9x Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 125 125 Start the machine from which network activity will be monitored (using <code class="literal">Wireshark</code>). 126 126 Launch <code class="literal">Wireshark</code>, click … … 128 128 </p><p> 129 129 Click the following: 130 </p><div class="orderedlist"><ol type="1"><li><p>Update list of packets in real time</p></li><li><p>Automatic scrolling in live capture</p></li><li><p>Enable MAC name resolution</p></li><li><p>Enable network name resolution</p></li><li><p>Enable transport name resolution</p></li></ol></div><p>130 </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p>Update list of packets in real time</p></li><li class="listitem"><p>Automatic scrolling in live capture</p></li><li class="listitem"><p>Enable MAC name resolution</p></li><li class="listitem"><p>Enable network name resolution</p></li><li class="listitem"><p>Enable transport name resolution</p></li></ol></div><p> 131 131 Click <span class="guibutton">OK</span>. 132 </p></li><li ><p>132 </p></li><li class="step" title="Step 2"><p> 133 133 Start the Windows 9x/Me machine to be monitored. Let it run for a full 30 minutes. While monitoring, 134 134 do not press any keyboard keys, do not click any on-screen icons or menus, and do not answer any dialog boxes. 135 </p></li><li ><p>135 </p></li><li class="step" title="Step 3"><p> 136 136 At the conclusion of 30 minutes, stop the capture. Save the capture to a file so you can go back to it later. 137 137 Leave this machine running in preparation for the task in <a class="link" href="primer.html#secondmachine" title="Second Machine Startup Broadcast Interaction">“Second Machine Startup Broadcast Interaction”</a>. 138 </p></li><li ><p>138 </p></li><li class="step" title="Step 4"><p> 139 139 Analyze the capture. Identify each discrete message type that was captured. Note what transport protocol 140 140 was used. Identify the timing between messages of identical types. 141 </p></li></ol></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2625878"></a>Findings</h4></div></div></div><p>141 </p></li></ol></div><div class="sect3" title="Findings"><div class="titlepage"><div><div><h4 class="title"><a name="id391158"></a>Findings</h4></div></div></div><p> 142 142 The summary of the first 10 minutes of the packet capture should look like <a class="link" href="primer.html#pktcap01" title="Figure 16.1. Windows Me Broadcasts The First 10 Minutes">“Windows Me Broadcasts The First 10 Minutes”</a>. 143 143 A screenshot of a later stage of the same capture is shown in <a class="link" href="primer.html#pktcap02" title="Figure 16.2. Windows Me Later Broadcast Sample">“Windows Me Later Broadcast Sample”</a>. 144 </p><div class="figure"><a name="pktcap01"></a><p class="title"><b>Figure 16.1. Windows Me Broadcasts The First 10 Minutes</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/WINREPRESSME-Capture.png" width="216" alt="Windows Me Broadcasts The First 10 Minutes"></div></div></div><br class="figure-break"><div class="figure"><a name="pktcap02"></a><p class="title"><b>Figure 16.2. Windows Me Later Broadcast Sample</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/WINREPRESSME-Capture2.png" width="226.8" alt="Windows Me Later Broadcast Sample"></div></div></div><br class="figure-break"><p><a class="indexterm" name="id 2625995"></a><a class="indexterm" name="id2626006"></a>144 </p><div class="figure"><a name="pktcap01"></a><p class="title"><b>Figure 16.1. Windows Me Broadcasts The First 10 Minutes</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/WINREPRESSME-Capture.png" width="216" alt="Windows Me Broadcasts The First 10 Minutes"></div></div></div><br class="figure-break"><div class="figure"><a name="pktcap02"></a><p class="title"><b>Figure 16.2. Windows Me Later Broadcast Sample</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/WINREPRESSME-Capture2.png" width="226.8" alt="Windows Me Later Broadcast Sample"></div></div></div><br class="figure-break"><p><a class="indexterm" name="id391271"></a><a class="indexterm" name="id391282"></a> 145 145 Broadcast messages observed are shown in <a class="link" href="primer.html#capsstats01" title="Table 16.1. Windows Me Startup Broadcast Capture Statistics">“Windows Me Startup Broadcast Capture Statistics”</a>. 146 146 Actual observations vary a little, but not by much. … … 148 148 first to ensure that its name would not result in a name clash, and second to establish its 149 149 presence with the Local Master Browser (LMB). 150 </p><div class="table"><a name="capsstats01"></a><p class="title"><b>Table 16.1. Windows Me Startup Broadcast Capture Statistics</b></p><div class="table-contents"><table summary="Windows Me Startup Broadcast Capture Statistics" border="1"><colgroup><col align="left"><col align="center"><col align="center"><col align="left"></colgroup><thead><tr><th align="left">Message</th><th align="center">Type</th><th align="center">Num</th><th align="left">Notes</th></tr></thead><tbody><tr><td align="left">WINEPRESSME<00></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.6 sec apart</td></tr><tr><td align="left">WINEPRESSME<03></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.6 sec apart</td></tr><tr><td align="left">WINEPRESSME<20></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<00></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1d></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1e></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1b></td><td align="center">Qry</td><td align="center">84</td><td align="left">300 sec apart at stable operation</td></tr><tr><td align="left">__MSBROWSE__</td><td align="center">Reg</td><td align="center">8</td><td align="left">Registered after winning election to Browse Master</td></tr><tr><td align="left">JHT<03></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 x 2. This is the name of the user that logged onto Windows</td></tr><tr><td align="left">Host Announcement WINEPRESSME</td><td align="center">Ann</td><td align="center">2</td><td align="left">Observed at 10 sec</td></tr><tr><td align="left">Domain/Workgroup Announcement MIDEARTH</td><td align="center">Ann</td><td align="center">18</td><td align="left">300 sec apart at stable operation</td></tr><tr><td align="left">Local Master Announcement WINEPRESSME</td><td align="center">Ann</td><td align="center">18</td><td align="left">300 sec apart at stable operation</td></tr><tr><td align="left">Get Backup List Request</td><td align="center">Qry</td><td align="center">12</td><td align="left">6 x 2 early in startup, 0.5 sec apart</td></tr><tr><td align="left">Browser Election Request</td><td align="center">Ann</td><td align="center">10</td><td align="left">5 x 2 early in startup</td></tr><tr><td align="left">Request Announcement WINEPRESSME</td><td align="center">Ann</td><td align="center">4</td><td align="left">Early in startup</td></tr></tbody></table></div></div><br class="table-break"><p><a class="indexterm" name="id 2626353"></a><a class="indexterm" name="id2626361"></a>150 </p><div class="table"><a name="capsstats01"></a><p class="title"><b>Table 16.1. Windows Me Startup Broadcast Capture Statistics</b></p><div class="table-contents"><table summary="Windows Me Startup Broadcast Capture Statistics" border="1"><colgroup><col align="left"><col align="center"><col align="center"><col align="left"></colgroup><thead><tr><th align="left">Message</th><th align="center">Type</th><th align="center">Num</th><th align="left">Notes</th></tr></thead><tbody><tr><td align="left">WINEPRESSME<00></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.6 sec apart</td></tr><tr><td align="left">WINEPRESSME<03></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.6 sec apart</td></tr><tr><td align="left">WINEPRESSME<20></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<00></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1d></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1e></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1b></td><td align="center">Qry</td><td align="center">84</td><td align="left">300 sec apart at stable operation</td></tr><tr><td align="left">__MSBROWSE__</td><td align="center">Reg</td><td align="center">8</td><td align="left">Registered after winning election to Browse Master</td></tr><tr><td align="left">JHT<03></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 x 2. This is the name of the user that logged onto Windows</td></tr><tr><td align="left">Host Announcement WINEPRESSME</td><td align="center">Ann</td><td align="center">2</td><td align="left">Observed at 10 sec</td></tr><tr><td align="left">Domain/Workgroup Announcement MIDEARTH</td><td align="center">Ann</td><td align="center">18</td><td align="left">300 sec apart at stable operation</td></tr><tr><td align="left">Local Master Announcement WINEPRESSME</td><td align="center">Ann</td><td align="center">18</td><td align="left">300 sec apart at stable operation</td></tr><tr><td align="left">Get Backup List Request</td><td align="center">Qry</td><td align="center">12</td><td align="left">6 x 2 early in startup, 0.5 sec apart</td></tr><tr><td align="left">Browser Election Request</td><td align="center">Ann</td><td align="center">10</td><td align="left">5 x 2 early in startup</td></tr><tr><td align="left">Request Announcement WINEPRESSME</td><td align="center">Ann</td><td align="center">4</td><td align="left">Early in startup</td></tr></tbody></table></div></div><br class="table-break"><p><a class="indexterm" name="id391620"></a><a class="indexterm" name="id391628"></a> 151 151 From the packet trace, it should be noted that no messages were propagated over TCP/IP; 152 152 all messages employed UDP/IP. When steady-state operation has been achieved, there is a cycle 153 153 of various announcements, re-election of a browse master, and name queries. These create 154 154 the symphony of announcements by which network browsing is made possible. 155 </p><p><a class="indexterm" name="id 2626379"></a>155 </p><p><a class="indexterm" name="id391642"></a> 156 156 For detailed information regarding the precise behavior of the CIFS/SMB protocols, 157 refer to the book “<span class="quote">Implementing CIFS: The Common Internet File System,</span>”157 refer to the book <span class="quote">“<span class="quote">Implementing CIFS: The Common Internet File System,</span>”</span> 158 158 by Christopher Hertel, (Prentice Hall PTR, ISBN: 013047116X). 159 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="secondmachine"></a>Second Machine Startup Broadcast Interaction</h3></div></div></div><p>159 </p></div></div><div class="sect2" title="Second Machine Startup Broadcast Interaction"><div class="titlepage"><div><div><h3 class="title"><a name="secondmachine"></a>Second Machine Startup Broadcast Interaction</h3></div></div></div><p> 160 160 At this time, the machine you used to capture the single-system startup trace should still be running. 161 161 The objective of this task is to identify the interaction of two machines in respect to broadcast activity. 162 </p><div class="procedure" ><a name="id2626415"></a><p class="title"><b>Procedure 16.3. Monitoring of Second Machine Activity</b></p><ol type="1"><li><p>162 </p><div class="procedure" title="Procedure 16.3. Monitoring of Second Machine Activity"><a name="id391674"></a><p class="title"><b>Procedure 16.3. Monitoring of Second Machine Activity</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 163 163 On the machine from which network activity will be monitored (using <code class="literal">Wireshark</code>), 164 164 launch <code class="literal">Wireshark</code> and click … … 166 166 </p><p> 167 167 Click: 168 </p><div class="orderedlist"><ol type="1"><li><p>Update list of packets in real time</p></li><li><p>Automatic scrolling in live capture</p></li><li><p>Enable MAC name resolution</p></li><li><p>Enable network name resolution</p></li><li><p>Enable transport name resolution</p></li></ol></div><p>168 </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p>Update list of packets in real time</p></li><li class="listitem"><p>Automatic scrolling in live capture</p></li><li class="listitem"><p>Enable MAC name resolution</p></li><li class="listitem"><p>Enable network name resolution</p></li><li class="listitem"><p>Enable transport name resolution</p></li></ol></div><p> 169 169 Click <span class="guibutton">OK</span>. 170 </p></li><li ><p>170 </p></li><li class="step" title="Step 2"><p> 171 171 Start the second Windows 9x/Me machine. Let it run for 15 to 20 minutes. While monitoring, do not press 172 172 any keyboard keys, do not click any on-screen icons or menus, and do not answer any dialog boxes. 173 </p></li><li ><p>173 </p></li><li class="step" title="Step 3"><p> 174 174 At the conclusion of the capture time, stop the capture. Be sure to save the captured data so you 175 175 can examine the network data capture again at a later date should that be necessary. 176 </p></li><li ><p>176 </p></li><li class="step" title="Step 4"><p> 177 177 Analyze the capture trace, taking note of the transport protocols used, the types of messages observed, 178 178 and what interaction took place between the two machines. Leave both machines running for the next task. 179 </p></li></ol></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2626531"></a>Findings</h4></div></div></div><p>179 </p></li></ol></div><div class="sect3" title="Findings"><div class="titlepage"><div><div><h4 class="title"><a name="id391782"></a>Findings</h4></div></div></div><p> 180 180 <a class="link" href="primer.html#capsstats02" title="Table 16.2. Second Machine (Windows 98) Capture Statistics">“Second Machine (Windows 98) Capture Statistics”</a> summarizes capture statistics observed. As in the previous case, 181 181 all announcements used UDP/IP broadcasts. Also, as was observed with the last example, the second … … 183 183 (i.e., the name is already registered by another machine) on the network segment. Those wishing 184 184 to explore the inner details of the precise mechanism of how this functions should refer to 185 “<span class="quote">Implementing CIFS: The Common Internet File System.</span>”185 <span class="quote">“<span class="quote">Implementing CIFS: The Common Internet File System.</span>”</span> 186 186 </p><div class="table"><a name="capsstats02"></a><p class="title"><b>Table 16.2. Second Machine (Windows 98) Capture Statistics</b></p><div class="table-contents"><table summary="Second Machine (Windows 98) Capture Statistics" border="1"><colgroup><col align="left"><col align="center"><col align="center"><col align="left"></colgroup><thead><tr><th align="left">Message</th><th align="center">Type</th><th align="center">Num</th><th align="left">Notes</th></tr></thead><tbody><tr><td align="left">MILGATE98<00></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.6 sec apart</td></tr><tr><td align="left">MILGATE98<03></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.6 sec apart</td></tr><tr><td align="left">MILGATE98<20></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<00></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1d></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1e></td><td align="center">Reg</td><td align="center">8</td><td align="left">4 lots of 2, 0.75 sec apart</td></tr><tr><td align="left">MIDEARTH<1b></td><td align="center">Qry</td><td align="center">18</td><td align="left">900 sec apart at stable operation</td></tr><tr><td align="left">JHT<03></td><td align="center">Reg</td><td align="center">2</td><td align="left">This is the name of the user that logged onto Windows</td></tr><tr><td align="left">Host Announcement MILGATE98</td><td align="center">Ann</td><td align="center">14</td><td align="left">Every 120 sec</td></tr><tr><td align="left">Domain/Workgroup Announcement MIDEARTH</td><td align="center">Ann</td><td align="center">6</td><td align="left">900 sec apart at stable operation</td></tr><tr><td align="left">Local Master Announcement WINEPRESSME</td><td align="center">Ann</td><td align="center">6</td><td align="left">Insufficient detail to determine frequency</td></tr></tbody></table></div></div><br class="table-break"><p> 187 <a class="indexterm" name="id 2626813"></a>188 <a class="indexterm" name="id 2626820"></a>189 <a class="indexterm" name="id 2626827"></a>187 <a class="indexterm" name="id392055"></a> 188 <a class="indexterm" name="id392062"></a> 189 <a class="indexterm" name="id392069"></a> 190 190 Observation of the contents of Host Announcements, Domain/Workgroup Announcements, 191 191 and Local Master Announcements is instructive. These messages convey a significant 192 192 level of detail regarding the nature of each machine that is on the network. An example 193 193 dissection of a Host Announcement is given in <a class="link" href="primer.html#hostannounce" title="Figure 16.3. Typical Windows 9x/Me Host Announcement">“Typical Windows 9x/Me Host Announcement”</a>. 194 </p><div class="figure"><a name="hostannounce"></a><p class="title"><b>Figure 16.3. Typical Windows 9x/Me Host Announcement</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/HostAnnouncment.png" width="221.4" alt="Typical Windows 9x/Me Host Announcement"></div></div></div><br class="figure-break"></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2626892"></a>Simple Windows Client Connection Characteristics</h3></div></div></div><p>194 </p><div class="figure"><a name="hostannounce"></a><p class="title"><b>Figure 16.3. Typical Windows 9x/Me Host Announcement</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/HostAnnouncment.png" width="221.4" alt="Typical Windows 9x/Me Host Announcement"></div></div></div><br class="figure-break"></div></div><div class="sect2" title="Simple Windows Client Connection Characteristics"><div class="titlepage"><div><div><h3 class="title"><a name="id392130"></a>Simple Windows Client Connection Characteristics</h3></div></div></div><p> 195 195 The purpose of this exercise is to discover how Microsoft Windows clients create (establish) 196 196 connections with remote servers. The methodology involves analysis of a key aspect of how 197 197 Windows clients access remote servers: the session setup protocol. 198 </p><div class="procedure" ><a name="id2626906"></a><p class="title"><b>Procedure 16.4. Client Connection Exploration Steps</b></p><ol type="1"><li><p>198 </p><div class="procedure" title="Procedure 16.4. Client Connection Exploration Steps"><a name="id392141"></a><p class="title"><b>Procedure 16.4. Client Connection Exploration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 199 199 Configure a Windows 9x/Me machine (MILGATE98) with a share called <code class="constant">Stuff</code>. 200 200 Create a <em class="parameter"><code>Full Access</code></em> control password on this share. 201 </p></li><li ><p>201 </p></li><li class="step" title="Step 2"><p> 202 202 Configure another Windows 9x/Me machine (WINEPRESSME) as a client. Make sure that it exports 203 203 no shared resources. 204 </p></li><li ><p>204 </p></li><li class="step" title="Step 3"><p> 205 205 Start both Windows 9x/Me machines and allow them to stabilize for 10 minutes. Log on to both 206 206 machines using a user name (JHT) of your choice. Wait approximately 2 minutes before proceeding. 207 </p></li><li ><p>207 </p></li><li class="step" title="Step 4"><p> 208 208 Start Wireshark (or the network sniffer of your choice). 209 </p></li><li ><p>209 </p></li><li class="step" title="Step 5"><p> 210 210 From the WINEPRESSME machine, right-click <span class="guimenu">Network Neighborhood</span>, select 211 211 <span class="guimenuitem">Explore</span>, select … … 213 213 Enter the password you set for the <code class="constant">Full Control</code> mode for the 214 214 <code class="constant">Stuff</code> share. 215 </p></li><li ><p>215 </p></li><li class="step" title="Step 6"><p> 216 216 When the share called <code class="constant">Stuff</code> is being displayed, stop the capture. 217 217 Save the captured data in case it is needed for later analysis. 218 </p></li><li ><p>219 <a class="indexterm" name="id 2627037"></a>218 </p></li><li class="step" title="Step 7"><p> 219 <a class="indexterm" name="id392265"></a> 220 220 From the top of the packets captured, scan down to locate the first packet that has 221 221 interpreted as <code class="constant">Session Setup AndX, User: anonymous; Tree Connect AndX, 222 222 Path: \\MILGATE98\IPC$</code>. 223 </p></li><li ><p><a class="indexterm" name="id2627056"></a><a class="indexterm" name="id2627064"></a>223 </p></li><li class="step" title="Step 8"><p><a class="indexterm" name="id392283"></a><a class="indexterm" name="id392291"></a> 224 224 In the dissection (analysis) panel, expand the <code class="constant">SMB, Session Setup AndX Request, 225 225 and Tree Connect AndX Request</code>. Examine both operations. Identify the name of 226 226 the user Account and what password was used. The Account name should be empty. 227 227 This is a <code class="constant">NULL</code> session setup packet. 228 </p></li><li ><p>228 </p></li><li class="step" title="Step 9"><p> 229 229 Return to the packet capture sequence. There will be a number of packets that have been 230 230 decoded of the type <code class="constant">Session Setup AndX</code>. Locate the last such packet 231 231 that was targeted at the <code class="constant">\\MILGATE98\IPC$</code> service. 232 </p></li><li ><p>233 <a class="indexterm" name="id 2627108"></a>234 <a class="indexterm" name="id 2627115"></a>232 </p></li><li class="step" title="Step 10"><p> 233 <a class="indexterm" name="id392331"></a> 234 <a class="indexterm" name="id392338"></a> 235 235 Dissect this packet as per the previous one. This packet should have a password length 236 236 of 24 (characters) and should have a password field, the contents of which is a 237 237 long hexadecimal number. Observe the name in the Account field. This is a User Mode 238 238 session setup packet. 239 </p></li></ol></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2627129"></a>Findings and Comments</h4></div></div></div><p>240 <a class="indexterm" name="id 2627138"></a>241 The <code class="constant">IPC$</code> share serves a vital purpose<sup>[<a name="id 2627149" href="#ftn.id2627149" class="footnote">15</a>]</sup>239 </p></li></ol></div><div class="sect3" title="Findings and Comments"><div class="titlepage"><div><div><h4 class="title"><a name="id392350"></a>Findings and Comments</h4></div></div></div><p> 240 <a class="indexterm" name="id392358"></a> 241 The <code class="constant">IPC$</code> share serves a vital purpose<sup>[<a name="id392369" href="#ftn.id392369" class="footnote">15</a>]</sup> 242 242 in SMB/CIFS-based networking. A Windows client connects to this resource to obtain the list of 243 243 resources that are available on the server. The server responds with the shares and print queues that … … 245 245 username and a <code class="constant">NULL</code> password. 246 246 </p><p> 247 <a class="indexterm" name="id 2627169"></a>247 <a class="indexterm" name="id392386"></a> 248 248 The two packets examined are material evidence of how Windows clients may 249 249 interoperate with Samba. Samba requires every connection setup to be authenticated using … … 252 252 account. 253 253 </p><p> 254 <a class="indexterm" name="id 2627189"></a><a class="indexterm" name="id2627195"></a>255 <a class="indexterm" name="id 2627204"></a>254 <a class="indexterm" name="id392403"></a><a class="indexterm" name="id392408"></a> 255 <a class="indexterm" name="id392417"></a> 256 256 Samba has a special name for the <code class="constant">NULL</code>, or empty, user account: 257 257 it calls it the <a class="link" href="smb.conf.5.html#GUESTACCOUNT" target="_top">guest account</a>. The … … 262 262 <a class="link" href="primer.html#nullconnect" title="Figure 16.4. Typical Windows 9x/Me NULL SessionSetUp AndX Request">“Typical Windows 9x/Me NULL SessionSetUp AndX Request”</a>. 263 263 </p><div class="figure"><a name="nullconnect"></a><p class="title"><b>Figure 16.4. Typical Windows 9x/Me NULL SessionSetUp AndX Request</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/NullConnect.png" width="221.4" alt="Typical Windows 9x/Me NULL SessionSetUp AndX Request"></div></div></div><br class="figure-break"><p> 264 <a class="indexterm" name="id 2627289"></a>265 <a class="indexterm" name="id 2627296"></a>266 <a class="indexterm" name="id 2627303"></a>264 <a class="indexterm" name="id392498"></a> 265 <a class="indexterm" name="id392505"></a> 266 <a class="indexterm" name="id392512"></a> 267 267 When a UNIX/Linux system does not have a <code class="constant">nobody</code> user account 268 268 (<code class="filename">/etc/passwd</code>), the operation of the <code class="constant">NULL</code> … … 272 272 is shown in <a class="link" href="primer.html#userconnect" title="Figure 16.5. Typical Windows 9x/Me User SessionSetUp AndX Request">“Typical Windows 9x/Me User SessionSetUp AndX Request”</a>. 273 273 </p><div class="figure"><a name="userconnect"></a><p class="title"><b>Figure 16.5. Typical Windows 9x/Me User SessionSetUp AndX Request</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/UserConnect.png" width="221.4" alt="Typical Windows 9x/Me User SessionSetUp AndX Request"></div></div></div><br class="figure-break"><p> 274 <a class="indexterm" name="id 2627380"></a>274 <a class="indexterm" name="id392585"></a> 275 275 The User Mode connection packet contains the account name and the domain name. 276 276 The password is provided in Microsoft encrypted form, and its length is shown 277 277 as 24 characters. This is the length of Microsoft encrypted passwords. 278 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2627394"></a>Windows 200x/XP Client Interaction with Samba-3</h3></div></div></div><p>279 By now you may be asking, “<span class="quote">Why did you choose to work with Windows 9x/Me?</span>”278 </p></div></div><div class="sect2" title="Windows 200x/XP Client Interaction with Samba-3"><div class="titlepage"><div><div><h3 class="title"><a name="id392597"></a>Windows 200x/XP Client Interaction with Samba-3</h3></div></div></div><p> 279 By now you may be asking, <span class="quote">“<span class="quote">Why did you choose to work with Windows 9x/Me?</span>”</span> 280 280 </p><p> 281 281 First, we want to demonstrate the simple case. This book is not intended to be a detailed treatise … … 291 291 a domain member of either a Samba-controlled domain or a Windows NT4 or 200x Active Directory domain. 292 292 Here we do not provide details for how to configure this, as full coverage is provided earlier in this book. 293 </p><div class="procedure" ><a name="id2627437"></a><p class="title"><b>Procedure 16.5. Steps to Explore Windows XP Pro Connection Set-up</b></p><ol type="1"><li><p>293 </p><div class="procedure" title="Procedure 16.5. Steps to Explore Windows XP Pro Connection Set-up"><a name="id392631"></a><p class="title"><b>Procedure 16.5. Steps to Explore Windows XP Pro Connection Set-up</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 294 294 Start your domain controller. Also, start the Wireshark monitoring machine, launch Wireshark, 295 295 and then wait for the next step to complete. 296 </p></li><li ><p>296 </p></li><li class="step" title="Step 2"><p> 297 297 Start the Windows XP Client and wait 5 minutes before proceeding. 298 </p></li><li ><p>298 </p></li><li class="step" title="Step 3"><p> 299 299 On the machine from which network activity will be monitored (using <code class="literal">Wireshark</code>), 300 300 launch <code class="literal">Wireshark</code> and click … … 302 302 </p><p> 303 303 Click: 304 </p><div class="orderedlist"><ol type="1"><li><p>Update list of packets in real time</p></li><li><p>Automatic scrolling in live capture</p></li><li><p>Enable MAC name resolution</p></li><li><p>Enable network name resolution</p></li><li><p>Enable transport name resolution</p></li></ol></div><p>304 </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p>Update list of packets in real time</p></li><li class="listitem"><p>Automatic scrolling in live capture</p></li><li class="listitem"><p>Enable MAC name resolution</p></li><li class="listitem"><p>Enable network name resolution</p></li><li class="listitem"><p>Enable transport name resolution</p></li></ol></div><p> 305 305 Click <span class="guibutton">OK</span>. 306 </p></li><li ><p>306 </p></li><li class="step" title="Step 4"><p> 307 307 On the Windows XP Professional client, press <span class="guimenu">Ctrl-Alt-Delete</span> to bring 308 308 up the domain logon screen. Log in using valid credentials for a domain user account. 309 </p></li><li ><p>309 </p></li><li class="step" title="Step 5"><p> 310 310 Now proceed to connect to the domain controller as follows: 311 311 <span class="guimenu">Start</span> → <span class="guimenuitem">(right-click) My Network Places</span> → <span class="guimenuitem">Explore</span> → <span class="guimenuitem">{Left Panel} [+] Entire Network</span> → <span class="guimenuitem">{Left Panel} [+] Microsoft Windows Network</span> → <span class="guimenuitem">{Left Panel} [+] Midearth</span> → <span class="guimenuitem">{Left Panel} [+] Frodo</span> → <span class="guimenuitem">{Left Panel} [+] data</span>. Close the explorer window. … … 313 313 In this step, our domain name is <code class="constant">Midearth</code>, the domain controller is called 314 314 <code class="constant">Frodo</code>, and we have connected to a share called <code class="constant">data</code>. 315 </p></li><li ><p>315 </p></li><li class="step" title="Step 6"><p> 316 316 Stop the capture on the <code class="literal">Wireshark</code> monitoring machine. Be sure to save the captured data 317 317 to a file so that you can refer to it again later. 318 </p></li><li ><p>318 </p></li><li class="step" title="Step 7"><p> 319 319 If desired, the Windows XP Professional client and the domain controller are no longer needed for exercises 320 320 in this chapter. 321 </p></li><li ><p>322 <a class="indexterm" name="id 2627663"></a>323 <a class="indexterm" name="id 2627670"></a>321 </p></li><li class="step" title="Step 8"><p> 322 <a class="indexterm" name="id392845"></a> 323 <a class="indexterm" name="id392852"></a> 324 324 From the top of the packets captured, scan down to locate the first packet that has 325 325 interpreted as <code class="constant">Session Setup AndX Request, NTLMSSP_AUTH</code>. 326 </p></li><li ><p>327 <a class="indexterm" name="id 2627690"></a>328 <a class="indexterm" name="id 2627697"></a>329 <a class="indexterm" name="id 2627704"></a>326 </p></li><li class="step" title="Step 9"><p> 327 <a class="indexterm" name="id392870"></a> 328 <a class="indexterm" name="id392877"></a> 329 <a class="indexterm" name="id392884"></a> 330 330 In the dissection (analysis) panel, expand the <code class="constant">SMB, Session Setup AndX Request</code>. 331 331 Expand the packet decode information, beginning at the <code class="constant">Security Blob:</code> … … 334 334 The <code class="constant">User name: NULL</code> so indicates. An example decode is shown in 335 335 <a class="link" href="primer.html#XPCap01" title="Figure 16.6. Typical Windows XP NULL Session Setup AndX Request">“Typical Windows XP NULL Session Setup AndX Request”</a>. 336 </p></li><li ><p>336 </p></li><li class="step" title="Step 10"><p> 337 337 Return to the packet capture sequence. There will be a number of packets that have been 338 338 decoded of the type <code class="constant">Session Setup AndX Request</code>. Click the last such packet that 339 339 has been decoded as <code class="constant">Session Setup AndX Request, NTLMSSP_AUTH</code>. 340 </p></li><li ><p>341 <a class="indexterm" name="id 2627766"></a>340 </p></li><li class="step" title="Step 11"><p> 341 <a class="indexterm" name="id392941"></a> 342 342 In the dissection (analysis) panel, expand the <code class="constant">SMB, Session Setup AndX Request</code>. 343 343 Expand the packet decode information, beginning at the <code class="constant">Security Blob:</code> … … 349 349 The values of these two parameters are the Microsoft encrypted password hashes: respectively, the LanMan 350 350 password and then the NT (case-preserving) password hash. 351 </p></li><li ><p>352 <a class="indexterm" name="id 2627828"></a>353 <a class="indexterm" name="id 2627835"></a>351 </p></li><li class="step" title="Step 12"><p> 352 <a class="indexterm" name="id392995"></a> 353 <a class="indexterm" name="id393002"></a> 354 354 The passwords are 24-character hexadecimal numbers. This packet confirms that this is a User Mode 355 355 session setup packet. 356 </p></li></ol></div><div class="figure"><a name="XPCap01"></a><p class="title"><b>Figure 16.6. Typical Windows XP NULL Session Setup AndX Request</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/WindowsXP-NullConnection.png" width="270" alt="Typical Windows XP NULL Session Setup AndX Request"></div></div></div><br class="figure-break"><div class="figure"><a name="XPCap02"></a><p class="title"><b>Figure 16.7. Typical Windows XP User Session Setup AndX Request</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/WindowsXP-UserConnection.png" width="270" alt="Typical Windows XP User Session Setup AndX Request"></div></div></div><br class="figure-break"><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2627931"></a>Discussion</h4></div></div></div><p><a class="indexterm" name="id2627938"></a>356 </p></li></ol></div><div class="figure"><a name="XPCap01"></a><p class="title"><b>Figure 16.6. Typical Windows XP NULL Session Setup AndX Request</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/WindowsXP-NullConnection.png" width="270" alt="Typical Windows XP NULL Session Setup AndX Request"></div></div></div><br class="figure-break"><div class="figure"><a name="XPCap02"></a><p class="title"><b>Figure 16.7. Typical Windows XP User Session Setup AndX Request</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/WindowsXP-UserConnection.png" width="270" alt="Typical Windows XP User Session Setup AndX Request"></div></div></div><br class="figure-break"><div class="sect3" title="Discussion"><div class="titlepage"><div><div><h4 class="title"><a name="id393094"></a>Discussion</h4></div></div></div><p><a class="indexterm" name="id393101"></a> 357 357 This exercise demonstrates that, while the specific protocol for the Session Setup AndX is handled 358 358 in a more sophisticated manner by recent MS Windows clients, the underlying rules or principles … … 361 361 technology server (one using Windows NT4/200x or Samba). It also demonstrates that an authenticated 362 362 connection must be made before resources can be used. 363 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2627962"></a>Conclusions to Exercises</h3></div></div></div><p>363 </p></div></div><div class="sect2" title="Conclusions to Exercises"><div class="titlepage"><div><div><h3 class="title"><a name="id393121"></a>Conclusions to Exercises</h3></div></div></div><p> 364 364 In summary, the following points have been established in this chapter: 365 </p><div class="itemizedlist"><ul type="disc"><li><p>365 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 366 366 When NetBIOS over TCP/IP protocols are enabled, MS Windows networking employs broadcast-oriented messaging protocols to provide knowledge of network services. 367 </p></li><li ><p>367 </p></li><li class="listitem"><p> 368 368 Network browsing protocols query information stored on browse masters that manage 369 369 information provided by NetBIOS Name Registrations and by way of ongoing host 370 370 announcements and workgroup announcements. 371 </p></li><li ><p>371 </p></li><li class="listitem"><p> 372 372 All Samba servers must be configured with a mechanism for mapping the <code class="constant">NULL-Session</code> 373 373 to a valid but nonprivileged UNIX system account. 374 </p></li><li ><p>374 </p></li><li class="listitem"><p> 375 375 The use of Microsoft encrypted passwords is built right into the fabric of Windows 376 376 networking operations. Such passwords cannot be provided from the UNIX <code class="filename">/etc/passwd</code> … … 378 378 use. Samba-2.x permitted such encrypted passwords to be stored in the <code class="constant">smbpasswd</code> 379 379 file or in an LDAP database. Samba-3 permits use of multiple <em class="parameter"><code>passdb backend</code></em> 380 databases in concurrent deployment. Refer to <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 10, “<span class="quote">Account Information Databases.</span>”381 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="chap01conc"></a>Dissection and Discussion</h2></div></div></div><p>382 <a class="indexterm" name="id 2628050"></a>380 databases in concurrent deployment. Refer to <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 10, <span class="quote">“<span class="quote">Account Information Databases.</span>”</span> 381 </p></li></ul></div></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="chap01conc"></a>Dissection and Discussion</h2></div></div></div><p> 382 <a class="indexterm" name="id393199"></a> 383 383 The exercises demonstrate the use of the <code class="constant">guest</code> account, the way that 384 384 MS Windows clients and servers resolve computer names to a TCP/IP address, and how connections … … 388 388 the Microsoft knowledgebase article 389 389 <a class="ulink" href="http://support.microsoft.com/support/kb/articles/Q102/78/8.asp" target="_top">Q102878.</a> 390 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2628077"></a>Technical Issues</h3></div></div></div><p>391 <a class="indexterm" name="id 2628085"></a>390 </p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id393223"></a>Technical Issues</h3></div></div></div><p> 391 <a class="indexterm" name="id393231"></a> 392 392 Network browsing involves SMB broadcast announcements, SMB enumeration requests, 393 393 connections to the <code class="constant">IPC$</code> share, share enumerations, and SMB connection 394 394 setup processes. The use of anonymous connections to a Samba server involve the use of 395 395 the <em class="parameter"><code>guest account</code></em> that must map to a valid UNIX UID. 396 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="chap01qa"></a>Questions and Answers</h2></div></div></div><p>396 </p></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="chap01qa"></a>Questions and Answers</h2></div></div></div><p> 397 397 The questions and answers given in this section are designed to highlight important aspects of Microsoft 398 398 Windows networking. 399 </p><div class="qandaset" ><dl><dt> <a href="primer.html#id2628131">399 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id393266"></a><dl><dt> <a href="primer.html#id393272"> 400 400 What is the significance of the MIDEARTH<1b> type query? 401 </a></dt><dt> <a href="primer.html#id 2628177">401 </a></dt><dt> <a href="primer.html#id393315"> 402 402 What is the significance of the MIDEARTH<1d> type name registration? 403 </a></dt><dt> <a href="primer.html#id 2628251">403 </a></dt><dt> <a href="primer.html#id393382"> 404 404 What is the role and significance of the <01><02>__MSBROWSE__<02><01> 405 405 name registration? 406 </a></dt><dt> <a href="primer.html#id 2628284">406 </a></dt><dt> <a href="primer.html#id393410"> 407 407 What is the significance of the MIDEARTH<1e> type name registration? 408 </a></dt><dt> <a href="primer.html#id 2628315">408 </a></dt><dt> <a href="primer.html#id393437"> 409 409 410 410 What is the significance of the guest account in smb.conf? 411 </a></dt><dt> <a href="primer.html#id 2628393">411 </a></dt><dt> <a href="primer.html#id393508"> 412 412 Is it possible to reduce network broadcast activity with Samba-3? 413 </a></dt><dt> <a href="primer.html#id 2628502">413 </a></dt><dt> <a href="primer.html#id393609"> 414 414 Can I just use plain-text passwords with Samba? 415 </a></dt><dt> <a href="primer.html#id 2628589">415 </a></dt><dt> <a href="primer.html#id393684"> 416 416 What parameter in the smb.conf file is used to enable the use of encrypted passwords? 417 </a></dt><dt> <a href="primer.html#id 2628630">417 </a></dt><dt> <a href="primer.html#id393723"> 418 418 Is it necessary to specify encrypt passwords = Yes 419 419 when Samba-3 is configured as a domain member? 420 </a></dt><dt> <a href="primer.html#id 2628662">420 </a></dt><dt> <a href="primer.html#id393753"> 421 421 Is it necessary to specify a guest account when Samba-3 is configured 422 422 as a domain member server? 423 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2628131"></a><a name="id2628133"></a></td><td align="left" valign="top"><p>423 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id393272"></a><a name="id393275"></a></td><td align="left" valign="top"><p> 424 424 What is the significance of the MIDEARTH<1b> type query? 425 425 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 426 <a class="indexterm" name="id 2628145"></a>427 <a class="indexterm" name="id 2628155"></a>426 <a class="indexterm" name="id393286"></a> 427 <a class="indexterm" name="id393296"></a> 428 428 This is a broadcast announcement by which the Windows machine is attempting to 429 429 locate a Domain Master Browser (DMB) in the event that it might exist on the network. 430 Refer to <span class="emphasis"><em>TOSHARG2,</em></span> Chapter 9, Section 9.7, “<span class="quote">Technical Overview of Browsing,</span>”430 Refer to <span class="emphasis"><em>TOSHARG2,</em></span> Chapter 9, Section 9.7, <span class="quote">“<span class="quote">Technical Overview of Browsing,</span>”</span> 431 431 for details regarding the function of the DMB and its role in network browsing. 432 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2628177"></a><a name="id2628179"></a></td><td align="left" valign="top"><p>432 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id393315"></a><a name="id393317"></a></td><td align="left" valign="top"><p> 433 433 What is the significance of the MIDEARTH<1d> type name registration? 434 434 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 435 <a class="indexterm" name="id 2628192"></a>436 <a class="indexterm" name="id 2628201"></a>435 <a class="indexterm" name="id393329"></a> 436 <a class="indexterm" name="id393338"></a> 437 437 This name registration records the machine IP addresses of the LMBs. 438 438 Network clients can query this name type to obtain a list of browser servers from the … … 442 442 collating the information contained within them. Using this information, it can provide answers to other Windows 443 443 network clients that request information such as: 444 </p><div class="itemizedlist"><ul type="disc"><li><p>444 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 445 445 The list of machines known to the LMB (i.e., the browse list) 446 </p></li><li ><p>446 </p></li><li class="listitem"><p> 447 447 The IP addresses of all domain controllers known for the domain 448 </p></li><li ><p>448 </p></li><li class="listitem"><p> 449 449 The IP addresses of LMBs 450 </p></li><li ><p>450 </p></li><li class="listitem"><p> 451 451 The IP address of the DMB (if one exists) 452 </p></li><li ><p>452 </p></li><li class="listitem"><p> 453 453 The IP address of the LMB on the local segment 454 </p></li></ul></div></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2628251"></a><a name="id2628254"></a></td><td align="left" valign="top"><p>454 </p></li></ul></div></td></tr><tr class="question"><td align="left" valign="top"><a name="id393382"></a><a name="id393384"></a></td><td align="left" valign="top"><p> 455 455 What is the role and significance of the <01><02>__MSBROWSE__<02><01> 456 456 name registration? 457 457 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 458 <a class="indexterm" name="id 2628269"></a>458 <a class="indexterm" name="id393397"></a> 459 459 This name is registered by the browse master to broadcast and receive domain announcements. 460 460 Its scope is limited to the local network segment, or subnet. By querying this name type, 461 461 master browsers on networks that have multiple domains can find the names of master browsers 462 462 for each domain. 463 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2628284"></a><a name="id2628286"></a></td><td align="left" valign="top"><p>463 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id393410"></a><a name="id393412"></a></td><td align="left" valign="top"><p> 464 464 What is the significance of the MIDEARTH<1e> type name registration? 465 465 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 466 <a class="indexterm" name="id 2628298"></a>466 <a class="indexterm" name="id393423"></a> 467 467 This name is registered by all browse masters in a domain or workgroup. The registration 468 468 name type is known as the Browser Election Service. Master browsers register themselves 469 469 with this name type so that DMBs can locate them to perform cross-subnet 470 470 browse list updates. This name type is also used to initiate elections for Master Browsers. 471 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2628315"></a><a name="id2628317"></a></td><td align="left" valign="top"><p>472 <a class="indexterm" name="id 2628321"></a>471 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id393437"></a><a name="id393439"></a></td><td align="left" valign="top"><p> 472 <a class="indexterm" name="id393443"></a> 473 473 What is the significance of the <em class="parameter"><code>guest account</code></em> in smb.conf? 474 474 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 483 483 or there must be an entry in the <code class="filename">smb.conf</code> file with a valid UNIX account, such as 484 484 <a class="link" href="smb.conf.5.html#GUESTACCOUNT" target="_top">guest account = ftp</a>. 485 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2628393"></a><a name="id2628395"></a></td><td align="left" valign="top"><p>485 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id393508"></a><a name="id393510"></a></td><td align="left" valign="top"><p> 486 486 Is it possible to reduce network broadcast activity with Samba-3? 487 487 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 488 <a class="indexterm" name="id 2628407"></a>489 <a class="indexterm" name="id 2628413"></a>488 <a class="indexterm" name="id393521"></a> 489 <a class="indexterm" name="id393528"></a> 490 490 Yes, there are two ways to do this. The first involves use of WINS (See <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 9, 491 Section 9.5, “<span class="quote">WINS The Windows Inter-networking Name Server</span>”); the491 Section 9.5, <span class="quote">“<span class="quote">WINS The Windows Inter-networking Name Server</span>”</span>); the 492 492 alternate method involves disabling the use of NetBIOS over TCP/IP. This second method requires 493 a correctly configured DNS server (see <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 9, Section 9.3, “<span class="quote">Discussion</span>”).494 </p><p> 495 <a class="indexterm" name="id 2628445"></a>496 <a class="indexterm" name="id 2628452"></a>497 <a class="indexterm" name="id 2628461"></a>493 a correctly configured DNS server (see <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 9, Section 9.3, <span class="quote">“<span class="quote">Discussion</span>”</span>). 494 </p><p> 495 <a class="indexterm" name="id393558"></a> 496 <a class="indexterm" name="id393564"></a> 497 <a class="indexterm" name="id393573"></a> 498 498 The use of WINS reduces network broadcast traffic. The reduction is greatest when all network 499 499 clients are configured to operate in <em class="parameter"><code>Hybrid Mode</code></em>. This can be effected through 500 500 use of DHCP to set the NetBIOS node type to type 8 for all network clients. Additionally, it is 501 501 beneficial to configure Samba to use <a class="link" href="smb.conf.5.html#NAMERESOLVEORDER" target="_top">name resolve order = wins host cast</a>. 502 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>502 </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 503 503 Use of SMB without NetBIOS is possible only on Windows 200x/XP Professional clients and servers, as 504 504 well as with Samba-3. 505 </p></div></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2628502"></a><a name="id2628504"></a></td><td align="left" valign="top"><p>505 </p></div></td></tr><tr class="question"><td align="left" valign="top"><a name="id393609"></a><a name="id393611"></a></td><td align="left" valign="top"><p> 506 506 Can I just use plain-text passwords with Samba? 507 507 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 526 526 PDC/BDC to provide Windows user and group accounts, the <em class="parameter"><code>idmap uid, idmap gid</code></em> ranges 527 527 set in the <code class="filename">smb.conf</code> file provide the local UID/GIDs needed for local identity management purposes. 528 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2628589"></a><a name="id2628591"></a></td><td align="left" valign="top"><p>528 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id393684"></a><a name="id393686"></a></td><td align="left" valign="top"><p> 529 529 What parameter in the <code class="filename">smb.conf</code> file is used to enable the use of encrypted passwords? 530 530 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 531 531 The parameter in the <code class="filename">smb.conf</code> file that controls this behavior is known as <em class="parameter"><code>encrypt 532 532 passwords</code></em>. The default setting for this in Samba-3 is <code class="constant">Yes (Enabled)</code>. 533 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2628630"></a><a name="id2628632"></a></td><td align="left" valign="top"><p>533 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id393723"></a><a name="id393725"></a></td><td align="left" valign="top"><p> 534 534 Is it necessary to specify <a class="link" href="smb.conf.5.html#ENCRYPTPASSWORDS" target="_top">encrypt passwords = Yes</a> 535 535 when Samba-3 is configured as a domain member? 536 536 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 537 537 No. This is the default behavior. 538 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2628662"></a><a name="id2628664"></a></td><td align="left" valign="top"><p>538 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id393753"></a><a name="id393756"></a></td><td align="left" valign="top"><p> 539 539 Is it necessary to specify a <em class="parameter"><code>guest account</code></em> when Samba-3 is configured 540 540 as a domain member server? … … 544 544 necessary to provide a <a class="link" href="smb.conf.5.html#GUESTACCOUNT" target="_top">guest account = an_account</a>, 545 545 where <code class="constant">an_account</code> is a valid local UNIX user account. 546 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id 2627149" href="#id2627149" class="para">15</a>] </sup>TOSHARG2, Sect 4.5.1</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="appendix.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="RefSection.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="apa.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 15. A Collection of Useful Tidbits </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Appendix A.547 GNUGeneral Public License version 3546 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id392369" href="#id392369" class="para">15</a>] </sup>TOSHARG2, Sect 4.5.1</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="appendix.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="RefSection.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="apa.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 15. A Collection of Useful Tidbits </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Appendix A. 547 <acronym class="acronym">GNU</acronym> General Public License version 3 548 548 </td></tr></table></div></body></html> -
trunk/server/docs/htmldocs/Samba3-ByExample/secure.html
r414 r599 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 3. Secure Office Networking</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 4.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="small.html" title="Chapter 2. Small Office Networking"><link rel="next" href="Big500users.html" title="Chapter 4. The 500-User Office"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 3. Secure Office Networking</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="small.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="Big500users.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="secure"></a>Chapter 3. Secure Office Networking</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="secure.html#id2558563">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id2558614">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2558848">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id2558863">Technical Issues</a></span></dt><dt><span class="sect2"><a href="secure.html#id2559289">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2559329">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#ch4bsc">Basic System Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id2560183">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4ptrcfg">Printer Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4valid">Validation</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4appscfg">Application Share Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id2564645">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id2564707">Questions and Answers</a></span></dt></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 3. Secure Office Networking</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="small.html" title="Chapter 2. Small Office Networking"><link rel="next" href="Big500users.html" title="Chapter 4. The 500-User Office"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 3. Secure Office Networking</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="small.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="Big500users.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 3. Secure Office Networking"><div class="titlepage"><div><div><h2 class="title"><a name="secure"></a>Chapter 3. Secure Office Networking</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="secure.html#id330143">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id330177">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id330386">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#id330398">Technical Issues</a></span></dt><dt><span class="sect2"><a href="secure.html#id330742">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id330776">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="secure.html#ch4bsc">Basic System Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id331530">Samba Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4dhcpdns">Configuration of DHCP and DNS Servers</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4ptrcfg">Printer Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#procstart">Process Startup Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4valid">Validation</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4appscfg">Application Share Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#ch4wincfg">Windows Client Configuration</a></span></dt><dt><span class="sect2"><a href="secure.html#id335513">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="secure.html#id335566">Questions and Answers</a></span></dt></dl></div><p> 2 2 Congratulations, your Samba networking skills are developing nicely. You started out 3 3 with three simple networks in <a class="link" href="simple.html" title="Chapter 1. No-Frills Samba Servers">“No-Frills Samba Servers”</a>, and then in <a class="link" href="small.html" title="Chapter 2. Small Office Networking">“Small Office Networking”</a> … … 12 12 To avoid confusion, this book is all about Samba-3. Let's get the exercises in this 13 13 chapter underway. 14 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2558563"></a>Introduction</h2></div></div></div><p>14 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id330143"></a>Introduction</h2></div></div></div><p> 15 15 You have made Mr. Meany a very happy man. Recently he paid you a fat bonus for work 16 16 well done. It is one year since the last network upgrade. You have been quite busy. … … 41 41 about your move, she almost resigned, although she was reassured that a new manager would 42 42 be hired to run Information Technology, and she would be responsible only for operations. 43 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2558614"></a>Assignment Tasks</h3></div></div></div><p>43 </p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id330177"></a>Assignment Tasks</h3></div></div></div><p> 44 44 You promised the staff Internet services including Web browsing, electronic mail, virus 45 45 protection, and a company Web site. Christine is eager to help turn the vision into … … 84 84 some problems with desktop computers and software installation into the new users' 85 85 desktop profiles. 86 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2558848"></a>Dissection and Discussion</h2></div></div></div><p>86 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id330386"></a>Dissection and Discussion</h2></div></div></div><p> 87 87 Many of the conclusions you draw here are obvious. Some requirements are not very clear 88 88 or may simply be your means of drawing the most out of Samba-3. Much can be done more simply … … 90 90 users. This means that some functionality will be overdesigned for the current 130-user 91 91 environment. 92 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2558863"></a>Technical Issues</h3></div></div></div><p>92 </p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id330398"></a>Technical Issues</h3></div></div></div><p> 93 93 In this exercise we use a 24-bit subnet mask for the two local networks. This, 94 94 of course, limits our network to a maximum of 253 usable IP addresses. The network … … 98 98 in the 172.16.0.0/16 range. This is done in subsequent chapters. 99 99 </p><p> 100 <a class="indexterm" name="id 2558881"></a>101 <a class="indexterm" name="id 2558888"></a>100 <a class="indexterm" name="id330412"></a> 101 <a class="indexterm" name="id330419"></a> 102 102 The high growth rates projected are a good reason to use the <code class="constant">tdbsam</code> 103 103 passdb backend. The use of <code class="constant">smbpasswd</code> for the backend may result in … … 105 105 are not available with the older, flat ASCII-based <code class="constant">smbpasswd</code> database. 106 106 </p><p> 107 <a class="indexterm" name="id 2558914"></a>107 <a class="indexterm" name="id330443"></a> 108 108 The proposed network design uses a single server to act as an Internet services host for 109 109 electronic mail, Web serving, remote administrative access via SSH, … … 118 118 directly connected to the Internet. 119 119 </p><p> 120 <a class="indexterm" name="id 2558939"></a>121 <a class="indexterm" name="id 2558945"></a>122 <a class="indexterm" name="id 2558952"></a>123 <a class="indexterm" name="id 2558960"></a>120 <a class="indexterm" name="id330462"></a> 121 <a class="indexterm" name="id330469"></a> 122 <a class="indexterm" name="id330475"></a> 123 <a class="indexterm" name="id330483"></a> 124 124 You know that your ISP is providing full firewall services, but you cannot rely on that. 125 125 Always assume that human error will occur, so be prepared by using Linux firewall facilities … … 132 132 covered except insofar as this affects Samba-3. 133 133 </p><p> 134 <a class="indexterm" name="id 2558989"></a>134 <a class="indexterm" name="id330507"></a> 135 135 Notebook computers are configured to use a network login when in the office and a 136 136 local account to log in while away from the office. Users store all work done in … … 142 142 records. 143 143 </p><p> 144 <a class="indexterm" name="id 2559020"></a>144 <a class="indexterm" name="id330527"></a> 145 145 All applications are served from the central server from a share called <code class="constant">apps</code>. 146 146 Microsoft Office XP Professional and OpenOffice 1.1.0 will be installed using a network … … 149 149 locally installed applications on a need-to-have basis only. 150 150 </p><p> 151 <a class="indexterm" name="id 2559039"></a>151 <a class="indexterm" name="id330543"></a> 152 152 The introduction of roaming profiles support means that users can move between 153 153 desktop computer systems without constraint while retaining full access to their data. 154 154 The desktop travels with them as they move. 155 155 </p><p> 156 <a class="indexterm" name="id 2559052"></a>156 <a class="indexterm" name="id330555"></a> 157 157 The DNS server implementation must now address both internal and external 158 158 needs. You forward DNS lookups to your ISP-provided server as well as the 159 159 <code class="constant">abmas.us</code> external secondary DNS server. 160 160 </p><p> 161 <a class="indexterm" name="id 2559069"></a>162 <a class="indexterm" name="id 2559075"></a>163 <a class="indexterm" name="id 2559083"></a>161 <a class="indexterm" name="id330569"></a> 162 <a class="indexterm" name="id330575"></a> 163 <a class="indexterm" name="id330584"></a> 164 164 Compared with the DHCP server configuration in <a class="link" href="small.html" title="Chapter 2. Small Office Networking">“Small Office Networking”</a>, <a class="link" href="small.html#dhcp01" title="Example 2.2. Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf">“Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf”</a>, the 165 165 configuration used in this example has to deal with the presence of an Internet connection. … … 185 185 then clone that configuration, using Norton Ghost, to all workstations. Each machine is 186 186 identical, so this should pose no problem. 187 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2559135"></a>Hardware Requirements</h4></div></div></div><p>188 <a class="indexterm" name="id 2559143"></a>187 </p><div class="sect3" title="Hardware Requirements"><div class="titlepage"><div><div><h4 class="title"><a name="id330622"></a>Hardware Requirements</h4></div></div></div><p> 188 <a class="indexterm" name="id330630"></a> 189 189 This server runs a considerable number of services. From similarly configured Linux 190 190 installations, the approximate calculated memory requirements are as shown in … … 214 214 compromise in this area. 215 215 </p><p> 216 <a class="indexterm" name="id 2559194"></a>216 <a class="indexterm" name="id330669"></a> 217 217 Aggregate input/output loads should be considered for sizing network configuration as 218 218 well as disk subsystems. For network bandwidth calculations, one would typically use an … … 223 223 switched ports. 224 224 </p><p> 225 <a class="indexterm" name="id 2559213"></a>226 <a class="indexterm" name="id 2559219"></a>225 <a class="indexterm" name="id330683"></a> 226 <a class="indexterm" name="id330689"></a> 227 227 Considering the choice of 1 Gb Ethernet interfaces for the two local network segments, 228 228 the aggregate network I/O capacity will be 2100 Mb/sec (about 230 MB/sec), an I/O … … 256 256 Recommended Storage: 908 GBytes 257 257 </pre></div></div><p><br class="example-break"> 258 <a class="indexterm" name="id 2559277"></a>258 <a class="indexterm" name="id330731"></a> 259 259 The preferred storage capacity should be approximately 1 Terabyte. Use of RAID level 5 260 260 with two hot spare drives would require an 8-drive by 200 GB capacity per drive array. 261 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2559289"></a>Political Issues</h3></div></div></div><p>261 </p></div></div><div class="sect2" title="Political Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id330742"></a>Political Issues</h3></div></div></div><p> 262 262 Your industry is coming under increasing accountability pressures. Increased paranoia 263 263 is necessary so you can demonstrate that you have acted with due diligence. You must … … 268 268 gives you greater control over software licensing. 269 269 </p><p> 270 <a class="indexterm" name="id 2559311"></a>270 <a class="indexterm" name="id330760"></a> 271 271 You are well aware that the current configuration results in some performance issues 272 272 as the size of the desktop profile grows. Given that users use Microsoft Outlook 273 273 Express, you know that the storage implications of the <code class="constant">.PST</code> file 274 274 is something that needs to be addressed later. 275 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2559329"></a>Implementation</h2></div></div></div><p>275 </p></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id330776"></a>Implementation</h2></div></div></div><p> 276 276 <a class="link" href="secure.html#ch04net" title="Figure 3.1. Abmas Network Topology 130 Users">“Abmas Network Topology 130 Users”</a> demonstrates the overall design of the network that you will implement. 277 277 </p><p> … … 284 284 </p><p> 285 285 The <code class="filename">smb.conf</code> file has the following noteworthy features: 286 </p><div class="itemizedlist"><ul type="disc"><li><p>286 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 287 287 The NetBIOS name of the Samba server is set to <code class="constant">DIAMOND</code>. 288 </p></li><li ><p>288 </p></li><li class="listitem"><p> 289 289 The Domain name is set to <code class="constant">PROMISES</code>. 290 </p></li><li ><p>291 <a class="indexterm" name="id 2559386"></a>292 <a class="indexterm" name="id 2559392"></a>293 <a class="indexterm" name="id 2559398"></a>290 </p></li><li class="listitem"><p> 291 <a class="indexterm" name="id330826"></a> 292 <a class="indexterm" name="id330832"></a> 293 <a class="indexterm" name="id330838"></a> 294 294 Ethernet interface <code class="constant">eth0</code> is attached to the Internet connection 295 295 and is externally exposed. This interface is explicitly not available for Samba to use. … … 298 298 This is achieved by way of the <em class="parameter"><code>interfaces</code></em> parameter and the 299 299 <em class="parameter"><code>bind interfaces only</code></em> entry. 300 </p></li><li ><p>301 <a class="indexterm" name="id 2559431"></a>302 <a class="indexterm" name="id 2559438"></a>303 <a class="indexterm" name="id 2559444"></a>300 </p></li><li class="listitem"><p> 301 <a class="indexterm" name="id330868"></a> 302 <a class="indexterm" name="id330874"></a> 303 <a class="indexterm" name="id330881"></a> 304 304 The <em class="parameter"><code>passdb backend</code></em> parameter specifies the creation and use 305 305 of the <code class="constant">tdbsam</code> password backend. This is a binary database that 306 306 has excellent scalability for a large number of user account entries. 307 </p></li><li ><p>308 <a class="indexterm" name="id 2559466"></a>309 <a class="indexterm" name="id 2559472"></a>310 <a class="indexterm" name="id 2559478"></a>307 </p></li><li class="listitem"><p> 308 <a class="indexterm" name="id330901"></a> 309 <a class="indexterm" name="id330907"></a> 310 <a class="indexterm" name="id330913"></a> 311 311 WINS serving is enabled by the <a class="link" href="smb.conf.5.html#WINSSUPPORT" target="_top">wins support = Yes</a>, 312 312 and name resolution is set to use it by means of the 313 313 <a class="link" href="smb.conf.5.html#NAMERESOLVEORDER" target="_top">name resolve order = wins bcast hosts</a> entry. 314 </p></li><li ><p>315 <a class="indexterm" name="id 2559508"></a>314 </p></li><li class="listitem"><p> 315 <a class="indexterm" name="id330940"></a> 316 316 The Samba server is configured for use by Windows clients as a time server. 317 </p></li><li ><p>318 <a class="indexterm" name="id 2559520"></a>319 <a class="indexterm" name="id 2559526"></a>320 <a class="indexterm" name="id 2559532"></a>317 </p></li><li class="listitem"><p> 318 <a class="indexterm" name="id330950"></a> 319 <a class="indexterm" name="id330957"></a> 320 <a class="indexterm" name="id330963"></a> 321 321 Samba is configured to directly interface with CUPS via the direct internal interface 322 322 that is provided by CUPS libraries. This is achieved with the 323 323 <a class="link" href="smb.conf.5.html#PRINTING" target="_top">printing = CUPS</a> as well as the 324 324 <a class="link" href="smb.conf.5.html#PRINTCAPNAME" target="_top">printcap name = CUPS</a> entries. 325 </p></li><li ><p>326 <a class="indexterm" name="id 2559563"></a>327 <a class="indexterm" name="id 2559569"></a>328 <a class="indexterm" name="id 2559576"></a>325 </p></li><li class="listitem"><p> 326 <a class="indexterm" name="id330990"></a> 327 <a class="indexterm" name="id330996"></a> 328 <a class="indexterm" name="id331003"></a> 329 329 External interface scripts are provided to enable Samba to interface smoothly to 330 330 essential operating system functions for user and group management. This is important … … 334 334 downloaded from the Microsoft FTP 335 335 <a class="ulink" href="ftp://ftp.microsoft.com/Softlib/MSLFILES/SRVTOOLS.EXE" target="_top">site</a>. 336 </p></li><li ><p>337 <a class="indexterm" name="id 2559605"></a>336 </p></li><li class="listitem"><p> 337 <a class="indexterm" name="id331028"></a> 338 338 The <code class="filename">smb.conf</code> file specifies that the Samba server will operate in (default) <em class="parameter"><code> 339 security = user</code></em> mode<sup>[<a name="id 2559623" href="#ftn.id2559623" class="footnote">5</a>]</sup>339 security = user</code></em> mode<sup>[<a name="id331045" href="#ftn.id331045" class="footnote">5</a>]</sup> 340 340 (User Mode). 341 </p></li><li ><p>342 <a class="indexterm" name="id 2559640"></a>343 <a class="indexterm" name="id 2559646"></a>341 </p></li><li class="listitem"><p> 342 <a class="indexterm" name="id331061"></a> 343 <a class="indexterm" name="id331067"></a> 344 344 Domain logon services as well as a Domain logon script are specified. The logon script 345 345 will be used to add robustness to the overall network configuration. 346 </p></li><li ><p>347 <a class="indexterm" name="id 2559659"></a>348 <a class="indexterm" name="id 2559665"></a>349 <a class="indexterm" name="id 2559672"></a>346 </p></li><li class="listitem"><p> 347 <a class="indexterm" name="id331079"></a> 348 <a class="indexterm" name="id331085"></a> 349 <a class="indexterm" name="id331092"></a> 350 350 Roaming profiles are enabled through the specification of the parameter, 351 351 <a class="link" href="smb.conf.5.html#LOGONPATH" target="_top">logon path = \\%L\profiles\%U</a>. The value of this parameter translates the … … 356 356 profile share for each user. This directory must be owned by the user also. An exception to this 357 357 requirement is when a profile is created for group use. 358 </p></li><li ><p>359 <a class="indexterm" name="id 2559712"></a>360 <a class="indexterm" name="id 2559718"></a>358 </p></li><li class="listitem"><p> 359 <a class="indexterm" name="id331124"></a> 360 <a class="indexterm" name="id331130"></a> 361 361 Precautionary veto is effected for particular Windows file names that have been targeted by 362 362 virus-related activity. Additionally, Microsoft Office files are vetoed from opportunistic locking 363 363 controls. This should help to prevent lock contention-related file access problems. 364 </p></li><li ><p>364 </p></li><li class="listitem"><p> 365 365 Every user has a private home directory on the UNIX/Linux host. This is mapped to 366 366 a network drive that is the same for all users. 367 367 </p></li></ul></div><p> 368 368 The configuration of the server is the most complex so far. The following steps are used: 369 </p><div class="orderedlist"><ol type="1"><li><p>369 </p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><p> 370 370 Basic System Configuration 371 </p></li><li ><p>371 </p></li><li class="listitem"><p> 372 372 Samba Configuration 373 </p></li><li ><p>373 </p></li><li class="listitem"><p> 374 374 DHCP and DNS Server Configuration 375 </p></li><li ><p>375 </p></li><li class="listitem"><p> 376 376 Printer Configuration 377 </p></li><li ><p>377 </p></li><li class="listitem"><p> 378 378 Process Start-up Configuration 379 </p></li><li ><p>379 </p></li><li class="listitem"><p> 380 380 Validation 381 </p></li><li ><p>381 </p></li><li class="listitem"><p> 382 382 Application Share Configuration 383 </p></li><li ><p>383 </p></li><li class="listitem"><p> 384 384 Windows Client Configuration 385 385 </p></li></ol></div><p> 386 386 The following sections cover each step in logical and defined detail. 387 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch4bsc"></a>Basic System Configuration</h3></div></div></div><p>388 <a class="indexterm" name="id 2559803"></a>387 </p><div class="sect2" title="Basic System Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="ch4bsc"></a>Basic System Configuration</h3></div></div></div><p> 388 <a class="indexterm" name="id331207"></a> 389 389 The preparation in this section assumes that your SUSE Enterprise Linux Server 8.0 system has been 390 390 freshly installed. It prepares basic files so that the system is ready for comprehensive 391 391 operation in line with the network diagram shown in <a class="link" href="secure.html#ch04net" title="Figure 3.1. Abmas Network Topology 130 Users">“Abmas Network Topology 130 Users”</a>. 392 </p><div class="procedure" ><a name="id2559820"></a><p class="title"><b>Procedure 3.1. Server Configuration Steps</b></p><ol type="1"><li><p>393 <a class="indexterm" name="id 2559830"></a>392 </p><div class="procedure" title="Procedure 3.1. Server Configuration Steps"><a name="id331220"></a><p class="title"><b>Procedure 3.1. Server Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 393 <a class="indexterm" name="id331231"></a> 394 394 Using the UNIX/Linux system tools, name the server <code class="constant">server.abmas.us</code>. 395 395 Verify that your hostname is correctly set by running: … … 403 403 server.abmas.us 404 404 </pre><p> 405 </p></li><li ><p>406 <a class="indexterm" name="id 2559870"></a>407 <a class="indexterm" name="id 2559877"></a>405 </p></li><li class="step" title="Step 2"><p> 406 <a class="indexterm" name="id331268"></a> 407 <a class="indexterm" name="id331274"></a> 408 408 Edit your <code class="filename">/etc/hosts</code> file to include the primary names and addresses 409 409 of all network interfaces that are on the host server. This is necessary so that during … … 426 426 192.168.2.30 hplj6f.abmas.biz hplj6f 427 427 </pre><p> 428 <a class="indexterm" name="id 2559928"></a>429 <a class="indexterm" name="id 2559934"></a>430 <a class="indexterm" name="id 2559940"></a>428 <a class="indexterm" name="id331319"></a> 429 <a class="indexterm" name="id331325"></a> 430 <a class="indexterm" name="id331332"></a> 431 431 The printer entries are not necessary if <code class="literal">named</code> is started prior to 432 432 startup of <code class="literal">cupsd</code>, the CUPS daemon. 433 </p></li><li ><p>434 <a class="indexterm" name="id 2559965"></a>435 <a class="indexterm" name="id 2559971"></a>436 <a class="indexterm" name="id 2559978"></a>433 </p></li><li class="step" title="Step 3"><p> 434 <a class="indexterm" name="id331354"></a> 435 <a class="indexterm" name="id331361"></a> 436 <a class="indexterm" name="id331367"></a> 437 437 The host server is acting as a router between the two internal network segments as well 438 438 as for all Internet access. This necessitates that IP forwarding be enabled. This can be … … 443 443 To ensure that your kernel is capable of IP forwarding during configuration, you may 444 444 wish to execute that command manually also. This setting permits the Linux system to 445 act as a router.<sup>[<a name="id 2560004" href="#ftn.id2560004" class="footnote">6</a>]</sup>446 </p></li><li ><p>447 <a class="indexterm" name="id 2560016"></a>448 <a class="indexterm" name="id 2560023"></a>445 act as a router.<sup>[<a name="id331388" href="#ftn.id331388" class="footnote">6</a>]</sup> 446 </p></li><li class="step" title="Step 4"><p> 447 <a class="indexterm" name="id331400"></a> 448 <a class="indexterm" name="id331406"></a> 449 449 Installation of a basic firewall and NAT facility is necessary. 450 450 The following script can be installed in the <code class="filename">/usr/local/sbin</code> … … 498 498 echo -e "\nNAT firewall done.\n" 499 499 </pre></div></div><p><br class="example-break"> 500 </p></li><li ><p>500 </p></li><li class="step" title="Step 5"><p> 501 501 Execute the following to make the script executable: 502 502 </p><pre class="screen"> … … 525 525 </pre><p> 526 526 </p></li></ol></div><p> 527 <a class="indexterm" name="id 2560162"></a>527 <a class="indexterm" name="id331512"></a> 528 528 The server is now ready for Samba configuration. During the validation step, you remove 529 529 the entry for the Samba server <code class="constant">diamond</code> from the <code class="filename">/etc/hosts</code> 530 530 file. This is done after you are satisfied that DNS-based name resolution is functioning correctly. 531 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2560183"></a>Samba Configuration</h3></div></div></div><p>531 </p></div><div class="sect2" title="Samba Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="id331530"></a>Samba Configuration</h3></div></div></div><p> 532 532 When you have completed this section, the Samba server is ready for testing and validation; 533 533 however, testing and validation have to wait until DHCP, DNS, and printing (CUPS) services have 534 534 been configured. 535 </p><div class="procedure" ><a name="id2560195"></a><p class="title"><b>Procedure 3.2. Samba Configuration Steps</b></p><ol type="1"><li><p>535 </p><div class="procedure" title="Procedure 3.2. Samba Configuration Steps"><a name="id331541"></a><p class="title"><b>Procedure 3.2. Samba Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 536 536 Install the Samba-3 binary RPM from the Samba-Team FTP site. Assuming that the binary 537 537 RPM file is called <code class="filename">samba-3.0.20-1.i386.rpm</code>, one way to install this … … 543 543 Successful operation is clearly indicated. If this installation should fail for any reason, 544 544 refer to the operating system manufacturer's documentation for guidance. 545 </p></li><li ><p>545 </p></li><li class="step" title="Step 2"><p> 546 546 Install the <code class="filename">smb.conf</code> file shown in <a class="link" href="secure.html#promisnet" title="Example 3.4. 130 User Network with tdbsam [globals] Section">“130 User Network with tdbsam [globals] Section”</a>, <a class="link" href="secure.html#promisnetsvca" title="Example 3.5. 130 User Network with tdbsam Services Section Part A">“130 User Network with tdbsam Services Section Part A”</a>, 547 547 and <a class="link" href="secure.html#promisnetsvcb" title="Example 3.6. 130 User Network with tdbsam Services Section Part B">“130 User Network with tdbsam Services Section Part B”</a>. Concatenate (join) all three files to make a single <code class="filename">smb.conf</code> 548 548 file. The final, fully qualified path for this file should be <code class="filename">/etc/samba/smb.conf</code>. 549 549 550 </p><div class="example"><a name="promisnet"></a><p class="title"><b>Example 3.4. 130 User Network with <span class="emphasis"><em>tdbsam</em></span> [globals] Section</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2560301"></a><em class="parameter"><code>workgroup = PROMISES</code></em></td></tr><tr><td><a class="indexterm" name="id2560311"></a><em class="parameter"><code>netbios name = DIAMOND</code></em></td></tr><tr><td><a class="indexterm" name="id2560322"></a><em class="parameter"><code>interfaces = eth1, eth2, lo</code></em></td></tr><tr><td><a class="indexterm" name="id2560332"></a><em class="parameter"><code>bind interfaces only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560342"></a><em class="parameter"><code>passdb backend = tdbsam</code></em></td></tr><tr><td><a class="indexterm" name="id2560353"></a><em class="parameter"><code>pam password change = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560363"></a><em class="parameter"><code>passwd program = /usr/bin/passwd %u</code></em></td></tr><tr><td><a class="indexterm" name="id2560374"></a><em class="parameter"><code>passwd chat = *New*Password* %n\n *Re-enter*new*password*%n\n *Password*changed*</code></em></td></tr><tr><td><a class="indexterm" name="id2560385"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2560396"></a><em class="parameter"><code>unix password sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560407"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2560417"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2560428"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2560439"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id2560449"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2560460"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2560471"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560481"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2560492"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2560503"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2560514"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2560525"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2560536"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2560548"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -G '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2560559"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /tmp '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2560571"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id2560582"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id2560593"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2560604"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2560616"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2560626"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id2560636"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560647"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560657"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560668"></a><em class="parameter"><code>utmp = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560678"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560688"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id2560699"></a><em class="parameter"><code>cups options = Raw</code></em></td></tr><tr><td><a class="indexterm" name="id2560709"></a><em class="parameter"><code>veto files = /*.eml/*.nws/*.{*}/</code></em></td></tr><tr><td><a class="indexterm" name="id2560720"></a><em class="parameter"><code>veto oplock files = /*.doc/*.xls/*.mdb/</code></em></td></tr></table></div></div><p><br class="example-break">551 552 </p><div class="example"><a name="promisnetsvca"></a><p class="title"><b>Example 3.5. 130 User Network with <span class="emphasis"><em>tdbsam</em></span> Services Section Part A</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2560759"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2560770"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2560780"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2560791"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2560809"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2560820"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2560830"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560841"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560851"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560861"></a><em class="parameter"><code>default devmode = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560872"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2560891"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2560901"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id2560912"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2560922"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id2560941"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id2560952"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id2560963"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2560973"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id2560992"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id2561002"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id2561013"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><p><br class="example-break">553 554 </p><div class="example"><a name="promisnetsvcb"></a><p class="title"><b>Example 3.6. 130 User Network with <span class="emphasis"><em>tdbsam</em></span> Services Section Part B</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id2561051"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id2561062"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id2561072"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id2561091"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id2561102"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id2561112"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id2561131"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id2561141"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id2561152"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2561162"></a><em class="parameter"><code>admin users = bjordan</code></em></td></tr></table></div></div><p><br class="example-break">555 </p></li><li ><p>556 <a class="indexterm" name="id 2561180"></a><a class="indexterm" name="id2561185"></a>550 </p><div class="example"><a name="promisnet"></a><p class="title"><b>Example 3.4. 130 User Network with <span class="emphasis"><em>tdbsam</em></span> [globals] Section</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id331640"></a><em class="parameter"><code>workgroup = PROMISES</code></em></td></tr><tr><td><a class="indexterm" name="id331650"></a><em class="parameter"><code>netbios name = DIAMOND</code></em></td></tr><tr><td><a class="indexterm" name="id331661"></a><em class="parameter"><code>interfaces = eth1, eth2, lo</code></em></td></tr><tr><td><a class="indexterm" name="id331671"></a><em class="parameter"><code>bind interfaces only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id331682"></a><em class="parameter"><code>passdb backend = tdbsam</code></em></td></tr><tr><td><a class="indexterm" name="id331692"></a><em class="parameter"><code>pam password change = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id331702"></a><em class="parameter"><code>passwd program = /usr/bin/passwd %u</code></em></td></tr><tr><td><a class="indexterm" name="id331713"></a><em class="parameter"><code>passwd chat = *New*Password* %n\n *Re-enter*new*password*%n\n *Password*changed*</code></em></td></tr><tr><td><a class="indexterm" name="id331724"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id331734"></a><em class="parameter"><code>unix password sync = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id331745"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id331755"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id331766"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id331776"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id331786"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id331797"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id331807"></a><em class="parameter"><code>time server = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id331818"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id331828"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id331838"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id331849"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id331859"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id331870"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id331880"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -G '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id331891"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /tmp '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id331902"></a><em class="parameter"><code>shutdown script = /var/lib/samba/scripts/shutdown.sh</code></em></td></tr><tr><td><a class="indexterm" name="id331912"></a><em class="parameter"><code>abort shutdown script = /sbin/shutdown -c</code></em></td></tr><tr><td><a class="indexterm" name="id331923"></a><em class="parameter"><code>logon script = scripts\logon.bat</code></em></td></tr><tr><td><a class="indexterm" name="id331933"></a><em class="parameter"><code>logon path = \\%L\profiles\%U</code></em></td></tr><tr><td><a class="indexterm" name="id331944"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id331954"></a><em class="parameter"><code>logon home = \\%L\%U</code></em></td></tr><tr><td><a class="indexterm" name="id331964"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id331975"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id331985"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id331996"></a><em class="parameter"><code>utmp = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id332006"></a><em class="parameter"><code>map acl inherit = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id332016"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td><a class="indexterm" name="id332027"></a><em class="parameter"><code>cups options = Raw</code></em></td></tr><tr><td><a class="indexterm" name="id332037"></a><em class="parameter"><code>veto files = /*.eml/*.nws/*.{*}/</code></em></td></tr><tr><td><a class="indexterm" name="id332048"></a><em class="parameter"><code>veto oplock files = /*.doc/*.xls/*.mdb/</code></em></td></tr></table></div></div><p><br class="example-break"> 551 552 </p><div class="example"><a name="promisnetsvca"></a><p class="title"><b>Example 3.5. 130 User Network with <span class="emphasis"><em>tdbsam</em></span> Services Section Part A</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id332085"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id332096"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id332106"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id332117"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id332135"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id332146"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id332156"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id332167"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id332177"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id332187"></a><em class="parameter"><code>default devmode = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id332198"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id332217"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id332227"></a><em class="parameter"><code>path = /var/lib/samba/netlogon</code></em></td></tr><tr><td><a class="indexterm" name="id332237"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id332248"></a><em class="parameter"><code>locking = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[profiles]</code></em></td></tr><tr><td><a class="indexterm" name="id332267"></a><em class="parameter"><code>comment = Profile Share</code></em></td></tr><tr><td><a class="indexterm" name="id332277"></a><em class="parameter"><code>path = /var/lib/samba/profiles</code></em></td></tr><tr><td><a class="indexterm" name="id332287"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id332298"></a><em class="parameter"><code>profile acls = Yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id332317"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id332327"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id332337"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><p><br class="example-break"> 553 554 </p><div class="example"><a name="promisnetsvcb"></a><p class="title"><b>Example 3.6. 130 User Network with <span class="emphasis"><em>tdbsam</em></span> Services Section Part B</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[service]</code></em></td></tr><tr><td><a class="indexterm" name="id332375"></a><em class="parameter"><code>comment = Financial Services Files</code></em></td></tr><tr><td><a class="indexterm" name="id332386"></a><em class="parameter"><code>path = /data/service</code></em></td></tr><tr><td><a class="indexterm" name="id332396"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[pidata]</code></em></td></tr><tr><td><a class="indexterm" name="id332415"></a><em class="parameter"><code>comment = Property Insurance Files</code></em></td></tr><tr><td><a class="indexterm" name="id332425"></a><em class="parameter"><code>path = /data/pidata</code></em></td></tr><tr><td><a class="indexterm" name="id332436"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[apps]</code></em></td></tr><tr><td><a class="indexterm" name="id332454"></a><em class="parameter"><code>comment = Application Files</code></em></td></tr><tr><td><a class="indexterm" name="id332465"></a><em class="parameter"><code>path = /apps</code></em></td></tr><tr><td><a class="indexterm" name="id332475"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id332486"></a><em class="parameter"><code>admin users = bjordan</code></em></td></tr></table></div></div><p><br class="example-break"> 555 </p></li><li class="step" title="Step 3"><p> 556 <a class="indexterm" name="id332503"></a><a class="indexterm" name="id332508"></a> 557 557 Add the <code class="constant">root</code> user to the password backend as follows: 558 558 </p><pre class="screen"> … … 566 566 deleted. If for any reason the account is deleted, you may not be able to recreate this account 567 567 without considerable trouble. 568 </p></li><li ><p>569 <a class="indexterm" name="id 2561229"></a>568 </p></li><li class="step" title="Step 4"><p> 569 <a class="indexterm" name="id332548"></a> 570 570 Create the username map file to permit the <code class="constant">root</code> account to be called 571 571 <code class="constant">Administrator</code> from the Windows network environment. To do this, create … … 593 593 #### 594 594 </pre><p> 595 </p></li><li ><p>596 <a class="indexterm" name="id 2561271"></a>597 <a class="indexterm" name="id 2561277"></a>598 <a class="indexterm" name="id 2561288"></a>599 <a class="indexterm" name="id 2561298"></a>595 </p></li><li class="step" title="Step 5"><p> 596 <a class="indexterm" name="id332583"></a> 597 <a class="indexterm" name="id332590"></a> 598 <a class="indexterm" name="id332600"></a> 599 <a class="indexterm" name="id332611"></a> 600 600 Create and map Windows Domain Groups to UNIX groups. A sample script is provided in <a class="link" href="small.html" title="Chapter 2. Small Office Networking">“Small Office Networking”</a>, 601 601 <a class="link" href="small.html#initGrps" title="Example 2.1. Script to Map Windows NT Groups to UNIX Groups">“Script to Map Windows NT Groups to UNIX Groups”</a>. Create a file containing this script. We called ours … … 603 603 and then execute the script. Sample output should be as follows: 604 604 605 </p><div class="example"><a name="ch4initGrps"></a><p class="title"><b>Example 3.7. Script to Map Windows NT Groups to UNIX Groups</b></p><div class="example-contents"><a class="indexterm" name="id 2561336"></a><pre class="screen">605 </p><div class="example"><a name="ch4initGrps"></a><p class="title"><b>Example 3.7. Script to Map Windows NT Groups to UNIX Groups</b></p><div class="example-contents"><a class="indexterm" name="id332645"></a><pre class="screen"> 606 606 #!/bin/bash 607 607 # … … 655 655 Users (S-1-5-32-545) -> -1 656 656 </pre><p> 657 </p></li><li ><p>658 <a class="indexterm" name="id 2561409"></a>659 <a class="indexterm" name="id 2561415"></a>660 <a class="indexterm" name="id 2561421"></a>661 <a class="indexterm" name="id 2561427"></a>662 <a class="indexterm" name="id 2561434"></a>663 <a class="indexterm" name="id 2561440"></a>664 <a class="indexterm" name="id 2561448"></a>657 </p></li><li class="step" title="Step 6"><p> 658 <a class="indexterm" name="id332701"></a> 659 <a class="indexterm" name="id332708"></a> 660 <a class="indexterm" name="id332714"></a> 661 <a class="indexterm" name="id332720"></a> 662 <a class="indexterm" name="id332726"></a> 663 <a class="indexterm" name="id332733"></a> 664 <a class="indexterm" name="id332741"></a> 665 665 There is one preparatory step without which you will not have a working Samba 666 666 network environment. You must add an account for each network user. … … 686 686 </pre><p> 687 687 You do of course use a valid user login ID in place of <em class="parameter"><code>username</code></em>. 688 </p></li><li ><p>689 <a class="indexterm" name="id 2561553"></a>690 <a class="indexterm" name="id 2561561"></a>691 <a class="indexterm" name="id 2561569"></a>688 </p></li><li class="step" title="Step 7"><p> 689 <a class="indexterm" name="id332838"></a> 690 <a class="indexterm" name="id332846"></a> 691 <a class="indexterm" name="id332854"></a> 692 692 Using the preferred tool for your UNIX system, add each user to the UNIX groups created 693 693 previously as necessary. File system access control will be based on UNIX group membership. 694 </p></li><li ><p>694 </p></li><li class="step" title="Step 8"><p> 695 695 Create the directory mount point for the disk subsystem that can be mounted to provide 696 696 data storage for company files. In this case the mount point is indicated in the <code class="filename">smb.conf</code> 697 697 file is <code class="filename">/data</code>. Format the file system as required, and mount the formatted 698 698 file system partition using appropriate system tools. 699 </p></li><li ><p>700 <a class="indexterm" name="id 2561609"></a>699 </p></li><li class="step" title="Step 9"><p> 700 <a class="indexterm" name="id332889"></a> 701 701 Create the top-level file storage directories for data and applications as follows: 702 702 </p><pre class="screen"> … … 715 715 The <code class="filename">/apps</code> directory is the root of the <code class="constant">apps</code> share 716 716 that provides the application server infrastructure. 717 </p></li><li ><p>717 </p></li><li class="step" title="Step 10"><p> 718 718 The <code class="filename">smb.conf</code> file specifies an infrastructure to support roaming profiles and network 719 719 logon services. You can now create the file system infrastructure to provide the … … 738 738 <code class="prompt">root# </code> chmod ug+wrx,o+rx,-w /var/lib/samba/profiles/'username' 739 739 </pre><p> 740 </p></li><li ><p>741 <a class="indexterm" name="id 2561803"></a>742 <a class="indexterm" name="id 2561809"></a>743 <a class="indexterm" name="id 2561815"></a>740 </p></li><li class="step" title="Step 11"><p> 741 <a class="indexterm" name="id333063"></a> 742 <a class="indexterm" name="id333069"></a> 743 <a class="indexterm" name="id333075"></a> 744 744 Create a logon script. It is important that each line is correctly terminated with 745 745 a carriage return and line-feed combination (i.e., DOS encoding). The following procedure … … 757 757 > /var/lib/samba/netlogon/scripts/logon.bat 758 758 </pre><p> 759 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch4dhcpdns"></a>Configuration of DHCP and DNS Servers</h3></div></div></div><p>759 </p></li></ol></div></div><div class="sect2" title="Configuration of DHCP and DNS Servers"><div class="titlepage"><div><div><h3 class="title"><a name="ch4dhcpdns"></a>Configuration of DHCP and DNS Servers</h3></div></div></div><p> 760 760 DHCP services are a basic component of the entire network client installation. DNS operation is 761 761 foundational to Internet access as well as to trouble-free operation of local networking. When 762 762 you have completed this section, the server should be ready for solid duty operation. 763 </p><div class="procedure" ><a name="id2561886"></a><p class="title"><b>Procedure 3.3. DHCP and DNS Server Configuration Steps</b></p><ol type="1"><li><p>764 <a class="indexterm" name="id 2561897"></a>763 </p><div class="procedure" title="Procedure 3.3. DHCP and DNS Server Configuration Steps"><a name="id333134"></a><p class="title"><b>Procedure 3.3. DHCP and DNS Server Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 764 <a class="indexterm" name="id333145"></a> 765 765 Create a file called <code class="filename">/etc/dhcpd.conf</code> with the contents as 766 766 shown in <a class="link" href="secure.html#prom-dhcp" title="Example 3.8. DHCP Server Configuration File /etc/dhcpd.conf">“DHCP Server Configuration File /etc/dhcpd.conf”</a>. … … 812 812 } 813 813 </pre></div></div><p><br class="example-break"> 814 </p></li><li ><p>815 <a class="indexterm" name="id 2561972"></a>814 </p></li><li class="step" title="Step 2"><p> 815 <a class="indexterm" name="id333199"></a> 816 816 Create a file called <code class="filename">/etc/named.conf</code> that has the combined contents 817 817 of the <a class="link" href="secure.html#ch4namedcfg" title="Example 3.9. DNS Master Configuration File /etc/named.conf Master Section">“DNS Master Configuration File /etc/named.conf Master Section”</a>, <a class="link" href="secure.html#ch4namedvarfwd" title="Example 3.10. DNS Master Configuration File /etc/named.conf Forward Lookup Definition Section">“DNS Master Configuration File /etc/named.conf Forward Lookup Definition Section”</a>, and 818 818 <a class="link" href="secure.html#ch4namedvarrev" title="Example 3.11. DNS Master Configuration File /etc/named.conf Reverse Lookup Definition Section">“DNS Master Configuration File /etc/named.conf Reverse Lookup Definition Section”</a> files that are concatenated (merged) in this 819 819 specific order. 820 </p></li><li ><p>820 </p></li><li class="step" title="Step 3"><p> 821 821 Create the files shown in their respective directories as shown in <a class="link" href="secure.html#namedrscfiles" title="Table 3.2. DNS (named) Resource Files">DNS 822 822 (named) Resource Files</a>. … … 824 824 </p><div class="table"><a name="namedrscfiles"></a><p class="title"><b>Table 3.2. DNS (named) Resource Files</b></p><div class="table-contents"><table summary="DNS (named) Resource Files" border="1"><colgroup><col align="left"><col align="left"></colgroup><thead><tr><th align="left">Reference</th><th align="left">File Location</th></tr></thead><tbody><tr><td align="left"><a class="link" href="appendix.html#loopback" title="Example 15.3. DNS Localhost Forward Zone File: /var/lib/named/localhost.zone">“DNS Localhost Forward Zone File: /var/lib/named/localhost.zone”</a></td><td align="left">/var/lib/named/localhost.zone</td></tr><tr><td align="left"><a class="link" href="appendix.html#dnsloopy" title="Example 15.4. DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone">“DNS Localhost Reverse Zone File: /var/lib/named/127.0.0.zone”</a></td><td align="left">/var/lib/named/127.0.0.zone</td></tr><tr><td align="left"><a class="link" href="appendix.html#roothint" title="Example 15.5. DNS Root Name Server Hint File: /var/lib/named/root.hint">“DNS Root Name Server Hint File: /var/lib/named/root.hint”</a></td><td align="left">/var/lib/named/root.hint</td></tr><tr><td align="left"><a class="link" href="secure.html#abmasbiz" title="Example 3.14. DNS Abmas.biz Forward Zone File">“DNS Abmas.biz Forward Zone File”</a></td><td align="left">/var/lib/named/master/abmas.biz.hosts</td></tr><tr><td align="left"><a class="link" href="secure.html#abmasus" title="Example 3.15. DNS Abmas.us Forward Zone File">“DNS Abmas.us Forward Zone File”</a></td><td align="left">/var/lib/named/abmas.us.hosts</td></tr><tr><td align="left"><a class="link" href="secure.html#eth1zone" title="Example 3.12. DNS 192.168.1 Reverse Zone File">“DNS 192.168.1 Reverse Zone File”</a></td><td align="left">/var/lib/named/192.168.1.0.rev</td></tr><tr><td align="left"><a class="link" href="secure.html#eth2zone" title="Example 3.13. DNS 192.168.2 Reverse Zone File">“DNS 192.168.2 Reverse Zone File”</a></td><td align="left">/var/lib/named/192.168.2.0.rev</td></tr></tbody></table></div></div><p><br class="table-break"> 825 825 826 </p><div class="example"><a name="ch4namedcfg"></a><p class="title"><b>Example 3.9. DNS Master Configuration File <code class="filename">/etc/named.conf</code> Master Section</b></p><div class="example-contents"><a class="indexterm" name="id 2562182"></a><pre class="screen">826 </p><div class="example"><a name="ch4namedcfg"></a><p class="title"><b>Example 3.9. DNS Master Configuration File <code class="filename">/etc/named.conf</code> Master Section</b></p><div class="example-contents"><a class="indexterm" name="id333369"></a><pre class="screen"> 827 827 ### 828 828 # Abmas Biz DNS Control File … … 1008 1008 </pre></div></div><p><br class="example-break"> 1009 1009 1010 </p></li><li ><p>1011 <a class="indexterm" name="id 2562396"></a><a class="indexterm" name="id2562402"></a>1010 </p></li><li class="step" title="Step 4"><p> 1011 <a class="indexterm" name="id333533"></a><a class="indexterm" name="id333539"></a> 1012 1012 All DNS name resolution should be handled locally. To ensure that the server is configured 1013 1013 correctly to handle this, edit <code class="filename">/etc/resolv.conf</code> to have the following … … 1018 1018 nameserver 123.45.54.23 1019 1019 </pre><p> 1020 <a class="indexterm" name="id 2562427"></a>1020 <a class="indexterm" name="id333561"></a> 1021 1021 This instructs the name resolver function (when configured correctly) to ask the DNS server 1022 1022 that is running locally to resolve names to addresses. In the event that the local name server 1023 1023 is not available, ask the name server provided by the ISP. The latter, of course, does not resolve 1024 1024 purely local names to IP addresses. 1025 </p></li><li ><p>1026 <a class="indexterm" name="id 2562448"></a>1025 </p></li><li class="step" title="Step 5"><p> 1026 <a class="indexterm" name="id333580"></a> 1027 1027 The final step is to edit the <code class="filename">/etc/nsswitch.conf</code> file. 1028 1028 This file controls the operation of the various resolver libraries that are part of the Linux … … 1036 1036 processing system. Then you can configure the server so that all services 1037 1037 start automatically on reboot. You must also manually start all services prior to validation testing. 1038 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch4ptrcfg"></a>Printer Configuration</h3></div></div></div><p>1038 </p></div><div class="sect2" title="Printer Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="ch4ptrcfg"></a>Printer Configuration</h3></div></div></div><p> 1039 1039 Network administrators who are new to CUPS based-printing typically experience some difficulty mastering 1040 1040 its powerful features. The steps outlined in this section are designed to navigate around the distractions … … 1043 1043 submitted to it. In other words, our configuration turns CUPS into a raw-mode print queue. This means that 1044 1044 the correct printer driver must be installed on all clients. 1045 </p><div class="procedure" ><a name="id2562506"></a><p class="title"><b>Procedure 3.4. Printer Configuration Steps</b></p><ol type="1"><li><p>1045 </p><div class="procedure" title="Procedure 3.4. Printer Configuration Steps"><a name="id333627"></a><p class="title"><b>Procedure 3.4. Printer Configuration Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 1046 1046 Configure each printer to be a DHCP client, carefully following the manufacturer's guidelines. 1047 </p></li><li ><p>1047 </p></li><li class="step" title="Step 2"><p> 1048 1048 Follow the instructions in the printer manufacturer's manuals to permit printing to port 9100. 1049 1049 Use any other port the manufacturer specifies for direct-mode raw printing, and adjust the 1050 1050 port as necessary in the following example commands. 1051 1051 This allows the CUPS spooler to print using raw mode protocols. 1052 <a class="indexterm" name="id 2562532"></a>1053 <a class="indexterm" name="id 2562539"></a>1054 </p></li><li ><p>1055 <a class="indexterm" name="id 2562552"></a><a class="indexterm" name="id2562560"></a>1052 <a class="indexterm" name="id333649"></a> 1053 <a class="indexterm" name="id333656"></a> 1054 </p></li><li class="step" title="Step 3"><p> 1055 <a class="indexterm" name="id333669"></a><a class="indexterm" name="id333677"></a> 1056 1056 Configure the CUPS Print Queues as follows: 1057 1057 </p><pre class="screen"> … … 1061 1061 <code class="prompt">root# </code> lpadmin -p hplj6f -v socket://hplj6f.abmas.biz:9100 -E 1062 1062 </pre><p> 1063 <a class="indexterm" name="id 2562603"></a>1063 <a class="indexterm" name="id333717"></a> 1064 1064 This creates the necessary print queues with no assigned print filter. 1065 </p></li><li ><p><a class="indexterm" name="id2562618"></a>1065 </p></li><li class="step" title="Step 4"><p><a class="indexterm" name="id333731"></a> 1066 1066 Print queues may not be enabled at creation. Use <code class="literal">lpc stat</code> to check 1067 1067 the status of the print queues and, if necessary, make certain that the queues you have … … 1073 1073 <code class="prompt">root# </code> /usr/bin/enable hplj6f 1074 1074 </pre><p> 1075 </p></li><li ><p><a class="indexterm" name="id2562673"></a>1075 </p></li><li class="step" title="Step 5"><p><a class="indexterm" name="id333783"></a> 1076 1076 Even though your print queues may be enabled, it is still possible that they 1077 1077 are not accepting print jobs. A print queue services incoming printing … … 1084 1084 <code class="prompt">root# </code> /usr/sbin/accept hplj6f 1085 1085 </pre><p> 1086 </p></li><li ><p>1087 <a class="indexterm" name="id 2562724"></a>1088 <a class="indexterm" name="id 2562731"></a>1089 <a class="indexterm" name="id 2562738"></a>1086 </p></li><li class="step" title="Step 6"><p> 1087 <a class="indexterm" name="id333831"></a> 1088 <a class="indexterm" name="id333838"></a> 1089 <a class="indexterm" name="id333844"></a> 1090 1090 Edit the file <code class="filename">/etc/cups/mime.convs</code> to uncomment the line: 1091 1091 </p><pre class="screen"> 1092 1092 application/octet-stream application/vnd.cups-raw 0 - 1093 1093 </pre><p> 1094 </p></li><li ><p>1095 <a class="indexterm" name="id 2562765"></a>1094 </p></li><li class="step" title="Step 7"><p> 1095 <a class="indexterm" name="id333871"></a> 1096 1096 Edit the file <code class="filename">/etc/cups/mime.types</code> to uncomment the line: 1097 1097 </p><pre class="screen"> 1098 1098 application/octet-stream 1099 1099 </pre><p> 1100 </p></li><li ><p>1100 </p></li><li class="step" title="Step 8"><p> 1101 1101 Printing drivers are installed on each network client workstation. 1102 1102 </p></li></ol></div><p> … … 1105 1105 </p><p> 1106 1106 The UNIX system print queues have been configured and are ready for validation testing. 1107 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="procstart"></a>Process Startup Configuration</h3></div></div></div><p>1108 <a class="indexterm" name="id 2562831"></a>1107 </p></div><div class="sect2" title="Process Startup Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="procstart"></a>Process Startup Configuration</h3></div></div></div><p> 1108 <a class="indexterm" name="id333932"></a> 1109 1109 There are two essential steps to process startup configuration. First, the process 1110 1110 must be configured so that it automatically restarts each time the server … … 1115 1115 necessary start or kill script is run. 1116 1116 </p><p> 1117 <a class="indexterm" name="id 2562866"></a>1118 <a class="indexterm" name="id 2562873"></a>1119 <a class="indexterm" name="id 2562880"></a>1120 <a class="indexterm" name="id 2562886"></a>1121 <a class="indexterm" name="id 2562893"></a>1117 <a class="indexterm" name="id333964"></a> 1118 <a class="indexterm" name="id333970"></a> 1119 <a class="indexterm" name="id333977"></a> 1120 <a class="indexterm" name="id333984"></a> 1121 <a class="indexterm" name="id333991"></a> 1122 1122 In the event that a service is not run as a daemon, but via the internetworking 1123 1123 super daemon (<code class="literal">inetd</code> or <code class="literal">xinetd</code>), then the <code class="literal">chkconfig</code> … … 1127 1127 </p><p> 1128 1128 Last, each service must be started to permit system validation to proceed. 1129 </p><div class="procedure"><ol type="1"><li><p>1129 </p><div class="procedure"><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 1130 1130 Use the standard system tool to configure each service to restart 1131 1131 automatically at every system reboot. For example, 1132 <a class="indexterm" name="id 2562945"></a>1132 <a class="indexterm" name="id334038"></a> 1133 1133 </p><pre class="screen"> 1134 1134 <code class="prompt">root# </code> chkconfig dhpcd on … … 1137 1137 <code class="prompt">root# </code> chkconfig smb on 1138 1138 </pre><p> 1139 </p></li><li ><p>1140 <a class="indexterm" name="id 2562989"></a>1141 <a class="indexterm" name="id 2562996"></a>1142 <a class="indexterm" name="id 2563002"></a>1139 </p></li><li class="step" title="Step 2"><p> 1140 <a class="indexterm" name="id334080"></a> 1141 <a class="indexterm" name="id334087"></a> 1142 <a class="indexterm" name="id334094"></a> 1143 1143 Now start each service to permit the system to be validated. 1144 1144 Execute each of the following in the sequence shown: … … 1150 1150 <code class="prompt">root# </code> /etc/rc.d/init.d/smb restart 1151 1151 </pre><p> 1152 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch4valid"></a>Validation</h3></div></div></div><p>1153 <a class="indexterm" name="id 2563057"></a>1152 </p></li></ol></div></div><div class="sect2" title="Validation"><div class="titlepage"><div><div><h3 class="title"><a name="ch4valid"></a>Validation</h3></div></div></div><p> 1153 <a class="indexterm" name="id334146"></a> 1154 1154 Complex networking problems are most often caused by simple things that are poorly or incorrectly 1155 1155 configured. The validation process adopted here should be followed carefully; it is the result of the … … 1161 1161 Later in this book you learn how to make users happier. For now, it is enough to learn to 1162 1162 validate. Let's get on with it. 1163 </p><div class="procedure" ><a name="id2563079"></a><p class="title"><b>Procedure 3.5. Server Validation Steps</b></p><ol type="1"><li><p>1164 <a class="indexterm" name="id 2563090"></a>1163 </p><div class="procedure" title="Procedure 3.5. Server Validation Steps"><a name="id334161"></a><p class="title"><b>Procedure 3.5. Server Validation Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 1164 <a class="indexterm" name="id334172"></a> 1165 1165 One of the most important facets of Samba configuration is to ensure that 1166 1166 name resolution functions correctly. You can check name resolution … … 1187 1187 This proves that name resolution via the <code class="filename">/etc/hosts</code> file 1188 1188 is working. 1189 </p></li><li ><p>1190 <a class="indexterm" name="id 2563160"></a>1189 </p></li><li class="step" title="Step 2"><p> 1190 <a class="indexterm" name="id334233"></a> 1191 1191 So far, your installation is going particularly well. In this step we validate 1192 1192 DNS server and name resolution operation. Using your favorite UNIX system editor, … … 1196 1196 hosts: dns 1197 1197 </pre><p> 1198 </p></li><li ><p>1199 <a class="indexterm" name="id 2563193"></a>1198 </p></li><li class="step" title="Step 3"><p> 1199 <a class="indexterm" name="id334263"></a> 1200 1200 Before you test DNS operation, it is a good idea to verify that the DNS server 1201 1201 is running by executing the following: … … 1211 1211 </pre><p> 1212 1212 This means that we are ready to check DNS operation. Do so by executing: 1213 <a class="indexterm" name="id 2563223"></a>1213 <a class="indexterm" name="id334287"></a> 1214 1214 </p><pre class="screen"> 1215 1215 <code class="prompt">root# </code> ping diamond … … 1227 1227 sleeth1.abmas.biz has address 192.168.1.1 1228 1228 </pre><p> 1229 <a class="indexterm" name="id 2563261"></a>1229 <a class="indexterm" name="id334321"></a> 1230 1230 You may now remove the entry called <code class="constant">diamond</code> from the 1231 1231 <code class="filename">/etc/hosts</code> file. It does not hurt to leave it there, 1232 1232 but its removal reduces the number of administrative steps for this name. 1233 </p></li><li ><p>1234 <a class="indexterm" name="id 2563287"></a>1233 </p></li><li class="step" title="Step 4"><p> 1234 <a class="indexterm" name="id334346"></a> 1235 1235 WINS is a great way to resolve NetBIOS names to their IP address. You can test 1236 1236 the operation of WINS by starting <code class="literal">nmbd</code> (manually or by way … … 1251 1251 64 bytes from 192.168.1.1: icmp_seq=2 ttl=64 time=0.479 ms 1252 1252 </pre><p> 1253 <a class="indexterm" name="id 2563380"></a>1253 <a class="indexterm" name="id334432"></a> 1254 1254 Now that you can relax with the knowledge that all three major forms of name 1255 1255 resolution to IP address resolution are working, edit the <code class="filename">/etc/nsswitch.conf</code> … … 1260 1260 </pre><p> 1261 1261 The system is looking good. Let's move on. 1262 </p></li><li ><p>1262 </p></li><li class="step" title="Step 5"><p> 1263 1263 It would give you peace of mind to know that the DHCP server is running 1264 1264 and available for service. You can validate DHCP services by running: … … 1271 1271 This shows that the server is running. The proof of whether or not it is working 1272 1272 comes when you try to add the first DHCP client to the network. 1273 </p></li><li ><p>1274 <a class="indexterm" name="id 2563440"></a>1273 </p></li><li class="step" title="Step 6"><p> 1274 <a class="indexterm" name="id334485"></a> 1275 1275 This is a good point at which to start validating Samba operation. You are 1276 1276 content that name resolution is working for basic TCP/IP needs. Let's move on. … … 1343 1343 </pre><p> 1344 1344 Clear away all errors before proceeding. 1345 </p></li><li ><p>1346 <a class="indexterm" name="id 2563541"></a>1347 <a class="indexterm" name="id 2563548"></a>1348 <a class="indexterm" name="id 2563554"></a>1349 <a class="indexterm" name="id 2563561"></a>1345 </p></li><li class="step" title="Step 7"><p> 1346 <a class="indexterm" name="id334550"></a> 1347 <a class="indexterm" name="id334557"></a> 1348 <a class="indexterm" name="id334564"></a> 1349 <a class="indexterm" name="id334571"></a> 1350 1350 Check that the Samba server is running: 1351 1351 </p><pre class="screen"> … … 1360 1360 </pre><p> 1361 1361 The <code class="literal">winbindd</code> daemon is running in split mode (normal), so there are also 1362 two instances<sup>[<a name="id 2563592" href="#ftn.id2563592" class="footnote">7</a>]</sup> of it.1363 </p></li><li ><p>1364 <a class="indexterm" name="id 2563623"></a>1365 <a class="indexterm" name="id 2563630"></a>1362 two instances<sup>[<a name="id334598" href="#ftn.id334598" class="footnote">7</a>]</sup> of it. 1363 </p></li><li class="step" title="Step 8"><p> 1364 <a class="indexterm" name="id334627"></a> 1365 <a class="indexterm" name="id334634"></a> 1366 1366 Check that an anonymous connection can be made to the Samba server: 1367 1367 </p><pre class="screen"> … … 1394 1394 The <code class="constant">-U%</code> argument means to send a <code class="constant">NULL</code> username and 1395 1395 a <code class="constant">NULL</code> password. 1396 </p></li><li ><p>1397 <a class="indexterm" name="id 2563688"></a>1398 <a class="indexterm" name="id 2563695"></a>1399 <a class="indexterm" name="id 2563702"></a>1396 </p></li><li class="step" title="Step 9"><p> 1397 <a class="indexterm" name="id334682"></a> 1398 <a class="indexterm" name="id334688"></a> 1399 <a class="indexterm" name="id334695"></a> 1400 1400 Verify that each printer has the IP address assigned in the DHCP server configuration file. 1401 1401 The easiest way to do this is to ping the printer name. Immediately after the ping response … … 1412 1412 hplj6a (192.168.1.30) at 00:03:47:CB:81:E0 [ether] on eth0 1413 1413 </pre><p> 1414 <a class="indexterm" name="id 2563748"></a>1414 <a class="indexterm" name="id334736"></a> 1415 1415 The MAC address <code class="constant">00:03:47:CB:81:E0</code> matches that specified for the 1416 1416 IP address from which the printer has responded and with the entry for it in the 1417 1417 <code class="filename">/etc/dhcpd.conf</code> file. Repeat this for each printer configured. 1418 </p></li><li ><p>1419 <a class="indexterm" name="id 2563777"></a>1418 </p></li><li class="step" title="Step 10"><p> 1419 <a class="indexterm" name="id334763"></a> 1420 1420 Make an authenticated connection to the server using the <code class="literal">smbclient</code> tool: 1421 1421 </p><pre class="screen"> … … 1435 1435 smb: \> q 1436 1436 </pre><p> 1437 </p></li><li ><p>1438 <a class="indexterm" name="id 2563834"></a>1437 </p></li><li class="step" title="Step 11"><p> 1438 <a class="indexterm" name="id334807"></a> 1439 1439 Your new server is connected to an Internet-accessible connection. Before you start 1440 1440 your firewall, you should run a port scanner against your system. You should repeat that … … 1510 1510 Nmap run completed -- 1 IP address (1 host up) scanned in 168 seconds 1511 1511 </pre><p> 1512 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch4appscfg"></a>Application Share Configuration</h3></div></div></div><p>1513 <a class="indexterm" name="id 2563937"></a>1514 <a class="indexterm" name="id 2563944"></a>1512 </p></li></ol></div></div><div class="sect2" title="Application Share Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="ch4appscfg"></a>Application Share Configuration</h3></div></div></div><p> 1513 <a class="indexterm" name="id334886"></a> 1514 <a class="indexterm" name="id334893"></a> 1515 1515 The use of an application server is a key mechanism by which desktop administration overheads 1516 1516 can be reduced. Check the application manual for your software to identify how best to … … 1520 1520 is typically not suited for administrative installation. Administratively installed software 1521 1521 permits one or more of the following installation choices: 1522 </p><div class="itemizedlist"><ul type="disc"><li><p>1522 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 1523 1523 Install software fully onto a workstation, storing data files on the same workstation. 1524 </p></li><li ><p>1524 </p></li><li class="listitem"><p> 1525 1525 Install software fully onto a workstation with central network data file storage. 1526 </p></li><li ><p>1526 </p></li><li class="listitem"><p> 1527 1527 Install software to run off a central application server with data files stored 1528 1528 on the local workstation. This is often called a minimum installation, or a 1529 1529 network client installation. 1530 </p></li><li ><p>1530 </p></li><li class="listitem"><p> 1531 1531 Install software to run off a central application server with data files stored 1532 1532 on a central network share. This type of installation often prevents storage 1533 1533 of work files on the local workstation. 1534 1534 </p></li></ul></div><p> 1535 <a class="indexterm" name="id 2563996"></a>1535 <a class="indexterm" name="id334936"></a> 1536 1536 A common application deployed in this environment is an office suite. 1537 1537 Enterprise editions of Microsoft Office XP Professional can be administratively installed … … 1550 1550 local disk space. In the latter case, when the applications are used, they load over the network. 1551 1551 </p><p> 1552 <a class="indexterm" name="id 2564033"></a>1553 <a class="indexterm" name="id 2564040"></a>1552 <a class="indexterm" name="id334963"></a> 1553 <a class="indexterm" name="id334970"></a> 1554 1554 Microsoft Office Service Packs can be unpacked to update an administrative share. This makes 1555 1555 it possible to update MS Office XP Professional for all users from a single installation … … 1560 1560 editing or by way of configuration options inside each Office XP Professional application. 1561 1561 </p><p> 1562 <a class="indexterm" name="id 2564062"></a>1562 <a class="indexterm" name="id334988"></a> 1563 1563 OpenOffice.Org OpenOffice Version 1.1.0 can be installed locally. It can also 1564 1564 be installed to run off a network share. The latter is a most desirable solution for office-bound … … 1573 1573 share point. The full administrative OpenOffice share takes approximately 150 MB of disk 1574 1574 space. 1575 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2564093"></a>Comments Regarding Software Terms of Use</h4></div></div></div><p>1575 </p><div class="sect3" title="Comments Regarding Software Terms of Use"><div class="titlepage"><div><div><h4 class="title"><a name="id335012"></a>Comments Regarding Software Terms of Use</h4></div></div></div><p> 1576 1576 Many single-user products can be installed into an administrative share, but 1577 1577 personal versions of products such as Microsoft Office XP Professional do not permit this. … … 1597 1597 please do not use the software. 1598 1598 </p><p> 1599 <a class="indexterm" name="id 2564142"></a>1599 <a class="indexterm" name="id335047"></a> 1600 1600 Samba is provided under the terms of the GNU GPL Version 2, a copy of which is provided 1601 1601 with the source code. 1602 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="ch4wincfg"></a>Windows Client Configuration</h3></div></div></div><p>1602 </p></div></div><div class="sect2" title="Windows Client Configuration"><div class="titlepage"><div><div><h3 class="title"><a name="ch4wincfg"></a>Windows Client Configuration</h3></div></div></div><p> 1603 1603 Christine needs to roll out 130 new desktop systems. There is no doubt that she also needs 1604 1604 to reinstall many of the notebook computers that will be recycled for use with the new network … … 1607 1607 Ghost (enterprise edition) to replicate the staged machine to its target desktops. The same can 1608 1608 be done with notebook computers as long as they are identical or sufficiently similar. 1609 </p><div class="procedure" ><a name="sbewinclntprep"></a><p class="title"><b>Procedure 3.6. Windows Client Configuration Procedure</b></p><ol type="1"><li><p>1610 <a class="indexterm" name="id 2564192"></a>1611 <a class="indexterm" name="id 2564199"></a>1609 </p><div class="procedure" title="Procedure 3.6. Windows Client Configuration Procedure"><a name="sbewinclntprep"></a><p class="title"><b>Procedure 3.6. Windows Client Configuration Procedure</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 1610 <a class="indexterm" name="id335091"></a> 1611 <a class="indexterm" name="id335098"></a> 1612 1612 Install MS Windows XP Professional. During installation, configure the client to use DHCP for 1613 1613 TCP/IP protocol configuration. DHCP configures all Windows clients to use the WINS Server 1614 1614 address that has been defined for the local subnet. 1615 </p></li><li ><p>1615 </p></li><li class="step" title="Step 2"><p> 1616 1616 Join the Windows Domain <code class="constant">PROMISES</code>. Use the Domain Administrator 1617 1617 username <code class="constant">root</code> and the SMB password you assigned to this account. … … 1620 1620 Reboot the machine as prompted and then log on using the Domain Administrator account 1621 1621 (<code class="constant">root</code>). 1622 </p></li><li ><p>1622 </p></li><li class="step" title="Step 3"><p> 1623 1623 Verify <code class="constant">DIAMOND</code> is visible in <span class="guimenu">My Network Places</span>, 1624 1624 that it is possible to connect to it and see the shares <span class="guimenuitem">accounts</span>, 1625 1625 <span class="guimenuitem">apps</span>, and <span class="guimenuitem">finsvcs</span>, and that it is 1626 1626 possible to open each share to reveal its contents. 1627 </p></li><li ><p>1627 </p></li><li class="step" title="Step 4"><p> 1628 1628 Create a drive mapping to the <code class="constant">apps</code> share on the server <code class="constant">DIAMOND</code>. 1629 </p></li><li ><p>1629 </p></li><li class="step" title="Step 5"><p> 1630 1630 Perform an administrative installation of each application to be used. Select the options 1631 1631 that you wish to use. Of course, you can choose to run applications over the network, correct? 1632 </p></li><li ><p>1632 </p></li><li class="step" title="Step 6"><p> 1633 1633 Now install all applications to be installed locally. Typical tools include Adobe Acrobat, 1634 1634 NTP-based time synchronization software, drivers for specific local devices such as fingerprint 1635 1635 scanners, and the like. Probably the most significant application for local installation 1636 1636 is antivirus software. 1637 </p></li><li ><p>1637 </p></li><li class="step" title="Step 7"><p> 1638 1638 Now install all four printers onto the staging system. The printers you install 1639 1639 include the accounting department HP LaserJet 6 and Minolta QMS Magicolor printers. You will … … 1641 1641 Install printers on each machine following the steps shown in the Windows client printer 1642 1642 preparation procedure below. 1643 </p></li><li ><p>1644 <a class="indexterm" name="id 2564337"></a>1643 </p></li><li class="step" title="Step 8"><p> 1644 <a class="indexterm" name="id335222"></a> 1645 1645 When you are satisfied that the staging systems are complete, use the appropriate procedure to 1646 1646 remove the client from the domain. Reboot the system and then log on as the local administrator 1647 1647 and clean out all temporary files stored on the system. Before shutting down, use the disk 1648 1648 defragmentation tool so that the file system is in optimal condition before replication. 1649 </p></li><li ><p>1649 </p></li><li class="step" title="Step 9"><p> 1650 1650 Boot the workstation using the Norton (Symantec) Ghosting diskette (or CD-ROM) and image the 1651 1651 machine to a network share on the server. 1652 </p></li><li ><p>1653 <a class="indexterm" name="id 2564366"></a>1654 <a class="indexterm" name="id 2564375"></a>1652 </p></li><li class="step" title="Step 10"><p> 1653 <a class="indexterm" name="id335246"></a> 1654 <a class="indexterm" name="id335256"></a> 1655 1655 You may now replicate the image to the target machines using the appropriate Norton Ghost 1656 1656 procedure. Make sure to use the procedure that ensures each machine has a unique 1657 1657 Windows security identifier (SID). When the installation of the disk image has completed, boot the PC. 1658 </p></li><li ><p>1658 </p></li><li class="step" title="Step 11"><p> 1659 1659 Log on to the machine as the local Administrator (the only option), and join the machine to 1660 1660 the Domain, following the procedure set out in <a class="link" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">“A Collection of Useful Tidbits”</a>, <a class="link" href="appendix.html#domjoin" title="Joining a Domain: Windows 200x/XP Professional">“Joining a Domain: Windows 200x/XP Professional”</a>. The system is now 1661 1661 ready for the user to log on, provided you have created a network logon account for that 1662 1662 user, of course. 1663 </p></li><li ><p>1663 </p></li><li class="step" title="Step 12"><p> 1664 1664 Instruct all users to log on to the workstation using their assigned username and password. 1665 </p></li></ol></div><div class="procedure" ><a name="sbewinclntptrprep"></a><p class="title"><b>Procedure 3.7. Windows Client Printer Preparation Procedure</b></p><ol type="1"><li><p>1665 </p></li></ol></div><div class="procedure" title="Procedure 3.7. Windows Client Printer Preparation Procedure"><a name="sbewinclntptrprep"></a><p class="title"><b>Procedure 3.7. Windows Client Printer Preparation Procedure</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 1666 1666 Click <span class="guimenu">Start</span> → <span class="guimenuitem">Settings</span> → <span class="guimenuitem">Printers</span>+<span class="guiicon">Add Printer</span>+<span class="guibutton">Next</span>. Do not click <span class="guimenuitem">Network printer</span>. 1667 1667 Ensure that <span class="guimenuitem">Local printer</span> is selected. 1668 </p></li><li ><p>1668 </p></li><li class="step" title="Step 2"><p> 1669 1669 Click <span class="guibutton">Next</span>. In the 1670 1670 <span class="guimenuitem">Manufacturer:</span> panel, select <code class="constant">HP</code>. 1671 1671 In the <span class="guimenuitem">Printers:</span> panel, select the printer called 1672 1672 <code class="constant">HP LaserJet 6</code>. Click <span class="guibutton">Next</span>. 1673 </p></li><li ><p>1673 </p></li><li class="step" title="Step 3"><p> 1674 1674 In the <span class="guimenuitem">Available ports:</span> panel, select 1675 1675 <code class="constant">FILE:</code>. Accept the default printer name by clicking 1676 <span class="guibutton">Next</span>. When asked, “<span class="quote">Would you like to print a1677 test page?,</span>” click <span class="guimenuitem">No</span>. Click1676 <span class="guibutton">Next</span>. When asked, <span class="quote">“<span class="quote">Would you like to print a 1677 test page?,</span>”</span> click <span class="guimenuitem">No</span>. Click 1678 1678 <span class="guibutton">Finish</span>. 1679 </p></li><li ><p>1679 </p></li><li class="step" title="Step 4"><p> 1680 1680 You may be prompted for the name of a file to print to. If so, close the 1681 1681 dialog panel. Right-click <span class="guiicon">HP LaserJet 6</span> → <span class="guimenuitem">Properties</span> → <span class="guisubmenu">Details (Tab)</span> → <span class="guimenuitem">Add Port</span>. 1682 </p></li><li ><p>1682 </p></li><li class="step" title="Step 5"><p> 1683 1683 In the <span class="guimenuitem">Network</span> panel, enter the name of 1684 1684 the print queue on the Samba server as follows: <code class="constant">\\DIAMOND\hplj6a</code>. 1685 1685 Click <span class="guibutton">OK</span>+<span class="guibutton">OK</span> to complete the installation. 1686 </p></li><li ><p>1686 </p></li><li class="step" title="Step 6"><p> 1687 1687 Repeat the printer installation steps above for both HP LaserJet 6 printers 1688 1688 as well as for both QMS Magicolor laser printers. 1689 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2564645"></a>Key Points Learned</h3></div></div></div><p>1689 </p></li></ol></div></div><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id335513"></a>Key Points Learned</h3></div></div></div><p> 1690 1690 How do you feel? You have built a capable network, a truly ambitious project. 1691 1691 Future network updates can be handled by 1692 1692 your staff. You must be a satisfied manager. Let's review the achievements. 1693 </p><div class="itemizedlist"><ul type="disc"><li><p>1693 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 1694 1694 A simple firewall has been configured to protect the server in the event that 1695 1695 the ISP firewall service should fail. 1696 </p></li><li ><p>1696 </p></li><li class="listitem"><p> 1697 1697 The Samba configuration uses measures to ensure that only local network users 1698 1698 can connect to SMB/CIFS services. 1699 </p></li><li ><p>1699 </p></li><li class="listitem"><p> 1700 1700 Samba uses the new <code class="constant">tdbsam</code> passdb backend facility. 1701 1701 Considerable complexity was added to Samba functionality. 1702 </p></li><li ><p>1702 </p></li><li class="listitem"><p> 1703 1703 A DHCP server was configured to implement dynamic DNS (DDNS) updates to the DNS 1704 1704 server. 1705 </p></li><li ><p>1705 </p></li><li class="listitem"><p> 1706 1706 The DNS server was configured to permit DDNS only for local network clients. This 1707 1707 server also provides primary DNS services for the company Internet presence. 1708 </p></li><li ><p>1708 </p></li><li class="listitem"><p> 1709 1709 You introduced an application server as well as the concept of cloning a Windows 1710 1710 client in order to effect improved standardization of desktops and to reduce 1711 1711 the costs of network management. 1712 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2564707"></a>Questions and Answers</h2></div></div></div><p>1713 </p><div class="qandaset" ><dl><dt>1. <a href="secure.html#id2564723">1712 </p></li></ul></div></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id335566"></a>Questions and Answers</h2></div></div></div><p> 1713 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id335576"></a><dl><dt>1. <a href="secure.html#id335582"> 1714 1714 What is the maximum number of account entries that the tdbsam 1715 1715 passdb backend can handle? 1716 </a></dt><dt>2. <a href="secure.html#id 2564792">1716 </a></dt><dt>2. <a href="secure.html#id335635"> 1717 1717 Would Samba operate any better if the OS level is set to a value higher than 35? 1718 </a></dt><dt>3. <a href="secure.html#id 2564814">1718 </a></dt><dt>3. <a href="secure.html#id335654"> 1719 1719 Why in this example have you provided UNIX group to Windows Group mappings for only Domain Groups? 1720 </a></dt><dt>4. <a href="secure.html#id 2564836">1720 </a></dt><dt>4. <a href="secure.html#id335674"> 1721 1721 Why has a path been specified in the IPC$ share? 1722 </a></dt><dt>5. <a href="secure.html#id 2564865">1722 </a></dt><dt>5. <a href="secure.html#id335699"> 1723 1723 Why does the smb.conf file in this exercise include an entry for smb ports? 1724 </a></dt><dt>6. <a href="secure.html#id 2564911">1724 </a></dt><dt>6. <a href="secure.html#id335740"> 1725 1725 What is the difference between a print queue and a printer? 1726 </a></dt><dt>7. <a href="secure.html#id 2564947">1726 </a></dt><dt>7. <a href="secure.html#id335768"> 1727 1727 Can all MS Windows application software be installed onto an application server share? 1728 </a></dt><dt>8. <a href="secure.html#id 2564972">1728 </a></dt><dt>8. <a href="secure.html#id335788"> 1729 1729 Why use dynamic DNS (DDNS)? 1730 </a></dt><dt>9. <a href="secure.html#id 2564992">1730 </a></dt><dt>9. <a href="secure.html#id335807"> 1731 1731 Why would you use WINS as well as DNS-based name resolution? 1732 </a></dt><dt>10. <a href="secure.html#id 2565077">1732 </a></dt><dt>10. <a href="secure.html#id335876"> 1733 1733 What are the major benefits of using an application server? 1734 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2564723"></a><a name="id2564725"></a><p><b>1.</b></p></td><td align="left" valign="top"><p>1734 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question" title="1."><td align="left" valign="top"><a name="id335582"></a><a name="id335584"></a><p><b>1.</b></p></td><td align="left" valign="top"><p> 1735 1735 What is the maximum number of account entries that the <em class="parameter"><code>tdbsam</code></em> 1736 1736 passdb backend can handle? … … 1758 1758 not provide a mechanism for replicating tdbsam data so it can be used by a BDC. The 1759 1759 limitation of 250 users per tdbsam is predicated only on the need for replication, 1760 not on the limits<sup>[<a name="id 2564781" href="#ftn.id2564781" class="footnote">8</a>]</sup> of the tdbsam backend itself.1761 </p></td></tr><tr class="question" ><td align="left" valign="top"><a name="id2564792"></a><a name="id2564794"></a><p><b>2.</b></p></td><td align="left" valign="top"><p>1760 not on the limits<sup>[<a name="id335626" href="#ftn.id335626" class="footnote">8</a>]</sup> of the tdbsam backend itself. 1761 </p></td></tr><tr class="question" title="2."><td align="left" valign="top"><a name="id335635"></a><a name="id335637"></a><p><b>2.</b></p></td><td align="left" valign="top"><p> 1762 1762 Would Samba operate any better if the OS level is set to a value higher than 35? 1763 1763 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1765 1765 of 35 already assures Samba of precedence over MS Windows products in browser elections. There is 1766 1766 no gain to be had from setting this higher. 1767 </p></td></tr><tr class="question" ><td align="left" valign="top"><a name="id2564814"></a><a name="id2564816"></a><p><b>3.</b></p></td><td align="left" valign="top"><p>1767 </p></td></tr><tr class="question" title="3."><td align="left" valign="top"><a name="id335654"></a><a name="id335656"></a><p><b>3.</b></p></td><td align="left" valign="top"><p> 1768 1768 Why in this example have you provided UNIX group to Windows Group mappings for only Domain Groups? 1769 1769 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1771 1771 a later date Samba may make use of Windows Local Groups, as well as of the Active Directory special 1772 1772 Groups. Proper operation requires Domain Groups to be mapped to valid UNIX groups. 1773 </p></td></tr><tr class="question" ><td align="left" valign="top"><a name="id2564836"></a><a name="id2564838"></a><p><b>4.</b></p></td><td align="left" valign="top"><p>1773 </p></td></tr><tr class="question" title="4."><td align="left" valign="top"><a name="id335674"></a><a name="id335676"></a><p><b>4.</b></p></td><td align="left" valign="top"><p> 1774 1774 Why has a path been specified in the <em class="parameter"><code>IPC$</code></em> share? 1775 1775 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1777 1777 obtain access to the file system, it does so at a location that presents least risk. Under normal operation 1778 1778 this type of paranoid step should not be necessary. The use of this parameter should not be necessary. 1779 </p></td></tr><tr class="question" ><td align="left" valign="top"><a name="id2564865"></a><a name="id2564867"></a><p><b>5.</b></p></td><td align="left" valign="top"><p>1779 </p></td></tr><tr class="question" title="5."><td align="left" valign="top"><a name="id335699"></a><a name="id335701"></a><p><b>5.</b></p></td><td align="left" valign="top"><p> 1780 1780 Why does the <code class="filename">smb.conf</code> file in this exercise include an entry for <a class="link" href="smb.conf.5.html#SMBPORTS" target="_top">smb ports</a>? 1781 1781 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1786 1786 The result of this is improved network performance. Where Samba-3 is installed as an Active Directory Domain 1787 1787 member, the default behavior is highly beneficial and should not be changed. 1788 </p></td></tr><tr class="question" ><td align="left" valign="top"><a name="id2564911"></a><a name="id2564914"></a><p><b>6.</b></p></td><td align="left" valign="top"><p>1788 </p></td></tr><tr class="question" title="6."><td align="left" valign="top"><a name="id335740"></a><a name="id335742"></a><p><b>6.</b></p></td><td align="left" valign="top"><p> 1789 1789 What is the difference between a print queue and a printer? 1790 1790 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1800 1800 and the job is then submitted to a sequential print queue where the job is stored until 1801 1801 the printer is ready to receive the job. 1802 </p></td></tr><tr class="question" ><td align="left" valign="top"><a name="id2564947"></a><a name="id2564949"></a><p><b>7.</b></p></td><td align="left" valign="top"><p>1802 </p></td></tr><tr class="question" title="7."><td align="left" valign="top"><a name="id335768"></a><a name="id335770"></a><p><b>7.</b></p></td><td align="left" valign="top"><p> 1803 1803 Can all MS Windows application software be installed onto an application server share? 1804 1804 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1808 1808 Professional do not permit installation to an application server share and can be installed 1809 1809 and used only to/from a local workstation hard disk. 1810 </p></td></tr><tr class="question" ><td align="left" valign="top"><a name="id2564972"></a><a name="id2564974"></a><p><b>8.</b></p></td><td align="left" valign="top"><p>1810 </p></td></tr><tr class="question" title="8."><td align="left" valign="top"><a name="id335788"></a><a name="id335791"></a><p><b>8.</b></p></td><td align="left" valign="top"><p> 1811 1811 Why use dynamic DNS (DDNS)? 1812 1812 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1814 1814 network clients that are not NetBIOS-enabled, and thus cannot use WINS, to locate 1815 1815 Windows clients via DNS. 1816 </p></td></tr><tr class="question" ><td align="left" valign="top"><a name="id2564992"></a><a name="id2564994"></a><p><b>9.</b></p></td><td align="left" valign="top"><p>1816 </p></td></tr><tr class="question" title="9."><td align="left" valign="top"><a name="id335807"></a><a name="id335809"></a><p><b>9.</b></p></td><td align="left" valign="top"><p> 1817 1817 Why would you use WINS as well as DNS-based name resolution? 1818 1818 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 1819 1819 WINS is to NetBIOS names as DNS is to fully qualified domain names (FQDN). The FQDN is 1820 a name like “<span class="quote">myhost.mydomain.tld</span>”where <em class="parameter"><code>tld</code></em>1820 a name like <span class="quote">“<span class="quote">myhost.mydomain.tld</span>”</span> where <em class="parameter"><code>tld</code></em> 1821 1821 means <code class="constant">top-level domain</code>. A FQDN is a longhand but easy-to-remember 1822 1822 expression that may be up to 1024 characters in length and that represents an IP address. 1823 1823 A NetBIOS name is always 16 characters long. The 16<sup>th</sup> character 1824 is a name type indicator. A specific name type is registered<sup>[<a name="id 2565029" href="#ftn.id2565029" class="footnote">9</a>]</sup> for each1824 is a name type indicator. A specific name type is registered<sup>[<a name="id335840" href="#ftn.id335840" class="footnote">9</a>]</sup> for each 1825 1825 type of service that is provided by the Windows server or client and that may be registered 1826 1826 where a WINS server is in use. … … 1837 1837 </p><p> 1838 1838 Windows 200x Active Directory requires the registration in the DNS zone for the domain it 1839 controls of service locator<sup>[<a name="id 2565063" href="#ftn.id2565063" class="footnote">10</a>]</sup> records1839 controls of service locator<sup>[<a name="id335866" href="#ftn.id335866" class="footnote">10</a>]</sup> records 1840 1840 that Windows clients and servers will use to locate Kerberos and LDAP services. ADS also 1841 1841 requires the registration of special records that are called global catalog (GC) entries 1842 1842 and site entries by which domain controllers and other essential ADS servers may be located. 1843 </p></td></tr><tr class="question" ><td align="left" valign="top"><a name="id2565077"></a><a name="id2565079"></a><p><b>10.</b></p></td><td align="left" valign="top"><p>1843 </p></td></tr><tr class="question" title="10."><td align="left" valign="top"><a name="id335876"></a><a name="id335879"></a><p><b>10.</b></p></td><td align="left" valign="top"><p> 1844 1844 What are the major benefits of using an application server? 1845 1845 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 1848 1848 one location for all major applications used. This results in faster update roll-outs and 1849 1849 significantly better application usage control. 1850 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id 2559623" href="#id2559623" class="para">5</a>] </sup>See <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 3.1850 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id331045" href="#id331045" class="para">5</a>] </sup>See <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 3. 1851 1851 This is necessary so that Samba can act as a Domain Controller (PDC); see 1852 <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 4, for additional information.</p></div><div class="footnote"><p><sup>[<a name="ftn.id 2560004" href="#id2560004" class="para">6</a>] </sup>You may want to do the echo command last and include1853 "0" in the init scripts, since it opens up your network for a short time.</p></div><div class="footnote"><p><sup>[<a name="ftn.id 2563592" href="#id2563592" class="para">7</a>] </sup>For more information regarding winbindd, see <span class="emphasis"><em>TOSHARG2</em></span>,1852 <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 4, for additional information.</p></div><div class="footnote"><p><sup>[<a name="ftn.id331388" href="#id331388" class="para">6</a>] </sup>You may want to do the echo command last and include 1853 "0" in the init scripts, since it opens up your network for a short time.</p></div><div class="footnote"><p><sup>[<a name="ftn.id334598" href="#id334598" class="para">7</a>] </sup>For more information regarding winbindd, see <span class="emphasis"><em>TOSHARG2</em></span>, 1854 1854 Chapter 23, Section 23.3. The single instance of <code class="literal">smbd</code> is normal. One additional 1855 1855 <code class="literal">smbd</code> slave process is spawned for each SMB/CIFS client 1856 connection.</p></div><div class="footnote"><p><sup>[<a name="ftn.id 2564781" href="#id2564781" class="para">8</a>] </sup>Bench tests have shown that tdbsam is a very1856 connection.</p></div><div class="footnote"><p><sup>[<a name="ftn.id335626" href="#id335626" class="para">8</a>] </sup>Bench tests have shown that tdbsam is a very 1857 1857 effective database technology. There is surprisingly little performance loss even 1858 with over 4000 users.</p></div><div class="footnote"><p><sup>[<a name="ftn.id 2565029" href="#id2565029" class="para">9</a>] </sup>1859 See <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 9, for more information.</p></div><div class="footnote"><p><sup>[<a name="ftn.id 2565063" href="#id2565063" class="para">10</a>] </sup>See TOSHARG2, Chapter 9, Section 9.3.3.</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="small.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="ExNetworks.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="Big500users.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 2. Small Office Networking </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 4. The 500-User Office</td></tr></table></div></body></html>1858 with over 4000 users.</p></div><div class="footnote"><p><sup>[<a name="ftn.id335840" href="#id335840" class="para">9</a>] </sup> 1859 See <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 9, for more information.</p></div><div class="footnote"><p><sup>[<a name="ftn.id335866" href="#id335866" class="para">10</a>] </sup>See TOSHARG2, Chapter 9, Section 9.3.3.</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="small.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="ExNetworks.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="Big500users.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 2. Small Office Networking </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 4. The 500-User Office</td></tr></table></div></body></html> -
trunk/server/docs/htmldocs/Samba3-ByExample/simple.html
r414 r599 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 1. No-Frills Samba Servers</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 4.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="next" href="small.html" title="Chapter 2. Small Office Networking"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 1. No-Frills Samba Servers</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="ExNetworks.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="small.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="simple"></a>Chapter 1. No-Frills Samba Servers</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="simple.html#id2550843">Introduction</a></span></dt><dt><span class="sect1"><a href="simple.html#id2550883">Assignment Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="simple.html#id2550925">Drafting Office</a></span></dt><dt><span class="sect2"><a href="simple.html#id2551634">Charity Administration Office</a></span></dt><dt><span class="sect2"><a href="simple.html#AccountingOffice">Accounting Office</a></span></dt></dl></dd><dt><span class="sect1"><a href="simple.html#id2554969">Questions and Answers</a></span></dt></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 1. No-Frills Samba Servers</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="next" href="small.html" title="Chapter 2. Small Office Networking"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 1. No-Frills Samba Servers</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="ExNetworks.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="small.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 1. No-Frills Samba Servers"><div class="titlepage"><div><div><h2 class="title"><a name="simple"></a>Chapter 1. No-Frills Samba Servers</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="simple.html#id323089">Introduction</a></span></dt><dt><span class="sect1"><a href="simple.html#id323120">Assignment Tasks</a></span></dt><dd><dl><dt><span class="sect2"><a href="simple.html#id323158">Drafting Office</a></span></dt><dt><span class="sect2"><a href="simple.html#id323803">Charity Administration Office</a></span></dt><dt><span class="sect2"><a href="simple.html#AccountingOffice">Accounting Office</a></span></dt></dl></dd><dt><span class="sect1"><a href="simple.html#id326925">Questions and Answers</a></span></dt></dl></div><p> 2 2 This is the start of the real journey toward the successful deployment of Samba. For some this chapter 3 3 is the end of the road because their needs will have been adequately met. For others, this chapter is … … 5 5 example configurations of, for the greater part, complete networking solutions. The intent of this book 6 6 is to help you to get your Samba installation working with the least amount of pain and aggravation. 7 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2550843"></a>Introduction</h2></div></div></div><p>7 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id323089"></a>Introduction</h2></div></div></div><p> 8 8 This chapter lays the groundwork for understanding the basics of Samba operation. 9 9 Instead of a bland technical discussion, each principle is demonstrated by way of a 10 real-world scenario for which a working solution<sup>[<a name="id 2550854" href="#ftn.id2550854" class="footnote">1</a>]</sup> is fully described.10 real-world scenario for which a working solution<sup>[<a name="id323099" href="#ftn.id323099" class="footnote">1</a>]</sup> is fully described. 11 11 </p><p> 12 12 The practical exercises take you on a journey through a drafting office, a charity administration … … 18 18 you should aim to be a Samba expert, so do attempt to find better solutions and try them as you work your 19 19 way through the examples. 20 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2550883"></a>Assignment Tasks</h2></div></div></div><p>20 </p></div><div class="sect1" title="Assignment Tasks"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id323120"></a>Assignment Tasks</h2></div></div></div><p> 21 21 Each case presented highlights different aspects of Windows networking for which a simple 22 22 Samba-based solution can be provided. Each has subtly different requirements taken from real-world cases. … … 26 26 This chapter has three assignments built around fictitious companies: 27 27 </p><p> 28 </p><div class="itemizedlist"><ul type="disc"><li><p>A drafting office</p></li><li><p>A charity administration office</p></li><li><p>An accounting office</p></li></ul></div><p>28 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>A drafting office</p></li><li class="listitem"><p>A charity administration office</p></li><li class="listitem"><p>An accounting office</p></li></ul></div><p> 29 29 </p><p> 30 30 Let's get started. 31 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2550925"></a>Drafting Office</h3></div></div></div><p>31 </p><div class="sect2" title="Drafting Office"><div class="titlepage"><div><div><h3 class="title"><a name="id323158"></a>Drafting Office</h3></div></div></div><p> 32 32 Our fictitious company is called <span class="emphasis"><em>Abmas Design, Inc.</em></span> This is a three-person 33 33 computer-aided design (CAD) business that often has more work than can be handled. The … … 39 39 plans from each machine. The files available from the server must remain read-only. 40 40 Anyone should be able to access the plans at any time and without barriers or difficulty. 41 </p><p><a class="indexterm" name="id 2550950"></a>42 <a class="indexterm" name="id 2550956"></a>41 </p><p><a class="indexterm" name="id323177"></a> 42 <a class="indexterm" name="id323183"></a> 43 43 Mr. Bob Jordan has asked you to install the new server as economically as possible. The central 44 44 server has a Pentium-IV 1.6GHz CPU, 768MB RAM, a 20GB IDE boot drive, a 160GB IDE second disk … … 47 47 <a class="ulink" href="http://www.samba.org" target="_top">FTP</a> sites. (Note: Fedora CoreX indicates your favorite 48 48 version.) 49 </p><p><a class="indexterm" name="id 2550984"></a>49 </p><p><a class="indexterm" name="id323204"></a> 50 50 The four permanent drafting machines (Microsoft Windows workstations) have attached printers 51 51 and plotters that are shared on a peer-to-peer basis by any and all network users. The intent … … 56 56 machine. The office works best with this arrangement and does not want to change anything. 57 57 Old habits are too ingrained. 58 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2551005"></a>Dissection and Discussion</h4></div></div></div><p>59 <a class="indexterm" name="id 2551012"></a>58 </p><div class="sect3" title="Dissection and Discussion"><div class="titlepage"><div><div><h4 class="title"><a name="id323219"></a>Dissection and Discussion</h4></div></div></div><p> 59 <a class="indexterm" name="id323227"></a> 60 60 The requirements for this server installation demand simplicity. An anonymous read-only 61 61 file server adequately meets all needs. The network consultant determines how … … 64 64 </p><p> 65 65 It is not necessary to have specific users on the server. The site has a method for storing 66 all design files (plans). Each plan is stored in a directory that is named YYYYWW,<sup>[<a name="id 2551032" href="#ftn.id2551032" class="footnote">2</a>]</sup> where66 all design files (plans). Each plan is stored in a directory that is named YYYYWW,<sup>[<a name="id323243" href="#ftn.id323243" class="footnote">2</a>]</sup> where 67 67 YYYY is the year, and WW is the week of the year. This arrangement allows work to be stored 68 68 by week of year to preserve the filing technique the site is familiar with. … … 74 74 demanding the disk space that would be needed if a duplicate file copy were to be stored. 75 75 The share containing the plans is called <span class="emphasis"><em>Plans</em></span>. 76 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2551061"></a>Implementation</h4></div></div></div><p>76 </p></div><div class="sect3" title="Implementation"><div class="titlepage"><div><div><h4 class="title"><a name="id323262"></a>Implementation</h4></div></div></div><p> 77 77 It is assumed that the server is fully installed and ready for installation and 78 78 configuration of Samba 3.0.20 and any support files needed. All TCP/IP addresses … … 80 80 <code class="constant">192.168.1.1</code> and the netmask is <code class="constant">255.255.255.0</code>. 81 81 The hostname of the server used is <code class="constant">server</code>. 82 </p><div class="procedure" ><a name="id2551084"></a><p class="title"><b>Procedure 1.1. Samba Server Configuration</b></p><ol type="1"><li><p>82 </p><div class="procedure" title="Procedure 1.1. Samba Server Configuration"><a name="id323282"></a><p class="title"><b>Procedure 1.1. Samba Server Configuration</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 83 83 Download the Samba-3 RPM packages for Red Hat Fedora Core2 from the Samba 84 84 <a class="ulink" href="http://www.samba.org" target="_top">FTP servers.</a> 85 </p></li><li ><p>86 <a class="indexterm" name="id 2551108"></a>87 <a class="indexterm" name="id 2551116"></a>85 </p></li><li class="step" title="Step 2"><p> 86 <a class="indexterm" name="id323305"></a> 87 <a class="indexterm" name="id323314"></a> 88 88 Install the RPM package using either the Red Hat Linux preferred GUI 89 89 tool or the <code class="literal">rpm</code>: … … 91 91 <code class="prompt">root# </code> rpm -Uvh samba-3.0.20-1.i386.rpm 92 92 </pre><p> 93 </p></li><li ><p>93 </p></li><li class="step" title="Step 3"><p> 94 94 Create a mount point for the file system that will be used to store all data files. 95 95 You can create a directory called <code class="filename">/plans</code>: … … 101 101 and execute, and the group and everyone else to read and execute only. 102 102 </p><p> 103 <a class="indexterm" name="id 2551175"></a>103 <a class="indexterm" name="id323369"></a> 104 104 Use Red Hat Linux system tools (refer to Red Hat instructions) 105 105 to format the 160GB hard drive with a suitable file system. An Ext3 file system 106 106 is suitable. Configure this drive to automatically mount using the <code class="filename">/plans</code> 107 107 directory as the mount point. 108 </p></li><li ><p>108 </p></li><li class="step" title="Step 4"><p> 109 109 Install the <code class="filename">smb.conf</code> file shown in <a class="link" href="simple.html#draft-smbconf" title="Example 1.1. Drafting Office smb.conf File">“Drafting Office smb.conf File”</a> in the 110 110 <code class="filename">/etc/samba</code> directory. 111 111 112 </p><div class="example"><a name="draft-smbconf"></a><p class="title"><b>Example 1.1. Drafting Office <code class="filename">smb.conf</code> File</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global Parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2551244"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2551254"></a><em class="parameter"><code>security = SHARE</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[Plans]</code></em></td></tr><tr><td><a class="indexterm" name="id2551273"></a><em class="parameter"><code>path = /plans</code></em></td></tr><tr><td><a class="indexterm" name="id2551283"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2551294"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr></table></div></div><p><br class="example-break">113 </p></li><li ><p>114 <a class="indexterm" name="id 2551311"></a>112 </p><div class="example"><a name="draft-smbconf"></a><p class="title"><b>Example 1.1. Drafting Office <code class="filename">smb.conf</code> File</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global Parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id323435"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id323446"></a><em class="parameter"><code>security = SHARE</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[Plans]</code></em></td></tr><tr><td><a class="indexterm" name="id323464"></a><em class="parameter"><code>path = /plans</code></em></td></tr><tr><td><a class="indexterm" name="id323475"></a><em class="parameter"><code>read only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id323485"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr></table></div></div><p><br class="example-break"> 113 </p></li><li class="step" title="Step 5"><p> 114 <a class="indexterm" name="id323503"></a> 115 115 Verify that the <code class="filename">/etc/hosts</code> file contains the following entry: 116 116 </p><pre class="screen"> … … 118 118 </pre><p> 119 119 120 </p></li><li ><p>121 <a class="indexterm" name="id 2551335"></a>122 <a class="indexterm" name="id 2551344"></a>123 <a class="indexterm" name="id 2551350"></a>120 </p></li><li class="step" title="Step 6"><p> 121 <a class="indexterm" name="id323526"></a> 122 <a class="indexterm" name="id323534"></a> 123 <a class="indexterm" name="id323540"></a> 124 124 Use the standard system tool to start Samba and to configure it to restart 125 125 automatically at every system reboot. For example, … … 128 128 <code class="prompt">root# </code> /etc/rc.d/init.d/smb restart 129 129 </pre><p> 130 </p></li></ol></div><div class="procedure" ><a name="id2551376"></a><p class="title"><b>Procedure 1.2. Windows Client Configuration</b></p><ol type="1"><li><p>130 </p></li></ol></div><div class="procedure" title="Procedure 1.2. Windows Client Configuration"><a name="id323566"></a><p class="title"><b>Procedure 1.2. Windows Client Configuration</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 131 131 Make certain that all clients are set to the same network address range as 132 132 used for the Samba server. For example, one client might have an IP 133 133 address 192.168.1.10. 134 </p></li><li ><p>135 <a class="indexterm" name="id 2551396"></a>134 </p></li><li class="step" title="Step 2"><p> 135 <a class="indexterm" name="id323584"></a> 136 136 Ensure that the netmask used on the Windows clients matches that used 137 137 for the Samba server. All clients must have the same netmask, such as 138 138 255.255.255.0. 139 </p></li><li ><p>140 <a class="indexterm" name="id 2551412"></a>139 </p></li><li class="step" title="Step 3"><p> 140 <a class="indexterm" name="id323598"></a> 141 141 Set the workgroup name on all clients to <code class="constant">MIDEARTH</code>. 142 </p></li><li ><p>142 </p></li><li class="step" title="Step 4"><p> 143 143 Verify on each client that the machine called <code class="constant">SERVER</code> 144 144 is visible in the <span class="guimenu">Network Neighborhood</span>, that it is 145 145 possible to connect to it and see the share <span class="guimenuitem">Plans</span>, 146 146 and that it is possible to open that share to reveal its contents. 147 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="validate1"></a>Validation</h4></div></div></div><p>148 <a class="indexterm" name="id 2551458"></a>147 </p></li></ol></div></div><div class="sect3" title="Validation"><div class="titlepage"><div><div><h4 class="title"><a name="validate1"></a>Validation</h4></div></div></div><p> 148 <a class="indexterm" name="id323642"></a> 149 149 The first priority in validating the new Samba configuration should be to check 150 150 that Samba answers on the loop-back interface. Then it is time to check that Samba 151 151 answers its own name correctly. Last, check that a client can connect to the Samba 152 152 server. 153 </p><div class="procedure"><ol type="1"><li><p>154 <a class="indexterm" name="id 2551477"></a>155 <a class="indexterm" name="id 2551483"></a>156 <a class="indexterm" name="id 2551490"></a>153 </p><div class="procedure"><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 154 <a class="indexterm" name="id323659"></a> 155 <a class="indexterm" name="id323665"></a> 156 <a class="indexterm" name="id323671"></a> 157 157 To check the ability to access the <code class="literal">smbd</code> daemon 158 158 services, execute the following: … … 173 173 MIDEARTH SERVER 174 174 </pre><p> 175 <a class="indexterm" name="id 2551521"></a>176 <a class="indexterm" name="id 2551527"></a>175 <a class="indexterm" name="id323697"></a> 176 <a class="indexterm" name="id323703"></a> 177 177 This indicates that Samba is able to respond on the loopback interface to 178 178 a NULL connection. The <em class="parameter"><code>-U%</code></em> means send an empty 179 179 username and an empty password. This command should be repeated after 180 180 Samba has been running for 15 minutes. 181 </p></li><li ><p>181 </p></li><li class="step" title="Step 2"><p> 182 182 Now verify that Samba correctly handles being passed a username 183 183 and password, and that it answers its own name. Execute the following: … … 188 188 configured to ignore all usernames given; instead it uses the 189 189 <em class="parameter"><code>guest account</code></em> for all connections. 190 </p></li><li ><p>191 <a class="indexterm" name="id 2551577"></a>192 <a class="indexterm" name="id 2551583"></a>190 </p></li><li class="step" title="Step 3"><p> 191 <a class="indexterm" name="id323748"></a> 192 <a class="indexterm" name="id323754"></a> 193 193 From the Windows 9x/Me client, launch Windows Explorer: 194 194 <span class="guiicon">[Desktop: right-click] Network Neighborhood</span>+<span class="guimenu">Explore</span> → <span class="guimenuitem">[Left Panel] [+] Entire Network</span> → <span class="guimenuitem">[Left Panel] [+] Server</span> → <span class="guimenuitem">[Left Panel] [+] Plans</span>. In the right panel you should see the files and directories 195 195 (folders) that are in the <span class="guiicon">Plans</span> share. 196 </p></li></ol></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2551634"></a>Charity Administration Office</h3></div></div></div><p>196 </p></li></ol></div></div></div><div class="sect2" title="Charity Administration Office"><div class="titlepage"><div><div><h3 class="title"><a name="id323803"></a>Charity Administration Office</h3></div></div></div><p> 197 197 The fictitious charity organization is called <span class="emphasis"><em>Abmas Vision NL</em></span>. This office 198 198 has five networked computers. Staff are all volunteers, staff changes are frequent. … … 217 217 file share. 218 218 </p><p> 219 <a class="indexterm" name="id 2551697"></a>220 <a class="indexterm" name="id 2551703"></a>219 <a class="indexterm" name="id323847"></a> 220 <a class="indexterm" name="id323854"></a> 221 221 Printer handling in Samba results in a significant level of confusion. Samba presents to the 222 222 MS Windows client only a print queue. The Samba <code class="literal">smbd</code> process passes a … … 232 232 used on this network. 233 233 </p><p> 234 <a class="indexterm" name="id 2551736"></a>234 <a class="indexterm" name="id323879"></a> 235 235 The central server was donated by a local computer store. It is a dual processor Pentium-III 236 236 server, has 1GB RAM, a 3-Ware IDE RAID Controller that has four 200GB IDE hard drives, and a … … 243 243 to the printers was accepted. You have supplied SUSE Enterprise Linux Server 9 and 244 244 have upgraded Samba to version 3.0.20. 245 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2551758"></a>Dissection and Discussion</h4></div></div></div><p>246 <a class="indexterm" name="id 2551766"></a>247 <a class="indexterm" name="id 2551772"></a>248 <a class="indexterm" name="id 2551778"></a>249 <a class="indexterm" name="id 2551784"></a>245 </p><div class="sect3" title="Dissection and Discussion"><div class="titlepage"><div><div><h4 class="title"><a name="id323894"></a>Dissection and Discussion</h4></div></div></div><p> 246 <a class="indexterm" name="id323902"></a> 247 <a class="indexterm" name="id323908"></a> 248 <a class="indexterm" name="id323914"></a> 249 <a class="indexterm" name="id323920"></a> 250 250 This installation demands simplicity. Frequent turnover of volunteer staff indicates that 251 251 a network environment that requires users to logon might be problematic. It is suggested that the … … 259 259 an inadvertent ACL from overriding actual file permissions. 260 260 </p><p> 261 <a class="indexterm" name="id 2551823"></a>262 <a class="indexterm" name="id 2551830"></a>263 <a class="indexterm" name="id 2551836"></a>261 <a class="indexterm" name="id323953"></a> 262 <a class="indexterm" name="id323959"></a> 263 <a class="indexterm" name="id323965"></a> 264 264 This organization is a prime candidate for Share Mode security. The <em class="parameter"><code>force user</code></em> 265 265 allows all files to be owned by the same user and group. In addition, it would not hurt to … … 268 268 For further information regarding the significance of the SUID/SGID settings, see <a class="link" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">“A Collection of Useful Tidbits”</a>, <a class="link" href="appendix.html#ch12-SUIDSGID" title="Effect of Setting File and Directory SUID/SGID Permissions Explained">“Effect of Setting File and Directory SUID/SGID Permissions Explained”</a>. 269 269 </p><p> 270 <a class="indexterm" name="id 2551869"></a>271 <a class="indexterm" name="id 2551875"></a>272 <a class="indexterm" name="id 2551883"></a>273 <a class="indexterm" name="id 2551890"></a>270 <a class="indexterm" name="id323994"></a> 271 <a class="indexterm" name="id324000"></a> 272 <a class="indexterm" name="id324009"></a> 273 <a class="indexterm" name="id324015"></a> 274 274 All client workstations print to a print queue on the server. This ensures that print jobs 275 275 continue to print in the event that a user shuts down the workstation immediately after … … 278 278 that CUPS has become the leading UNIX printing technology. 279 279 </p><p> 280 <a class="indexterm" name="id 2551907"></a>280 <a class="indexterm" name="id324028"></a> 281 281 The print queues are set up as <code class="constant">Raw</code> devices, which means that CUPS will 282 282 not do intelligent print processing, and vendor-supplied drivers must be installed locally on the … … 298 298 really is just a print queue. The name of the print queue is representative of 299 299 the device to which the print spooler delivers print jobs. 300 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2551953"></a>Implementation</h4></div></div></div><p>300 </p></div><div class="sect3" title="Implementation"><div class="titlepage"><div><div><h4 class="title"><a name="id324064"></a>Implementation</h4></div></div></div><p> 301 301 It is assumed that the server is fully installed and ready for configuration of 302 302 Samba 3.0.20 and for necessary support files. All TCP/IP addresses should be hard-coded. … … 304 304 255.255.255.0. The hostname of the server used is <code class="constant">server</code>. 305 305 The office network is built as shown in <a class="link" href="simple.html#charitynet" title="Figure 1.1. Charity Administration Office Network">“Charity Administration Office Network”</a>. 306 </p><div class="figure"><a name="charitynet"></a><p class="title"><b>Figure 1.1. Charity Administration Office Network</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/Charity-Network.png" width="432" alt="Charity Administration Office Network"></div></div></div><br class="figure-break"><div class="procedure" ><a name="id2552014"></a><p class="title"><b>Procedure 1.3. Samba Server Configuration</b></p><ol type="1"><li><p>307 <a class="indexterm" name="id 2552024"></a>306 </p><div class="figure"><a name="charitynet"></a><p class="title"><b>Figure 1.1. Charity Administration Office Network</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/Charity-Network.png" width="432" alt="Charity Administration Office Network"></div></div></div><br class="figure-break"><div class="procedure" title="Procedure 1.3. Samba Server Configuration"><a name="id324118"></a><p class="title"><b>Procedure 1.3. Samba Server Configuration</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 307 <a class="indexterm" name="id324129"></a> 308 308 Create a group account for office file storage: 309 309 </p><pre class="screen"> 310 310 <code class="prompt">root# </code> groupadd office 311 311 </pre><p> 312 </p></li><li ><p>313 <a class="indexterm" name="id 2552048"></a>314 <a class="indexterm" name="id 2552055"></a>312 </p></li><li class="step" title="Step 2"><p> 313 <a class="indexterm" name="id324152"></a> 314 <a class="indexterm" name="id324158"></a> 315 315 Create a user account for office file storage: 316 316 </p><pre class="screen"> … … 323 323 </pre><p> 324 324 where XXXXXXXX is a secret password. 325 </p></li><li ><p>325 </p></li><li class="step" title="Step 3"><p> 326 326 Use the 3-Ware IDE RAID Controller firmware utilities to configure the four 200GB 327 327 drives as a single RAID level 5 drive, with one drive set aside as the hot spare. 328 328 (Refer to the 3-Ware RAID Controller Manual for the manufacturer's preferred procedure.) 329 329 The resulting drive has a capacity of approximately 500GB of usable space. 330 </p></li><li ><p>331 <a class="indexterm" name="id 2552099"></a>330 </p></li><li class="step" title="Step 4"><p> 331 <a class="indexterm" name="id324197"></a> 332 332 Create a mount point for the file system that can be used to store all data files. 333 333 Create a directory called <code class="filename">/data</code>: … … 338 338 The 755 permissions on this directory (mount point) permit the owner to read, write, and execute, 339 339 and the group and everyone else to read and execute only. 340 </p></li><li ><p>340 </p></li><li class="step" title="Step 5"><p> 341 341 Use SUSE Linux system tools (refer to the SUSE Administrators Guide for correct 342 342 procedures) to format the partition with a suitable file system. The reiserfs file system 343 343 is suitable. Configure this drive to automount using the <code class="filename">/data</code> 344 344 directory as the mount point. It must be mounted before proceeding. 345 </p></li><li ><p>345 </p></li><li class="step" title="Step 6"><p> 346 346 Under the directory called <code class="filename">/data</code>, create two directories 347 347 named <code class="filename">ftmfiles</code> and <code class="filename">officefiles</code>, and set … … 361 361 /data/officefiles/misc 362 362 </pre><p> 363 <a class="indexterm" name="id 2552207"></a>363 <a class="indexterm" name="id324296"></a> 364 364 The <code class="literal">chown</code> operation sets the owner to the user <code class="constant">abmas</code> 365 365 and the group to <code class="constant">office</code> on all directories just created. It recursively … … 369 369 created. Any new directories created still have the same owner, group, and permissions as the 370 370 directory they are in. This should eliminate all permissions-based file access problems. For 371 more information on this subject, refer to TOSHARG2<sup>[<a name="id 2552236" href="#ftn.id2552236" class="footnote">3</a>]</sup> or refer371 more information on this subject, refer to TOSHARG2<sup>[<a name="id324318" href="#ftn.id324318" class="footnote">3</a>]</sup> or refer 372 372 to the UNIX man page for the <code class="literal">chmod</code> and the <code class="literal">chown</code> commands. 373 </p></li><li ><p>373 </p></li><li class="step" title="Step 7"><p> 374 374 Install the <code class="filename">smb.conf</code> file shown in <a class="link" href="simple.html#charity-smbconfnew" title="Example 1.2. Charity Administration Office smb.conf New-style File">“Charity Administration Office smb.conf New-style File”</a> in the 375 375 <code class="filename">/etc/samba</code> directory. This newer <code class="filename">smb.conf</code> file uses user-mode security … … 380 380 can install the file shown in <a class="link" href="simple.html#charity-smbconf" title="Example 1.3. Charity Administration Office smb.conf Old-style File">“Charity Administration Office smb.conf Old-style File”</a> in the 381 381 <code class="filename">/etc/samba</code> directory. 382 </p></li><li ><p>383 <a class="indexterm" name="id 2552304"></a>382 </p></li><li class="step" title="Step 8"><p> 383 <a class="indexterm" name="id324382"></a> 384 384 We must ensure that the <code class="literal">smbd</code> can resolve the name of the Samba 385 385 server to its IP address. Verify that the <code class="filename">/etc/hosts</code> file … … 388 388 192.168.1.1 server 389 389 </pre><p> 390 </p></li><li ><p>390 </p></li><li class="step" title="Step 9"><p> 391 391 Configure the printers with the IP address as shown in <a class="link" href="simple.html#charitynet" title="Figure 1.1. Charity Administration Office Network">“Charity Administration Office Network”</a>. 392 392 Follow the instructions in the manufacturer's manual to permit printing to port 9100 393 393 so that the CUPS spooler can print using raw mode protocols. 394 </p></li><li ><p>395 <a class="indexterm" name="id 2552349"></a>394 </p></li><li class="step" title="Step 10"><p> 395 <a class="indexterm" name="id324423"></a> 396 396 Configure the CUPS Print Queues: 397 397 </p><pre class="screen"> … … 400 400 </pre><p> 401 401 This creates the necessary print queues with no assigned print filter. 402 </p></li><li ><p>403 <a class="indexterm" name="id 2552381"></a>404 <a class="indexterm" name="id 2552388"></a>405 <a class="indexterm" name="id 2552394"></a>402 </p></li><li class="step" title="Step 11"><p> 403 <a class="indexterm" name="id324452"></a> 404 <a class="indexterm" name="id324459"></a> 405 <a class="indexterm" name="id324465"></a> 406 406 Edit the file <code class="filename">/etc/cups/mime.convs</code> to uncomment the line: 407 407 </p><pre class="screen"> 408 408 application/octet-stream application/vnd.cups-raw 0 - 409 409 </pre><p> 410 </p></li><li ><p>411 <a class="indexterm" name="id 2552418"></a>410 </p></li><li class="step" title="Step 12"><p> 411 <a class="indexterm" name="id324488"></a> 412 412 Edit the file <code class="filename">/etc/cups/mime.types</code> to uncomment the line: 413 413 </p><pre class="screen"> 414 414 application/octet-stream 415 415 </pre><p> 416 </p></li><li ><p>417 <a class="indexterm" name="id 2552441"></a>416 </p></li><li class="step" title="Step 13"><p> 417 <a class="indexterm" name="id324511"></a> 418 418 Use the standard system tool to start Samba and CUPS to configure them to restart 419 419 automatically at every system reboot. For example, 420 420 </p><p> 421 <a class="indexterm" name="id 2552453"></a>422 <a class="indexterm" name="id 2552459"></a>423 <a class="indexterm" name="id 2552466"></a>421 <a class="indexterm" name="id324522"></a> 422 <a class="indexterm" name="id324528"></a> 423 <a class="indexterm" name="id324535"></a> 424 424 </p><pre class="screen"> 425 425 <code class="prompt">root# </code> chkconfig smb on … … 428 428 <code class="prompt">root# </code> /etc/rc.d/init.d/cups restart 429 429 </pre><p> 430 </p></li></ol></div><div class="example"><a name="charity-smbconfnew"></a><p class="title"><b>Example 1.2. Charity Administration Office <code class="filename">smb.conf</code> New-style File</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global Parameters - Newer Configuration</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2552530"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2552540"></a><em class="parameter"><code>printing = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2552551"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2552561"></a><em class="parameter"><code>map to guest = Bad User</code></em></td></tr><tr><td><a class="indexterm" name="id2552572"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2552582"></a><em class="parameter"><code>wins support = yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[FTMFILES]</code></em></td></tr><tr><td><a class="indexterm" name="id2552601"></a><em class="parameter"><code>comment = Funds Tracking & Management Files</code></em></td></tr><tr><td><a class="indexterm" name="id2552612"></a><em class="parameter"><code>path = /data/ftmfiles</code></em></td></tr><tr><td><a class="indexterm" name="id2552623"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2552633"></a><em class="parameter"><code>force user = abmas</code></em></td></tr><tr><td><a class="indexterm" name="id2552644"></a><em class="parameter"><code>force group = office</code></em></td></tr><tr><td><a class="indexterm" name="id2552654"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2552664"></a><em class="parameter"><code>nt acl support = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[office]</code></em></td></tr><tr><td><a class="indexterm" name="id2552683"></a><em class="parameter"><code>comment = General Office Files</code></em></td></tr><tr><td><a class="indexterm" name="id2552694"></a><em class="parameter"><code>path = /data/officefiles</code></em></td></tr><tr><td><a class="indexterm" name="id2552704"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2552714"></a><em class="parameter"><code>force user = abmas</code></em></td></tr><tr><td><a class="indexterm" name="id2552725"></a><em class="parameter"><code>force group = office</code></em></td></tr><tr><td><a class="indexterm" name="id2552735"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2552746"></a><em class="parameter"><code>nt acl support = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2552764"></a><em class="parameter"><code>comment = Print Temporary Spool Configuration</code></em></td></tr><tr><td><a class="indexterm" name="id2552776"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2552786"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2552796"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2552807"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2552817"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="charity-smbconf"></a><p class="title"><b>Example 1.3. Charity Administration Office <code class="filename">smb.conf</code> Old-style File</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global Parameters - Older Style Configuration</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2552859"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id2552869"></a><em class="parameter"><code>security = SHARE</code></em></td></tr><tr><td><a class="indexterm" name="id2552880"></a><em class="parameter"><code>printing = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2552890"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2552901"></a><em class="parameter"><code>disable spoolss = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2552911"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2552921"></a><em class="parameter"><code>wins support = yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[FTMFILES]</code></em></td></tr><tr><td><a class="indexterm" name="id2552940"></a><em class="parameter"><code>comment = Funds Tracking & Management Files</code></em></td></tr><tr><td><a class="indexterm" name="id2552952"></a><em class="parameter"><code>path = /data/ftmfiles</code></em></td></tr><tr><td><a class="indexterm" name="id2552962"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2552972"></a><em class="parameter"><code>force user = abmas</code></em></td></tr><tr><td><a class="indexterm" name="id2552983"></a><em class="parameter"><code>force group = office</code></em></td></tr><tr><td><a class="indexterm" name="id2552993"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2553004"></a><em class="parameter"><code>nt acl support = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[office]</code></em></td></tr><tr><td><a class="indexterm" name="id2553022"></a><em class="parameter"><code>comment = General Office Files</code></em></td></tr><tr><td><a class="indexterm" name="id2553033"></a><em class="parameter"><code>path = /data/officefiles</code></em></td></tr><tr><td><a class="indexterm" name="id2553043"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2553054"></a><em class="parameter"><code>force user = abmas</code></em></td></tr><tr><td><a class="indexterm" name="id2553064"></a><em class="parameter"><code>force group = office</code></em></td></tr><tr><td><a class="indexterm" name="id2553074"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2553085"></a><em class="parameter"><code>nt acl support = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2553104"></a><em class="parameter"><code>comment = Print Temporary Spool Configuration</code></em></td></tr><tr><td><a class="indexterm" name="id2553115"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2553125"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2553136"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2553146"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2553157"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="procedure"><a name="id2553168"></a><p class="title"><b>Procedure 1.4. Windows Client Configuration</b></p><ol type="1"><li><p>430 </p></li></ol></div><div class="example"><a name="charity-smbconfnew"></a><p class="title"><b>Example 1.2. Charity Administration Office <code class="filename">smb.conf</code> New-style File</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global Parameters - Newer Configuration</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id324598"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id324609"></a><em class="parameter"><code>printing = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id324619"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id324630"></a><em class="parameter"><code>map to guest = Bad User</code></em></td></tr><tr><td><a class="indexterm" name="id324640"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id324650"></a><em class="parameter"><code>wins support = yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[FTMFILES]</code></em></td></tr><tr><td><a class="indexterm" name="id324669"></a><em class="parameter"><code>comment = Funds Tracking & Management Files</code></em></td></tr><tr><td><a class="indexterm" name="id324680"></a><em class="parameter"><code>path = /data/ftmfiles</code></em></td></tr><tr><td><a class="indexterm" name="id324690"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id324700"></a><em class="parameter"><code>force user = abmas</code></em></td></tr><tr><td><a class="indexterm" name="id324711"></a><em class="parameter"><code>force group = office</code></em></td></tr><tr><td><a class="indexterm" name="id324721"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id324732"></a><em class="parameter"><code>nt acl support = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[office]</code></em></td></tr><tr><td><a class="indexterm" name="id324750"></a><em class="parameter"><code>comment = General Office Files</code></em></td></tr><tr><td><a class="indexterm" name="id324761"></a><em class="parameter"><code>path = /data/officefiles</code></em></td></tr><tr><td><a class="indexterm" name="id324771"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id324782"></a><em class="parameter"><code>force user = abmas</code></em></td></tr><tr><td><a class="indexterm" name="id324792"></a><em class="parameter"><code>force group = office</code></em></td></tr><tr><td><a class="indexterm" name="id324802"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id324813"></a><em class="parameter"><code>nt acl support = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id324832"></a><em class="parameter"><code>comment = Print Temporary Spool Configuration</code></em></td></tr><tr><td><a class="indexterm" name="id324842"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id324852"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id324863"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id324873"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id324884"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="charity-smbconf"></a><p class="title"><b>Example 1.3. Charity Administration Office <code class="filename">smb.conf</code> Old-style File</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global Parameters - Older Style Configuration</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id324924"></a><em class="parameter"><code>workgroup = MIDEARTH</code></em></td></tr><tr><td><a class="indexterm" name="id324935"></a><em class="parameter"><code>security = SHARE</code></em></td></tr><tr><td><a class="indexterm" name="id324945"></a><em class="parameter"><code>printing = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id324956"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id324966"></a><em class="parameter"><code>disable spoolss = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id324976"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id324987"></a><em class="parameter"><code>wins support = yes</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[FTMFILES]</code></em></td></tr><tr><td><a class="indexterm" name="id325006"></a><em class="parameter"><code>comment = Funds Tracking & Management Files</code></em></td></tr><tr><td><a class="indexterm" name="id325016"></a><em class="parameter"><code>path = /data/ftmfiles</code></em></td></tr><tr><td><a class="indexterm" name="id325026"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id325037"></a><em class="parameter"><code>force user = abmas</code></em></td></tr><tr><td><a class="indexterm" name="id325047"></a><em class="parameter"><code>force group = office</code></em></td></tr><tr><td><a class="indexterm" name="id325058"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id325068"></a><em class="parameter"><code>nt acl support = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[office]</code></em></td></tr><tr><td><a class="indexterm" name="id325087"></a><em class="parameter"><code>comment = General Office Files</code></em></td></tr><tr><td><a class="indexterm" name="id325097"></a><em class="parameter"><code>path = /data/officefiles</code></em></td></tr><tr><td><a class="indexterm" name="id325108"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id325118"></a><em class="parameter"><code>force user = abmas</code></em></td></tr><tr><td><a class="indexterm" name="id325128"></a><em class="parameter"><code>force group = office</code></em></td></tr><tr><td><a class="indexterm" name="id325139"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id325149"></a><em class="parameter"><code>nt acl support = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id325168"></a><em class="parameter"><code>comment = Print Temporary Spool Configuration</code></em></td></tr><tr><td><a class="indexterm" name="id325178"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id325189"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id325199"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id325210"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id325220"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"><div class="procedure" title="Procedure 1.4. Windows Client Configuration"><a name="id325232"></a><p class="title"><b>Procedure 1.4. Windows Client Configuration</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 431 431 Configure clients to the network settings shown in <a class="link" href="simple.html#charitynet" title="Figure 1.1. Charity Administration Office Network">“Charity Administration Office Network”</a>. 432 </p></li><li ><p>432 </p></li><li class="step" title="Step 2"><p> 433 433 Ensure that the netmask used on the Windows clients matches that used 434 434 for the Samba server. All clients must have the same netmask, such as 435 435 <code class="constant">255.255.255.0</code>. 436 </p></li><li ><p>437 <a class="indexterm" name="id 2553202"></a>436 </p></li><li class="step" title="Step 3"><p> 437 <a class="indexterm" name="id325264"></a> 438 438 On all Windows clients, set the WINS Server address to <code class="constant">192.168.1.1</code>, 439 439 the IP address of the server. 440 </p></li><li ><p>440 </p></li><li class="step" title="Step 4"><p> 441 441 Set the workgroup name on all clients to <code class="constant">MIDEARTH</code>. 442 </p></li><li ><p>443 <a class="indexterm" name="id 2553230"></a>444 Install the “<span class="quote">Client for Microsoft Networks.</span>”Ensure that the only option445 enabled in its properties is the option “<span class="quote">Logon and restore network connections.</span>”446 </p></li><li ><p>442 </p></li><li class="step" title="Step 5"><p> 443 <a class="indexterm" name="id325290"></a> 444 Install the <span class="quote">“<span class="quote">Client for Microsoft Networks.</span>”</span> Ensure that the only option 445 enabled in its properties is the option <span class="quote">“<span class="quote">Logon and restore network connections.</span>”</span> 446 </p></li><li class="step" title="Step 6"><p> 447 447 Click <span class="guibutton">OK</span> when you are prompted to reboot the system. Reboot the 448 448 system, then log on using any username and password you choose. 449 </p></li><li ><p>450 <a class="indexterm" name="id 2553265"></a>449 </p></li><li class="step" title="Step 7"><p> 450 <a class="indexterm" name="id325322"></a> 451 451 Verify on each client that the machine called <code class="constant">SERVER</code> 452 452 is visible in <span class="guimenu">My Network Places</span>, that it is 453 453 possible to connect to it and see the share <span class="guimenuitem">office</span>, 454 454 and that it is possible to open that share to reveal its contents. 455 </p></li><li ><p>456 <a class="indexterm" name="id 2553295"></a>457 <a class="indexterm" name="id 2553301"></a>455 </p></li><li class="step" title="Step 8"><p> 456 <a class="indexterm" name="id325350"></a> 457 <a class="indexterm" name="id325356"></a> 458 458 Disable password caching on all Windows 9x/Me machines using the registry change file 459 459 shown in <a class="link" href="simple.html#MEreg" title="Example 1.4. Windows Me Registry Edit File: Disable Password Caching">“Windows Me Registry Edit File: Disable Password Caching”</a>. Be sure to remove all files that have the … … 472 472 C:\WINDOWS: regedit ME-dpwc.reg 473 473 </pre><p> 474 </p></li><li ><p>474 </p></li><li class="step" title="Step 9"><p> 475 475 Instruct all users to log onto the workstation using a name and password of their own 476 476 choosing. The Samba server has been 477 477 configured to ignore the username and password given. 478 </p></li><li ><p>478 </p></li><li class="step" title="Step 10"><p> 479 479 On each Windows Me workstation, configure a network drive mapping to drive <code class="filename">G:</code> 480 480 that redirects to the uniform naming convention (UNC) resource 481 481 <code class="filename">\\server\office</code>. Make this a permanent drive connection: 482 </p><div class="procedure"><ol type="1"><li><p>482 </p><div class="procedure"><ol class="procedure" type="1"><li class="step" title="Step 10.1"><p> 483 483 Right-click <span class="guimenu">My Network</span> → <span class="guimenuitem">Map Network Drive...</span> 484 </p></li><li ><p>485 In the box labeled “<span class="quote">Drive:</span>”, type G.486 </p></li><li ><p>487 In the box labeled “<span class="quote">Path:</span>”, enter484 </p></li><li class="step" title="Step 10.2"><p> 485 In the box labeled <span class="quote">“<span class="quote">Drive:</span>”</span>, type G. 486 </p></li><li class="step" title="Step 10.3"><p> 487 In the box labeled <span class="quote">“<span class="quote">Path:</span>”</span>, enter 488 488 <code class="filename">\\server\officefiles</code>. 489 </p></li><li ><p>489 </p></li><li class="step" title="Step 10.4"><p> 490 490 Click <span class="guimenuitem">Reconnect at logon</span>. 491 491 Click <span class="guibutton">OK</span>. 492 </p></li></ol></div></li><li ><p>492 </p></li></ol></div></li><li class="step" title="Step 11"><p> 493 493 On each workstation, install the FTM software following the 494 494 manufacturer's instructions. 495 </p><div class="procedure"><ol type="1"><li><p>495 </p><div class="procedure"><ol class="procedure" type="1"><li class="step" title="Step 11.1"><p> 496 496 During installation, you are prompted for the name of the Windows 98 497 497 server. Enter the name <code class="constant">SERVER</code>. 498 </p></li><li ><p>498 </p></li><li class="step" title="Step 11.2"><p> 499 499 You are prompted for the name of the data share. 500 500 The prompt defaults to <code class="constant">FTMFILES</code>. Press enter to accept the default value. 501 </p></li><li ><p>501 </p></li><li class="step" title="Step 11.3"><p> 502 502 You are now prompted for the print queue name. The default prompt is the name of 503 503 the server you entered (<code class="constant">SERVER</code> as follows: 504 504 <code class="constant">\\SERVER\PRINTQ</code>). Simply accept the default and press enter to 505 505 continue. The software now completes the installation. 506 </p></li></ol></div></li><li ><p>506 </p></li></ol></div></li><li class="step" title="Step 12"><p> 507 507 Install an office automation software package of the customer's choice. Either Microsoft 508 508 Office 2003 Standard or OpenOffice 1.1.0 suffices for any functions the office may 509 509 need to perform. Repeat this on each workstation. 510 </p></li><li ><p>510 </p></li><li class="step" title="Step 13"><p> 511 511 Install a printer on each workstation using the following steps: 512 </p><div class="procedure"><ol type="1"><li><p>512 </p><div class="procedure"><ol class="procedure" type="1"><li class="step" title="Step 13.1"><p> 513 513 Click <span class="guimenu">Start</span> → <span class="guimenuitem">Settings</span> → <span class="guimenuitem">Printers</span>+<span class="guiicon">Add Printer</span>+<span class="guibutton">Next</span>. Do not click <span class="guimenuitem">Network printer</span>. 514 514 Ensure that <span class="guimenuitem">Local printer</span> is selected. 515 </p></li><li ><p>515 </p></li><li class="step" title="Step 13.2"><p> 516 516 Click <span class="guibutton">Next</span>. In the Manufacturer: panel, select 517 517 <code class="constant">HP</code>. In the Printers: panel, select the printer called 518 518 <code class="constant">HP LaserJet 5/5M Postscript</code>. Click <span class="guibutton">Next</span>. 519 </p></li><li ><p>519 </p></li><li class="step" title="Step 13.3"><p> 520 520 In the Available ports: panel, select <code class="constant">FILE:</code>. Accept the 521 521 default printer name by clicking <span class="guibutton">Next</span>. When asked, 522 “<span class="quote">Would you like to print a test page?</span>”, click522 <span class="quote">“<span class="quote">Would you like to print a test page?</span>”</span>, click 523 523 <span class="guimenuitem">No</span>. Click <span class="guibutton">Finish</span>. 524 </p></li><li ><p>524 </p></li><li class="step" title="Step 13.4"><p> 525 525 You may be prompted for the name of a file to print to. If so, close the 526 526 dialog panel. Right-click <span class="guiicon">HP LaserJet 5/5M Postscript</span> → <span class="guimenuitem">Properties</span> → <span class="guisubmenu">Details (Tab)</span> → <span class="guimenuitem">Add Port</span>. 527 </p></li><li ><p>527 </p></li><li class="step" title="Step 13.5"><p> 528 528 In the Network panel, enter the name of 529 529 the print queue on the Samba server as follows: <code class="constant">\\SERVER\hplj5</code>. 530 530 Click <span class="guibutton">OK</span>+<span class="guibutton">OK</span> to complete the installation. 531 </p></li><li ><p>531 </p></li><li class="step" title="Step 13.6"><p> 532 532 It is a good idea to test the functionality of the complete installation before 533 533 handing the newly configured network over to the Charity Administration Office 534 534 for production use. 535 </p></li></ol></div></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2553705"></a>Validation</h4></div></div></div><p>535 </p></li></ol></div></li></ol></div></div><div class="sect3" title="Validation"><div class="titlepage"><div><div><h4 class="title"><a name="id325734"></a>Validation</h4></div></div></div><p> 536 536 Use the same validation process as was followed in <a class="link" href="simple.html#validate1" title="Validation">“Validation”</a>. 537 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="AccountingOffice"></a>Accounting Office</h3></div></div></div><p>537 </p></div></div><div class="sect2" title="Accounting Office"><div class="titlepage"><div><div><h3 class="title"><a name="AccountingOffice"></a>Accounting Office</h3></div></div></div><p> 538 538 Abmas Accounting is a 40-year-old family-run business. There are nine permanent 539 539 computer users. The network clients were upgraded two years ago. All computers run Windows 2000 … … 552 552 on the server. 553 553 </p><p> 554 <a class="indexterm" name="id 2553768"></a>554 <a class="indexterm" name="id325783"></a> 555 555 The new server will run Red Hat Fedora Core2. You should install Samba-3.0.20 and 556 556 copy all files from the old system to the new one. The existing Windows NT4 server has a parallel 557 557 port HP LaserJet 4 printer that is shared by all. The printer driver is installed on each 558 558 workstation. You must not change anything on the workstations. Mr. Meany gave instructions to 559 replace the server, “<span class="quote">but leave everything else alone to avoid staff unrest.</span>”559 replace the server, <span class="quote">“<span class="quote">but leave everything else alone to avoid staff unrest.</span>”</span> 560 560 </p><p> 561 561 You have tried to educate Mr. Meany and found that he has no desire to understand networking. 562 He believes that Windows for Workgroups 3.11 was “<span class="quote">the best server Microsoft ever sold563 </span>” and that Windows NT and 2000 are “<span class="quote">too fang-dangled complex!</span>”564 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2553799"></a>Dissection and Discussion</h4></div></div></div><p>565 <a class="indexterm" name="id 2553807"></a>562 He believes that Windows for Workgroups 3.11 was <span class="quote">“<span class="quote">the best server Microsoft ever sold 563 </span>”</span> and that Windows NT and 2000 are <span class="quote">“<span class="quote">too fang-dangled complex!</span>”</span> 564 </p><div class="sect3" title="Dissection and Discussion"><div class="titlepage"><div><div><h4 class="title"><a name="id325807"></a>Dissection and Discussion</h4></div></div></div><p> 565 <a class="indexterm" name="id325814"></a> 566 566 The requirements of this network installation are not unusual. The staff are not interested in the 567 567 details of networking. Passwords are never changed. In this example solution, we demonstrate the use … … 574 574 You have finished configuring the new hardware and have just completed installation of Red Hat 575 575 Fedora Core2. Roll up your sleeves and let's get to work. 576 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="AcctgNet"></a>Implementation</h4></div></div></div><p>576 </p></div><div class="sect3" title="Implementation"><div class="titlepage"><div><div><h4 class="title"><a name="AcctgNet"></a>Implementation</h4></div></div></div><p> 577 577 The workstations have fixed IP addresses. The old server runs Windows NT4 Workstation, so it 578 578 cannot be running as a WINS server. It is best that the new configuration preserves the same … … 583 583 <a class="link" href="simple.html#acctingnet2" title="Figure 1.2. Accounting Office Network Topology">“Accounting Office Network Topology”</a>. All machines have been configured as indicated prior to the 584 584 start of Samba configuration. The following prescriptive steps may now commence. 585 </p><div class="figure"><a name="acctingnet2"></a><p class="title"><b>Figure 1.2. Accounting Office Network Topology</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/AccountingNetwork.png" width="459" alt="Accounting Office Network Topology"></div></div></div><br class="figure-break"><div class="table"><a name="acctingnet"></a><p class="title"><b>Table 1.1. Accounting Office Network Information</b></p><div class="table-contents"><table summary="Accounting Office Network Information" border="1"><colgroup><col align="left"><col align="left"><col align="left"><col align="left"><col align="left"><col align="left"></colgroup><thead><tr><th align="left">User</th><th align="left">Login-ID</th><th align="left">Password</th><th align="left">Share Name</th><th align="left">Directory</th><th align="left">Wkst</th></tr></thead><tbody><tr><td align="left">Alan Meany</td><td align="left">alan</td><td align="left">alm1961</td><td align="left">alan</td><td align="left">/data</td><td align="left">PC1</td></tr><tr><td align="left">James Meany</td><td align="left">james</td><td align="left">jimm1962</td><td align="left">james</td><td align="left">/data/james</td><td align="left">PC2</td></tr><tr><td align="left">Jeannie Meany</td><td align="left">jeannie</td><td align="left">jema1965</td><td align="left">jeannie</td><td align="left">/data/jeannie</td><td align="left">PC3</td></tr><tr><td align="left">Suzy Millicent</td><td align="left">suzy</td><td align="left">suzy1967</td><td align="left">suzy</td><td align="left">/data/suzy</td><td align="left">PC4</td></tr><tr><td align="left">Ursula Jenning</td><td align="left">ujen</td><td align="left">ujen1974</td><td align="left">ursula</td><td align="left">/data/ursula</td><td align="left">PC5</td></tr><tr><td align="left">Peter Pan</td><td align="left">peter</td><td align="left">pete1984</td><td align="left">peter</td><td align="left">/data/peter</td><td align="left">PC6</td></tr><tr><td align="left">Dale Roland</td><td align="left">dale</td><td align="left">dale1986</td><td align="left">dale</td><td align="left">/data/dale</td><td align="left">PC7</td></tr><tr><td align="left">Bertrand E Paoletti</td><td align="left">eric</td><td align="left">eric1993</td><td align="left">eric</td><td align="left">/data/eric</td><td align="left">PC8</td></tr><tr><td align="left">Russell Lewis</td><td align="left">russ</td><td align="left">russ2001</td><td align="left">russell</td><td align="left">/data/russell</td><td align="left">PC9</td></tr></tbody></table></div></div><br class="table-break"><div class="procedure" ><a name="id2554178"></a><p class="title"><b>Procedure 1.5. Migration from Windows NT4 Workstation System to Samba-3</b></p><ol type="1"><li><p><a class="indexterm" name="id2554188"></a>585 </p><div class="figure"><a name="acctingnet2"></a><p class="title"><b>Figure 1.2. Accounting Office Network Topology</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/AccountingNetwork.png" width="459" alt="Accounting Office Network Topology"></div></div></div><br class="figure-break"><div class="table"><a name="acctingnet"></a><p class="title"><b>Table 1.1. Accounting Office Network Information</b></p><div class="table-contents"><table summary="Accounting Office Network Information" border="1"><colgroup><col align="left"><col align="left"><col align="left"><col align="left"><col align="left"><col align="left"></colgroup><thead><tr><th align="left">User</th><th align="left">Login-ID</th><th align="left">Password</th><th align="left">Share Name</th><th align="left">Directory</th><th align="left">Wkst</th></tr></thead><tbody><tr><td align="left">Alan Meany</td><td align="left">alan</td><td align="left">alm1961</td><td align="left">alan</td><td align="left">/data</td><td align="left">PC1</td></tr><tr><td align="left">James Meany</td><td align="left">james</td><td align="left">jimm1962</td><td align="left">james</td><td align="left">/data/james</td><td align="left">PC2</td></tr><tr><td align="left">Jeannie Meany</td><td align="left">jeannie</td><td align="left">jema1965</td><td align="left">jeannie</td><td align="left">/data/jeannie</td><td align="left">PC3</td></tr><tr><td align="left">Suzy Millicent</td><td align="left">suzy</td><td align="left">suzy1967</td><td align="left">suzy</td><td align="left">/data/suzy</td><td align="left">PC4</td></tr><tr><td align="left">Ursula Jenning</td><td align="left">ujen</td><td align="left">ujen1974</td><td align="left">ursula</td><td align="left">/data/ursula</td><td align="left">PC5</td></tr><tr><td align="left">Peter Pan</td><td align="left">peter</td><td align="left">pete1984</td><td align="left">peter</td><td align="left">/data/peter</td><td align="left">PC6</td></tr><tr><td align="left">Dale Roland</td><td align="left">dale</td><td align="left">dale1986</td><td align="left">dale</td><td align="left">/data/dale</td><td align="left">PC7</td></tr><tr><td align="left">Bertrand E Paoletti</td><td align="left">eric</td><td align="left">eric1993</td><td align="left">eric</td><td align="left">/data/eric</td><td align="left">PC8</td></tr><tr><td align="left">Russell Lewis</td><td align="left">russ</td><td align="left">russ2001</td><td align="left">russell</td><td align="left">/data/russell</td><td align="left">PC9</td></tr></tbody></table></div></div><br class="table-break"><div class="procedure" title="Procedure 1.5. Migration from Windows NT4 Workstation System to Samba-3"><a name="id326171"></a><p class="title"><b>Procedure 1.5. Migration from Windows NT4 Workstation System to Samba-3</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p><a class="indexterm" name="id326181"></a> 586 586 Rename the old server from <code class="constant">CASHPOOL</code> to <code class="constant">STABLE</code> 587 587 by logging onto the console as the <code class="constant">Administrator</code>. Restart the machine 588 588 following system prompts. 589 </p></li><li ><p>589 </p></li><li class="step" title="Step 2"><p> 590 590 Name the new server <code class="constant">CASHPOOL</code> using the standard configuration method. 591 591 Restart the machine following system prompts. 592 </p></li><li ><p>592 </p></li><li class="step" title="Step 3"><p> 593 593 Install the latest Samba-3 binary Red Hat Linux RPM that is available from the 594 594 Samba FTP site. 595 </p></li><li ><p>596 <a class="indexterm" name="id 2554234"></a>597 <a class="indexterm" name="id 2554240"></a>595 </p></li><li class="step" title="Step 4"><p> 596 <a class="indexterm" name="id326223"></a> 597 <a class="indexterm" name="id326230"></a> 598 598 Add a group account for the office to use. Execute the following: 599 599 </p><pre class="screen"> 600 600 <code class="prompt">root# </code> groupadd accts 601 601 </pre><p> 602 </p></li><li ><p>603 Install the <code class="filename">smb.conf</code> file shown<sup>[<a name="id 2554269" href="#ftn.id2554269" class="footnote">4</a>]</sup>602 </p></li><li class="step" title="Step 5"><p> 603 Install the <code class="filename">smb.conf</code> file shown<sup>[<a name="id326258" href="#ftn.id326258" class="footnote">4</a>]</sup> 604 604 in <a class="link" href="simple.html#acctconf" title="Example 1.5. Accounting Office Network smb.conf Old Style Configuration File">“Accounting Office Network smb.conf Old Style Configuration File”</a>. 605 </p></li><li ><p>606 <a class="indexterm" name="id 2554302"></a>607 <a class="indexterm" name="id 2554308"></a>608 <a class="indexterm" name="id 2554314"></a>605 </p></li><li class="step" title="Step 6"><p> 606 <a class="indexterm" name="id326289"></a> 607 <a class="indexterm" name="id326296"></a> 608 <a class="indexterm" name="id326302"></a> 609 609 For each user who uses this system (see <a class="link" href="simple.html#acctingnet" title="Table 1.1. Accounting Office Network Information">“Accounting Office Network Information”</a>), 610 610 execute the following: … … 620 620 Added user "LoginID" 621 621 </pre><p> 622 </p></li><li ><p>623 <a class="indexterm" name="id 2554363"></a>622 </p></li><li class="step" title="Step 7"><p> 623 <a class="indexterm" name="id326344"></a> 624 624 Create the directory structure for the file shares by executing the following: 625 625 </p><pre class="screen"> … … 635 635 </pre><p> 636 636 The data storage structure is now prepared for use. 637 </p></li><li ><p>638 <a class="indexterm" name="id 2554412"></a>637 </p></li><li class="step" title="Step 8"><p> 638 <a class="indexterm" name="id326390"></a> 639 639 Configure the CUPS Print Queues: 640 640 </p><pre class="screen"> … … 642 642 </pre><p> 643 643 This creates the necessary print queues with no assigned print filter. 644 </p></li><li ><p>645 <a class="indexterm" name="id 2554438"></a>646 <a class="indexterm" name="id 2554444"></a>644 </p></li><li class="step" title="Step 9"><p> 645 <a class="indexterm" name="id326414"></a> 646 <a class="indexterm" name="id326420"></a> 647 647 Edit the file <code class="filename">/etc/cups/mime.convs</code> to uncomment the line: 648 648 </p><pre class="screen"> 649 649 application/octet-stream application/vnd.cups-raw 0 - 650 650 </pre><p> 651 </p></li><li ><p>652 <a class="indexterm" name="id 2554468"></a>653 <a class="indexterm" name="id 2554474"></a>651 </p></li><li class="step" title="Step 10"><p> 652 <a class="indexterm" name="id326444"></a> 653 <a class="indexterm" name="id326450"></a> 654 654 Edit the file <code class="filename">/etc/cups/mime.types</code> to uncomment the line: 655 655 </p><pre class="screen"> 656 656 application/octet-stream 657 657 </pre><p> 658 </p></li><li ><p>659 <a class="indexterm" name="id 2554497"></a>658 </p></li><li class="step" title="Step 11"><p> 659 <a class="indexterm" name="id326473"></a> 660 660 Use the standard system tool to start Samba and CUPS to configure them to restart 661 661 automatically at every system reboot. For example, 662 662 </p><p> 663 <a class="indexterm" name="id 2554509"></a>664 <a class="indexterm" name="id 2554516"></a>665 <a class="indexterm" name="id 2554522"></a>663 <a class="indexterm" name="id326484"></a> 664 <a class="indexterm" name="id326490"></a> 665 <a class="indexterm" name="id326497"></a> 666 666 </p><pre class="screen"> 667 667 <code class="prompt">root# </code> chkconfig smb on … … 670 670 <code class="prompt">root# </code> /etc/rc.d/init.d/cups restart 671 671 </pre><p> 672 </p></li><li ><p>672 </p></li><li class="step" title="Step 12"><p> 673 673 On Alan's workstation, use Windows Explorer to migrate the files from the old server 674 674 to the new server. The new server should appear in the <span class="guimenu">Network Neighborhood</span> 675 675 with the name of the old server (<code class="constant">CASHPOOL</code>). 676 </p><div class="procedure"><ol type="1"><li><p>676 </p><div class="procedure"><ol class="procedure" type="1"><li class="step" title="Step 12.1"><p> 677 677 Log on to Alan's workstation as the user <code class="constant">alan</code>. 678 </p></li><li ><p>678 </p></li><li class="step" title="Step 12.2"><p> 679 679 Launch a second instance of Windows Explorer and navigate to the share called 680 680 <span class="guiicon">files</span> on the server called <span class="guimenu">STABLE</span>. 681 </p></li><li ><p>681 </p></li><li class="step" title="Step 12.3"><p> 682 682 Click in the right panel, and press <span class="guimenu">Ctrl-A</span> to select all files and 683 683 directories. Press <span class="guimenu">Ctrl-C</span> to instruct Windows that you wish to 684 684 copy all selected items. 685 </p></li><li ><p>685 </p></li><li class="step" title="Step 12.4"><p> 686 686 Launch the Windows Explorer, and navigate to the share called <span class="guiicon">files</span> 687 687 on the server called <span class="guimenu">CASHPOOL</span>. Click in the right panel, and then press 688 688 <span class="guimenu">Ctrl-V</span> to commence the copying process. 689 </p></li></ol></div></li><li ><p>689 </p></li></ol></div></li><li class="step" title="Step 13"><p> 690 690 Verify that the files are being copied correctly from the Windows NT4 machine to the Samba-3 server. 691 691 This is best done on the Samba-3 server. Check the contents of the directory tree under … … 704 704 <code class="prompt">root# </code> chmod -R ug+rwxs,o-r+x /data 705 705 </pre><p> 706 </p></li><li ><p>706 </p></li><li class="step" title="Step 14"><p> 707 707 The migration of all data should now be complete. It is time to validate the installation. 708 708 For this, you should make sure all applications, including printing, work before asking the 709 709 customer to test drive the new network. 710 </p></li></ol></div><div class="example"><a name="acctconf"></a><p class="title"><b>Example 1.5. Accounting Office Network <code class="filename">smb.conf</code> Old Style Configuration File</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2554750"></a><em class="parameter"><code>workgroup = BILLMORE</code></em></td></tr><tr><td><a class="indexterm" name="id2554761"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2554771"></a><em class="parameter"><code>disable spoolss = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2554781"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2554792"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[files]</code></em></td></tr><tr><td><a class="indexterm" name="id2554811"></a><em class="parameter"><code>comment = Work area files</code></em></td></tr><tr><td><a class="indexterm" name="id2554822"></a><em class="parameter"><code>path = /data/%U</code></em></td></tr><tr><td><a class="indexterm" name="id2554832"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[master]</code></em></td></tr><tr><td><a class="indexterm" name="id2554851"></a><em class="parameter"><code>comment = Master work area files</code></em></td></tr><tr><td><a class="indexterm" name="id2554862"></a><em class="parameter"><code>path = /data</code></em></td></tr><tr><td><a class="indexterm" name="id2554872"></a><em class="parameter"><code>valid users = alan</code></em></td></tr><tr><td><a class="indexterm" name="id2554883"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2554902"></a><em class="parameter"><code>comment = Print Temporary Spool Configuration</code></em></td></tr><tr><td><a class="indexterm" name="id2554913"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2554923"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2554934"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2554944"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2554954"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2554969"></a>Questions and Answers</h2></div></div></div><p>710 </p></li></ol></div><div class="example"><a name="acctconf"></a><p class="title"><b>Example 1.5. Accounting Office Network <code class="filename">smb.conf</code> Old Style Configuration File</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id326708"></a><em class="parameter"><code>workgroup = BILLMORE</code></em></td></tr><tr><td><a class="indexterm" name="id326718"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id326729"></a><em class="parameter"><code>disable spoolss = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id326739"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id326750"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[files]</code></em></td></tr><tr><td><a class="indexterm" name="id326768"></a><em class="parameter"><code>comment = Work area files</code></em></td></tr><tr><td><a class="indexterm" name="id326779"></a><em class="parameter"><code>path = /data/%U</code></em></td></tr><tr><td><a class="indexterm" name="id326789"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[master]</code></em></td></tr><tr><td><a class="indexterm" name="id326808"></a><em class="parameter"><code>comment = Master work area files</code></em></td></tr><tr><td><a class="indexterm" name="id326818"></a><em class="parameter"><code>path = /data</code></em></td></tr><tr><td><a class="indexterm" name="id326829"></a><em class="parameter"><code>valid users = alan</code></em></td></tr><tr><td><a class="indexterm" name="id326839"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id326858"></a><em class="parameter"><code>comment = Print Temporary Spool Configuration</code></em></td></tr><tr><td><a class="indexterm" name="id326868"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id326879"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id326889"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id326900"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id326910"></a><em class="parameter"><code>browseable = No</code></em></td></tr></table></div></div><br class="example-break"></div></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id326925"></a>Questions and Answers</h2></div></div></div><p> 711 711 The following questions and answers draw from the examples in this chapter. 712 712 Many design decisions are impacted by the configurations chosen. The intent 713 713 is to expose some of the hidden implications. 714 </p><div class="qandaset" ><dl><dt> <a href="simple.html#id2554987">714 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id326935"></a><dl><dt> <a href="simple.html#id326941"> 715 715 What makes an anonymous Samba server more simple than a non-anonymous Samba server? 716 </a></dt><dt> <a href="simple.html#id 2555013">716 </a></dt><dt> <a href="simple.html#id326964"> 717 717 How is the operation of the parameter force user different from 718 718 setting the root directory of the share SUID? 719 </a></dt><dt> <a href="simple.html#id 2555064">719 </a></dt><dt> <a href="simple.html#id327008"> 720 720 When would you both use the per share parameter force user and set 721 721 the share root directory SUID? 722 </a></dt><dt> <a href="simple.html#id 2555091">722 </a></dt><dt> <a href="simple.html#id327031"> 723 723 What is better about CUPS printing than LPRng printing? 724 </a></dt><dt> <a href="simple.html#id 2555135">724 </a></dt><dt> <a href="simple.html#id327065"> 725 725 When should Windows client IP addresses be hard-coded? 726 </a></dt><dt> <a href="simple.html#id 2555161">726 </a></dt><dt> <a href="simple.html#id327086"> 727 727 Under what circumstances is it best to use a DHCP server? 728 </a></dt><dt> <a href="simple.html#id 2555200">728 </a></dt><dt> <a href="simple.html#id327117"> 729 729 What is the purpose of setting the parameter guest ok on a share? 730 </a></dt><dt> <a href="simple.html#id 2555224">730 </a></dt><dt> <a href="simple.html#id327140"> 731 731 When would you set the global parameter disable spoolss? 732 </a></dt><dt> <a href="simple.html#id 2555310">732 </a></dt><dt> <a href="simple.html#id327209"> 733 733 Why would you disable password caching on Windows 9x/Me clients? 734 </a></dt><dt> <a href="simple.html#id 2555334">734 </a></dt><dt> <a href="simple.html#id327230"> 735 735 The example of Abmas Accounting uses User Mode security. How does this provide anonymous access? 736 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2554987"></a><a name="id2554989"></a></td><td align="left" valign="top"><p>736 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id326941"></a><a name="id326943"></a></td><td align="left" valign="top"><p> 737 737 What makes an anonymous Samba server more simple than a non-anonymous Samba server? 738 738 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 741 741 UNIX system and to the Samba configuration. Non-anonymous servers require additional 742 742 administration. 743 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2555013"></a><a name="id2555015"></a></td><td align="left" valign="top"><p>743 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id326964"></a><a name="id326966"></a></td><td align="left" valign="top"><p> 744 744 How is the operation of the parameter <em class="parameter"><code>force user</code></em> different from 745 745 setting the root directory of the share SUID? … … 755 755 The parameter <em class="parameter"><code>force user</code></em> has potential security implications that go 756 756 beyond the actual share root directory. Be careful and wary of using this parameter. 757 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2555064"></a><a name="id2555066"></a></td><td align="left" valign="top"><p>757 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id327008"></a><a name="id327010"></a></td><td align="left" valign="top"><p> 758 758 When would you both use the per share parameter <em class="parameter"><code>force user</code></em> and set 759 759 the share root directory SUID? … … 762 762 are conducted as the forced user, while all file and directory creation are done as the SUID 763 763 directory owner. 764 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2555091"></a><a name="id2555093"></a></td><td align="left" valign="top"><p>764 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id327031"></a><a name="id327034"></a></td><td align="left" valign="top"><p> 765 765 What is better about CUPS printing than LPRng printing? 766 766 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 780 780 Which spooling system is better is a matter of personal taste. It depends on what you want to do and how you want to 781 781 do it and manage it. Most modern Linux systems ship with CUPS as the default print management system. 782 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2555135"></a><a name="id2555137"></a></td><td align="left" valign="top"><p>782 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id327065"></a><a name="id327067"></a></td><td align="left" valign="top"><p> 783 783 When should Windows client IP addresses be hard-coded? 784 784 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 789 789 for a DHCP server. This reduces maintenance overheads and eliminates a possible point of network 790 790 failure. 791 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2555161"></a><a name="id2555163"></a></td><td align="left" valign="top"><p>791 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id327086"></a><a name="id327088"></a></td><td align="left" valign="top"><p> 792 792 Under what circumstances is it best to use a DHCP server? 793 793 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 805 805 assigned IP addresses with the DNS server. The benefits of Dynamic DNS (DDNS) are considerable in 806 806 a large Windows network environment. 807 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2555200"></a><a name="id2555202"></a></td><td align="left" valign="top"><p>807 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id327117"></a><a name="id327119"></a></td><td align="left" valign="top"><p> 808 808 What is the purpose of setting the parameter <em class="parameter"><code>guest ok</code></em> on a share? 809 809 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 810 810 If this parameter is set to yes for a service, then no password is required to connect to the service. 811 811 Privileges are those of the guest account. 812 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2555224"></a><a name="id2555226"></a></td><td align="left" valign="top"><p>812 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id327140"></a><a name="id327142"></a></td><td align="left" valign="top"><p> 813 813 When would you set the global parameter <em class="parameter"><code>disable spoolss</code></em>? 814 814 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 831 831 access rights associated with the logged on user. If the user possesses local administrator rights but not root 832 832 privilege on the Samba host (often the case), the <em class="parameter"><code>OpenPrinterEx()</code></em> call fails. The result is 833 that the client now displays an “<span class="quote">Access Denied; Unable to connect</span>”message in the printer queue window833 that the client now displays an <span class="quote">“<span class="quote">Access Denied; Unable to connect</span>”</span> message in the printer queue window 834 834 (even though jobs may be printed successfully). This parameter MUST not be enabled on a print share that has a valid 835 835 print driver installed on the Samba server. 836 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2555310"></a><a name="id2555312"></a></td><td align="left" valign="top"><p>836 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id327209"></a><a name="id327211"></a></td><td align="left" valign="top"><p> 837 837 Why would you disable password caching on Windows 9x/Me clients? 838 838 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 841 841 machine) and decrypted, thus revealing the user's access credentials for all systems the user may have accessed. 842 842 It is most insecure to allow any Windows 9x/Me client to operate with password caching enabled. 843 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2555334"></a><a name="id2555336"></a></td><td align="left" valign="top"><p>843 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id327230"></a><a name="id327232"></a></td><td align="left" valign="top"><p> 844 844 The example of Abmas Accounting uses User Mode security. How does this provide anonymous access? 845 845 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 849 849 password are the same as those set on the Samba server, access is transparent and does not require 850 850 separate user authentication. 851 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id 2550854" href="#id2550854" class="para">1</a>] </sup>The examples given mirror those documented851 </p></td></tr></tbody></table></div></div><div class="footnotes"><br><hr width="100" align="left"><div class="footnote"><p><sup>[<a name="ftn.id323099" href="#id323099" class="para">1</a>] </sup>The examples given mirror those documented 852 852 in The Official Samba-3 HOWTO and Reference Guide, Second Edition (TOSHARG2) Chapter 2, Section 2.3.1. You may gain additional 853 853 insight from the standalone server configurations covered in TOSHARG2, sections 2.3.1.2 through 2.3.1.4. 854 </p></div><div class="footnote"><p><sup>[<a name="ftn.id 2551032" href="#id2551032" class="para">2</a>] </sup>854 </p></div><div class="footnote"><p><sup>[<a name="ftn.id323243" href="#id323243" class="para">2</a>] </sup> 855 855 This information is given purely as an example of how data may be stored in such a way that it 856 856 will be easy to locate records at a later date. The example is not meant to imply any instructions 857 857 that may be construed as essential to the design of the solution; this is something you will almost 858 certainly want to determine for yourself.</p></div><div class="footnote"><p><sup>[<a name="ftn.id 2552236" href="#id2552236" class="para">3</a>] </sup>The Official Samba-3 HOWTO and859 Reference Guide, Chapter 15, File, Directory and Share Access Controls.</p></div><div class="footnote"><p><sup>[<a name="ftn.id 2554269" href="#id2554269" class="para">4</a>] </sup>This example uses the858 certainly want to determine for yourself.</p></div><div class="footnote"><p><sup>[<a name="ftn.id324318" href="#id324318" class="para">3</a>] </sup>The Official Samba-3 HOWTO and 859 Reference Guide, Chapter 15, File, Directory and Share Access Controls.</p></div><div class="footnote"><p><sup>[<a name="ftn.id326258" href="#id326258" class="para">4</a>] </sup>This example uses the 860 860 <em class="parameter"><code>smbpasswd</code></em> file in an obtuse way, since the use of 861 861 the <em class="parameter"><code>passdb backend</code></em> has not been specified in the <code class="filename">smb.conf</code> -
trunk/server/docs/htmldocs/Samba3-ByExample/small.html
r414 r599 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 2. Small Office Networking</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 4.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="simple.html" title="Chapter 1. No-Frills Samba Servers"><link rel="next" href="secure.html" title="Chapter 3. Secure Office Networking"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 2. Small Office Networking</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="simple.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="secure.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="small"></a>Chapter 2. Small Office Networking</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="small.html#id2555439">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2555462">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2555522">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2555570">Technical Issues</a></span></dt><dt><span class="sect2"><a href="small.html#id2555768">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2555790">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id2557337">Validation</a></span></dt><dt><span class="sect2"><a href="small.html#id2557985">Notebook Computers: A Special Case</a></span></dt><dt><span class="sect2"><a href="small.html#id2558010">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id2558084">Questions and Answers</a></span></dt></dl></div><p>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 2. Small Office Networking</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="ExNetworks.html" title="Part I. Example Network Configurations"><link rel="prev" href="simple.html" title="Chapter 1. No-Frills Samba Servers"><link rel="next" href="secure.html" title="Chapter 3. Secure Office Networking"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 2. Small Office Networking</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="simple.html">Prev</a> </td><th width="60%" align="center">Part I. Example Network Configurations</th><td width="20%" align="right"> <a accesskey="n" href="secure.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 2. Small Office Networking"><div class="titlepage"><div><div><h2 class="title"><a name="small"></a>Chapter 2. Small Office Networking</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="small.html#id327308">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id327326">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id327371">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id327416">Technical Issues</a></span></dt><dt><span class="sect2"><a href="small.html#id327588">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id327606">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="small.html#id329058">Validation</a></span></dt><dt><span class="sect2"><a href="small.html#id329633">Notebook Computers: A Special Case</a></span></dt><dt><span class="sect2"><a href="small.html#id329652">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="small.html#id329716">Questions and Answers</a></span></dt></dl></div><p> 2 2 <a class="link" href="simple.html" title="Chapter 1. No-Frills Samba Servers">“No-Frills Samba Servers”</a> focused on the basics of simple yet effective 3 3 network solutions. Network administrators who take pride in their work … … 9 9 good advice that the following two scenarios illustrate. 10 10 </p><p> 11 <a class="indexterm" name="id 2555395"></a>11 <a class="indexterm" name="id327280"></a> 12 12 In one case the network administrator of a mid-sized company spent three 13 13 months building a new network to replace an old Netware server. What he … … 34 34 new innovations. He always asked the users if a 35 35 particular feature was what they wanted. He asked his boss for a raise 36 and got it. He often told me, “<span class="quote">Always keep a few new tricks up your37 sleeves for when you need them.</span>” Was he smart? You decide. Let's36 and got it. He often told me, <span class="quote">“<span class="quote">Always keep a few new tricks up your 37 sleeves for when you need them.</span>”</span> Was he smart? You decide. Let's 38 38 get on with our next exercise. 39 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2555439"></a>Introduction</h2></div></div></div><p>39 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id327308"></a>Introduction</h2></div></div></div><p> 40 40 Abmas Accounting has grown. Mr. Meany likes you and says he knew you 41 41 were the right person for the job. That's why he asked you to install the … … 48 48 some of the workstations that came with the acquired business and found some machines in need of both 49 49 hardware and software maintenance. 50 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2555462"></a>Assignment Tasks</h3></div></div></div><p>51 <a class="indexterm" name="id 2555469"></a>50 </p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id327326"></a>Assignment Tasks</h3></div></div></div><p> 51 <a class="indexterm" name="id327333"></a> 52 52 Mr. Meany is retiring in 12 months. Before he goes, he wants you to help ensure 53 53 that the business is running efficiently. Many of the new staff want notebook … … 81 81 user accounts from the Windows desktop. That person will be responsible for 82 82 basic operations. 83 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2555522"></a>Dissection and Discussion</h2></div></div></div><p>83 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id327371"></a>Dissection and Discussion</h2></div></div></div><p> 84 84 What are the key requirements in this business example? A quick review indicates 85 85 a need for 86 </p><div class="itemizedlist"><ul type="disc"><li><p>86 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 87 87 Scalability, from 52 to over 100 users in 12 months 88 </p></li><li ><p>88 </p></li><li class="listitem"><p> 89 89 Mobile computing capability 90 <a class="indexterm" name="id 2555543"></a>91 </p></li><li ><p>90 <a class="indexterm" name="id327391"></a> 91 </p></li><li class="listitem"><p> 92 92 Improved reliability and usability 93 </p></li><li ><p>93 </p></li><li class="listitem"><p> 94 94 Easier administration 95 95 </p></li></ul></div><p> … … 97 97 (as in <a class="link" href="simple.html#AccountingOffice" title="Accounting Office">“Accounting Office”</a>). 98 98 99 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2555570"></a>Technical Issues</h3></div></div></div><p>100 <a class="indexterm" name="id 2555577"></a>101 <a class="indexterm" name="id 2555584"></a>102 <a class="indexterm" name="id 2555590"></a>103 <a class="indexterm" name="id 2555596"></a>104 <a class="indexterm" name="id 2555602"></a>99 </p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id327416"></a>Technical Issues</h3></div></div></div><p> 100 <a class="indexterm" name="id327424"></a> 101 <a class="indexterm" name="id327430"></a> 102 <a class="indexterm" name="id327436"></a> 103 <a class="indexterm" name="id327443"></a> 104 <a class="indexterm" name="id327449"></a> 105 105 It is time to implement a domain security environment. You will use the <code class="constant"> 106 106 smbpasswd</code> (default) backend. You should implement a DHCP server. There is no need to … … 111 111 the printer a fixed IP address by way of its Ethernet interface (MAC) address. 112 112 See <a class="link" href="small.html#dhcp01" title="Example 2.2. Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf">“Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf”</a>. 113 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>113 </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 114 114 The <code class="filename">smb.conf</code> file you are creating in this exercise can be used with equal effectiveness 115 115 with Samba-2.2.x series releases. This is deliberate so that in the next chapter it is … … 123 123 other enhancements. It is important that you plan accordingly. 124 124 </p><p> 125 <a class="indexterm" name="id 2555662"></a>125 <a class="indexterm" name="id327498"></a> 126 126 You have split the network into two separate areas. Each has its own Ethernet switch. 127 127 There are 20 users on the accounting network and 32 users on the financial services … … 138 138 hostname name resolution. 139 139 </p><p> 140 <a class="indexterm" name="id 2555692"></a>141 <a class="indexterm" name="id 2555700"></a>140 <a class="indexterm" name="id327521"></a> 141 <a class="indexterm" name="id327530"></a> 142 142 It is necessary to map Windows Domain Groups to UNIX groups. It is 143 143 advisable to also map Windows Local Groups to UNIX groups. Additionally, the two … … 156 156 more information. 157 157 </p><p> 158 <a class="indexterm" name="id 2555755"></a>158 <a class="indexterm" name="id327576"></a> 159 159 Vendor-supplied printer drivers will be installed on each client. The CUPS print 160 160 spooler on the UNIX host will be operated in <code class="constant">raw</code> mode. 161 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2555768"></a>Political Issues</h3></div></div></div><p>161 </p></div><div class="sect2" title="Political Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id327588"></a>Political Issues</h3></div></div></div><p> 162 162 Mr. Meany is an old-school manager. He sets the rules and wants to see compliance. 163 163 He is willing to spend money on things he believes are of value. You need more … … 167 167 supplied with antivirus software? Above all, demonstrate good purchase value and remember 168 168 to make your users happy. 169 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2555790"></a>Implementation</h2></div></div></div><p>170 <a class="indexterm" name="id 2555797"></a>169 </p></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id327606"></a>Implementation</h2></div></div></div><p> 170 <a class="indexterm" name="id327614"></a> 171 171 In this example, the assumption is made that this server is being configured from a clean start. 172 172 The alternate approach could be to demonstrate the migration of the system that is documented … … 176 176 Additionally, a fresh installation makes the example easier to follow. 177 177 </p><p> 178 <a class="indexterm" name="id 2555823"></a>178 <a class="indexterm" name="id327636"></a> 179 179 Each user will be given a home directory on the UNIX system, which will be available as a private 180 180 share. Two additional shares will be created, one for the accounting department and the other for … … 182 182 of group membership. 183 183 </p><p> 184 <a class="indexterm" name="id 2555838"></a>184 <a class="indexterm" name="id327648"></a> 185 185 UNIX group membership is the primary mechanism by which Windows Domain users will be granted 186 186 rights and privileges within the Windows environment. 187 187 </p><p> 188 <a class="indexterm" name="id 2555852"></a>188 <a class="indexterm" name="id327661"></a> 189 189 The user <code class="literal">alanm</code> will be made the owner of all files. This will be preserved 190 190 by setting the sticky bit (set UID/GID) on the top-level directories. 191 191 </p><p> 192 192 </p><div class="figure"><a name="acct2net"></a><p class="title"><b>Figure 2.1. Abmas Accounting 52-User Network Topology</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/acct2net.png" alt="Abmas Accounting 52-User Network Topology"></div></div></div><p><br class="figure-break"> 193 </p><div class="procedure" ><a name="id2555910"></a><p class="title"><b>Procedure 2.1. Server Installation Steps</b></p><ol type="1"><li><p>193 </p><div class="procedure" title="Procedure 2.1. Server Installation Steps"><a name="id327717"></a><p class="title"><b>Procedure 2.1. Server Installation Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 194 194 Using UNIX/Linux system tools, name the server <code class="constant">sleeth</code>. 195 </p></li><li ><p>196 <a class="indexterm" name="id 2555931"></a>195 </p></li><li class="step" title="Step 2"><p> 196 <a class="indexterm" name="id327737"></a> 197 197 Place an entry for the machine <code class="constant">sleeth</code> in the <code class="filename">/etc/hosts</code>. 198 198 The printers are network attached, so there should be entries for the … … 205 205 192.168.2.10 qms 206 206 </pre><p> 207 </p></li><li ><p>207 </p></li><li class="step" title="Step 3"><p> 208 208 Install the Samba-3 binary RPM from the Samba-Team FTP site. 209 </p></li><li ><p>209 </p></li><li class="step" title="Step 4"><p> 210 210 Install the ISC DHCP server using the UNIX/Linux system tools available to you. 211 </p></li><li ><p>212 <a class="indexterm" name="id 2555982"></a>213 <a class="indexterm" name="id 2555988"></a>214 <a class="indexterm" name="id 2555995"></a>215 <a class="indexterm" name="id 2556001"></a>211 </p></li><li class="step" title="Step 5"><p> 212 <a class="indexterm" name="id327784"></a> 213 <a class="indexterm" name="id327791"></a> 214 <a class="indexterm" name="id327797"></a> 215 <a class="indexterm" name="id327803"></a> 216 216 Because Samba will be operating over two network interfaces and clients on each side 217 217 may want to be able to reach clients on the other side, it is imperative that IP forwarding … … 223 223 </pre><p> 224 224 This causes the Linux kernel to forward IP packets so that it acts as a router. 225 </p></li><li ><p>225 </p></li><li class="step" title="Step 6"><p> 226 226 Install the <code class="filename">smb.conf</code> file as shown in <a class="link" href="small.html#acct2conf" title="Example 2.3. Accounting Office Network smb.conf File [globals] Section">“Accounting Office Network smb.conf File [globals] Section”</a> and 227 227 <a class="link" href="small.html#acct3conf" title="Example 2.4. Accounting Office Network smb.conf File Services and Shares Section">“Accounting Office Network smb.conf File Services and Shares Section”</a>. Combine these two examples to form a single 228 228 <code class="filename">/etc/samba/smb.conf</code> file. 229 </p></li><li ><p>230 <a class="indexterm" name="id 2556060"></a>229 </p></li><li class="step" title="Step 7"><p> 230 <a class="indexterm" name="id327856"></a> 231 231 Add the user <code class="literal">root</code> to the Samba password backend: 232 232 </p><pre class="screen"> … … 236 236 <code class="prompt">root# </code> 237 237 </pre><p> 238 <a class="indexterm" name="id 2556089"></a>238 <a class="indexterm" name="id327884"></a> 239 239 This is the Windows Domain Administrator password. Never delete this account from 240 240 the password backend after Windows Domain Groups have been initialized. If you delete 241 241 this account, your system is crippled. You cannot restore this account, 242 242 and your Samba server can no longer be administered. 243 </p></li><li ><p>244 <a class="indexterm" name="id 2556107"></a>243 </p></li><li class="step" title="Step 8"><p> 244 <a class="indexterm" name="id327899"></a> 245 245 Create the username map file to permit the <code class="constant">root</code> account to be called 246 246 <code class="constant">Administrator</code> from the Windows network environment. To do this, create … … 268 268 #### 269 269 </pre><p> 270 </p></li><li ><p>271 <a class="indexterm" name="id 2556147"></a>270 </p></li><li class="step" title="Step 9"><p> 271 <a class="indexterm" name="id327933"></a> 272 272 Create and map Windows Domain Groups to UNIX groups. A sample script is provided in 273 273 <a class="link" href="small.html#initGrps" title="Example 2.1. Script to Map Windows NT Groups to UNIX Groups">“Script to Map Windows NT Groups to UNIX Groups”</a>. Create a file containing this script. We called ours … … 275 275 and then execute the script. Sample output should be as follows: 276 276 277 </p><div class="example"><a name="initGrps"></a><p class="title"><b>Example 2.1. Script to Map Windows NT Groups to UNIX Groups</b></p><div class="example-contents"><a class="indexterm" name="id 2556176"></a><pre class="screen">277 </p><div class="example"><a name="initGrps"></a><p class="title"><b>Example 2.1. Script to Map Windows NT Groups to UNIX Groups</b></p><div class="example-contents"><a class="indexterm" name="id327958"></a><pre class="screen"> 278 278 #!/bin/bash 279 279 # … … 324 324 Users (S-1-5-32-545) -> -1 325 325 </pre><p> 326 </p></li><li ><p>327 <a class="indexterm" name="id 2556254"></a>328 <a class="indexterm" name="id 2556260"></a>329 <a class="indexterm" name="id 2556268"></a>326 </p></li><li class="step" title="Step 10"><p> 327 <a class="indexterm" name="id328022"></a> 328 <a class="indexterm" name="id328029"></a> 329 <a class="indexterm" name="id328037"></a> 330 330 For each user who needs to be given a Windows Domain account, make an entry in the 331 331 <code class="filename">/etc/passwd</code> file as well as in the Samba password backend. … … 333 333 <code class="literal">smbpasswd</code> program to create the Domain user accounts. 334 334 </p><p> 335 <a class="indexterm" name="id 2556293"></a>336 <a class="indexterm" name="id 2556300"></a>337 <a class="indexterm" name="id 2556306"></a>335 <a class="indexterm" name="id328059"></a> 336 <a class="indexterm" name="id328066"></a> 337 <a class="indexterm" name="id328072"></a> 338 338 There are a number of tools for user management under UNIX, such as 339 339 <code class="literal">useradd</code> and <code class="literal">adduser</code>, as well as a plethora of custom 340 340 tools. With the tool of your choice, create a home directory for each user. 341 </p></li><li ><p>341 </p></li><li class="step" title="Step 11"><p> 342 342 Using the preferred tool for your UNIX system, add each user to the UNIX groups created 343 343 previously, as necessary. File system access control will be based on UNIX group membership. 344 </p></li><li ><p>344 </p></li><li class="step" title="Step 12"><p> 345 345 Create the directory mount point for the disk subsystem that is mounted to provide 346 346 data storage for company files. In this case the mount point is indicated in the <code class="filename">smb.conf</code> … … 348 348 file system partition using <code class="literal">mount</code>, 349 349 and make the appropriate changes in <code class="filename">/etc/fstab</code>. 350 </p></li><li ><p>350 </p></li><li class="step" title="Step 13"><p> 351 351 Create the top-level file storage directories are follows: 352 352 </p><pre class="screen"> … … 360 360 share. The directory root of the <code class="literal">accounts</code> share is <code class="filename">/data/accounts</code>. 361 361 The directory root of the <code class="literal">finsvcs</code> share is <code class="filename">/data/finsvcs</code>. 362 </p></li><li ><p>362 </p></li><li class="step" title="Step 14"><p> 363 363 Configure the printers with the IP addresses as shown in <a class="link" href="small.html#acct2net" title="Figure 2.1. Abmas Accounting 52-User Network Topology">“Abmas Accounting 52-User Network Topology”</a>. 364 364 Follow the instructions in the manufacturers' manuals to permit printing to port 9100. 365 365 This allows the CUPS spooler to print using raw mode protocols. 366 <a class="indexterm" name="id 2556450"></a>367 <a class="indexterm" name="id 2556456"></a>368 </p></li><li ><p>369 <a class="indexterm" name="id 2556468"></a>370 <a class="indexterm" name="id 2556477"></a>366 <a class="indexterm" name="id328203"></a> 367 <a class="indexterm" name="id328209"></a> 368 </p></li><li class="step" title="Step 15"><p> 369 <a class="indexterm" name="id328222"></a> 370 <a class="indexterm" name="id328230"></a> 371 371 Configure the CUPS Print Queues as follows: 372 372 </p><pre class="screen"> … … 375 375 <code class="prompt">root# </code> lpadmin -p qms -v socket://192.168.2.10:9100 -E 376 376 </pre><p> 377 <a class="indexterm" name="id 2556508"></a>377 <a class="indexterm" name="id328257"></a> 378 378 This creates the necessary print queues with no assigned print filter. 379 </p></li><li ><p>380 <a class="indexterm" name="id 2556522"></a>381 <a class="indexterm" name="id 2556528"></a>382 <a class="indexterm" name="id 2556534"></a>379 </p></li><li class="step" title="Step 16"><p> 380 <a class="indexterm" name="id328270"></a> 381 <a class="indexterm" name="id328277"></a> 382 <a class="indexterm" name="id328283"></a> 383 383 Edit the file <code class="filename">/etc/cups/mime.convs</code> to uncomment the line: 384 384 </p><pre class="screen"> 385 385 application/octet-stream application/vnd.cups-raw 0 - 386 386 </pre><p> 387 </p></li><li ><p>388 <a class="indexterm" name="id 2556558"></a>387 </p></li><li class="step" title="Step 17"><p> 388 <a class="indexterm" name="id328306"></a> 389 389 Edit the file <code class="filename">/etc/cups/mime.types</code> to uncomment the line: 390 390 </p><pre class="screen"> 391 391 application/octet-stream 392 392 </pre><p> 393 </p></li><li ><p>394 <a class="indexterm" name="id 2556581"></a>393 </p></li><li class="step" title="Step 18"><p> 394 <a class="indexterm" name="id328329"></a> 395 395 Using your favorite system editor, create an <code class="filename">/etc/dhcpd.conf</code> with the 396 396 contents as shown in <a class="link" href="small.html#dhcp01" title="Example 2.2. Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf">“Abmas Accounting DHCP Server Configuration File /etc/dhcpd.conf”</a>. 397 </p><div class="example"><a name="dhcp01"></a><p class="title"><b>Example 2.2. Abmas Accounting DHCP Server Configuration File <code class="filename">/etc/dhcpd.conf</code></b></p><div class="example-contents"><a class="indexterm" name="id 2556614"></a><pre class="screen">397 </p><div class="example"><a name="dhcp01"></a><p class="title"><b>Example 2.2. Abmas Accounting DHCP Server Configuration File <code class="filename">/etc/dhcpd.conf</code></b></p><div class="example-contents"><a class="indexterm" name="id328359"></a><pre class="screen"> 398 398 default-lease-time 86400; 399 399 max-lease-time 172800; … … 439 439 } 440 440 </pre></div></div><p><br class="example-break"> 441 </p></li><li ><p>441 </p></li><li class="step" title="Step 19"><p> 442 442 Use the standard system tool to start Samba and CUPS and configure them to start 443 443 automatically at every system reboot. For example, 444 444 </p><p> 445 <a class="indexterm" name="id 2556658"></a>446 <a class="indexterm" name="id 2556664"></a>447 <a class="indexterm" name="id 2556670"></a>448 <a class="indexterm" name="id 2556676"></a>449 <a class="indexterm" name="id 2556683"></a>445 <a class="indexterm" name="id328392"></a> 446 <a class="indexterm" name="id328398"></a> 447 <a class="indexterm" name="id328404"></a> 448 <a class="indexterm" name="id328411"></a> 449 <a class="indexterm" name="id328417"></a> 450 450 </p><pre class="screen"> 451 451 <code class="prompt">root# </code> chkconfig dhcp on … … 456 456 <code class="prompt">root# </code> /etc/rc.d/init.d/cups restart 457 457 </pre><p> 458 </p></li><li ><p>459 <a class="indexterm" name="id 2556733"></a>460 <a class="indexterm" name="id 2556739"></a>461 <a class="indexterm" name="id 2556748"></a>462 <a class="indexterm" name="id 2556754"></a>463 <a class="indexterm" name="id 2556760"></a>464 <a class="indexterm" name="id 2556766"></a>458 </p></li><li class="step" title="Step 20"><p> 459 <a class="indexterm" name="id328466"></a> 460 <a class="indexterm" name="id328472"></a> 461 <a class="indexterm" name="id328480"></a> 462 <a class="indexterm" name="id328487"></a> 463 <a class="indexterm" name="id328493"></a> 464 <a class="indexterm" name="id328499"></a> 465 465 Configure the name service switch (NSS) to handle WINS-based name resolution. 466 466 Since this system does not use a DNS server, it is safe to remove this option from … … 470 470 hosts: files wins 471 471 </pre><p> 472 </p></li></ol></div><div class="example"><a name="acct2conf"></a><p class="title"><b>Example 2.3. Accounting Office Network <code class="filename">smb.conf</code> File [globals] Section</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2556824"></a><em class="parameter"><code>workgroup = BILLMORE</code></em></td></tr><tr><td><a class="indexterm" name="id2556834"></a><em class="parameter"><code>passwd chat = *New*Password* %n\n*Re-enter*new*password* %n\n *Password*changed*</code></em></td></tr><tr><td><a class="indexterm" name="id2556846"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2556857"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2556867"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2556878"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2556889"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id2556900"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m -G users '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2556911"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2556922"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2556934"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2556945"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -A '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2556956"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2556968"></a><em class="parameter"><code>logon script = scripts\login.bat</code></em></td></tr><tr><td><a class="indexterm" name="id2556979"></a><em class="parameter"><code>logon path = </code></em></td></tr><tr><td><a class="indexterm" name="id2556990"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id2557000"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557011"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557021"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557031"></a><em class="parameter"><code>printing = CUPS</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="acct3conf"></a><p class="title"><b>Example 2.4. Accounting Office Network <code class="filename">smb.conf</code> File Services and Shares Section</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2557072"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2557082"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2557093"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2557103"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2557122"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2557132"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2557143"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557153"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557163"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2557174"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id2557193"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id2557204"></a><em class="parameter"><code>path = /data/%U</code></em></td></tr><tr><td><a class="indexterm" name="id2557214"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2557224"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id2557243"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id2557254"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id2557264"></a><em class="parameter"><code>valid users = %G</code></em></td></tr><tr><td><a class="indexterm" name="id2557274"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[finsrvcs]</code></em></td></tr><tr><td><a class="indexterm" name="id2557293"></a><em class="parameter"><code>comment = Financial Service Files</code></em></td></tr><tr><td><a class="indexterm" name="id2557304"></a><em class="parameter"><code>path = /data/finsrvcs</code></em></td></tr><tr><td><a class="indexterm" name="id2557315"></a><em class="parameter"><code>valid users = %G</code></em></td></tr><tr><td><a class="indexterm" name="id2557325"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2557337"></a>Validation</h3></div></div></div><p>472 </p></li></ol></div><div class="example"><a name="acct2conf"></a><p class="title"><b>Example 2.3. Accounting Office Network <code class="filename">smb.conf</code> File [globals] Section</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id328555"></a><em class="parameter"><code>workgroup = BILLMORE</code></em></td></tr><tr><td><a class="indexterm" name="id328565"></a><em class="parameter"><code>passwd chat = *New*Password* %n\n*Re-enter*new*password* %n\n *Password*changed*</code></em></td></tr><tr><td><a class="indexterm" name="id328576"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id328587"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id328597"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id328607"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id328618"></a><em class="parameter"><code>show add printer wizard = No</code></em></td></tr><tr><td><a class="indexterm" name="id328628"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m -G users '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id328639"></a><em class="parameter"><code>delete user script = /usr/sbin/userdel -r '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id328649"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id328659"></a><em class="parameter"><code>delete group script = /usr/sbin/groupdel '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id328670"></a><em class="parameter"><code>add user to group script = /usr/sbin/usermod -A '%g' '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id328681"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id328692"></a><em class="parameter"><code>logon script = scripts\login.bat</code></em></td></tr><tr><td><a class="indexterm" name="id328702"></a><em class="parameter"><code>logon path = </code></em></td></tr><tr><td><a class="indexterm" name="id328713"></a><em class="parameter"><code>logon drive = X:</code></em></td></tr><tr><td><a class="indexterm" name="id328723"></a><em class="parameter"><code>domain logons = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id328734"></a><em class="parameter"><code>preferred master = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id328744"></a><em class="parameter"><code>wins support = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id328754"></a><em class="parameter"><code>printing = CUPS</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="acct3conf"></a><p class="title"><b>Example 2.4. Accounting Office Network <code class="filename">smb.conf</code> File Services and Shares Section</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id328794"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id328805"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id328815"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id328825"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id328844"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id328855"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id328865"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id328875"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id328886"></a><em class="parameter"><code>use client driver = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id328896"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[netlogon]</code></em></td></tr><tr><td><a class="indexterm" name="id328915"></a><em class="parameter"><code>comment = Network Logon Service</code></em></td></tr><tr><td><a class="indexterm" name="id328925"></a><em class="parameter"><code>path = /data/%U</code></em></td></tr><tr><td><a class="indexterm" name="id328936"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id328946"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[accounts]</code></em></td></tr><tr><td><a class="indexterm" name="id328965"></a><em class="parameter"><code>comment = Accounting Files</code></em></td></tr><tr><td><a class="indexterm" name="id328975"></a><em class="parameter"><code>path = /data/accounts</code></em></td></tr><tr><td><a class="indexterm" name="id328986"></a><em class="parameter"><code>valid users = %G</code></em></td></tr><tr><td><a class="indexterm" name="id328996"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[finsrvcs]</code></em></td></tr><tr><td><a class="indexterm" name="id329015"></a><em class="parameter"><code>comment = Financial Service Files</code></em></td></tr><tr><td><a class="indexterm" name="id329025"></a><em class="parameter"><code>path = /data/finsrvcs</code></em></td></tr><tr><td><a class="indexterm" name="id329036"></a><em class="parameter"><code>valid users = %G</code></em></td></tr><tr><td><a class="indexterm" name="id329046"></a><em class="parameter"><code>read only = No</code></em></td></tr></table></div></div><br class="example-break"><div class="sect2" title="Validation"><div class="titlepage"><div><div><h3 class="title"><a name="id329058"></a>Validation</h3></div></div></div><p> 473 473 Does everything function as it ought? That is the key question at this point. 474 474 Here are some simple steps to validate your Samba server configuration. 475 </p><div class="procedure" ><a name="id2557348"></a><p class="title"><b>Procedure 2.2. Validation Steps</b></p><ol type="1"><li><p>476 <a class="indexterm" name="id 2557358"></a>475 </p><div class="procedure" title="Procedure 2.2. Validation Steps"><a name="id329068"></a><p class="title"><b>Procedure 2.2. Validation Steps</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 476 <a class="indexterm" name="id329078"></a> 477 477 If your <code class="filename">smb.conf</code> file has bogus options or parameters, this may cause Samba 478 478 to refuse to start. The first step should always be to validate the contents … … 520 520 </pre><p> 521 521 Clear away all errors before proceeding, and start or restart samba as necessary. 522 </p></li><li ><p>523 <a class="indexterm" name="id 2557438"></a>524 <a class="indexterm" name="id 2557444"></a>525 <a class="indexterm" name="id 2557450"></a>526 <a class="indexterm" name="id 2557457"></a>522 </p></li><li class="step" title="Step 2"><p> 523 <a class="indexterm" name="id329135"></a> 524 <a class="indexterm" name="id329141"></a> 525 <a class="indexterm" name="id329148"></a> 526 <a class="indexterm" name="id329154"></a> 527 527 Check that the Samba server is running: 528 528 </p><pre class="screen"> … … 540 540 <span class="emphasis"><em>TOSHARG2</em></span>, Chapter 23, Section 23.3. The single instance of 541 541 <code class="literal">smbd</code> is normal. 542 </p></li><li ><p>543 <a class="indexterm" name="id 2557508"></a>542 </p></li><li class="step" title="Step 3"><p> 543 <a class="indexterm" name="id329199"></a> 544 544 Check that an anonymous connection can be made to the Samba server: 545 545 </p><pre class="screen"> … … 569 569 The <code class="constant">-U%</code> argument means to send a <code class="constant">NULL</code> username and 570 570 a <code class="constant">NULL</code> password. 571 </p></li><li ><p>572 <a class="indexterm" name="id 2557558"></a>573 <a class="indexterm" name="id 2557564"></a>574 <a class="indexterm" name="id 2557571"></a>571 </p></li><li class="step" title="Step 4"><p> 572 <a class="indexterm" name="id329241"></a> 573 <a class="indexterm" name="id329247"></a> 574 <a class="indexterm" name="id329254"></a> 575 575 Verify that the printers have the IP addresses assigned in the DHCP server configuration file. 576 576 The easiest way to do this is to ping the printer name. Immediately after the ping response … … 590 590 IP address from which the printer has responded and the entry for it in the 591 591 <code class="filename">/etc/dhcpd.conf</code> file. 592 </p></li><li ><p>593 <a class="indexterm" name="id 2557631"></a>592 </p></li><li class="step" title="Step 5"><p> 593 <a class="indexterm" name="id329307"></a> 594 594 Make an authenticated connection to the server using the <code class="literal">smbclient</code> tool: 595 595 </p><pre class="screen"> … … 608 608 smb: \> q 609 609 </pre><p> 610 </p></li></ol></div></div><div class="procedure" ><a name="id2557680"></a><p class="title"><b>Procedure 2.3. Windows XP Professional Client Configuration</b></p><ol type="1"><li><p>610 </p></li></ol></div></div><div class="procedure" title="Procedure 2.3. Windows XP Professional Client Configuration"><a name="id329344"></a><p class="title"><b>Procedure 2.3. Windows XP Professional Client Configuration</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 611 611 Configure clients to the network settings shown in <a class="link" href="small.html#acct2net" title="Figure 2.1. Abmas Accounting 52-User Network Topology">“Abmas Accounting 52-User Network Topology”</a>. 612 612 All clients use DHCP for TCP/IP protocol stack configuration. 613 <a class="indexterm" name="id 2557698"></a>614 <a class="indexterm" name="id 2557704"></a>613 <a class="indexterm" name="id329359"></a> 614 <a class="indexterm" name="id329366"></a> 615 615 DHCP configures all Windows clients to use the WINS Server address <code class="constant">192.168.1.1</code>. 616 </p></li><li ><p>616 </p></li><li class="step" title="Step 2"><p> 617 617 Join the Windows Domain called <code class="constant">BILLMORE</code>. Use the Domain Administrator 618 618 username <code class="constant">root</code> and the SMB password you assigned to this account. … … 620 620 a Windows Domain is given in <a class="link" href="appendix.html" title="Chapter 15. A Collection of Useful Tidbits">“A Collection of Useful Tidbits”</a>, <a class="link" href="appendix.html#domjoin" title="Joining a Domain: Windows 200x/XP Professional">“Joining a Domain: Windows 200x/XP Professional”</a>. 621 621 Reboot the machine as prompted and then log on using a Domain User account. 622 </p></li><li ><p>622 </p></li><li class="step" title="Step 3"><p> 623 623 Verify on each client that the machine called <code class="constant">SLEETH</code> 624 624 is visible in <span class="guimenu">My Network Places</span>, that it is … … 626 626 and <span class="guimenuitem">finsvcs</span>, 627 627 and that it is possible to open that share to reveal its contents. 628 </p></li><li ><p>628 </p></li><li class="step" title="Step 4"><p> 629 629 Instruct all users to log onto the workstation using their assigned username and password. 630 </p></li><li ><p>630 </p></li><li class="step" title="Step 5"><p> 631 631 Install a printer on each using the following steps: 632 </p><div class="procedure"><ol type="1"><li><p>632 </p><div class="procedure"><ol class="procedure" type="1"><li class="step" title="Step 5.1"><p> 633 633 Click <span class="guimenu">Start</span> → <span class="guimenuitem">Settings</span> → <span class="guimenuitem">Printers</span>+<span class="guiicon">Add Printer</span>+<span class="guibutton">Next</span>. Do not click <span class="guimenuitem">Network printer</span>. 634 634 Ensure that <span class="guimenuitem">Local printer</span> is selected. 635 </p></li><li ><p>635 </p></li><li class="step" title="Step 5.2"><p> 636 636 Click <span class="guibutton">Next</span>. In the 637 637 <span class="guimenuitem">Manufacturer:</span> panel, select <code class="constant">HP</code>. 638 638 In the <span class="guimenuitem">Printers:</span> panel, select the printer called 639 639 <code class="constant">HP LaserJet 4</code>. Click <span class="guibutton">Next</span>. 640 </p></li><li ><p>640 </p></li><li class="step" title="Step 5.3"><p> 641 641 In the <span class="guimenuitem">Available ports:</span> panel, select 642 642 <code class="constant">FILE:</code>. Accept the default printer name by clicking 643 <span class="guibutton">Next</span>. When asked, “<span class="quote">Would you like to print a644 test page?</span>” , click <span class="guimenuitem">No</span>. Click643 <span class="guibutton">Next</span>. When asked, <span class="quote">“<span class="quote">Would you like to print a 644 test page?</span>”</span>, click <span class="guimenuitem">No</span>. Click 645 645 <span class="guibutton">Finish</span>. 646 </p></li><li ><p>646 </p></li><li class="step" title="Step 5.4"><p> 647 647 You may be prompted for the name of a file to print to. If so, close the 648 648 dialog panel. Right-click <span class="guiicon">HP LaserJet 4</span> → <span class="guimenuitem">Properties</span> → <span class="guisubmenu">Details (Tab)</span> → <span class="guimenuitem">Add Port</span>. 649 </p></li><li ><p>649 </p></li><li class="step" title="Step 5.5"><p> 650 650 In the <span class="guimenuitem">Network</span> panel, enter the name of 651 651 the print queue on the Samba server as follows: <code class="constant">\\SERVER\hplj4</code>. 652 652 Click <span class="guibutton">OK</span>+<span class="guibutton">OK</span> to complete the installation. 653 </p></li><li ><p>653 </p></li><li class="step" title="Step 5.6"><p> 654 654 Repeat the printer installation steps above for the HP LaserJet 6 printer 655 655 as well as for the QMS Magicolor XXXX laser printer. 656 </p></li></ol></div></li></ol></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2557985"></a>Notebook Computers: A Special Case</h3></div></div></div><p>656 </p></li></ol></div></li></ol></div><div class="sect2" title="Notebook Computers: A Special Case"><div class="titlepage"><div><div><h3 class="title"><a name="id329633"></a>Notebook Computers: A Special Case</h3></div></div></div><p> 657 657 As a network administrator, you already know how to create local machine accounts for Windows 200x/XP 658 658 Professional systems. This is the preferred solution to provide continuity of work for notebook users … … 664 664 that mean that as the network is more tightly secured, it becomes necessary to modify Windows client 665 665 configuration somewhat. 666 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2558010"></a>Key Points Learned</h3></div></div></div><p>666 </p></div><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id329652"></a>Key Points Learned</h3></div></div></div><p> 667 667 In this network design and implementation exercise, you created a Windows NT4-style Domain 668 668 Controller using Samba-3.0.20. Following these guidelines, you experienced 669 669 and implemented several important aspects of Windows networking. In the next chapter, 670 670 you build on the experience. These are the highlights from this chapter: 671 </p><div class="itemizedlist"><ul type="disc"><li><p>672 <a class="indexterm" name="id 2558030"></a>671 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 672 <a class="indexterm" name="id329669"></a> 673 673 You implemented a DHCP server, and Microsoft Windows clients were able to obtain all necessary 674 674 network configuration settings from this server. 675 </p></li><li ><p>676 <a class="indexterm" name="id 2558043"></a>675 </p></li><li class="listitem"><p> 676 <a class="indexterm" name="id329681"></a> 677 677 You created a Windows Domain Controller. You were able to use the network logon service 678 678 and successfully joined Windows 200x/XP Professional clients to the Domain. 679 </p></li><li ><p>680 <a class="indexterm" name="id 2558057"></a>679 </p></li><li class="listitem"><p> 680 <a class="indexterm" name="id329693"></a> 681 681 You created raw print queues in the CUPS printing system. You maintained a simple 682 682 printing system so that all users can share centrally managed printers. You installed 683 683 native printer drivers on the Windows clients. 684 </p></li><li ><p>684 </p></li><li class="listitem"><p> 685 685 You experienced the benefits of centrally managed user accounts on the server. 686 </p></li><li ><p>686 </p></li><li class="listitem"><p> 687 687 You offered Mobile notebook users a solution that allows them to continue to work 688 688 while away from the office and not connected to the corporate network. 689 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2558084"></a>Questions and Answers</h2></div></div></div><p>689 </p></li></ul></div></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id329716"></a>Questions and Answers</h2></div></div></div><p> 690 690 Your new Domain Controller is ready to serve you. What does it mean? Here are some questions and answers that 691 691 may help. 692 </p><div class="qandaset" ><dl><dt>1. <a href="small.html#id2558097">692 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id329726"></a><dl><dt>1. <a href="small.html#id329728"> 693 693 What is the key benefit of using DHCP to configure Windows client TCP/IP stacks? 694 </a></dt><dt>2. <a href="small.html#id 2558124">694 </a></dt><dt>2. <a href="small.html#id329750"> 695 695 Are there any DHCP server configuration parameters in the /etc/dhcpd.conf 696 696 that should be noted in particular? 697 </a></dt><dt>3. <a href="small.html#id 2558155">697 </a></dt><dt>3. <a href="small.html#id329776"> 698 698 Is it possible to create a Windows Domain account that is specifically called Administrator? 699 </a></dt><dt>4. <a href="small.html#id 2558192">699 </a></dt><dt>4. <a href="small.html#id329810"> 700 700 Why is it necessary to give the Windows Domain Administrator a UNIX UID of 0? 701 </a></dt><dt>5. <a href="small.html#id 2558230">701 </a></dt><dt>5. <a href="small.html#id329843"> 702 702 One of my junior staff needs the ability to add machines to the Domain, but I do not want to give him 703 703 root access. How can we do this? 704 </a></dt><dt>6. <a href="small.html#id 2558270">704 </a></dt><dt>6. <a href="small.html#id329878"> 705 705 Why must I map Windows Domain Groups to UNIX groups? 706 </a></dt><dt>7. <a href="small.html#id 2558306">706 </a></dt><dt>7. <a href="small.html#id329912"> 707 707 I deleted my root account and now I cannot add it back! What can I do? 708 </a></dt><dt>8. <a href="small.html#id 2558373">708 </a></dt><dt>8. <a href="small.html#id329978"> 709 709 When I run net groupmap list, it reports a group called Administrators 710 710 as well as Domain Admins. What is the difference between them? 711 </a></dt><dt>9. <a href="small.html#id 2558418">711 </a></dt><dt>9. <a href="small.html#id330018"> 712 712 What is the effect of changing the name of a Samba server or of changing the Domain name? 713 </a></dt><dt>10. <a href="small.html#id 2558467">713 </a></dt><dt>10. <a href="small.html#id330060"> 714 714 How can I manage user accounts from my Windows XP Professional workstation? 715 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2558097"></a><a name="id2558099"></a><p><b>1.</b></p></td><td align="left" valign="top"><p>715 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question" title="1."><td align="left" valign="top"><a name="id329728"></a><a name="id329730"></a><p><b>1.</b></p></td><td align="left" valign="top"><p> 716 716 What is the key benefit of using DHCP to configure Windows client TCP/IP stacks? 717 717 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 722 722 default routes and DNS server addresses that apply only to the Abmas office environment do 723 723 not interfere with remote operations. This is an extremely important feature of DHCP. 724 </p></td></tr><tr class="question" ><td align="left" valign="top"><a name="id2558124"></a><a name="id2558126"></a><p><b>2.</b></p></td><td align="left" valign="top"><p>724 </p></td></tr><tr class="question" title="2."><td align="left" valign="top"><a name="id329750"></a><a name="id329752"></a><p><b>2.</b></p></td><td align="left" valign="top"><p> 725 725 Are there any DHCP server configuration parameters in the <code class="filename">/etc/dhcpd.conf</code> 726 726 that should be noted in particular? … … 731 731 NetBIOS machine name needs to be resolved to an IP Address. This configuration 732 732 results in far lower UDP broadcast traffic than would be the case if WINS was not used. 733 </p></td></tr><tr class="question" ><td align="left" valign="top"><a name="id2558155"></a><a name="id2558157"></a><p><b>3.</b></p></td><td align="left" valign="top"><p>733 </p></td></tr><tr class="question" title="3."><td align="left" valign="top"><a name="id329776"></a><a name="id329778"></a><p><b>3.</b></p></td><td align="left" valign="top"><p> 734 734 Is it possible to create a Windows Domain account that is specifically called <code class="constant">Administrator</code>? 735 735 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 738 738 necessary to use the <em class="parameter"><code>username map</code></em> facility to map this account to the UNIX 739 739 account called <code class="constant">root</code>. 740 </p></td></tr><tr class="question" ><td align="left" valign="top"><a name="id2558192"></a><a name="id2558194"></a><p><b>4.</b></p></td><td align="left" valign="top"><p>740 </p></td></tr><tr class="question" title="4."><td align="left" valign="top"><a name="id329810"></a><a name="id329812"></a><p><b>4.</b></p></td><td align="left" valign="top"><p> 741 741 Why is it necessary to give the Windows Domain <code class="constant">Administrator</code> a UNIX UID of 0? 742 742 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 748 748 settings within the Domain and on the Samba server, equivalent rights must be assigned. This is 749 749 achieved with the <code class="constant">root</code> UID equal to 0. 750 </p></td></tr><tr class="question" ><td align="left" valign="top"><a name="id2558230"></a><a name="id2558232"></a><p><b>5.</b></p></td><td align="left" valign="top"><p>750 </p></td></tr><tr class="question" title="5."><td align="left" valign="top"><a name="id329843"></a><a name="id329845"></a><p><b>5.</b></p></td><td align="left" valign="top"><p> 751 751 One of my junior staff needs the ability to add machines to the Domain, but I do not want to give him 752 752 <code class="constant">root</code> access. How can we do this? … … 757 757 This must be the primary GID of the account of the user who is a member of the Windows <code class="constant"> 758 758 Domain Admins</code> account. 759 </p></td></tr><tr class="question" ><td align="left" valign="top"><a name="id2558270"></a><a name="id2558272"></a><p><b>6.</b></p></td><td align="left" valign="top"><p>759 </p></td></tr><tr class="question" title="6."><td align="left" valign="top"><a name="id329878"></a><a name="id329880"></a><p><b>6.</b></p></td><td align="left" valign="top"><p> 760 760 Why must I map Windows Domain Groups to UNIX groups? 761 761 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 763 763 has a UNIX group account equivalent. The Domain groups that should be given UNIX equivalents are 764 764 <span class="guimenu">Domain Guests</span>, <span class="guimenu">Domain Users</span>, and <span class="guimenu">Domain Admins</span>. 765 </p></td></tr><tr class="question" ><td align="left" valign="top"><a name="id2558306"></a><a name="id2558308"></a><p><b>7.</b></p></td><td align="left" valign="top"><p>765 </p></td></tr><tr class="question" title="7."><td align="left" valign="top"><a name="id329912"></a><a name="id329914"></a><p><b>7.</b></p></td><td align="left" valign="top"><p> 766 766 I deleted my <code class="constant">root</code> account and now I cannot add it back! What can I do? 767 767 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 768 768 This is a nasty problem. Fortunately, there is a solution. 769 </p><div class="procedure"><ol type="1"><li><p>769 </p><div class="procedure"><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 770 770 Back up your existing configuration files in case you need to restore them. 771 </p></li><li ><p>771 </p></li><li class="step" title="Step 2"><p> 772 772 Rename the <code class="filename">group_mapping.tdb</code> file. 773 </p></li><li ><p>773 </p></li><li class="step" title="Step 3"><p> 774 774 Use the <code class="literal">smbpasswd</code> to add the root account. 775 </p></li><li ><p>775 </p></li><li class="step" title="Step 4"><p> 776 776 Restore the <code class="filename">group_mapping.tdb</code> file. 777 </p></li></ol></div></td></tr><tr class="question" ><td align="left" valign="top"><a name="id2558373"></a><a name="id2558375"></a><p><b>8.</b></p></td><td align="left" valign="top"><p>777 </p></li></ol></div></td></tr><tr class="question" title="8."><td align="left" valign="top"><a name="id329978"></a><a name="id329980"></a><p><b>8.</b></p></td><td align="left" valign="top"><p> 778 778 When I run <code class="literal">net groupmap list</code>, it reports a group called <span class="guimenu">Administrators</span> 779 779 as well as <span class="guimenu">Domain Admins</span>. What is the difference between them? … … 783 783 Groups at this time. A Workstation or Server Local Group has no meaning in a Samba context. This 784 784 may change at some later date. These accounts are provided only so that security objects are correctly shown. 785 </p></td></tr><tr class="question" ><td align="left" valign="top"><a name="id2558418"></a><a name="id2558420"></a><p><b>9.</b></p></td><td align="left" valign="top"><p>785 </p></td></tr><tr class="question" title="9."><td align="left" valign="top"><a name="id330018"></a><a name="id330020"></a><p><b>9.</b></p></td><td align="left" valign="top"><p> 786 786 What is the effect of changing the name of a Samba server or of changing the Domain name? 787 787 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> … … 795 795 or the <code class="literal">smbpasswd</code> (Samba-2.2.x). To change the SID, you use the same tool. Be sure 796 796 to check the man page for this command for detailed instructions regarding the steps involved. 797 </p></td></tr><tr class="question" ><td align="left" valign="top"><a name="id2558467"></a><a name="id2558469"></a><p><b>10.</b></p></td><td align="left" valign="top"><p>797 </p></td></tr><tr class="question" title="10."><td align="left" valign="top"><a name="id330060"></a><a name="id330062"></a><p><b>10.</b></p></td><td align="left" valign="top"><p> 798 798 How can I manage user accounts from my Windows XP Professional workstation? 799 799 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> -
trunk/server/docs/htmldocs/Samba3-ByExample/unixclients.html
r414 r599 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 7. Adding Domain Member Servers and Clients</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 4.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="next" href="upgrades.html" title="Chapter 8. Updating Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 7. Adding Domain Member Servers and Clients</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="DMSMig.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="upgrades.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="unixclients"></a>Chapter 7. Adding Domain Member Servers and Clients</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="unixclients.html#id2589228">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id2589282">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id2589317">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id2589345">Technical Issues</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id2589994">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id2590094">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></span></dt><dt><span class="sect2"><a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></span></dt><dt><span class="sect2"><a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a></span></dt><dt><span class="sect2"><a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id2596343">UNIX/Linux Client Domain Member</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id2596918">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id2596972">Questions and Answers</a></span></dt></dl></div><p><a class="indexterm" name="id2589130"></a><a class="indexterm" name="id2589137"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 7. Adding Domain Member Servers and Clients</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="next" href="upgrades.html" title="Chapter 8. Updating Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 7. Adding Domain Member Servers and Clients</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="DMSMig.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="upgrades.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 7. Adding Domain Member Servers and Clients"><div class="titlepage"><div><div><h2 class="title"><a name="unixclients"></a>Chapter 7. Adding Domain Member Servers and Clients</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="unixclients.html#id357946">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id357994">Assignment Tasks</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id358022">Dissection and Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#id358046">Technical Issues</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id358646">Political Issues</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id358731">Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="unixclients.html#sdcsdmldap">Samba Domain with Samba Domain Member Server Using NSS LDAP</a></span></dt><dt><span class="sect2"><a href="unixclients.html#wdcsdm">NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</a></span></dt><dt><span class="sect2"><a href="unixclients.html#dcwonss">NT4/Samba Domain with Samba Domain Member Server without NSS Support</a></span></dt><dt><span class="sect2"><a href="unixclients.html#adssdm">Active Directory Domain with Samba Domain Member Server</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id364506">UNIX/Linux Client Domain Member</a></span></dt><dt><span class="sect2"><a href="unixclients.html#id365002">Key Points Learned</a></span></dt></dl></dd><dt><span class="sect1"><a href="unixclients.html#id365047">Questions and Answers</a></span></dt></dl></div><p><a class="indexterm" name="id357857"></a><a class="indexterm" name="id357864"></a> 2 2 The most frequently discussed Samba subjects over the past 2 years have focused around domain control and printing. 3 3 It is well known that Samba is a file and print server. A recent survey conducted by <span class="emphasis"><em>Open Magazine</em></span> found … … 12 12 the addition of Samba servers into your present Windows network whatever the controlling technology 13 13 may be. So let's get back to our good friends at Abmas. 14 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2589228"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id2589234"></a><a class="indexterm" name="id2589242"></a>14 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id357946"></a>Introduction</h2></div></div></div><p><a class="indexterm" name="id357952"></a><a class="indexterm" name="id357960"></a> 15 15 Looking back over the achievements of the past year or two, daily events at Abmas are rather straightforward 16 16 with not too many distractions or problems. Your team is doing well, but a number of employees 17 17 are asking for Linux desktop systems. Your network has grown and demands additional domain member servers. Let's 18 18 get on with this; Christine and Stan are ready to go. 19 </p><p><a class="indexterm" name="id 2589263"></a>19 </p><p><a class="indexterm" name="id357978"></a> 20 20 Stan is firmly in control of the department of the future, while Christine is enjoying a stable and 21 21 predictable network environment. It is time to add more servers and to add Linux desktops. It is 22 22 time to meet the demands of future growth and endure trial by fire. 23 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2589282"></a>Assignment Tasks</h3></div></div></div><p><a class="indexterm" name="id2589288"></a>23 </p><div class="sect2" title="Assignment Tasks"><div class="titlepage"><div><div><h3 class="title"><a name="id357994"></a>Assignment Tasks</h3></div></div></div><p><a class="indexterm" name="id358000"></a> 24 24 You must now add UNIX/Linux domain member servers to your network. You have a friend who has a Windows 2003 25 25 Active Directory domain network who wants to add a Samba/Linux server and has asked Christine to help him … … 31 31 do likewise at Swodniw Biz NL (your friend's company) to help them to evaluate a Linux desktop. You want to make 32 32 the right decision, don't you? 33 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2589317"></a>Dissection and Discussion</h2></div></div></div><p>34 <a class="indexterm" name="id 2589325"></a>33 </p></div></div><div class="sect1" title="Dissection and Discussion"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id358022"></a>Dissection and Discussion</h2></div></div></div><p> 34 <a class="indexterm" name="id358030"></a> 35 35 Recent Samba mailing-list activity is witness to how many sites are using winbind. Some have no trouble 36 36 at all with it, yet to others the problems seem insurmountable. Periodically there are complaints concerning … … 40 40 resolution. You also provide working examples of solutions for integrated authentication for 41 41 both UNIX/Linux and Windows environments. 42 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2589345"></a>Technical Issues</h3></div></div></div><p>43 One of the great challenges we face when people ask us, “<span class="quote">What is the best way to solve44 this problem?</span>” is to get beyond the facts so we not only can clearly comprehend42 </p><div class="sect2" title="Technical Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id358046"></a>Technical Issues</h3></div></div></div><p> 43 One of the great challenges we face when people ask us, <span class="quote">“<span class="quote">What is the best way to solve 44 this problem?</span>”</span> is to get beyond the facts so we not only can clearly comprehend 45 45 the immediate technical problem, but also can understand how needs may change. 46 46 </p><p> 47 <a class="indexterm" name="id 2589364"></a>47 <a class="indexterm" name="id358063"></a> 48 48 There are a few facts we should note when dealing with the question of how best to 49 49 integrate UNIX/Linux clients and servers into a Windows networking environment: 50 </p><div class="itemizedlist"><ul type="disc"><li><p>51 <a class="indexterm" name="id 2589380"></a>52 <a class="indexterm" name="id 2589387"></a>53 <a class="indexterm" name="id 2589394"></a>54 <a class="indexterm" name="id 2589403"></a>55 <a class="indexterm" name="id 2589410"></a>50 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 51 <a class="indexterm" name="id358078"></a> 52 <a class="indexterm" name="id358084"></a> 53 <a class="indexterm" name="id358091"></a> 54 <a class="indexterm" name="id358100"></a> 55 <a class="indexterm" name="id358107"></a> 56 56 A domain controller (PDC or BDC) is always authoritative for all accounts in its domain. 57 57 This means that a BDC must (of necessity) be able to resolve all account UIDs and GIDs 58 58 to the same values that the PDC resolved them to. 59 </p></li><li ><p>60 <a class="indexterm" name="id 2589425"></a>61 <a class="indexterm" name="id 2589432"></a>62 <a class="indexterm" name="id 2589444"></a>63 <a class="indexterm" name="id 2589451"></a>59 </p></li><li class="listitem"><p> 60 <a class="indexterm" name="id358120"></a> 61 <a class="indexterm" name="id358127"></a> 62 <a class="indexterm" name="id358138"></a> 63 <a class="indexterm" name="id358145"></a> 64 64 A domain member can be authoritative for local accounts, but is never authoritative for 65 65 domain accounts. If a user is accessing a domain member server and that user's account … … 67 67 from the domain in which that user's account resides. It must then map that ID to a 68 68 UID/GID pair that it can use locally. This is handled by <code class="literal">winbindd</code>. 69 </p></li><li ><p>69 </p></li><li class="listitem"><p> 70 70 Samba, when running on a domain member server, can resolve user identities from a 71 71 number of sources: 72 </p><div class="itemizedlist"><ul type="circle"><li><p>73 <a class="indexterm" name="id 2589483"></a>74 <a class="indexterm" name="id 2589490"></a>75 <a class="indexterm" name="id 2589497"></a>76 <a class="indexterm" name="id 2589503"></a>77 <a class="indexterm" name="id 2589510"></a>72 </p><div class="itemizedlist"><ul class="itemizedlist" type="circle"><li class="listitem"><p> 73 <a class="indexterm" name="id358173"></a> 74 <a class="indexterm" name="id358180"></a> 75 <a class="indexterm" name="id358187"></a> 76 <a class="indexterm" name="id358193"></a> 77 <a class="indexterm" name="id358200"></a> 78 78 By executing a system <code class="literal">getpwnam()</code> or <code class="literal">getgrnam()</code> call. 79 79 On systems that support it, this utilizes the name service switch (NSS) facility to 80 80 resolve names according to the configuration of the <code class="filename">/etc/nsswitch.conf</code> 81 81 file. NSS can be configured to use LDAP, winbind, NIS, or local files. 82 </p></li><li ><p>83 <a class="indexterm" name="id 2589543"></a>84 <a class="indexterm" name="id 2589550"></a>85 <a class="indexterm" name="id 2589557"></a>82 </p></li><li class="listitem"><p> 83 <a class="indexterm" name="id358231"></a> 84 <a class="indexterm" name="id358238"></a> 85 <a class="indexterm" name="id358245"></a> 86 86 Performing, via NSS, a direct LDAP search (where an LDAP passdb backend has been configured). 87 87 This requires the use of the PADL nss_ldap tool (or equivalent). 88 </p></li><li ><p>89 <a class="indexterm" name="id 2589571"></a>90 <a class="indexterm" name="id 2589578"></a>91 <a class="indexterm" name="id 2589584"></a>92 <a class="indexterm" name="id 2589591"></a>88 </p></li><li class="listitem"><p> 89 <a class="indexterm" name="id358257"></a> 90 <a class="indexterm" name="id358264"></a> 91 <a class="indexterm" name="id358271"></a> 92 <a class="indexterm" name="id358277"></a> 93 93 Directly by querying <code class="literal">winbindd</code>. The <code class="literal">winbindd</code> 94 94 contacts a domain controller to attempt to resolve the identity of the user or group. It … … 98 98 <code class="filename">winbindd_cache.tdb</code> files. 99 99 </p><p> 100 <a class="indexterm" name="id 2589631"></a>101 <a class="indexterm" name="id 2589638"></a>100 <a class="indexterm" name="id358314"></a> 101 <a class="indexterm" name="id358321"></a> 102 102 If the parameter <a class="link" href="smb.conf.5.html#IDMAPBACKEND" target="_top">idmap backend = ldap:ldap://myserver.domain</a> 103 103 was specified and the LDAP server has been configured with a container in which it may … … 111 111 in the <code class="filename">smb.conf</code> file. Some of the configuration options are rather less than obvious to the 112 112 casual user. 113 </p></li><li ><p>114 <a class="indexterm" name="id 2589703"></a>115 <a class="indexterm" name="id 2589710"></a>116 <a class="indexterm" name="id 2589720"></a>113 </p></li><li class="listitem"><p> 114 <a class="indexterm" name="id358380"></a> 115 <a class="indexterm" name="id358387"></a> 116 <a class="indexterm" name="id358397"></a> 117 117 If you wish to make use of accounts (users and/or groups) that are local to (i.e., capable 118 118 of being resolved using) the NSS facility, it is possible to use the … … 121 121 and to domain member servers. 122 122 </p></li></ul></div><p> 123 <a class="indexterm" name="id 2589755"></a>124 <a class="indexterm" name="id 2589762"></a>125 <a class="indexterm" name="id 2589769"></a>123 <a class="indexterm" name="id358428"></a> 124 <a class="indexterm" name="id358434"></a> 125 <a class="indexterm" name="id358441"></a> 126 126 For many administrators, it should be plain that the use of an LDAP-based repository for all network 127 127 accounts (both for POSIX accounts and for Samba accounts) provides the most elegant and 128 128 controllable facility. You eventually appreciate the decision to use LDAP. 129 129 </p><p> 130 <a class="indexterm" name="id 2589784"></a>131 <a class="indexterm" name="id 2589790"></a>132 <a class="indexterm" name="id 2589797"></a>130 <a class="indexterm" name="id358454"></a> 131 <a class="indexterm" name="id358460"></a> 132 <a class="indexterm" name="id358467"></a> 133 133 If your network account information resides in an LDAP repository, you should use it ahead of any 134 134 alternative method. This means that if it is humanly possible to use the <code class="literal">nss_ldap</code> … … 137 137 throughout the network. 138 138 </p><p> 139 <a class="indexterm" name="id 2589820"></a>140 <a class="indexterm" name="id 2589829"></a>141 <a class="indexterm" name="id 2589836"></a>142 <a class="indexterm" name="id 2589843"></a>143 <a class="indexterm" name="id 2589850"></a>144 <a class="indexterm" name="id 2589857"></a>139 <a class="indexterm" name="id358486"></a> 140 <a class="indexterm" name="id358495"></a> 141 <a class="indexterm" name="id358502"></a> 142 <a class="indexterm" name="id358509"></a> 143 <a class="indexterm" name="id358515"></a> 144 <a class="indexterm" name="id358522"></a> 145 145 In the situation where UNIX accounts are held on the domain member server itself, the only effective 146 146 way to use them involves the <code class="filename">smb.conf</code> entry … … 150 150 disables the use of Samba with trusted domains (i.e., external domains). 151 151 </p><p> 152 <a class="indexterm" name="id 2589908"></a>153 <a class="indexterm" name="id 2589915"></a>154 <a class="indexterm" name="id 2589924"></a>155 <a class="indexterm" name="id 2589931"></a>152 <a class="indexterm" name="id358570"></a> 153 <a class="indexterm" name="id358577"></a> 154 <a class="indexterm" name="id358586"></a> 155 <a class="indexterm" name="id358593"></a> 156 156 Winbind can be used to create an appliance mode domain member server. In this capacity, <code class="literal">winbindd</code> 157 157 is configured to automatically allocate UIDs/GIDs from numeric ranges set in the <code class="filename">smb.conf</code> file. The allocation … … 162 162 is stored in the <code class="filename">winbindd_idmap.tdb</code> and <code class="filename">winbindd_cache.tdb</code> files. 163 163 </p><p> 164 <a class="indexterm" name="id 2589979"></a>164 <a class="indexterm" name="id358634"></a> 165 165 The use of an LDAP backend for the Winbind IDMAP facility permits Windows domain SIDs 166 166 mappings to UIDs/GIDs to be stored centrally. The result is a consistent mapping across all domain member 167 167 servers so configured. This solves one of the major headaches for network administrators who need to copy 168 168 files between or across network file servers. 169 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2589994"></a>Political Issues</h3></div></div></div><p>170 <a class="indexterm" name="id 2590002"></a>171 <a class="indexterm" name="id 2590009"></a>172 <a class="indexterm" name="id 2590015"></a>173 <a class="indexterm" name="id 2590024"></a>169 </p></div><div class="sect2" title="Political Issues"><div class="titlepage"><div><div><h3 class="title"><a name="id358646"></a>Political Issues</h3></div></div></div><p> 170 <a class="indexterm" name="id358654"></a> 171 <a class="indexterm" name="id358661"></a> 172 <a class="indexterm" name="id358667"></a> 173 <a class="indexterm" name="id358676"></a> 174 174 One of the most fierce conflicts recently being waged is resistance to the adoption of LDAP, in 175 175 particular OpenLDAP, as a replacement for UNIX NIS (previously called Yellow Pages). Let's face it, LDAP … … 183 183 commercial integration products. But it's not what Active Directory was designed for. 184 184 </p><p> 185 <a class="indexterm" name="id 2590063"></a>186 <a class="indexterm" name="id 2590069"></a>185 <a class="indexterm" name="id358707"></a> 186 <a class="indexterm" name="id358713"></a> 187 187 A number of long-term UNIX devotees have recently commented in various communications that the Samba Team 188 188 is the first application group to almost force network administrators to use LDAP. It should be pointed … … 190 190 finally emerged as the preferred identity management backend for Samba. We recommend LDAP for your total 191 191 organizational directory needs. 192 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2590094"></a>Implementation</h2></div></div></div><p>193 <a class="indexterm" name="id 2590102"></a>194 <a class="indexterm" name="id 2590112"></a>195 <a class="indexterm" name="id 2590121"></a>192 </p></div></div><div class="sect1" title="Implementation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id358731"></a>Implementation</h2></div></div></div><p> 193 <a class="indexterm" name="id358738"></a> 194 <a class="indexterm" name="id358748"></a> 195 <a class="indexterm" name="id358757"></a> 196 196 The domain member server and the domain member client are at the center of focus in this chapter. 197 197 Configuration of Samba-3 domain controller is covered in earlier chapters, so if your … … 199 199 oil that helps you to add domain member servers and clients. 200 200 </p><p> 201 <a class="indexterm" name="id 2590137"></a>201 <a class="indexterm" name="id358770"></a> 202 202 In practice, domain member servers and domain member workstations are very different entities, but in 203 203 terms of technology they share similar core infrastructure. A technologist would argue that servers … … 207 207 but a server is viewed as a core component of the business. 208 208 </p><p> 209 <a class="indexterm" name="id 2590159"></a>209 <a class="indexterm" name="id358787"></a> 210 210 We can look at this another way. If a workstation breaks down, one user is affected, but if a 211 211 server breaks down, hundreds of users may not be able to work. The services that a workstation … … 213 213 and is distribution oriented. 214 214 </p><p> 215 <a class="indexterm" name="id 2590175"></a>216 <a class="indexterm" name="id 2590182"></a>217 <a class="indexterm" name="id 2590189"></a>215 <a class="indexterm" name="id358800"></a> 216 <a class="indexterm" name="id358807"></a> 217 <a class="indexterm" name="id358813"></a> 218 218 <span class="emphasis"><em>Why is this important?</em></span> For starters, we must identify what 219 219 components of the operating system and its environment must be configured. Also, it is necessary … … 226 226 So, in this chapter we demonstrate how to implement the technology. It is done within a context of 227 227 what type of service need must be fulfilled. 228 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="sdcsdmldap"></a>Samba Domain with Samba Domain Member Server Using NSS LDAP</h3></div></div></div><p>229 <a class="indexterm" name="id 2590230"></a>230 <a class="indexterm" name="id 2590236"></a>231 <a class="indexterm" name="id 2590243"></a>232 <a class="indexterm" name="id 2590250"></a>233 <a class="indexterm" name="id 2590259"></a>234 <a class="indexterm" name="id 2590266"></a>228 </p><div class="sect2" title="Samba Domain with Samba Domain Member Server Using NSS LDAP"><div class="titlepage"><div><div><h3 class="title"><a name="sdcsdmldap"></a>Samba Domain with Samba Domain Member Server Using NSS LDAP</h3></div></div></div><p> 229 <a class="indexterm" name="id358848"></a> 230 <a class="indexterm" name="id358854"></a> 231 <a class="indexterm" name="id358861"></a> 232 <a class="indexterm" name="id358868"></a> 233 <a class="indexterm" name="id358877"></a> 234 <a class="indexterm" name="id358884"></a> 235 235 In this example, it is assumed that you have Samba PDC/BDC servers. This means you are using 236 236 an LDAP ldapsam backend. We are adding to the LDAP backend database (directory) … … 248 248 so that all domain member servers can use a consistent mapping. 249 249 </p><p> 250 <a class="indexterm" name="id 2590336"></a>251 <a class="indexterm" name="id 2590343"></a>252 <a class="indexterm" name="id 2590350"></a>250 <a class="indexterm" name="id358942"></a> 251 <a class="indexterm" name="id358948"></a> 252 <a class="indexterm" name="id358955"></a> 253 253 If your installation is accessed only from clients that are members of your own domain, and all 254 254 user accounts are present in a local passdb backend then it is not necessary to run … … 259 259 <code class="literal">getpwnam()</code> system call. On NSS-enabled systems, the actual POSIX account 260 260 source can be provided from 261 </p><div class="itemizedlist"><ul type="disc"><li><p>262 <a class="indexterm" name="id 2590387"></a>263 <a class="indexterm" name="id 2590394"></a>261 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 262 <a class="indexterm" name="id358988"></a> 263 <a class="indexterm" name="id358995"></a> 264 264 Accounts in <code class="filename">/etc/passwd</code> or in <code class="filename">/etc/group</code>. 265 </p></li><li ><p>266 <a class="indexterm" name="id 2590417"></a>267 <a class="indexterm" name="id 2590424"></a>268 <a class="indexterm" name="id 2590430"></a>269 <a class="indexterm" name="id 2590437"></a>270 <a class="indexterm" name="id 2590444"></a>271 <a class="indexterm" name="id 2590450"></a>272 <a class="indexterm" name="id 2590457"></a>273 <a class="indexterm" name="id 2590464"></a>274 <a class="indexterm" name="id 2590471"></a>265 </p></li><li class="listitem"><p> 266 <a class="indexterm" name="id359018"></a> 267 <a class="indexterm" name="id359025"></a> 268 <a class="indexterm" name="id359031"></a> 269 <a class="indexterm" name="id359038"></a> 270 <a class="indexterm" name="id359045"></a> 271 <a class="indexterm" name="id359052"></a> 272 <a class="indexterm" name="id359058"></a> 273 <a class="indexterm" name="id359065"></a> 274 <a class="indexterm" name="id359072"></a> 275 275 Resolution via NSS. On NSS-enabled systems, there is usually a facility to resolve IDs 276 276 via multiple methods. The methods typically include <code class="literal">files</code>, … … 279 279 correctly installed, Samba adds to this list the <code class="literal">winbindd</code> facility. 280 280 The ldap facility is frequently the nss_ldap tool provided by PADL Software. 281 </p></li></ul></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>281 </p></li></ul></div><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 282 282 To advoid confusion the use of the term <code class="literal">local passdb backend</code> means that 283 283 the user account backend is not shared by any other Samba server instead, it is 284 284 used only locally on the Samba domain member server under discussion. 285 285 </p></div><p> 286 <a class="indexterm" name="id 2590550"></a>286 <a class="indexterm" name="id359146"></a> 287 287 The diagram in <a class="link" href="unixclients.html#ch9-sambadc" title="Figure 7.2. Samba Domain: Samba Member Server">“Samba Domain: Samba Member Server”</a> demonstrates the relationship of Samba and system 288 288 components that are involved in the identity resolution process where Samba is used as a domain 289 289 member server within a Samba domain control network. 290 290 </p><div class="figure"><a name="ch9-sambadc"></a><p class="title"><b>Figure 7.2. Samba Domain: Samba Member Server</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap9-SambaDC.png" width="324" alt="Samba Domain: Samba Member Server"></div></div></div><br class="figure-break"><p> 291 <a class="indexterm" name="id 2590612"></a>292 <a class="indexterm" name="id 2590619"></a>291 <a class="indexterm" name="id359206"></a> 292 <a class="indexterm" name="id359213"></a> 293 293 In this example configuration, Samba will directly search the LDAP-based passwd backend ldapsam 294 294 to obtain authentication and user identity information. The IDMAP information is stored in the LDAP … … 301 301 If the network does not have an LDAP slave server (i.e., <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a> configuration), 302 302 change the target LDAP server from <code class="constant">lapdc</code> to <code class="constant">massive.</code> 303 </p><div class="procedure" ><a name="id2590668"></a><p class="title"><b>Procedure 7.1. Configuration of NSS_LDAP-Based Identity Resolution</b></p><ol type="1"><li><p>303 </p><div class="procedure" title="Procedure 7.1. Configuration of NSS_LDAP-Based Identity Resolution"><a name="id359255"></a><p class="title"><b>Procedure 7.1. Configuration of NSS_LDAP-Based Identity Resolution</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 304 304 Create the <code class="filename">smb.conf</code> file as shown in <a class="link" href="unixclients.html#ch9-sdmsdc" title="Example 7.1. Samba Domain Member in Samba Domain Using LDAP smb.conf File">“Samba Domain Member in Samba Domain Using LDAP smb.conf File”</a>. Locate 305 305 this file in the directory <code class="filename">/etc/samba</code>. 306 </p></li><li ><p>307 <a class="indexterm" name="id 2590706"></a>306 </p></li><li class="step" title="Step 2"><p> 307 <a class="indexterm" name="id359292"></a> 308 308 Configure the file that will be used by <code class="constant">nss_ldap</code> to 309 309 locate and communicate with the LDAP server. This file is called <code class="filename">ldap.conf</code>. … … 323 323 /etc/ldap.conf 324 324 </pre><p> 325 </p></li><li ><p>325 </p></li><li class="step" title="Step 3"><p> 326 326 Configure the NSS control file so it matches the one shown in 327 327 <a class="link" href="unixclients.html#ch9-sdmnss" title="Example 7.4. NSS using LDAP for Identity Resolution File: /etc/nsswitch.conf">“NSS using LDAP for Identity Resolution File: /etc/nsswitch.conf”</a>. 328 </p></li><li ><p>329 <a class="indexterm" name="id 2590794"></a>330 <a class="indexterm" name="id 2590800"></a>328 </p></li><li class="step" title="Step 4"><p> 329 <a class="indexterm" name="id359372"></a> 330 <a class="indexterm" name="id359379"></a> 331 331 Before proceeding to configure Samba, validate the operation of the NSS identity 332 332 resolution via LDAP by executing: … … 363 363 sammy:x:4321: 364 364 </pre><p> 365 <a class="indexterm" name="id 2590865"></a>366 <a class="indexterm" name="id 2590872"></a>367 <a class="indexterm" name="id 2590878"></a>365 <a class="indexterm" name="id359426"></a> 366 <a class="indexterm" name="id359433"></a> 367 <a class="indexterm" name="id359440"></a> 368 368 This shows that all is working as it should be. Notice that in the LDAP database 369 369 the users' primary and secondary group memberships are identical. It is not … … 374 374 conditions. It is intended that these limitations with winbind will be resolved soon 375 375 after Samba-3.0.20 has been released. 376 </p></li><li ><p>377 <a class="indexterm" name="id 2590902"></a>376 </p></li><li class="step" title="Step 5"><p> 377 <a class="indexterm" name="id359458"></a> 378 378 The LDAP directory must have a container object for IDMAP data. There are several ways you can 379 379 check that your LDAP database is able to receive IDMAP information. One of the simplest is to … … 384 384 ou: idmap 385 385 </pre><p> 386 <a class="indexterm" name="id 2590925"></a>386 <a class="indexterm" name="id359479"></a> 387 387 If the execution of this command does not return IDMAP entries, you need to create an LDIF 388 388 template file (see <a class="link" href="unixclients.html#ch9-ldifadd" title="Example 7.2. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF">“LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF”</a>). You can add the required entries using … … 392 392 -w not24get < /etc/openldap/idmap.LDIF 393 393 </pre><p> 394 </p></li><li ><p>394 </p></li><li class="step" title="Step 6"><p> 395 395 Samba automatically populates the LDAP directory container when it needs to. To permit Samba 396 396 write access to the LDAP directory it is necessary to set the LDAP administrative password … … 399 399 <code class="prompt">root# </code> smbpasswd -w not24get 400 400 </pre><p> 401 </p></li><li ><p>402 <a class="indexterm" name="id 2590989"></a>403 <a class="indexterm" name="id 2591000"></a>401 </p></li><li class="step" title="Step 7"><p> 402 <a class="indexterm" name="id359538"></a> 403 <a class="indexterm" name="id359549"></a> 404 404 The system is ready to join the domain. Execute the following: 405 405 </p><pre class="screen"> … … 412 412 causes of failure to join are: 413 413 </p><p> 414 </p><div class="itemizedlist"><ul type="disc"><li><p>Broken resolution of NetBIOS names to the respective IP address.</p></li><li><p>Incorrect username and password credentials.</p></li><li><p>The NT4 <em class="parameter"><code>restrict anonymous</code></em> is set to exclude anonymous414 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p>Broken resolution of NetBIOS names to the respective IP address.</p></li><li class="listitem"><p>Incorrect username and password credentials.</p></li><li class="listitem"><p>The NT4 <em class="parameter"><code>restrict anonymous</code></em> is set to exclude anonymous 415 415 connections.</p></li></ul></div><p> 416 416 </p><p> … … 419 419 <code class="prompt">root# </code> net rpc join -S 'pdc-name' -U administrator%password -d 5 420 420 </pre><p> 421 <a class="indexterm" name="id 2591072"></a>422 <a class="indexterm" name="id 2591079"></a>423 <a class="indexterm" name="id 2591086"></a>424 <a class="indexterm" name="id 2591093"></a>421 <a class="indexterm" name="id359616"></a> 422 <a class="indexterm" name="id359623"></a> 423 <a class="indexterm" name="id359629"></a> 424 <a class="indexterm" name="id359636"></a> 425 425 Note: Use "root" for UNIX/Linux and Samba, use "Administrator" for Windows NT4/200X. If the cause of 426 426 the failure appears to be related to a rejected or failed NT_SESSION_SETUP* or an error message that … … 449 449 Join to 'MEGANET2' failed. 450 450 </pre><p> 451 </p></li><li ><p>452 <a class="indexterm" name="id 2591154"></a>451 </p></li><li class="step" title="Step 8"><p> 452 <a class="indexterm" name="id359688"></a> 453 453 Just joining the domain is not quite enough; you must now provide a privileged set 454 454 of credentials through which <code class="literal">winbindd</code> can interact with the … … 458 458 </pre><p> 459 459 The configuration is now ready to obtain the Samba domain user and group information. 460 </p></li><li ><p>460 </p></li><li class="step" title="Step 9"><p> 461 461 You may now start Samba in the usual manner, and your Samba domain member server 462 462 is ready for use. Just add shares as required. 463 </p></li></ol></div><div class="example"><a name="ch9-sdmsdc"></a><p class="title"><b>Example 7.1. Samba Domain Member in Samba Domain Using LDAP <code class="filename">smb.conf</code> File</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2591232"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id2591244"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id2591256"></a><em class="parameter"><code>security = DOMAIN</code></em></td></tr><tr><td><a class="indexterm" name="id2591267"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2591279"></a><em class="parameter"><code>log level = 10</code></em></td></tr><tr><td><a class="indexterm" name="id2591291"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2591302"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2591314"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id2591326"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2591337"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2591350"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2591361"></a><em class="parameter"><code>wins server = 192.168.2.1</code></em></td></tr><tr><td><a class="indexterm" name="id2591373"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2591385"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2591397"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id2591409"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id2591421"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2591433"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id2591445"></a><em class="parameter"><code>idmap backend = ldap:ldap://lapdc.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id2591457"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2591469"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2591481"></a><em class="parameter"><code>winbind trusted domains only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2591493"></a><em class="parameter"><code>printer admin = root</code></em></td></tr><tr><td><a class="indexterm" name="id2591505"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2591525"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2591537"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2591549"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2591560"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2591581"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2591593"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2591604"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2591616"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2591628"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id2591648"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2591660"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2591672"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id2591684"></a><em class="parameter"><code>write list = root</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch9-ldifadd"></a><p class="title"><b>Example 7.2. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF</b></p><div class="example-contents"><pre class="screen">463 </p></li></ol></div><div class="example"><a name="ch9-sdmsdc"></a><p class="title"><b>Example 7.1. Samba Domain Member in Samba Domain Using LDAP <code class="filename">smb.conf</code> File</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id359761"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id359773"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id359784"></a><em class="parameter"><code>security = DOMAIN</code></em></td></tr><tr><td><a class="indexterm" name="id359796"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id359807"></a><em class="parameter"><code>log level = 10</code></em></td></tr><tr><td><a class="indexterm" name="id359819"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id359830"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id359842"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id359853"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id359865"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id359876"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id359888"></a><em class="parameter"><code>wins server = 192.168.2.1</code></em></td></tr><tr><td><a class="indexterm" name="id359899"></a><em class="parameter"><code>ldap suffix = dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id359911"></a><em class="parameter"><code>ldap machine suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id359923"></a><em class="parameter"><code>ldap user suffix = ou=People</code></em></td></tr><tr><td><a class="indexterm" name="id359934"></a><em class="parameter"><code>ldap group suffix = ou=Groups</code></em></td></tr><tr><td><a class="indexterm" name="id359946"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id359957"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=abmas,dc=biz</code></em></td></tr><tr><td><a class="indexterm" name="id359969"></a><em class="parameter"><code>idmap backend = ldap:ldap://lapdc.abmas.biz</code></em></td></tr><tr><td><a class="indexterm" name="id359981"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id359992"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id360004"></a><em class="parameter"><code>winbind trusted domains only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id360016"></a><em class="parameter"><code>printer admin = root</code></em></td></tr><tr><td><a class="indexterm" name="id360027"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id360047"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id360059"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id360070"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id360082"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id360102"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id360114"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id360125"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id360137"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id360148"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id360169"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id360180"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id360192"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id360204"></a><em class="parameter"><code>write list = root</code></em></td></tr></table></div></div><br class="example-break"><div class="example"><a name="ch9-ldifadd"></a><p class="title"><b>Example 7.2. LDIF IDMAP Add-On Load File File: /etc/openldap/idmap.LDIF</b></p><div class="example-contents"><pre class="screen"> 464 464 dn: ou=Idmap,dc=abmas,dc=biz 465 465 objectClass: organizationalUnit … … 498 498 automount: files 499 499 aliases: files 500 </pre></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="wdcsdm"></a>NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</h3></div></div></div><p>500 </pre></div></div><br class="example-break"></div><div class="sect2" title="NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind"><div class="titlepage"><div><div><h3 class="title"><a name="wdcsdm"></a>NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind</h3></div></div></div><p> 501 501 You need to use this method for creating a Samba domain member server if any of the following conditions 502 502 prevail: 503 </p><div class="itemizedlist"><ul type="disc"><li><p>503 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 504 504 LDAP support (client) is not installed on the system. 505 </p></li><li ><p>505 </p></li><li class="listitem"><p> 506 506 There are mitigating circumstances forcing a decision not to use LDAP. 507 </p></li><li ><p>507 </p></li><li class="listitem"><p> 508 508 The Samba domain member server must be part of a Windows NT4 Domain, or a Samba Domain. 509 509 </p></li></ul></div><p> 510 <a class="indexterm" name="id 2591815"></a>511 <a class="indexterm" name="id 2591821"></a>512 <a class="indexterm" name="id 2591828"></a>510 <a class="indexterm" name="id360323"></a> 511 <a class="indexterm" name="id360329"></a> 512 <a class="indexterm" name="id360336"></a> 513 513 Later in the chapter, you can see how to configure a Samba domain member server for a Windows ADS domain. 514 514 Right now your objective is to configure a Samba server that can be a member of a Windows NT4-style 515 515 domain and/or does not use LDAP. 516 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>517 <a class="indexterm" name="id 2591844"></a>516 </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 517 <a class="indexterm" name="id360349"></a> 518 518 If you use <code class="literal">winbind</code> for identity resolution, make sure that there are no 519 519 duplicate accounts. 520 520 </p><p> 521 <a class="indexterm" name="id 2591861"></a>521 <a class="indexterm" name="id360366"></a> 522 522 For example, do not have more than one account that has UID=0 in the password database. If there 523 523 is an account called <code class="constant">root</code> in the <code class="filename">/etc/passwd</code> database, … … 527 527 <code class="constant">root</code>. 528 528 </p><p> 529 <a class="indexterm" name="id 2591898"></a>530 <a class="indexterm" name="id 2591904"></a>531 <a class="indexterm" name="id 2591911"></a>529 <a class="indexterm" name="id360400"></a> 530 <a class="indexterm" name="id360406"></a> 531 <a class="indexterm" name="id360413"></a> 532 532 Winbind will break if there is an account in <code class="filename">/etc/passwd</code> that has 533 533 the same UID as an account that is in LDAP ldapsam (or in tdbsam) but that differs in name only. 534 534 </p></div><p> 535 <a class="indexterm" name="id 2591930"></a>536 <a class="indexterm" name="id 2591937"></a>537 <a class="indexterm" name="id 2591944"></a>538 <a class="indexterm" name="id 2591950"></a>539 <a class="indexterm" name="id 2591960"></a>535 <a class="indexterm" name="id360431"></a> 536 <a class="indexterm" name="id360437"></a> 537 <a class="indexterm" name="id360444"></a> 538 <a class="indexterm" name="id360451"></a> 539 <a class="indexterm" name="id360460"></a> 540 540 The following configuration uses CIFS/SMB protocols alone to obtain user and group credentials. 541 541 The winbind information is locally cached in the <code class="filename">winbindd_cache.tdb winbindd_idmap.tdb</code> … … 544 544 files using the tool <code class="literal">tdbdump</code>, though you may have to build this from the Samba 545 545 source code if it has not been supplied as part of a binary package distribution that you may be using. 546 </p><div class="procedure" ><a name="id2591989"></a><p class="title"><b>Procedure 7.2. Configuration of Winbind-Based Identity Resolution</b></p><ol type="1"><li><p>546 </p><div class="procedure" title="Procedure 7.2. Configuration of Winbind-Based Identity Resolution"><a name="id360484"></a><p class="title"><b>Procedure 7.2. Configuration of Winbind-Based Identity Resolution</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 547 547 Using your favorite text editor, create the <code class="filename">smb.conf</code> file so it has the contents 548 548 shown in <a class="link" href="unixclients.html#ch0-NT4DSDM" title="Example 7.5. Samba Domain Member Server Using Winbind smb.conf File for NT4 Domain">“Samba Domain Member Server Using Winbind smb.conf File for NT4 Domain”</a>. 549 </p></li><li ><p>550 <a class="indexterm" name="id 2592021"></a>549 </p></li><li class="step" title="Step 2"><p> 550 <a class="indexterm" name="id360515"></a> 551 551 Edit the <code class="filename">/etc/nsswitch.conf</code> so it has the entries shown in 552 552 <a class="link" href="unixclients.html#ch9-sdmnss" title="Example 7.4. NSS using LDAP for Identity Resolution File: /etc/nsswitch.conf">“NSS using LDAP for Identity Resolution File: /etc/nsswitch.conf”</a>. 553 </p></li><li ><p>554 <a class="indexterm" name="id 2592047"></a>553 </p></li><li class="step" title="Step 3"><p> 554 <a class="indexterm" name="id360540"></a> 555 555 The system is ready to join the domain. Execute the following: 556 556 </p><pre class="screen"> … … 560 560 This indicates that the domain join succeed. 561 561 562 </p></li><li ><p>563 <a class="indexterm" name="id 2592073"></a>564 <a class="indexterm" name="id 2592080"></a>562 </p></li><li class="step" title="Step 4"><p> 563 <a class="indexterm" name="id360565"></a> 564 <a class="indexterm" name="id360572"></a> 565 565 Validate operation of <code class="literal">winbind</code> using the <code class="literal">wbinfo</code> 566 566 tool as follows: … … 588 588 </pre><p> 589 589 This shows that domain groups have been correctly obtained also. 590 </p></li><li ><p>591 <a class="indexterm" name="id 2592136"></a>592 <a class="indexterm" name="id 2592143"></a>593 <a class="indexterm" name="id 2592150"></a>590 </p></li><li class="step" title="Step 5"><p> 591 <a class="indexterm" name="id360624"></a> 592 <a class="indexterm" name="id360631"></a> 593 <a class="indexterm" name="id360637"></a> 594 594 The next step verifies that NSS is able to obtain this information 595 595 correctly from <code class="literal">winbind</code> also. … … 630 630 MEGANET2+PIOps:x:10005: 631 631 </pre><p> 632 </p></li><li ><p>632 </p></li><li class="step" title="Step 6"><p> 633 633 The Samba member server of a Windows NT4 domain is ready for use. 634 </p></li></ol></div><div class="example"><a name="ch0-NT4DSDM"></a><p class="title"><b>Example 7.5. Samba Domain Member Server Using Winbind <code class="filename">smb.conf</code> File for NT4 Domain</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2592261"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id2592272"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id2592284"></a><em class="parameter"><code>security = DOMAIN</code></em></td></tr><tr><td><a class="indexterm" name="id2592296"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2592308"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2592319"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2592331"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2592343"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2592354"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2592366"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2592378"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2592390"></a><em class="parameter"><code>wins server = 192.168.2.1</code></em></td></tr><tr><td><a class="indexterm" name="id2592402"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2592414"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2592425"></a><em class="parameter"><code>template primary group = "Domain Users"</code></em></td></tr><tr><td><a class="indexterm" name="id2592438"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id2592449"></a><em class="parameter"><code>winbind separator = +</code></em></td></tr><tr><td><a class="indexterm" name="id2592461"></a><em class="parameter"><code>printer admin = root</code></em></td></tr><tr><td><a class="indexterm" name="id2592473"></a><em class="parameter"><code>hosts allow = 192.168.2., 192.168.3., 127.</code></em></td></tr><tr><td><a class="indexterm" name="id2592485"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2592506"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2592517"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2592529"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2592541"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2592561"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2592573"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2592585"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2592596"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2592608"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id2592628"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2592640"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2592652"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id2592664"></a><em class="parameter"><code>write list = root</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="dcwonss"></a>NT4/Samba Domain with Samba Domain Member Server without NSS Support</h3></div></div></div><p>634 </p></li></ol></div><div class="example"><a name="ch0-NT4DSDM"></a><p class="title"><b>Example 7.5. Samba Domain Member Server Using Winbind <code class="filename">smb.conf</code> File for NT4 Domain</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id360734"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id360745"></a><em class="parameter"><code>workgroup = MEGANET2</code></em></td></tr><tr><td><a class="indexterm" name="id360757"></a><em class="parameter"><code>security = DOMAIN</code></em></td></tr><tr><td><a class="indexterm" name="id360768"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id360780"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id360791"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id360803"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id360814"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id360826"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id360837"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id360849"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id360860"></a><em class="parameter"><code>wins server = 192.168.2.1</code></em></td></tr><tr><td><a class="indexterm" name="id360872"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id360883"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id360895"></a><em class="parameter"><code>template primary group = "Domain Users"</code></em></td></tr><tr><td><a class="indexterm" name="id360906"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id360918"></a><em class="parameter"><code>winbind separator = +</code></em></td></tr><tr><td><a class="indexterm" name="id360929"></a><em class="parameter"><code>printer admin = root</code></em></td></tr><tr><td><a class="indexterm" name="id360941"></a><em class="parameter"><code>hosts allow = 192.168.2., 192.168.3., 127.</code></em></td></tr><tr><td><a class="indexterm" name="id360953"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id360973"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id360985"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id360996"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id361008"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id361028"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id361040"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id361051"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id361062"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id361074"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id361094"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id361106"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id361118"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id361129"></a><em class="parameter"><code>write list = root</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect2" title="NT4/Samba Domain with Samba Domain Member Server without NSS Support"><div class="titlepage"><div><div><h3 class="title"><a name="dcwonss"></a>NT4/Samba Domain with Samba Domain Member Server without NSS Support</h3></div></div></div><p> 635 635 No matter how many UNIX/Linux administrators there may be who believe that a UNIX operating 636 636 system that does not have NSS and PAM support to be outdated, the fact is there … … 643 643 is found, it is used. If the account is not found, one will be automatically created 644 644 on the local machine so that it can then be used for all access controls. 645 </p><div class="procedure" ><a name="id2592707"></a><p class="title"><b>Procedure 7.3. Configuration Using Local Accounts Only</b></p><ol type="1"><li><p>645 </p><div class="procedure" title="Procedure 7.3. Configuration Using Local Accounts Only"><a name="id361165"></a><p class="title"><b>Procedure 7.3. Configuration Using Local Accounts Only</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 646 646 Using your favorite text editor, create the <code class="filename">smb.conf</code> file so it has the contents 647 647 shown in <a class="link" href="unixclients.html#ch0-NT4DSCM" title="Example 7.6. Samba Domain Member Server Using Local Accounts smb.conf File for NT4 Domain">“Samba Domain Member Server Using Local Accounts smb.conf File for NT4 Domain”</a>. 648 </p></li><li ><p><a class="indexterm" name="id2592740"></a>648 </p></li><li class="step" title="Step 2"><p><a class="indexterm" name="id361197"></a> 649 649 The system is ready to join the domain. Execute the following: 650 650 </p><pre class="screen"> … … 653 653 </pre><p> 654 654 This indicates that the domain join succeed. 655 </p></li><li ><p>655 </p></li><li class="step" title="Step 3"><p> 656 656 Be sure to run all three Samba daemons: <code class="literal">smbd</code>, <code class="literal">nmbd</code>, <code class="literal">winbindd</code>. 657 </p></li><li ><p>657 </p></li><li class="step" title="Step 4"><p> 658 658 The Samba member server of a Windows NT4 domain is ready for use. 659 </p></li></ol></div><div class="example"><a name="ch0-NT4DSCM"></a><p class="title"><b>Example 7.6. Samba Domain Member Server Using Local Accounts <code class="filename">smb.conf</code> File for NT4 Domain</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2592828"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id2592840"></a><em class="parameter"><code>workgroup = MEGANET3</code></em></td></tr><tr><td><a class="indexterm" name="id2592852"></a><em class="parameter"><code>netbios name = BSDBOX</code></em></td></tr><tr><td><a class="indexterm" name="id2592864"></a><em class="parameter"><code>security = DOMAIN</code></em></td></tr><tr><td><a class="indexterm" name="id2592876"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2592888"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2592899"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2592911"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2592923"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -M '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id2592935"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id2592947"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2592959"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2592971"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id2592982"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id2592994"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2593006"></a><em class="parameter"><code>wins server = 192.168.2.1</code></em></td></tr><tr><td><a class="indexterm" name="id2593018"></a><em class="parameter"><code>printer admin = root</code></em></td></tr><tr><td><a class="indexterm" name="id2593030"></a><em class="parameter"><code>hosts allow = 192.168.2., 192.168.3., 127.</code></em></td></tr><tr><td><a class="indexterm" name="id2593042"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2593062"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2593074"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2593086"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2593097"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2593118"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2593130"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2593141"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2593153"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2593165"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id2593185"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2593197"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2593209"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id2593221"></a><em class="parameter"><code>write list = root</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="adssdm"></a>Active Directory Domain with Samba Domain Member Server</h3></div></div></div><p>660 <a class="indexterm" name="id 2593246"></a>661 <a class="indexterm" name="id 2593255"></a>662 <a class="indexterm" name="id 2593262"></a>659 </p></li></ol></div><div class="example"><a name="ch0-NT4DSCM"></a><p class="title"><b>Example 7.6. Samba Domain Member Server Using Local Accounts <code class="filename">smb.conf</code> File for NT4 Domain</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id361282"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id361294"></a><em class="parameter"><code>workgroup = MEGANET3</code></em></td></tr><tr><td><a class="indexterm" name="id361305"></a><em class="parameter"><code>netbios name = BSDBOX</code></em></td></tr><tr><td><a class="indexterm" name="id361317"></a><em class="parameter"><code>security = DOMAIN</code></em></td></tr><tr><td><a class="indexterm" name="id361328"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id361340"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id361351"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id361363"></a><em class="parameter"><code>add user script = /usr/sbin/useradd -m '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id361374"></a><em class="parameter"><code>add machine script = /usr/sbin/useradd -M '%u'</code></em></td></tr><tr><td><a class="indexterm" name="id361386"></a><em class="parameter"><code>add group script = /usr/sbin/groupadd '%g'</code></em></td></tr><tr><td><a class="indexterm" name="id361398"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id361409"></a><em class="parameter"><code>max log size = 0</code></em></td></tr><tr><td><a class="indexterm" name="id361421"></a><em class="parameter"><code>smb ports = 139</code></em></td></tr><tr><td><a class="indexterm" name="id361432"></a><em class="parameter"><code>name resolve order = wins bcast hosts</code></em></td></tr><tr><td><a class="indexterm" name="id361444"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id361455"></a><em class="parameter"><code>wins server = 192.168.2.1</code></em></td></tr><tr><td><a class="indexterm" name="id361467"></a><em class="parameter"><code>printer admin = root</code></em></td></tr><tr><td><a class="indexterm" name="id361478"></a><em class="parameter"><code>hosts allow = 192.168.2., 192.168.3., 127.</code></em></td></tr><tr><td><a class="indexterm" name="id361490"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id361511"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id361522"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id361534"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id361545"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id361566"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id361577"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id361589"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id361600"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id361612"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id361632"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id361644"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id361655"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id361667"></a><em class="parameter"><code>write list = root</code></em></td></tr></table></div></div><br class="example-break"></div><div class="sect2" title="Active Directory Domain with Samba Domain Member Server"><div class="titlepage"><div><div><h3 class="title"><a name="adssdm"></a>Active Directory Domain with Samba Domain Member Server</h3></div></div></div><p> 660 <a class="indexterm" name="id361692"></a> 661 <a class="indexterm" name="id361701"></a> 662 <a class="indexterm" name="id361707"></a> 663 663 One of the much-sought-after features new to Samba-3 is the ability to join an Active Directory 664 664 domain using Kerberos protocols. This makes it possible to operate an entire Windows network … … 668 668 in. For now, we simply focus on how a Samba-3 server can be made a domain member server. 669 669 </p><p> 670 <a class="indexterm" name="id 2593284"></a>671 <a class="indexterm" name="id 2593291"></a>672 <a class="indexterm" name="id 2593298"></a>673 <a class="indexterm" name="id 2593305"></a>670 <a class="indexterm" name="id361725"></a> 671 <a class="indexterm" name="id361732"></a> 672 <a class="indexterm" name="id361738"></a> 673 <a class="indexterm" name="id361745"></a> 674 674 The diagram in <a class="link" href="unixclients.html#ch9-adsdc" title="Figure 7.3. Active Directory Domain: Samba Member Server">“Active Directory Domain: Samba Member Server”</a> demonstrates how Samba-3 interfaces with 675 675 Microsoft Active Directory components. It should be noted that if Microsoft Windows Services … … 695 695 is known as <code class="constant">w2k3s.london.abmas.biz</code>. In NetBIOS nomenclature, the 696 696 domain name is <code class="constant">LONDON</code> and the server name is <code class="constant">W2K3S</code>. 697 </p><div class="figure"><a name="ch9-adsdc"></a><p class="title"><b>Figure 7.3. Active Directory Domain: Samba Member Server</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap9-ADSDC.png" width="324" alt="Active Directory Domain: Samba Member Server"></div></div></div><br class="figure-break"><div class="procedure" ><a name="id2593418"></a><p class="title"><b>Procedure 7.4. Joining a Samba Server as an ADS Domain Member</b></p><ol type="1"><li><p>698 <a class="indexterm" name="id 2593430"></a>697 </p><div class="figure"><a name="ch9-adsdc"></a><p class="title"><b>Figure 7.3. Active Directory Domain: Samba Member Server</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/chap9-ADSDC.png" width="324" alt="Active Directory Domain: Samba Member Server"></div></div></div><br class="figure-break"><div class="procedure" title="Procedure 7.4. Joining a Samba Server as an ADS Domain Member"><a name="id361844"></a><p class="title"><b>Procedure 7.4. Joining a Samba Server as an ADS Domain Member</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 698 <a class="indexterm" name="id361856"></a> 699 699 Before you try to use Samba-3, you want to know for certain that your executables have 700 700 support for Kerberos and for LDAP. Execute the following to identify whether or … … 762 762 This does look promising; <code class="literal">smbd</code> has been built with Kerberos and LDAP 763 763 support. You are relieved to know that it is safe to progress. 764 </p></li><li ><p>765 <a class="indexterm" name="id 2593529"></a>766 <a class="indexterm" name="id 2593538"></a>767 <a class="indexterm" name="id 2593545"></a>768 <a class="indexterm" name="id 2593552"></a>769 <a class="indexterm" name="id 2593561"></a>770 <a class="indexterm" name="id 2593570"></a>771 <a class="indexterm" name="id 2593577"></a>772 <a class="indexterm" name="id 2593584"></a>773 <a class="indexterm" name="id 2593591"></a>764 </p></li><li class="step" title="Step 2"><p> 765 <a class="indexterm" name="id361938"></a> 766 <a class="indexterm" name="id361947"></a> 767 <a class="indexterm" name="id361954"></a> 768 <a class="indexterm" name="id361960"></a> 769 <a class="indexterm" name="id361970"></a> 770 <a class="indexterm" name="id361979"></a> 771 <a class="indexterm" name="id361986"></a> 772 <a class="indexterm" name="id361993"></a> 773 <a class="indexterm" name="id361999"></a> 774 774 The next step is to identify which version of the Kerberos libraries have been used. 775 775 In order to permit Samba-3 to interoperate with Windows 2003 Active Directory, it is … … 792 792 From this point on, you are certain that the Samba-3 build you are using has the 793 793 necessary capabilities. You can now configure Samba-3 and the NSS. 794 </p></li><li ><p>794 </p></li><li class="step" title="Step 3"><p> 795 795 Using you favorite editor, configure the <code class="filename">smb.conf</code> file that is located in the 796 796 <code class="filename">/etc/samba</code> directory so that it has the contents shown 797 797 in <a class="link" href="unixclients.html#ch9-adssdm" title="Example 7.7. Samba Domain Member smb.conf File for Active Directory Membership">“Samba Domain Member smb.conf File for Active Directory Membership”</a>. 798 </p></li><li ><p>798 </p></li><li class="step" title="Step 4"><p> 799 799 Edit or create the NSS control file so it has the contents shown in <a class="link" href="unixclients.html#ch9-sdmnss" title="Example 7.4. NSS using LDAP for Identity Resolution File: /etc/nsswitch.conf">“NSS using LDAP for Identity Resolution File: /etc/nsswitch.conf”</a>. 800 </p></li><li ><p>801 <a class="indexterm" name="id 2593692"></a>800 </p></li><li class="step" title="Step 5"><p> 801 <a class="indexterm" name="id362091"></a> 802 802 Delete the file <code class="filename">/etc/samba/secrets.tdb</code> if it exists. Of course, you 803 803 do keep a backup, don't you? 804 </p></li><li ><p>804 </p></li><li class="step" title="Step 6"><p> 805 805 Delete the tdb files that cache Samba information. You keep a backup of the old 806 806 files, of course. You also remove all files to ensure that nothing can pollute your … … 809 809 <code class="prompt">root# </code> rm /var/lib/samba/*tdb 810 810 </pre><p> 811 </p></li><li ><p>812 <a class="indexterm" name="id 2593736"></a>811 </p></li><li class="step" title="Step 7"><p> 812 <a class="indexterm" name="id362132"></a> 813 813 Validate your <code class="filename">smb.conf</code> file using <code class="literal">testparm</code> (as you have 814 814 done previously). Correct all errors reported before proceeding. The command you … … 819 819 Now that you are satisfied that your Samba server is ready to join the Windows 820 820 ADS domain, let's move on. 821 </p></li><li ><p>822 <a class="indexterm" name="id 2593778"></a>823 <a class="indexterm" name="id 2593789"></a>821 </p></li><li class="step" title="Step 8"><p> 822 <a class="indexterm" name="id362171"></a> 823 <a class="indexterm" name="id362182"></a> 824 824 This is a good time to double-check everything and then execute the following 825 825 command when everything you have done has checked out okay: … … 832 832 using Kerberos protocols. 833 833 </p><p> 834 <a class="indexterm" name="id 2593817"></a>835 <a class="indexterm" name="id 2593824"></a>834 <a class="indexterm" name="id362207"></a> 835 <a class="indexterm" name="id362214"></a> 836 836 In the event that you receive no output messages, a silent return means that the 837 837 domain join failed. You should use <code class="literal">ethereal</code> to identify what 838 838 may be failing. Common causes of a failed join include: 839 839 840 </p><div class="itemizedlist"><ul type="disc"><li><p>841 <a class="indexterm" name="id 2593845"></a>840 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 841 <a class="indexterm" name="id362233"></a> 842 842 Defective or misconfigured DNS name resolution. 843 </p></li><li ><p>844 <a class="indexterm" name="id 2593860"></a>843 </p></li><li class="listitem"><p> 844 <a class="indexterm" name="id362247"></a> 845 845 Restrictive security settings on the Windows 200x ADS domain controller 846 846 preventing needed communications protocols. You can check this by searching 847 847 the Windows Server 200x Event Viewer. 848 </p></li><li ><p>848 </p></li><li class="listitem"><p> 849 849 Incorrectly configured <code class="filename">smb.conf</code> file settings. 850 </p></li><li ><p>850 </p></li><li class="listitem"><p> 851 851 Lack of support of necessary Kerberos protocols because the version of MIT 852 852 Kerberos (or Heimdal) in use is not up to date enough to support the necessary … … 854 854 </p></li></ul></div><p> 855 855 856 <a class="indexterm" name="id 2593891"></a>857 <a class="indexterm" name="id 2593902"></a>858 <a class="indexterm" name="id 2593909"></a>856 <a class="indexterm" name="id362275"></a> 857 <a class="indexterm" name="id362286"></a> 858 <a class="indexterm" name="id362293"></a> 859 859 In any case, never execute the <code class="literal">net rpc join</code> command in an attempt 860 860 to join the Samba server to the domain, unless you wish not to use the Kerberos 861 861 security protocols. Use of the older RPC-based domain join facility requires that 862 862 Windows Server 200x ADS has been configured appropriately for mixed mode operation. 863 </p></li><li ><p>864 <a class="indexterm" name="id 2593934"></a>865 <a class="indexterm" name="id 2593941"></a>863 </p></li><li class="step" title="Step 9"><p> 864 <a class="indexterm" name="id362314"></a> 865 <a class="indexterm" name="id362321"></a> 866 866 If the <code class="literal">tdbdump</code> is installed on your system (not essential), 867 867 you can look inside the <code class="filename">/etc/samba/secrets.tdb</code> file. If … … 890 890 </pre><p> 891 891 This is given to demonstrate to the skeptics that this process truly does work. 892 </p></li><li ><p>892 </p></li><li class="step" title="Step 10"><p> 893 893 It is now time to start Samba in the usual way (as has been done many time before 894 894 in this book). 895 </p></li><li ><p>896 <a class="indexterm" name="id 2593998"></a>895 </p></li><li class="step" title="Step 11"><p> 896 <a class="indexterm" name="id362371"></a> 897 897 This is a good time to verify that everything is working. First, check that 898 898 winbind is able to obtain the list of users and groups from the ADS domain controller. … … 920 920 </pre><p> 921 921 Excellent. That worked also, as expected. 922 </p></li><li ><p><a class="indexterm" name="id2594044"></a>922 </p></li><li class="step" title="Step 12"><p><a class="indexterm" name="id362412"></a> 923 923 Now repeat this via NSS to validate that full identity resolution is 924 924 functional as required. Execute: … … 952 952 </pre><p> 953 953 This is very pleasing. Everything works as expected. 954 </p></li><li ><p>955 <a class="indexterm" name="id 2594102"></a>956 <a class="indexterm" name="id 2594113"></a>957 <a class="indexterm" name="id 2594122"></a>954 </p></li><li class="step" title="Step 13"><p> 955 <a class="indexterm" name="id362460"></a> 956 <a class="indexterm" name="id362471"></a> 957 <a class="indexterm" name="id362480"></a> 958 958 You may now perform final verification that communications between Samba-3 winbind and 959 959 the Active Directory server is using Kerberos protocols. Execute the following: … … 972 972 keep all server time clocks synchronized using the network time protocol (NTP). 973 973 In any case, the output we obtained confirms that all systems are operational. 974 </p></li><li ><p>975 <a class="indexterm" name="id 2594158"></a>974 </p></li><li class="step" title="Step 14"><p> 975 <a class="indexterm" name="id362511"></a> 976 976 There is one more action you elect to take, just because you are paranoid and disbelieving, 977 977 so you execute the following command: … … 1143 1143 Now all is revealed. Your curiosity, as well as that of your team, has been put at ease. 1144 1144 May this server serve well all who happen upon it. 1145 </p><div class="example"><a name="ch9-adssdm"></a><p class="title"><b>Example 7.7. Samba Domain Member <code class="filename">smb.conf</code> File for Active Directory Membership</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2594415"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id2594427"></a><em class="parameter"><code>workgroup = LONDON</code></em></td></tr><tr><td><a class="indexterm" name="id2594439"></a><em class="parameter"><code>realm = LONDON.ABMAS.BIZ</code></em></td></tr><tr><td><a class="indexterm" name="id2594450"></a><em class="parameter"><code>server string = Samba 3.0.20</code></em></td></tr><tr><td><a class="indexterm" name="id2594462"></a><em class="parameter"><code>security = ADS</code></em></td></tr><tr><td><a class="indexterm" name="id2594474"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id2594486"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id2594498"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id2594509"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id2594521"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id2594533"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id2594544"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id2594556"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2594568"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id2594580"></a><em class="parameter"><code>template primary group = "Domain Users"</code></em></td></tr><tr><td><a class="indexterm" name="id2594592"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id2594604"></a><em class="parameter"><code>winbind separator = +</code></em></td></tr><tr><td><a class="indexterm" name="id2594616"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id2594636"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id2594648"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id2594659"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id2594671"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id2594692"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id2594703"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id2594715"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2594727"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2594738"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id2594759"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2594770"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id2594782"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id2594794"></a><em class="parameter"><code>write list = root</code></em></td></tr></table></div></div><br class="example-break"><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2594807"></a>IDMAP_RID with Winbind</h4></div></div></div><p>1146 <a class="indexterm" name="id 2594815"></a>1147 <a class="indexterm" name="id 2594822"></a>1148 <a class="indexterm" name="id 2594828"></a>1149 <a class="indexterm" name="id 2594835"></a>1145 </p><div class="example"><a name="ch9-adssdm"></a><p class="title"><b>Example 7.7. Samba Domain Member <code class="filename">smb.conf</code> File for Active Directory Membership</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id362682"></a><em class="parameter"><code>unix charset = LOCALE</code></em></td></tr><tr><td><a class="indexterm" name="id362694"></a><em class="parameter"><code>workgroup = LONDON</code></em></td></tr><tr><td><a class="indexterm" name="id362705"></a><em class="parameter"><code>realm = LONDON.ABMAS.BIZ</code></em></td></tr><tr><td><a class="indexterm" name="id362717"></a><em class="parameter"><code>server string = Samba 3.0.20</code></em></td></tr><tr><td><a class="indexterm" name="id362729"></a><em class="parameter"><code>security = ADS</code></em></td></tr><tr><td><a class="indexterm" name="id362740"></a><em class="parameter"><code>username map = /etc/samba/smbusers</code></em></td></tr><tr><td><a class="indexterm" name="id362752"></a><em class="parameter"><code>log level = 1</code></em></td></tr><tr><td><a class="indexterm" name="id362763"></a><em class="parameter"><code>syslog = 0</code></em></td></tr><tr><td><a class="indexterm" name="id362775"></a><em class="parameter"><code>log file = /var/log/samba/%m</code></em></td></tr><tr><td><a class="indexterm" name="id362786"></a><em class="parameter"><code>max log size = 50</code></em></td></tr><tr><td><a class="indexterm" name="id362798"></a><em class="parameter"><code>printcap name = CUPS</code></em></td></tr><tr><td><a class="indexterm" name="id362809"></a><em class="parameter"><code>ldap ssl = no</code></em></td></tr><tr><td><a class="indexterm" name="id362821"></a><em class="parameter"><code>idmap uid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id362832"></a><em class="parameter"><code>idmap gid = 10000-20000</code></em></td></tr><tr><td><a class="indexterm" name="id362844"></a><em class="parameter"><code>template primary group = "Domain Users"</code></em></td></tr><tr><td><a class="indexterm" name="id362855"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id362867"></a><em class="parameter"><code>winbind separator = +</code></em></td></tr><tr><td><a class="indexterm" name="id362878"></a><em class="parameter"><code>printing = cups</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[homes]</code></em></td></tr><tr><td><a class="indexterm" name="id362899"></a><em class="parameter"><code>comment = Home Directories</code></em></td></tr><tr><td><a class="indexterm" name="id362910"></a><em class="parameter"><code>valid users = %S</code></em></td></tr><tr><td><a class="indexterm" name="id362922"></a><em class="parameter"><code>read only = No</code></em></td></tr><tr><td><a class="indexterm" name="id362933"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[printers]</code></em></td></tr><tr><td><a class="indexterm" name="id362954"></a><em class="parameter"><code>comment = SMB Print Spool</code></em></td></tr><tr><td><a class="indexterm" name="id362965"></a><em class="parameter"><code>path = /var/spool/samba</code></em></td></tr><tr><td><a class="indexterm" name="id362977"></a><em class="parameter"><code>guest ok = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id362988"></a><em class="parameter"><code>printable = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id363000"></a><em class="parameter"><code>browseable = No</code></em></td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[print$]</code></em></td></tr><tr><td><a class="indexterm" name="id363020"></a><em class="parameter"><code>comment = Printer Drivers</code></em></td></tr><tr><td><a class="indexterm" name="id363032"></a><em class="parameter"><code>path = /var/lib/samba/drivers</code></em></td></tr><tr><td><a class="indexterm" name="id363043"></a><em class="parameter"><code>admin users = root, Administrator</code></em></td></tr><tr><td><a class="indexterm" name="id363055"></a><em class="parameter"><code>write list = root</code></em></td></tr></table></div></div><br class="example-break"><div class="sect3" title="IDMAP_RID with Winbind"><div class="titlepage"><div><div><h4 class="title"><a name="id363067"></a>IDMAP_RID with Winbind</h4></div></div></div><p> 1146 <a class="indexterm" name="id363075"></a> 1147 <a class="indexterm" name="id363082"></a> 1148 <a class="indexterm" name="id363088"></a> 1149 <a class="indexterm" name="id363095"></a> 1150 1150 The <code class="literal">idmap_rid</code> facility is a new tool that, unlike native winbind, creates a 1151 1151 predictable mapping of MS Windows SIDs to UNIX UIDs and GIDs. The key benefit of this method … … 1154 1154 is not compatible with trusted domain implementations. 1155 1155 </p><p> 1156 <a class="indexterm" name="id 2594859"></a>1157 <a class="indexterm" name="id 2594865"></a>1158 <a class="indexterm" name="id 2594872"></a>1159 <a class="indexterm" name="id 2594879"></a>1156 <a class="indexterm" name="id363115"></a> 1157 <a class="indexterm" name="id363122"></a> 1158 <a class="indexterm" name="id363128"></a> 1159 <a class="indexterm" name="id363135"></a> 1160 1160 This alternate method of SID to UID/GID mapping can be achieved with the idmap_rid 1161 1161 plug-in. This plug-in uses the RID of the user SID to derive the UID and GID by adding the 1162 1162 RID to a base value specified. This utility requires that the parameter 1163 “<span class="quote">allow trusted domains = No</span>”must be specified, as it is not compatible1163 <span class="quote">“<span class="quote">allow trusted domains = No</span>”</span> must be specified, as it is not compatible 1164 1164 with multiple domain environments. The <em class="parameter"><code>idmap uid</code></em> and 1165 1165 <em class="parameter"><code>idmap gid</code></em> ranges must be specified. 1166 1166 </p><p> 1167 <a class="indexterm" name="id 2594912"></a>1168 <a class="indexterm" name="id 2594919"></a>1167 <a class="indexterm" name="id363164"></a> 1168 <a class="indexterm" name="id363171"></a> 1169 1169 The idmap_rid facility can be used both for NT4/Samba-style domains as well as with Active Directory. 1170 1170 To use this with an NT4 domain, the <em class="parameter"><code>realm</code></em> is not used. Additionally the … … 1172 1172 </p><p> 1173 1173 An example <code class="filename">smb.conf</code> file for an ADS domain environment is shown in <a class="link" href="unixclients.html#sbe-idmapridex" title="Example 7.8. Example smb.conf File Using idmap_rid">“Example smb.conf File Using idmap_rid”</a>. 1174 </p><div class="example"><a name="sbe-idmapridex"></a><p class="title"><b>Example 7.8. Example <code class="filename">smb.conf</code> File Using <code class="constant">idmap_rid</code></b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2594993"></a><em class="parameter"><code>workgroup = KPAK</code></em></td></tr><tr><td><a class="indexterm" name="id2595005"></a><em class="parameter"><code>netbios name = BIGJOE</code></em></td></tr><tr><td><a class="indexterm" name="id2595016"></a><em class="parameter"><code>realm = CORP.KPAK.COM</code></em></td></tr><tr><td><a class="indexterm" name="id2595028"></a><em class="parameter"><code>server string = Office Server</code></em></td></tr><tr><td><a class="indexterm" name="id2595040"></a><em class="parameter"><code>security = ADS</code></em></td></tr><tr><td><a class="indexterm" name="id2595052"></a><em class="parameter"><code>allow trusted domains = No</code></em></td></tr><tr><td><a class="indexterm" name="id2595064"></a><em class="parameter"><code>idmap backend = idmap_rid:KPAK=500-100000000</code></em></td></tr><tr><td><a class="indexterm" name="id2595076"></a><em class="parameter"><code>idmap uid = 500-100000000</code></em></td></tr><tr><td><a class="indexterm" name="id2595088"></a><em class="parameter"><code>idmap gid = 500-100000000</code></em></td></tr><tr><td><a class="indexterm" name="id2595100"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id2595111"></a><em class="parameter"><code>winbind use default domain = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2595124"></a><em class="parameter"><code>winbind enum users = No</code></em></td></tr><tr><td><a class="indexterm" name="id2595135"></a><em class="parameter"><code>winbind enum groups = No</code></em></td></tr><tr><td><a class="indexterm" name="id2595147"></a><em class="parameter"><code>winbind nested groups = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2595159"></a><em class="parameter"><code>printer admin = "KPAK\Domain Admins"</code></em></td></tr></table></div></div><br class="example-break"><p>1175 <a class="indexterm" name="id 2595175"></a>1176 <a class="indexterm" name="id 2595182"></a>1177 <a class="indexterm" name="id 2595188"></a>1178 <a class="indexterm" name="id 2595195"></a>1174 </p><div class="example"><a name="sbe-idmapridex"></a><p class="title"><b>Example 7.8. Example <code class="filename">smb.conf</code> File Using <code class="constant">idmap_rid</code></b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id363243"></a><em class="parameter"><code>workgroup = KPAK</code></em></td></tr><tr><td><a class="indexterm" name="id363254"></a><em class="parameter"><code>netbios name = BIGJOE</code></em></td></tr><tr><td><a class="indexterm" name="id363266"></a><em class="parameter"><code>realm = CORP.KPAK.COM</code></em></td></tr><tr><td><a class="indexterm" name="id363277"></a><em class="parameter"><code>server string = Office Server</code></em></td></tr><tr><td><a class="indexterm" name="id363289"></a><em class="parameter"><code>security = ADS</code></em></td></tr><tr><td><a class="indexterm" name="id363300"></a><em class="parameter"><code>allow trusted domains = No</code></em></td></tr><tr><td><a class="indexterm" name="id363312"></a><em class="parameter"><code>idmap backend = idmap_rid:KPAK=500-100000000</code></em></td></tr><tr><td><a class="indexterm" name="id363324"></a><em class="parameter"><code>idmap uid = 500-100000000</code></em></td></tr><tr><td><a class="indexterm" name="id363335"></a><em class="parameter"><code>idmap gid = 500-100000000</code></em></td></tr><tr><td><a class="indexterm" name="id363347"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id363359"></a><em class="parameter"><code>winbind use default domain = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id363370"></a><em class="parameter"><code>winbind enum users = No</code></em></td></tr><tr><td><a class="indexterm" name="id363382"></a><em class="parameter"><code>winbind enum groups = No</code></em></td></tr><tr><td><a class="indexterm" name="id363393"></a><em class="parameter"><code>winbind nested groups = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id363405"></a><em class="parameter"><code>printer admin = "KPAK\Domain Admins"</code></em></td></tr></table></div></div><br class="example-break"><p> 1175 <a class="indexterm" name="id363420"></a> 1176 <a class="indexterm" name="id363427"></a> 1177 <a class="indexterm" name="id363433"></a> 1178 <a class="indexterm" name="id363440"></a> 1179 1179 In a large domain with many users, it is imperative to disable enumeration of users and groups. 1180 1180 For example, at a site that has 22,000 users in Active Directory the winbind-based user and … … 1186 1186 below. 1187 1187 </p><p> 1188 <a class="indexterm" name="id 2595234"></a>1189 <a class="indexterm" name="id 2595241"></a>1188 <a class="indexterm" name="id363473"></a> 1189 <a class="indexterm" name="id363480"></a> 1190 1190 The use of this tool requires configuration of NSS as per the native use of winbind. Edit the 1191 1191 <code class="filename">/etc/nsswitch.conf</code> so it has the following parameters: … … 1201 1201 </p><p> 1202 1202 The following procedure can be used to utilize the idmap_rid facility: 1203 </p><div class="procedure"><ol type="1"><li><p>1203 </p><div class="procedure"><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 1204 1204 Create or install and <code class="filename">smb.conf</code> file with the above configuration. 1205 </p></li><li ><p>1205 </p></li><li class="step" title="Step 2"><p> 1206 1206 Edit the <code class="filename">/etc/nsswitch.conf</code> file as shown above. 1207 </p></li><li ><p>1207 </p></li><li class="step" title="Step 3"><p> 1208 1208 Execute: 1209 1209 </p><pre class="screen"> … … 1213 1213 </pre><p> 1214 1214 </p><p> 1215 <a class="indexterm" name="id 2595322"></a>1215 <a class="indexterm" name="id363555"></a> 1216 1216 An invalid or failed join can be detected by executing: 1217 1217 </p><pre class="screen"> … … 1225 1225 may have occurred. Increase the <em class="parameter"><code>log level</code></em> to 10, repeat the above test, 1226 1226 and then examine the log files produced to identify the nature of the failure. 1227 </p></li><li ><p>1227 </p></li><li class="step" title="Step 4"><p> 1228 1228 Start the <code class="literal">nmbd</code>, <code class="literal">winbind,</code> and <code class="literal">smbd</code> daemons in the order shown. 1229 </p></li><li ><p>1229 </p></li><li class="step" title="Step 5"><p> 1230 1230 Validate the operation of this configuration by executing: 1231 <a class="indexterm" name="id 2595389"></a>1231 <a class="indexterm" name="id363616"></a> 1232 1232 </p><pre class="screen"> 1233 1233 <code class="prompt">root# </code> getent passwd administrator 1234 1234 administrator:x:1000:1013:Administrator:/home/BE/administrator:/bin/bash 1235 1235 </pre><p> 1236 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2595411"></a>IDMAP Storage in LDAP using Winbind</h4></div></div></div><p>1237 <a class="indexterm" name="id 2595419"></a>1238 <a class="indexterm" name="id 2595426"></a>1236 </p></li></ol></div></div><div class="sect3" title="IDMAP Storage in LDAP using Winbind"><div class="titlepage"><div><div><h4 class="title"><a name="id363637"></a>IDMAP Storage in LDAP using Winbind</h4></div></div></div><p> 1237 <a class="indexterm" name="id363645"></a> 1238 <a class="indexterm" name="id363652"></a> 1239 1239 The storage of IDMAP information in LDAP can be used with both NT4/Samba-3-style domains as well as 1240 1240 with ADS domains. OpenLDAP is a commonly used LDAP server for this purpose, although any standards-compliant … … 1243 1243 </p><p> 1244 1244 The example in <a class="link" href="unixclients.html#sbeunxa" title="Example 7.9. Typical ADS Style Domain smb.conf File">“Typical ADS Style Domain smb.conf File”</a> is for an ADS-style domain. 1245 </p><div class="example"><a name="sbeunxa"></a><p class="title"><b>Example 7.9. Typical ADS Style Domain <code class="filename">smb.conf</code> File</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2595486"></a><em class="parameter"><code>workgroup = SNOWSHOW</code></em></td></tr><tr><td><a class="indexterm" name="id2595498"></a><em class="parameter"><code>netbios name = GOODELF</code></em></td></tr><tr><td><a class="indexterm" name="id2595510"></a><em class="parameter"><code>realm = SNOWSHOW.COM</code></em></td></tr><tr><td><a class="indexterm" name="id2595521"></a><em class="parameter"><code>server string = Samba Server</code></em></td></tr><tr><td><a class="indexterm" name="id2595533"></a><em class="parameter"><code>security = ADS</code></em></td></tr><tr><td><a class="indexterm" name="id2595545"></a><em class="parameter"><code>log level = 1 ads:10 auth:10 sam:10 rpc:10</code></em></td></tr><tr><td><a class="indexterm" name="id2595557"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=SNOWSHOW,dc=COM</code></em></td></tr><tr><td><a class="indexterm" name="id2595569"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id2595581"></a><em class="parameter"><code>ldap suffix = dc=SNOWSHOW,dc=COM</code></em></td></tr><tr><td><a class="indexterm" name="id2595593"></a><em class="parameter"><code>idmap backend = ldap:ldap://ldap.snowshow.com</code></em></td></tr><tr><td><a class="indexterm" name="id2595605"></a><em class="parameter"><code>idmap uid = 150000-550000</code></em></td></tr><tr><td><a class="indexterm" name="id2595617"></a><em class="parameter"><code>idmap gid = 150000-550000</code></em></td></tr><tr><td><a class="indexterm" name="id2595629"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id2595641"></a><em class="parameter"><code>winbind use default domain = Yes</code></em></td></tr></table></div></div><br class="example-break"><p>1246 <a class="indexterm" name="id 2595656"></a>1245 </p><div class="example"><a name="sbeunxa"></a><p class="title"><b>Example 7.9. Typical ADS Style Domain <code class="filename">smb.conf</code> File</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id363706"></a><em class="parameter"><code>workgroup = SNOWSHOW</code></em></td></tr><tr><td><a class="indexterm" name="id363718"></a><em class="parameter"><code>netbios name = GOODELF</code></em></td></tr><tr><td><a class="indexterm" name="id363729"></a><em class="parameter"><code>realm = SNOWSHOW.COM</code></em></td></tr><tr><td><a class="indexterm" name="id363741"></a><em class="parameter"><code>server string = Samba Server</code></em></td></tr><tr><td><a class="indexterm" name="id363752"></a><em class="parameter"><code>security = ADS</code></em></td></tr><tr><td><a class="indexterm" name="id363764"></a><em class="parameter"><code>log level = 1 ads:10 auth:10 sam:10 rpc:10</code></em></td></tr><tr><td><a class="indexterm" name="id363776"></a><em class="parameter"><code>ldap admin dn = cn=Manager,dc=SNOWSHOW,dc=COM</code></em></td></tr><tr><td><a class="indexterm" name="id363787"></a><em class="parameter"><code>ldap idmap suffix = ou=Idmap</code></em></td></tr><tr><td><a class="indexterm" name="id363799"></a><em class="parameter"><code>ldap suffix = dc=SNOWSHOW,dc=COM</code></em></td></tr><tr><td><a class="indexterm" name="id363811"></a><em class="parameter"><code>idmap backend = ldap:ldap://ldap.snowshow.com</code></em></td></tr><tr><td><a class="indexterm" name="id363822"></a><em class="parameter"><code>idmap uid = 150000-550000</code></em></td></tr><tr><td><a class="indexterm" name="id363834"></a><em class="parameter"><code>idmap gid = 150000-550000</code></em></td></tr><tr><td><a class="indexterm" name="id363846"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id363857"></a><em class="parameter"><code>winbind use default domain = Yes</code></em></td></tr></table></div></div><br class="example-break"><p> 1246 <a class="indexterm" name="id363872"></a> 1247 1247 In the case of an NT4 or Samba-3-style domain the <em class="parameter"><code>realm</code></em> is not used, and the 1248 1248 command used to join the domain is <code class="literal">net rpc join</code>. The above example also demonstrates 1249 1249 advanced error reporting techniques that are documented in the chapter called "Reporting Bugs" in 1250 “<span class="quote">The Official Samba-3 HOWTO and Reference Guide, Second Edition</span>”(TOSHARG2).1250 <span class="quote">“<span class="quote">The Official Samba-3 HOWTO and Reference Guide, Second Edition</span>”</span> (TOSHARG2). 1251 1251 </p><p> 1252 <a class="indexterm" name="id 2595687"></a>1253 <a class="indexterm" name="id 2595694"></a>1254 <a class="indexterm" name="id 2595701"></a>1252 <a class="indexterm" name="id363900"></a> 1253 <a class="indexterm" name="id363907"></a> 1254 <a class="indexterm" name="id363914"></a> 1255 1255 Where MIT kerberos is installed (version 1.3.4 or later), edit the <code class="filename">/etc/krb5.conf</code> 1256 1256 file so it has the following contents: … … 1291 1291 .snowshow.com = SNOWSHOW.COM 1292 1292 </pre><p> 1293 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>1293 </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 1294 1294 Samba cannot use the Heimdal libraries if there is no <code class="filename">/etc/krb5.conf</code> file. 1295 1295 So long as there is an empty file, the Heimdal kerberos libraries will be usable. There is no … … 1307 1307 </pre><p> 1308 1308 </p><p> 1309 <a class="indexterm" name="id 2595785"></a>1310 <a class="indexterm" name="id 2595792"></a>1309 <a class="indexterm" name="id363986"></a> 1310 <a class="indexterm" name="id363993"></a> 1311 1311 You will need the <a class="ulink" href="http://www.padl.com" target="_top">PADL</a> <code class="literal">nss_ldap</code> 1312 1312 tool set for this solution. Configure the <code class="filename">/etc/ldap.conf</code> file so it has … … 1327 1327 </p><p> 1328 1328 The following procedure may be followed to affect a working configuration: 1329 </p><div class="procedure"><ol type="1"><li><p>1329 </p><div class="procedure"><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 1330 1330 Configure the <code class="filename">smb.conf</code> file as shown above. 1331 </p></li><li ><p>1331 </p></li><li class="step" title="Step 2"><p> 1332 1332 Create the <code class="filename">/etc/krb5.conf</code> file following the indications above. 1333 </p></li><li ><p>1333 </p></li><li class="step" title="Step 3"><p> 1334 1334 Configure the <code class="filename">/etc/nsswitch.conf</code> file as shown above. 1335 </p></li><li ><p>1335 </p></li><li class="step" title="Step 4"><p> 1336 1336 Download, build, and install the PADL nss_ldap tool set. Configure the 1337 1337 <code class="filename">/etc/ldap.conf</code> file as shown above. 1338 </p></li><li ><p>1338 </p></li><li class="step" title="Step 5"><p> 1339 1339 Configure an LDAP server and initialize the directory with the top-level entries needed by IDMAP 1340 1340 as shown in the following LDIF file: … … 1356 1356 ou: idmap 1357 1357 </pre><p> 1358 </p></li><li ><p>1358 </p></li><li class="step" title="Step 6"><p> 1359 1359 Execute the command to join the Samba domain member server to the ADS domain as shown here: 1360 1360 </p><pre class="screen"> … … 1363 1363 Joined 'GOODELF' to realm 'SNOWSHOW.COM' 1364 1364 </pre><p> 1365 </p></li><li ><p>1365 </p></li><li class="step" title="Step 7"><p> 1366 1366 Store the LDAP server access password in the Samba <code class="filename">secrets.tdb</code> file as follows: 1367 1367 </p><pre class="screen"> 1368 1368 <code class="prompt">root# </code> smbpasswd -w not24get 1369 1369 </pre><p> 1370 </p></li><li ><p>1370 </p></li><li class="step" title="Step 8"><p> 1371 1371 Start the <code class="literal">nmbd</code>, <code class="literal">winbind</code>, and <code class="literal">smbd</code> daemons in the order shown. 1372 1372 </p></li></ol></div><p> 1373 <a class="indexterm" name="id 2595993"></a>1373 <a class="indexterm" name="id364177"></a> 1374 1374 Follow the diagnostic procedures shown earlier in this chapter to identify success or failure of the join. 1375 1375 In many cases a failure is indicated by a silent return to the command prompt with no indication of the 1376 1376 reason for failure. 1377 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2596006"></a>IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</h4></div></div></div><p>1378 <a class="indexterm" name="id 2596015"></a>1379 <a class="indexterm" name="id 2596022"></a>1377 </p></div><div class="sect3" title="IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension"><div class="titlepage"><div><div><h4 class="title"><a name="id364188"></a>IDMAP and NSS Using LDAP from ADS with RFC2307bis Schema Extension</h4></div></div></div><p> 1378 <a class="indexterm" name="id364196"></a> 1379 <a class="indexterm" name="id364203"></a> 1380 1380 The use of this method is messy. The information provided in this section is for guidance only 1381 1381 and is very definitely not complete. This method does work; it is used in a number of large sites … … 1383 1383 </p><p> 1384 1384 An example <code class="filename">smb.conf</code> file is shown in <a class="link" href="unixclients.html#sbewinbindex" title="Example 7.10. ADS Membership Using RFC2307bis Identity Resolution smb.conf File">“ADS Membership Using RFC2307bis Identity Resolution smb.conf File”</a>. 1385 </p><div class="example"><a name="sbewinbindex"></a><p class="title"><b>Example 7.10. ADS Membership Using RFC2307bis Identity Resolution <code class="filename">smb.conf</code> File</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2596085"></a><em class="parameter"><code>workgroup = BUBBAH</code></em></td></tr><tr><td><a class="indexterm" name="id2596096"></a><em class="parameter"><code>netbios name = MADMAX</code></em></td></tr><tr><td><a class="indexterm" name="id2596108"></a><em class="parameter"><code>realm = BUBBAH.COM</code></em></td></tr><tr><td><a class="indexterm" name="id2596120"></a><em class="parameter"><code>server string = Samba Server</code></em></td></tr><tr><td><a class="indexterm" name="id2596132"></a><em class="parameter"><code>security = ADS</code></em></td></tr><tr><td><a class="indexterm" name="id2596143"></a><em class="parameter"><code>idmap uid = 150000-550000</code></em></td></tr><tr><td><a class="indexterm" name="id2596155"></a><em class="parameter"><code>idmap gid = 150000-550000</code></em></td></tr><tr><td><a class="indexterm" name="id2596167"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id2596179"></a><em class="parameter"><code>winbind use default domain = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2596191"></a><em class="parameter"><code>winbind trusted domains only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id2596203"></a><em class="parameter"><code>winbind nested groups = Yes</code></em></td></tr></table></div></div><br class="example-break"><p>1386 <a class="indexterm" name="id 2596218"></a>1385 </p><div class="example"><a name="sbewinbindex"></a><p class="title"><b>Example 7.10. ADS Membership Using RFC2307bis Identity Resolution <code class="filename">smb.conf</code> File</b></p><div class="example-contents"><table border="0" summary="Simple list" class="simplelist"><tr><td># Global parameters</td></tr><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id364262"></a><em class="parameter"><code>workgroup = BUBBAH</code></em></td></tr><tr><td><a class="indexterm" name="id364274"></a><em class="parameter"><code>netbios name = MADMAX</code></em></td></tr><tr><td><a class="indexterm" name="id364285"></a><em class="parameter"><code>realm = BUBBAH.COM</code></em></td></tr><tr><td><a class="indexterm" name="id364297"></a><em class="parameter"><code>server string = Samba Server</code></em></td></tr><tr><td><a class="indexterm" name="id364308"></a><em class="parameter"><code>security = ADS</code></em></td></tr><tr><td><a class="indexterm" name="id364320"></a><em class="parameter"><code>idmap uid = 150000-550000</code></em></td></tr><tr><td><a class="indexterm" name="id364331"></a><em class="parameter"><code>idmap gid = 150000-550000</code></em></td></tr><tr><td><a class="indexterm" name="id364343"></a><em class="parameter"><code>template shell = /bin/bash</code></em></td></tr><tr><td><a class="indexterm" name="id364355"></a><em class="parameter"><code>winbind use default domain = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id364366"></a><em class="parameter"><code>winbind trusted domains only = Yes</code></em></td></tr><tr><td><a class="indexterm" name="id364378"></a><em class="parameter"><code>winbind nested groups = Yes</code></em></td></tr></table></div></div><br class="example-break"><p> 1386 <a class="indexterm" name="id364393"></a> 1387 1387 The DMS must be joined to the domain using the usual procedure. Additionally, it is necessary 1388 1388 to build and install the PADL nss_ldap tool set. Be sure to build this tool set with the … … 1393 1393 </pre><p> 1394 1394 </p><p> 1395 <a class="indexterm" name="id 2596239"></a>1395 <a class="indexterm" name="id364411"></a> 1396 1396 The following <code class="filename">/etc/nsswitch.conf</code> file contents are required: 1397 1397 </p><pre class="screen"> … … 1405 1405 </pre><p> 1406 1406 </p><p> 1407 <a class="indexterm" name="id 2596263"></a>1408 <a class="indexterm" name="id 2596270"></a>1407 <a class="indexterm" name="id364434"></a> 1408 <a class="indexterm" name="id364441"></a> 1409 1409 The <code class="filename">/etc/ldap.conf</code> file must be configured also. Refer to the PADL documentation 1410 1410 and source code for nss_ldap instructions. … … 1412 1412 The next step involves preparation on the ADS schema. This is briefly discussed in the remaining 1413 1413 part of this chapter. 1414 </p><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2596292"></a>IDMAP, Active Directory, and MS Services for UNIX 3.5</h5></div></div></div><p>1415 <a class="indexterm" name="id 2596301"></a>1414 </p><div class="sect4" title="IDMAP, Active Directory, and MS Services for UNIX 3.5"><div class="titlepage"><div><div><h5 class="title"><a name="id364460"></a>IDMAP, Active Directory, and MS Services for UNIX 3.5</h5></div></div></div><p> 1415 <a class="indexterm" name="id364468"></a> 1416 1416 The Microsoft Windows Service for UNIX version 3.5 is available for free 1417 1417 <a class="ulink" href="http://www.microsoft.com/windows/sfu/" target="_top">download</a> 1418 1418 from the Microsoft Web site. You will need to download this tool and install it following 1419 1419 Microsoft instructions. 1420 </p></div><div class="sect4" lang="en"><div class="titlepage"><div><div><h5 class="title"><a name="id2596321"></a>IDMAP, Active Directory, and AD4UNIX</h5></div></div></div><p>1420 </p></div><div class="sect4" title="IDMAP, Active Directory, and AD4UNIX"><div class="titlepage"><div><div><h5 class="title"><a name="id364486"></a>IDMAP, Active Directory, and AD4UNIX</h5></div></div></div><p> 1421 1421 Instructions for obtaining and installing the AD4UNIX tool set can be found from the 1422 1422 <a class="ulink" href="http://www.geekcomix.com/cgi-bin/classnotes/wiki.pl?LDAP01/An_Alternative_Approach" target="_top"> 1423 1423 Geekcomix</a> Web site. 1424 </p></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2596343"></a>UNIX/Linux Client Domain Member</h3></div></div></div><p><a class="indexterm" name="id2596350"></a>1424 </p></div></div></div><div class="sect2" title="UNIX/Linux Client Domain Member"><div class="titlepage"><div><div><h3 class="title"><a name="id364506"></a>UNIX/Linux Client Domain Member</h3></div></div></div><p><a class="indexterm" name="id364512"></a> 1425 1425 So far this chapter has been mainly concerned with the provision of file and print 1426 1426 services for domain member servers. However, an increasing number of UNIX/Linux … … 1428 1428 other than a single desktop user. The key demand for desktop systems is to be able 1429 1429 to log onto any UNIX/Linux or Windows desktop using the same network user credentials. 1430 </p><p><a class="indexterm" name="id 2596369"></a>1430 </p><p><a class="indexterm" name="id364527"></a> 1431 1431 The ability to use a common set of user credential across a variety of network systems 1432 1432 is generally regarded as a single sign-on (SSO) solution. SSO systems are sold by a 1433 1433 large number of vendors and include a range of technologies such as: 1434 </p><div class="itemizedlist"><ul type="disc"><li><p>1434 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 1435 1435 Proxy sign-on 1436 </p></li><li ><p>1436 </p></li><li class="listitem"><p> 1437 1437 Federated directory provisioning 1438 </p></li><li ><p>1438 </p></li><li class="listitem"><p> 1439 1439 Metadirectory server solutions 1440 </p></li><li ><p>1440 </p></li><li class="listitem"><p> 1441 1441 Replacement authentication systems 1442 </p></li></ul></div><p><a class="indexterm" name="id 2596411"></a>1442 </p></li></ul></div><p><a class="indexterm" name="id364566"></a> 1443 1443 There are really four solutions that provide integrated authentication and 1444 1444 user identity management facilities: 1445 </p><div class="itemizedlist"><ul type="disc"><li><p>1445 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 1446 1446 Samba winbind (free). Samba-3.0.20 introduced a complete replacement for Winbind that now 1447 1447 provides a greater level of scalability in large ADS environments. 1448 </p></li><li ><p>1448 </p></li><li class="listitem"><p> 1449 1449 <a class="ulink" href="http://www.padl.com" target="_top">PADL</a> PAM and LDAP tools (free). 1450 </p></li><li ><p>1450 </p></li><li class="listitem"><p> 1451 1451 <a class="ulink" href="http://www.vintela.com" target="_top">Vintela</a> Authentication Services (commercial). 1452 </p></li><li ><p>1452 </p></li><li class="listitem"><p> 1453 1453 <a class="ulink" href="http://www.centrify.com" target="_top">Centrify</a> DirectControl (commercial). 1454 1454 Centrify's commercial product allows UNIX and Linux systems to use Active Directory … … 1465 1465 support via Samba-3. 1466 1466 </p><p> 1467 <a class="indexterm" name="id 2596490"></a>1467 <a class="indexterm" name="id364633"></a> 1468 1468 On the other hand, if the authentication and identity resolution backend must be provided by 1469 1469 a Windows NT4-style domain or from an Active Directory Domain that does not have the Microsoft … … 1471 1471 situations now follows. 1472 1472 </p><p> 1473 <a class="indexterm" name="id 2596508"></a>1474 <a class="indexterm" name="id 2596514"></a>1475 <a class="indexterm" name="id 2596521"></a>1473 <a class="indexterm" name="id364648"></a> 1474 <a class="indexterm" name="id364655"></a> 1475 <a class="indexterm" name="id364662"></a> 1476 1476 To permit users to log on to a Linux system using Windows network credentials, you need to 1477 1477 configure identity resolution (NSS) and PAM. This means that the basic steps include those … … 1480 1480 of shares and printers is generally less important. Often this allows the share specifications 1481 1481 to be entirely removed from the <code class="filename">smb.conf</code> file. That is obviously an administrator decision. 1482 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2596544"></a>NT4 Domain Member</h4></div></div></div><p>1482 </p><div class="sect3" title="NT4 Domain Member"><div class="titlepage"><div><div><h4 class="title"><a name="id364680"></a>NT4 Domain Member</h4></div></div></div><p> 1483 1483 The following steps provide a Linux system that users can log onto using 1484 1484 Windows NT4 (or Samba-3) domain network credentials: 1485 </p><div class="procedure"><ol type="1"><li><p>1485 </p><div class="procedure"><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 1486 1486 Follow the steps outlined in <a class="link" href="unixclients.html#wdcsdm" title="NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind">“NT4/Samba Domain with Samba Domain Member Server: Using NSS and Winbind”</a> and ensure that 1487 1487 all validation tests function as shown. 1488 </p></li><li ><p>1488 </p></li><li class="step" title="Step 2"><p> 1489 1489 Identify what services users must log on to. On Red Hat Linux, if it is 1490 1490 intended that the user shall be given access to all services, it may be 1491 1491 most expeditious to simply configure the file 1492 1492 <code class="filename">/etc/pam.d/system-auth</code>. 1493 </p></li><li ><p>1493 </p></li><li class="step" title="Step 3"><p> 1494 1494 Carefully make a backup copy of all PAM configuration files before you 1495 1495 begin making changes. If you break the PAM configuration, please note … … 1498 1498 PAM files are incorrectly configured. The entire directory 1499 1499 <code class="filename">/etc/pam.d</code> should be backed up to a safe location. 1500 </p></li><li ><p>1500 </p></li><li class="step" title="Step 4"><p> 1501 1501 If you require only console login support, edit the <code class="filename">/etc/pam.d/login</code> 1502 1502 so it matches <a class="link" href="unixclients.html#ch9-pamwnbdlogin" title="Example 7.11. SUSE: PAM login Module Using Winbind">“SUSE: PAM login Module Using Winbind”</a>. 1503 </p></li><li ><p>1503 </p></li><li class="step" title="Step 5"><p> 1504 1504 To provide the ability to log onto the graphical desktop interface, you must edit 1505 1505 the files <code class="filename">gdm</code> and <code class="filename">xdm</code> in the 1506 1506 <code class="filename">/etc/pam.d</code> directory. 1507 </p></li><li ><p>1507 </p></li><li class="step" title="Step 6"><p> 1508 1508 Edit only one file at a time. Carefully validate its operation before attempting 1509 1509 to reboot the machine. 1510 </p></li></ol></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2596666"></a>ADS Domain Member</h4></div></div></div><p>1510 </p></li></ol></div></div><div class="sect3" title="ADS Domain Member"><div class="titlepage"><div><div><h4 class="title"><a name="id364792"></a>ADS Domain Member</h4></div></div></div><p> 1511 1511 This procedure should be followed to permit a Linux network client (workstation/desktop) 1512 1512 to permit users to log on using Microsoft Active Directory-based user credentials. 1513 </p><div class="procedure"><ol type="1"><li><p>1513 </p><div class="procedure"><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 1514 1514 Follow the steps outlined in <a class="link" href="unixclients.html#adssdm" title="Active Directory Domain with Samba Domain Member Server">“Active Directory Domain with Samba Domain Member Server”</a> and ensure that 1515 1515 all validation tests function as shown. 1516 </p></li><li ><p>1516 </p></li><li class="step" title="Step 2"><p> 1517 1517 Identify what services users must log on to. On Red Hat Linux, if it is 1518 1518 intended that the user shall be given access to all services, it may be 1519 1519 most expeditious to simply configure the file 1520 1520 <code class="filename">/etc/pam.d/system-auth</code> as shown in <a class="link" href="unixclients.html#ch9-rhsysauth" title="Example 7.13. Red Hat 9: PAM System Authentication File: /etc/pam.d/system-auth Module Using Winbind">“Red Hat 9: PAM System Authentication File: /etc/pam.d/system-auth Module Using Winbind”</a>. 1521 </p></li><li ><p>1521 </p></li><li class="step" title="Step 3"><p> 1522 1522 Carefully make a backup copy of all PAM configuration files before you 1523 1523 begin making changes. If you break the PAM configuration, please note … … 1526 1526 PAM files are incorrectly configured. The entire directory 1527 1527 <code class="filename">/etc/pam.d</code> should be backed up to a safe location. 1528 </p></li><li ><p>1528 </p></li><li class="step" title="Step 4"><p> 1529 1529 If you require only console login support, edit the <code class="filename">/etc/pam.d/login</code> 1530 1530 so it matches <a class="link" href="unixclients.html#ch9-pamwnbdlogin" title="Example 7.11. SUSE: PAM login Module Using Winbind">“SUSE: PAM login Module Using Winbind”</a>. 1531 </p></li><li ><p>1531 </p></li><li class="step" title="Step 5"><p> 1532 1532 To provide the ability to log onto the graphical desktop interface, you must edit 1533 1533 the files <code class="filename">gdm</code> and <code class="filename">xdm</code> in the 1534 1534 <code class="filename">/etc/pam.d</code> directory. 1535 </p></li><li ><p>1535 </p></li><li class="step" title="Step 6"><p> 1536 1536 Edit only one file at a time. Carefully validate its operation before attempting 1537 1537 to reboot the machine. … … 1588 1588 session sufficient /lib/security/$ISA/pam_unix.so 1589 1589 session sufficient /lib/security/$ISA/pam_winbind.so use_first_pass 1590 </pre></div></div><br class="example-break"></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2596918"></a>Key Points Learned</h3></div></div></div><p>1590 </pre></div></div><br class="example-break"></div><div class="sect2" title="Key Points Learned"><div class="titlepage"><div><div><h3 class="title"><a name="id365002"></a>Key Points Learned</h3></div></div></div><p> 1591 1591 The addition of UNIX/Linux Samba servers and clients is a common requirement. In this chapter, you 1592 1592 learned how to integrate such servers so that the UID/GID mappings they use can be consistent … … 1595 1595 </p><p> 1596 1596 The following are key points made in this chapter: 1597 </p><div class="itemizedlist"><ul type="disc"><li><p>1597 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 1598 1598 Domain controllers are always authoritative for the domain. 1599 </p></li><li ><p>1599 </p></li><li class="listitem"><p> 1600 1600 Domain members may have local accounts and must be able to resolve the identity of 1601 1601 domain user accounts. Domain user account identity must map to a local UID/GID. That 1602 1602 local UID/GID can be stored in LDAP. This way, it is possible to share the IDMAP data 1603 1603 across all domain member machines. 1604 </p></li><li ><p>1604 </p></li><li class="listitem"><p> 1605 1605 Resolution of user and group identities on domain member machines may be implemented 1606 1606 using direct LDAP services or using winbind. 1607 </p></li><li ><p>1607 </p></li><li class="listitem"><p> 1608 1608 On NSS/PAM enabled UNIX/Linux systems, NSS is responsible for identity management 1609 1609 and PAM is responsible for authentication of logon credentials (username and password). 1610 </p></li></ul></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2596972"></a>Questions and Answers</h2></div></div></div><p>1610 </p></li></ul></div></div></div><div class="sect1" title="Questions and Answers"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id365047"></a>Questions and Answers</h2></div></div></div><p> 1611 1611 The following questions were obtained from the mailing list and also from private discussions 1612 1612 with Windows network administrators. 1613 </p><div class="qandaset" ><dl><dt> <a href="unixclients.html#id2596990">1613 </p><div class="qandaset" title="Frequently Asked Questions"><a name="id365057"></a><dl><dt> <a href="unixclients.html#id365063"> 1614 1614 We use NIS for all UNIX accounts. Why do we need winbind? 1615 </a></dt><dt> <a href="unixclients.html#id 2597105">1615 </a></dt><dt> <a href="unixclients.html#id365171"> 1616 1616 Our IT management people do not like LDAP but are looking at Microsoft Active Directory. 1617 1617 Which is better? 1618 </a></dt><dt> <a href="unixclients.html#id 2597189">1618 </a></dt><dt> <a href="unixclients.html#id365244"> 1619 1619 We want to implement a Samba PDC, four Samba BDCs, and 10 Samba servers. Is it possible 1620 1620 to use NIS in place of LDAP? 1621 </a></dt><dt> <a href="unixclients.html#id 2597300">1621 </a></dt><dt> <a href="unixclients.html#id365348"> 1622 1622 Are you suggesting that users should not log on to a domain member server? If so, why? 1623 </a></dt><dt> <a href="unixclients.html#id 2597421">1623 </a></dt><dt> <a href="unixclients.html#id365457"> 1624 1624 We want to ensure that only users from our own domain plus from trusted domains can use our 1625 1625 Samba servers. In the smb.conf file on all servers, we have enabled the winbind … … 1627 1627 cannot access our servers, and users from Windows clients that are not domain members 1628 1628 can also access our servers. Is this a Samba bug? 1629 </a></dt><dt> <a href="unixclients.html#id 2597596">1629 </a></dt><dt> <a href="unixclients.html#id365622"> 1630 1630 What are the benefits of using LDAP for my domain member servers? 1631 </a></dt><dt> <a href="unixclients.html#id 2597780">1631 </a></dt><dt> <a href="unixclients.html#id365797"> 1632 1632 Is proper DNS operation necessary for Samba-3 plus LDAP? If so, what must I put into 1633 1633 my DNS configuration? 1634 </a></dt><dt> <a href="unixclients.html#id 2597938">1634 </a></dt><dt> <a href="unixclients.html#id365944"> 1635 1635 Our Windows 2003 Server Active Directory domain runs with NetBIOS disabled. Can we 1636 1636 use Samba-3 with that configuration? 1637 </a></dt><dt> <a href="unixclients.html#id 2597956">1637 </a></dt><dt> <a href="unixclients.html#id365962"> 1638 1638 When I tried to execute net ads join, I got no output. It did not work, so 1639 1639 I think that it failed. I then executed net rpc join and that worked fine. 1640 1640 That is okay, isn't it? 1641 </a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%"><tbody><tr class="question"><td align="left" valign="top"><a name="id2596990"></a><a name="id2596992"></a></td><td align="left" valign="top"><p>1641 </a></dt></dl><table border="0" width="100%" summary="Q and A Set"><col align="left" width="1%"><col><tbody><tr class="question"><td align="left" valign="top"><a name="id365063"></a><a name="id365066"></a></td><td align="left" valign="top"><p> 1642 1642 We use NIS for all UNIX accounts. Why do we need winbind? 1643 1643 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 1644 <a class="indexterm" name="id 2597004"></a>1645 <a class="indexterm" name="id 2597011"></a>1646 <a class="indexterm" name="id 2597018"></a>1647 <a class="indexterm" name="id 2597025"></a>1648 <a class="indexterm" name="id 2597031"></a>1649 <a class="indexterm" name="id 2597038"></a>1644 <a class="indexterm" name="id365077"></a> 1645 <a class="indexterm" name="id365083"></a> 1646 <a class="indexterm" name="id365090"></a> 1647 <a class="indexterm" name="id365097"></a> 1648 <a class="indexterm" name="id365104"></a> 1649 <a class="indexterm" name="id365111"></a> 1650 1650 You can use NIS for your UNIX accounts. NIS does not store the Windows encrypted 1651 1651 passwords that need to be stored in one of the acceptable passdb backends. … … 1654 1654 SIDs from trusted domains to local UID/GID values. 1655 1655 </p><p> 1656 <a class="indexterm" name="id 2597065"></a>1657 <a class="indexterm" name="id 2597073"></a>1656 <a class="indexterm" name="id365135"></a> 1657 <a class="indexterm" name="id365142"></a> 1658 1658 On a domain member server, you effectively map Windows domain users to local users 1659 1659 that are in your NIS database by specifying the <em class="parameter"><code>winbind trusted domains … … 1663 1663 </p><p> 1664 1664 As a general rule, it is always a good idea to run winbind on all Samba servers. 1665 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2597105"></a><a name="id2597107"></a></td><td align="left" valign="top"><p>1665 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id365171"></a><a name="id365173"></a></td><td align="left" valign="top"><p> 1666 1666 Our IT management people do not like LDAP but are looking at Microsoft Active Directory. 1667 Which is better?<a class="indexterm" name="id 2597114"></a>1668 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id 2597128"></a><a class="indexterm" name="id2597139"></a><a class="indexterm" name="id2597147"></a>1667 Which is better?<a class="indexterm" name="id365178"></a> 1668 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id365193"></a><a class="indexterm" name="id365204"></a><a class="indexterm" name="id365212"></a> 1669 1669 Microsoft Active Directory is an LDAP server that is intricately tied to a Kerberos 1670 1670 infrastructure. Most IT managers who object to LDAP do so because … … 1673 1673 devise the backup and recovery facilities in a site-dependent manner. LDAP servers 1674 1674 in general are seen as a high-energy, high-risk facility. 1675 </p><p><a class="indexterm" name="id 2597166"></a>1675 </p><p><a class="indexterm" name="id365227"></a> 1676 1676 Microsoft Active Directory by comparison is easy to install and configure and 1677 1677 is supplied with all tools necessary to implement and manage the directory. For sites … … 1682 1682 consider the options. On the other hand, if management just wants a solution that works, 1683 1683 Microsoft Active Directory is a good solution. 1684 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2597189"></a><a name="id2597191"></a></td><td align="left" valign="top"><p>1684 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id365244"></a><a name="id365247"></a></td><td align="left" valign="top"><p> 1685 1685 We want to implement a Samba PDC, four Samba BDCs, and 10 Samba servers. Is it possible 1686 1686 to use NIS in place of LDAP? 1687 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id 2597203"></a><a class="indexterm" name="id2597211"></a><a class="indexterm" name="id2597219"></a><a class="indexterm" name="id2597227"></a><a class="indexterm" name="id2597235"></a><a class="indexterm" name="id2597243"></a><a class="indexterm" name="id2597250"></a>1687 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id365257"></a><a class="indexterm" name="id365265"></a><a class="indexterm" name="id365273"></a><a class="indexterm" name="id365281"></a><a class="indexterm" name="id365289"></a><a class="indexterm" name="id365296"></a><a class="indexterm" name="id365304"></a> 1688 1688 Yes, it is possible to use NIS in place of LDAP, but there may be problems with keeping 1689 1689 the Windows (SMB) encrypted passwords database correctly synchronized across the entire … … 1691 1691 membership secure account password. How can you keep changes that are on remote BDCs 1692 1692 synchronized on the PDC? 1693 </p><p><a class="indexterm" name="id 2597268"></a><a class="indexterm" name="id2597276"></a><a class="indexterm" name="id2597284"></a>1693 </p><p><a class="indexterm" name="id365318"></a><a class="indexterm" name="id365326"></a><a class="indexterm" name="id365334"></a> 1694 1694 LDAP is a more elegant solution because it permits centralized storage and management 1695 1695 of all network identities (user, group, and machine accounts) together with all information 1696 1696 Samba needs to provide to network clients and their users. 1697 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2597300"></a><a name="id2597302"></a></td><td align="left" valign="top"><p>1697 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id365348"></a><a name="id365350"></a></td><td align="left" valign="top"><p> 1698 1698 Are you suggesting that users should not log on to a domain member server? If so, why? 1699 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id 2597314"></a><a class="indexterm" name="id2597322"></a><a class="indexterm" name="id2597333"></a>1699 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id365361"></a><a class="indexterm" name="id365369"></a><a class="indexterm" name="id365380"></a> 1700 1700 Many UNIX administrators mock the model that the personal computer industry has adopted 1701 1701 as normative since the early days of Novell NetWare. The old … … 1703 1703 fears concerning the security and integrity of data. It was a simple and generally 1704 1704 effective measure to keep users away from servers, except through mapped drives. 1705 </p><p><a class="indexterm" name="id 2597351"></a><a class="indexterm" name="id2597359"></a><a class="indexterm" name="id2597367"></a><a class="indexterm" name="id2597375"></a><a class="indexterm" name="id2597382"></a>1705 </p><p><a class="indexterm" name="id365395"></a><a class="indexterm" name="id365403"></a><a class="indexterm" name="id365410"></a><a class="indexterm" name="id365418"></a><a class="indexterm" name="id365426"></a> 1706 1706 UNIX administrators are fully correct in asserting that UNIX servers and workstations 1707 1707 are identical in terms of the software that is installed. They correctly assert that … … 1712 1712 Only then can one begin to appraise the best strategy and adopt a site-specific 1713 1713 policy that best protects the needs of users and of the organization alike. 1714 </p><p><a class="indexterm" name="id 2597405"></a>1714 </p><p><a class="indexterm" name="id365443"></a> 1715 1715 From experience, it is my recommendation to keep general system-level logins to a 1716 1716 practical minimum and to eliminate them if possible. This should not be taken as a 1717 1717 hard rule, though. The better question is, what works best for the site? 1718 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2597421"></a><a name="id2597423"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2597426"></a><a class="indexterm" name="id2597434"></a><a class="indexterm" name="id2597446"></a><a class="indexterm" name="id2597454"></a>1718 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id365457"></a><a name="id365459"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id365462"></a><a class="indexterm" name="id365470"></a><a class="indexterm" name="id365482"></a><a class="indexterm" name="id365490"></a> 1719 1719 We want to ensure that only users from our own domain plus from trusted domains can use our 1720 1720 Samba servers. In the <code class="filename">smb.conf</code> file on all servers, we have enabled the <em class="parameter"><code>winbind … … 1722 1722 cannot access our servers, and users from Windows clients that are not domain members 1723 1723 can also access our servers. Is this a Samba bug? 1724 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id 2597487"></a><a class="indexterm" name="id2597495"></a><a class="indexterm" name="id2597502"></a><a class="indexterm" name="id2597510"></a><a class="indexterm" name="id2597518"></a><a class="indexterm" name="id2597526"></a>1724 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id365519"></a><a class="indexterm" name="id365527"></a><a class="indexterm" name="id365534"></a><a class="indexterm" name="id365542"></a><a class="indexterm" name="id365550"></a><a class="indexterm" name="id365558"></a> 1725 1725 The manual page for this <em class="parameter"><code>winbind trusted domains only</code></em> parameter says, 1726 “<span class="quote">This parameter is designed to allow Samba servers that are members of a Samba-controlled1726 <span class="quote">“<span class="quote">This parameter is designed to allow Samba servers that are members of a Samba-controlled 1727 1727 domain to use UNIX accounts distributed vi NIS, rsync, or LDAP as the UIDs for winbindd users 1728 1728 in the hosts primary domain. Therefore, the user <code class="constant">SAMBA\user1</code> would be 1729 1729 mapped to the account <code class="constant">user1</code> in <code class="filename">/etc/passwd</code> instead 1730 of allocating a new UID for him or her.</span>” This clearly suggests that you are trying1730 of allocating a new UID for him or her.</span>”</span> This clearly suggests that you are trying 1731 1731 to use this parameter inappropriately. 1732 </p><p><a class="indexterm" name="id 2597568"></a>1732 </p><p><a class="indexterm" name="id365596"></a> 1733 1733 A far better solution is to use the <em class="parameter"><code>valid users</code></em> by specifying 1734 1734 precisely the domain users and groups that should be permitted access to the shares. You could, … … 1739 1739 valid users = @"Domain Users", @"OTHERDOMAIN\Domain Users" 1740 1740 </pre><p> 1741 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2597596"></a><a name="id2597598"></a></td><td align="left" valign="top"><p>1741 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id365622"></a><a name="id365624"></a></td><td align="left" valign="top"><p> 1742 1742 What are the benefits of using LDAP for my domain member servers? 1743 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id 2597609"></a><a class="indexterm" name="id2597617"></a><a class="indexterm" name="id2597625"></a><a class="indexterm" name="id2597633"></a><a class="indexterm" name="id2597640"></a><a class="indexterm" name="id2597648"></a><a class="indexterm" name="id2597656"></a><a class="indexterm" name="id2597664"></a><a class="indexterm" name="id2597672"></a>1743 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id365634"></a><a class="indexterm" name="id365642"></a><a class="indexterm" name="id365650"></a><a class="indexterm" name="id365657"></a><a class="indexterm" name="id365665"></a><a class="indexterm" name="id365673"></a><a class="indexterm" name="id365681"></a><a class="indexterm" name="id365689"></a><a class="indexterm" name="id365696"></a> 1744 1744 The key benefit of using LDAP is that the UID of all users and the GID of all groups 1745 1745 are globally consistent on domain controllers as well as on domain member servers. 1746 1746 This means that it is possible to copy/replicate files across servers without 1747 1747 loss of identity. 1748 </p><p><a class="indexterm" name="id 2597688"></a><a class="indexterm" name="id2597696"></a><a class="indexterm" name="id2597704"></a><a class="indexterm" name="id2597712"></a><a class="indexterm" name="id2597720"></a><a class="indexterm" name="id2597728"></a><a class="indexterm" name="id2597739"></a><a class="indexterm" name="id2597747"></a>1748 </p><p><a class="indexterm" name="id365710"></a><a class="indexterm" name="id365718"></a><a class="indexterm" name="id365726"></a><a class="indexterm" name="id365734"></a><a class="indexterm" name="id365741"></a><a class="indexterm" name="id365749"></a><a class="indexterm" name="id365761"></a><a class="indexterm" name="id365768"></a> 1749 1749 When use is made of account identity resolution via winbind, even when an IDMAP backend 1750 1750 is stored in LDAP, the UID/GID on domain member servers is consistent, but differs … … 1753 1753 idmap uid/gid</code></em> in the <code class="filename">smb.conf</code> file. On domain controllers, the UID/GID is 1754 1754 that of the POSIX value assigned in the LDAP directory as part of the POSIX account information. 1755 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2597780"></a><a name="id2597782"></a></td><td align="left" valign="top"><p>1755 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id365797"></a><a name="id365799"></a></td><td align="left" valign="top"><p> 1756 1756 Is proper DNS operation necessary for Samba-3 plus LDAP? If so, what must I put into 1757 1757 my DNS configuration? 1758 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id 2597793"></a><a class="indexterm" name="id2597805"></a><a class="indexterm" name="id2597816"></a><a class="indexterm" name="id2597824"></a><a class="indexterm" name="id2597832"></a><a class="indexterm" name="id2597839"></a><a class="indexterm" name="id2597847"></a>1758 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id365810"></a><a class="indexterm" name="id365821"></a><a class="indexterm" name="id365832"></a><a class="indexterm" name="id365840"></a><a class="indexterm" name="id365847"></a><a class="indexterm" name="id365855"></a><a class="indexterm" name="id365863"></a> 1759 1759 Samba depends on correctly functioning resolution of hostnames to their IP address. Samba 1760 1760 makes no direct DNS lookup calls, but rather redirects all name-to-address calls via the … … 1769 1769 If this fails to resolve, it attempts a DNS lookup, and if that fails, it tries a 1770 1770 WINS lookup. 1771 </p><p><a class="indexterm" name="id 2597902"></a><a class="indexterm" name="id2597910"></a><a class="indexterm" name="id2597918"></a>1771 </p><p><a class="indexterm" name="id365913"></a><a class="indexterm" name="id365920"></a><a class="indexterm" name="id365928"></a> 1772 1772 The addition of the WINS-based name lookup makes sense only if NetBIOS over TCP/IP has 1773 1773 been enabled on all Windows clients. Where NetBIOS over TCP/IP has been disabled, DNS … … 1776 1776 case, the Windows 200x autoregisters all locator records it needs with its own DNS 1777 1777 server or servers. 1778 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2597938"></a><a name="id2597940"></a></td><td align="left" valign="top"><p>1778 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id365944"></a><a name="id365947"></a></td><td align="left" valign="top"><p> 1779 1779 Our Windows 2003 Server Active Directory domain runs with NetBIOS disabled. Can we 1780 1780 use Samba-3 with that configuration? 1781 1781 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p> 1782 1782 Yes. 1783 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id 2597956"></a><a name="id2597958"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id2597962"></a><a class="indexterm" name="id2597976"></a>1783 </p></td></tr><tr class="question"><td align="left" valign="top"><a name="id365962"></a><a name="id365964"></a></td><td align="left" valign="top"><p><a class="indexterm" name="id365967"></a><a class="indexterm" name="id365982"></a> 1784 1784 When I tried to execute net ads join, I got no output. It did not work, so 1785 1785 I think that it failed. I then executed net rpc join and that worked fine. 1786 1786 That is okay, isn't it? 1787 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id 2598000"></a><a class="indexterm" name="id2598008"></a>1787 </p></td></tr><tr class="answer"><td align="left" valign="top"></td><td align="left" valign="top"><p><a class="indexterm" name="id366004"></a><a class="indexterm" name="id366012"></a> 1788 1788 No. This is not okay. It means that your Samba-3 client has joined the ADS domain as 1789 1789 a Windows NT4 client, and Samba-3 will not be using Kerberos-based authentication. -
trunk/server/docs/htmldocs/Samba3-ByExample/upgrades.html
r414 r599 1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 8. Updating Samba-3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.7 4.0"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="unixclients.html" title="Chapter 7. Adding Domain Member Servers and Clients"><link rel="next" href="ntmigration.html" title="Chapter 9. Migrating NT4 Domain to Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 8. Updating Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="unixclients.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="ntmigration.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="upgrades"></a>Chapter 8. Updating Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="upgrades.html#id2598125">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id2598221">Cautions and Notes</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id2599550">Upgrading from Samba 1.x and 2.x to Samba-3</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2599919">Applicable to All Samba 2.x to Samba-3 Upgrades</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2600245">Samba-2.x with LDAP Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id2600427">Updating a Samba-3 Installation</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id2600542">Samba-3 to Samba-3 Updates on the Same Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2600746">Migrating Samba-3 to a New Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id2601160">Migration of Samba Accounts to Active Directory</a></span></dt></dl></dd></dl></div><p>2 <a class="indexterm" name="id 2598040"></a>3 <a class="indexterm" name="id 2598047"></a>1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 8. Updating Samba-3</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Samba-3 by Example"><link rel="up" href="DMSMig.html" title="Part II. Domain Members, Updating Samba and Migration"><link rel="prev" href="unixclients.html" title="Chapter 7. Adding Domain Member Servers and Clients"><link rel="next" href="ntmigration.html" title="Chapter 9. Migrating NT4 Domain to Samba-3"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 8. Updating Samba-3</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="unixclients.html">Prev</a> </td><th width="60%" align="center">Part II. Domain Members, Updating Samba and Migration</th><td width="20%" align="right"> <a accesskey="n" href="ntmigration.html">Next</a></td></tr></table><hr></div><div class="chapter" title="Chapter 8. Updating Samba-3"><div class="titlepage"><div><div><h2 class="title"><a name="upgrades"></a>Chapter 8. Updating Samba-3</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="upgrades.html#id366117">Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id366200">Cautions and Notes</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id367413">Upgrading from Samba 1.x and 2.x to Samba-3</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#sbeug2">Samba 1.9.x and 2.x Versions Without LDAP</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id367754">Applicable to All Samba 2.x to Samba-3 Upgrades</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id368069">Samba-2.x with LDAP Support</a></span></dt></dl></dd><dt><span class="sect1"><a href="upgrades.html#id368184">Updating a Samba-3 Installation</a></span></dt><dd><dl><dt><span class="sect2"><a href="upgrades.html#id368281">Samba-3 to Samba-3 Updates on the Same Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id368465">Migrating Samba-3 to a New Server</a></span></dt><dt><span class="sect2"><a href="upgrades.html#id368842">Migration of Samba Accounts to Active Directory</a></span></dt></dl></dd></dl></div><p> 2 <a class="indexterm" name="id366043"></a> 3 <a class="indexterm" name="id366050"></a> 4 4 It was a little difficult to select an appropriate title for this chapter. 5 5 From email messages on the Samba mailing lists it is clear that many people … … 8 8 installing a new Samba server to replace an older existing Samba server. 9 9 </p><p> 10 <a class="indexterm" name="id 2598064"></a>11 <a class="indexterm" name="id 2598070"></a>10 <a class="indexterm" name="id366063"></a> 11 <a class="indexterm" name="id366070"></a> 12 12 There has also been much talk about migration of Samba-3 from an smbpasswd 13 13 passdb backend to the use of the tdbsam or ldapsam facilities that are new … … 18 18 highlighted by an email posting that included the following neat remark: 19 19 </p><div class="blockquote"><blockquote class="blockquote"><p> 20 <a class="indexterm" name="id 2598092"></a>21 I like the “<span class="quote">net rpc vampire</span>”on NT4, but that to my surprise does20 <a class="indexterm" name="id366088"></a> 21 I like the <span class="quote">“<span class="quote">net rpc vampire</span>”</span> on NT4, but that to my surprise does 22 22 not seem to work against a Samba PDC and, if addressed in the Samba to Samba 23 23 context in either book, I could not find it. 24 24 </p></blockquote></div><p> 25 <a class="indexterm" name="id 2598113"></a>25 <a class="indexterm" name="id366107"></a> 26 26 So in response to the significant request for these situations to be better 27 27 documented, this chapter has now been added. User contributions and documentation 28 28 of real-world experiences are a most welcome addition to this chapter. 29 </p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2598125"></a>Introduction</h2></div></div></div><p>30 <a class="indexterm" name="id 2598133"></a>31 <a class="indexterm" name="id 2598139"></a>32 <a class="indexterm" name="id 2598146"></a>29 </p><div class="sect1" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id366117"></a>Introduction</h2></div></div></div><p> 30 <a class="indexterm" name="id366125"></a> 31 <a class="indexterm" name="id366131"></a> 32 <a class="indexterm" name="id366138"></a> 33 33 A Windows network administrator explained in an email what changes he was 34 planning to make and followed with the question: “<span class="quote">Anyone done this35 before?</span>” Many of us have upgraded and updated Samba without incident.34 planning to make and followed with the question: <span class="quote">“<span class="quote">Anyone done this 35 before?</span>”</span> Many of us have upgraded and updated Samba without incident. 36 36 Others have experienced much pain and user frustration. So it is to be hoped 37 37 that the notes in this chapter will make a positive difference by assuring … … 44 44 fails to take adequate steps to avoid situations that may inflict lost 45 45 productivity on them. 46 </p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>47 <a class="indexterm" name="id 2598177"></a>48 <a class="indexterm" name="id 2598184"></a>46 </p><div class="warning" title="Warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p> 47 <a class="indexterm" name="id366163"></a> 48 <a class="indexterm" name="id366170"></a> 49 49 Samba makes it possible to upgrade and update configuration files, but it 50 50 is not possible to downgrade the configuration files. Please ensure that … … 52 52 in the rare event that this may be necessary. 53 53 </p></div><p> 54 <a class="indexterm" name="id 2598199"></a>55 <a class="indexterm" name="id 2598206"></a>54 <a class="indexterm" name="id366182"></a> 55 <a class="indexterm" name="id366189"></a> 56 56 It is prudent also to backup all data files on the server before attempting 57 57 to perform a major upgrade. Many administrators have experienced the consequences … … 60 60 the precautions taken were inadequate. If a backup was not needed, but was available, 61 61 caution was on the side of the victor. 62 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2598221"></a>Cautions and Notes</h3></div></div></div><p>63 Someone once said, “<span class="quote">It is good to be sorry, but better never to need to be!</span>”62 </p><div class="sect2" title="Cautions and Notes"><div class="titlepage"><div><div><h3 class="title"><a name="id366200"></a>Cautions and Notes</h3></div></div></div><p> 63 Someone once said, <span class="quote">“<span class="quote">It is good to be sorry, but better never to need to be!</span>”</span> 64 64 These are wise words of advice to those contemplating a Samba upgrade or update. 65 65 </p><p> 66 <a class="indexterm" name="id 2598239"></a>67 <a class="indexterm" name="id 2598245"></a>68 <a class="indexterm" name="id 2598252"></a>66 <a class="indexterm" name="id366216"></a> 67 <a class="indexterm" name="id366223"></a> 68 <a class="indexterm" name="id366230"></a> 69 69 This is as good a time as any to define the terms <code class="constant">upgrade</code> and 70 70 <code class="constant">update</code>. The term <code class="constant">upgrade</code> refers to … … 74 74 is in development. 75 75 </p><p> 76 <a class="indexterm" name="id 2598279"></a>76 <a class="indexterm" name="id366254"></a> 77 77 The term <code class="constant">update</code> refers to a minor version number installation 78 78 in place of one of the same generation. For example, updating from Samba 3.0.10 to 3.0.14 79 79 is an update. The move from Samba 2.0.7 to 3.0.14 is an upgrade. 80 80 </p><p> 81 <a class="indexterm" name="id 2598296"></a>81 <a class="indexterm" name="id366269"></a> 82 82 While the use of these terms is an exercise in semantics, what needs to be realized 83 83 is that there are major functional differences between a Samba 2.x release and a Samba … … 87 87 modified to preserve prior functionality. 88 88 </p><p> 89 There is an old axiom that says, “<span class="quote">The greater the volume of the documentation,89 There is an old axiom that says, <span class="quote">“<span class="quote">The greater the volume of the documentation, 90 90 the greater the risk that noone will read it, but where there is no documentation, 91 noone can read it!</span>” While true, some documentation is an evil necessity.91 noone can read it!</span>”</span> While true, some documentation is an evil necessity. 92 92 It is hoped that this update to the documentation will avoid both extremes. 93 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2598325"></a>Security Identifiers (SIDs)</h4></div></div></div><p>94 <a class="indexterm" name="id 2598333"></a>95 <a class="indexterm" name="id 2598342"></a>96 <a class="indexterm" name="id 2598349"></a>97 <a class="indexterm" name="id 2598356"></a>98 <a class="indexterm" name="id 2598362"></a>99 <a class="indexterm" name="id 2598372"></a>93 </p><div class="sect3" title="Security Identifiers (SIDs)"><div class="titlepage"><div><div><h4 class="title"><a name="id366291"></a>Security Identifiers (SIDs)</h4></div></div></div><p> 94 <a class="indexterm" name="id366298"></a> 95 <a class="indexterm" name="id366308"></a> 96 <a class="indexterm" name="id366315"></a> 97 <a class="indexterm" name="id366322"></a> 98 <a class="indexterm" name="id366328"></a> 99 <a class="indexterm" name="id366337"></a> 100 100 Before the days of Windows NT and OS/2, every Windows and DOS networking client 101 101 that used the SMB protocols was an entirely autonomous entity. There was no concept … … 105 105 Windows NT 3.10. 106 106 </p><p> 107 <a class="indexterm" name="id 2598391"></a>108 <a class="indexterm" name="id 2598398"></a>109 <a class="indexterm" name="id 2598405"></a>110 <a class="indexterm" name="id 2598412"></a>111 <a class="indexterm" name="id 2598418"></a>112 <a class="indexterm" name="id 2598425"></a>107 <a class="indexterm" name="id366353"></a> 108 <a class="indexterm" name="id366360"></a> 109 <a class="indexterm" name="id366367"></a> 110 <a class="indexterm" name="id366374"></a> 111 <a class="indexterm" name="id366380"></a> 112 <a class="indexterm" name="id366387"></a> 113 113 Versions of Samba prior to 1.9 did not make use of a SID. Instead they make exclusive use 114 114 of the username that is embedded in the SessionSetUpAndX component of the connection 115 115 setup process between a Windows client and an SMB/CIFS server. 116 116 </p><p> 117 <a class="indexterm" name="id 2598442"></a>118 <a class="indexterm" name="id 2598449"></a>119 <a class="indexterm" name="id 2598455"></a>117 <a class="indexterm" name="id366402"></a> 118 <a class="indexterm" name="id366409"></a> 119 <a class="indexterm" name="id366415"></a> 120 120 Around November 1997 support was added to Samba-1.9 to handle the Windows security 121 121 RPC-based protocols that implemented support for Samba to store a machine SID. This 122 122 information was stored in a file called <code class="filename">MACHINE.SID.</code> 123 123 </p><p> 124 <a class="indexterm" name="id 2598475"></a>125 <a class="indexterm" name="id 2598482"></a>126 <a class="indexterm" name="id 2598488"></a>124 <a class="indexterm" name="id366433"></a> 125 <a class="indexterm" name="id366440"></a> 126 <a class="indexterm" name="id366446"></a> 127 127 Within the lifetime of the early Samba 2.x series, the machine SID information was 128 128 relocated into a tdb file called <code class="filename">secrets.tdb</code>, which is where … … 130 130 local machine and its role within a domain security context. 131 131 </p><p> 132 <a class="indexterm" name="id 2598509"></a>133 <a class="indexterm" name="id 2598518"></a>134 <a class="indexterm" name="id 2598527"></a>135 <a class="indexterm" name="id 2598534"></a>132 <a class="indexterm" name="id366464"></a> 133 <a class="indexterm" name="id366474"></a> 134 <a class="indexterm" name="id366483"></a> 135 <a class="indexterm" name="id366489"></a> 136 136 There are two types of SID, those pertaining to the machine itself and the domain to 137 137 which it may belong, and those pertaining to users and groups within the security … … 139 139 servers (DMS). 140 140 </p><p> 141 <a class="indexterm" name="id 2598548"></a>142 <a class="indexterm" name="id 2598555"></a>143 <a class="indexterm" name="id 2598562"></a>144 <a class="indexterm" name="id 2598569"></a>145 <a class="indexterm" name="id 2598576"></a>146 <a class="indexterm" name="id 2598582"></a>141 <a class="indexterm" name="id366501"></a> 142 <a class="indexterm" name="id366508"></a> 143 <a class="indexterm" name="id366515"></a> 144 <a class="indexterm" name="id366522"></a> 145 <a class="indexterm" name="id366529"></a> 146 <a class="indexterm" name="id366535"></a> 147 147 When the Samba <code class="literal">smbd</code> daemon is first started, if the <code class="filename">secrets.tdb</code> 148 148 file does not exist, it is created at the first client connection attempt. If this file does … … 154 154 (hostname) and domain name (workgroup), it will be different. 155 155 </p><p> 156 <a class="indexterm" name="id 2598632"></a>156 <a class="indexterm" name="id366580"></a> 157 157 The SID is the key used by MS Windows networking for all networking operations. This means 158 158 that when the machine or domain SID changes, all security-encoded objects such as profiles 159 159 and ACLs may become unusable. 160 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>160 </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 161 161 It is of paramount importance that the machine and domain SID be backed up so that in 162 162 the event of a change of hostname (machine name) or domain name (workgroup) the SID can 163 163 be restored to its previous value. 164 164 </p></div><p> 165 <a class="indexterm" name="id 2598653"></a>166 <a class="indexterm" name="id 2598660"></a>167 <a class="indexterm" name="id 2598667"></a>168 <a class="indexterm" name="id 2598673"></a>169 <a class="indexterm" name="id 2598680"></a>170 <a class="indexterm" name="id 2598687"></a>171 <a class="indexterm" name="id 2598694"></a>172 <a class="indexterm" name="id 2598701"></a>173 <a class="indexterm" name="id 2598708"></a>174 <a class="indexterm" name="id 2598714"></a>165 <a class="indexterm" name="id366598"></a> 166 <a class="indexterm" name="id366604"></a> 167 <a class="indexterm" name="id366611"></a> 168 <a class="indexterm" name="id366617"></a> 169 <a class="indexterm" name="id366624"></a> 170 <a class="indexterm" name="id366631"></a> 171 <a class="indexterm" name="id366638"></a> 172 <a class="indexterm" name="id366645"></a> 173 <a class="indexterm" name="id366651"></a> 174 <a class="indexterm" name="id366658"></a> 175 175 In Samba-3 on a domain controller (PDC or BDC), the domain name controls the domain 176 176 SID. On all prior versions the hostname (computer name, or NetBIOS name) controlled 177 177 the SID. On a standalone server the hostname still controls the SID. 178 178 </p><p> 179 <a class="indexterm" name="id 2598728"></a>180 <a class="indexterm" name="id 2598737"></a>179 <a class="indexterm" name="id366670"></a> 180 <a class="indexterm" name="id366679"></a> 181 181 The local machine SID can be backed up using this procedure (Samba-3): 182 182 </p><pre class="screen"> … … 201 201 This is not a reversible process it is a one-way upgrade. 202 202 </p><p> 203 <a class="indexterm" name="id 2598826"></a>203 <a class="indexterm" name="id366761"></a> 204 204 In the course of the Samba 2.0.x series the <code class="literal">smbpasswd</code> was modified to 205 205 permit the domain SID to be captured to the <code class="filename">secrets.tdb</code> file by executing: … … 218 218 </pre><p> 219 219 </p><p> 220 <a class="indexterm" name="id 2598899"></a>221 <a class="indexterm" name="id 2598906"></a>220 <a class="indexterm" name="id366829"></a> 221 <a class="indexterm" name="id366835"></a> 222 222 Domain security information, which includes the domain SID, can be obtained from Samba-2.2.x 223 223 systems by executing: … … 238 238 case it is ever needed at a later date. 239 239 </p><p> 240 <a class="indexterm" name="id 2598953"></a>241 <a class="indexterm" name="id 2598960"></a>242 <a class="indexterm" name="id 2598966"></a>240 <a class="indexterm" name="id366877"></a> 241 <a class="indexterm" name="id366884"></a> 242 <a class="indexterm" name="id366891"></a> 243 243 Take note that the domain SID is used extensively in Samba. Where LDAP is used for the 244 244 <em class="parameter"><code>passdb backend</code></em>, all user, group, and trust accounts are encoded … … 251 251 </pre><p> 252 252 </p><p> 253 <a class="indexterm" name="id 2599002"></a>254 <a class="indexterm" name="id 2599009"></a>255 <a class="indexterm" name="id 2599016"></a>253 <a class="indexterm" name="id366922"></a> 254 <a class="indexterm" name="id366929"></a> 255 <a class="indexterm" name="id366936"></a> 256 256 When the domain SID has changed, roaming profiles cease to be functional. The recovery 257 257 of roaming profiles necessitates resetting of the domain portion of the user SID … … 262 262 addressed to the creator of the RPM package. The Samba Team do their best to make 263 263 available all the tools needed to manage a Samba-based Windows networking environment. 264 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2599053"></a>Change of hostname</h4></div></div></div><p>265 <a class="indexterm" name="id 2599061"></a>266 <a class="indexterm" name="id 2599070"></a>264 </p></div><div class="sect3" title="Change of hostname"><div class="titlepage"><div><div><h4 class="title"><a name="id366964"></a>Change of hostname</h4></div></div></div><p> 265 <a class="indexterm" name="id366972"></a> 266 <a class="indexterm" name="id366981"></a> 267 267 Samba uses two methods by which the primary NetBIOS machine name (also known as a computer 268 268 name or the hostname) may be determined: If the <code class="filename">smb.conf</code> file contains a … … 274 274 SID to be generated. If this happens on a domain controller, it will also change the 275 275 domain SID. These SIDs can be updated (restored) using the procedure outlined previously. 276 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>276 </p><div class="note" title="Note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p> 277 277 Do NOT change the hostname or the <em class="parameter"><code>netbios name</code></em>. If this 278 278 is changed, be sure to reset the machine SID to the original setting. Otherwise 279 279 there may be serious interoperability and/or operational problems. 280 </p></div></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2599119"></a>Change of Workgroup (Domain) Name</h4></div></div></div><p>281 <a class="indexterm" name="id 2599127"></a>280 </p></div></div><div class="sect3" title="Change of Workgroup (Domain) Name"><div class="titlepage"><div><div><h4 class="title"><a name="id367023"></a>Change of Workgroup (Domain) Name</h4></div></div></div><p> 281 <a class="indexterm" name="id367030"></a> 282 282 The domain name of a Samba server is identical to the workgroup name and is 283 283 set in the <code class="filename">smb.conf</code> file using the <em class="parameter"><code>workgroup</code></em> parameter. 284 284 This has been consistent throughout the history of Samba and across all versions. 285 285 </p><p> 286 <a class="indexterm" name="id 2599152"></a>286 <a class="indexterm" name="id367054"></a> 287 287 Be aware that when the workgroup name is changed, a new SID will be generated. 288 288 The old domain SID can be reset using the procedure outlined earlier in this chapter. 289 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="sbeug1"></a>Location of config files</h4></div></div></div><p>289 </p></div><div class="sect3" title="Location of config files"><div class="titlepage"><div><div><h4 class="title"><a name="sbeug1"></a>Location of config files</h4></div></div></div><p> 290 290 The Samba-Team has maintained a constant default location for all Samba control files 291 291 throughout the life of the project. People who have produced binary packages of Samba … … 293 293 for network administrators. 294 294 </p><p> 295 <a class="indexterm" name="id 2599183"></a>295 <a class="indexterm" name="id367081"></a> 296 296 The Samba 1.9.x <code class="filename">smb.conf</code> file may be found either in the <code class="filename">/etc</code> 297 297 directory or in <code class="filename">/usr/local/samba/lib</code>. … … 301 301 remains located also for Samba 3.0.x installations. 302 302 </p><p> 303 <a class="indexterm" name="id 2599230"></a>303 <a class="indexterm" name="id367126"></a> 304 304 Samba 2.x introduced the <code class="filename">secrets.tdb</code> file that is also stored in the 305 305 <code class="filename">/etc/samba</code> directory, or in the <code class="filename">/usr/local/samba/lib</code> 306 306 directory subsystem. 307 307 </p><p> 308 <a class="indexterm" name="id 2599260"></a>308 <a class="indexterm" name="id367154"></a> 309 309 The location at which <code class="literal">smbd</code> expects to find all configuration and control 310 310 files is determined at the time of compilation of Samba. For versions of Samba prior to … … 318 318 <code class="filename">/usr/local/samba/sbin</code>. 319 319 </p><p> 320 <a class="indexterm" name="id 2599318"></a>320 <a class="indexterm" name="id367209"></a> 321 321 Samba-3 provides a neat new way to track the location of all control files as well as to 322 322 find the compile-time options used as the Samba package was built. Here is how the dark … … 349 349 </pre><p> 350 350 </p><p> 351 <a class="indexterm" name="id 2599355"></a>351 <a class="indexterm" name="id367238"></a> 352 352 It is important that both the <code class="filename">smb.conf</code> file and the <code class="filename">secrets.tdb</code> 353 353 be backed up before attempting any upgrade. The <code class="filename">secrets.tdb</code> file … … 355 355 of Samba. A backup means that it is always possible to revert a failed or problematic 356 356 upgrade. 357 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2599385"></a>International Language Support</h4></div></div></div><p>358 <a class="indexterm" name="id 2599393"></a>359 <a class="indexterm" name="id 2599400"></a>360 <a class="indexterm" name="id 2599407"></a>361 <a class="indexterm" name="id 2599414"></a>357 </p></div><div class="sect3" title="International Language Support"><div class="titlepage"><div><div><h4 class="title"><a name="id367266"></a>International Language Support</h4></div></div></div><p> 358 <a class="indexterm" name="id367273"></a> 359 <a class="indexterm" name="id367280"></a> 360 <a class="indexterm" name="id367287"></a> 361 <a class="indexterm" name="id367294"></a> 362 362 Samba-2.x had no support for Unicode; instead, all national language character-set support in file names 363 363 was done using particular locale codepage mapping techniques. Samba-3 supports Unicode in file names, thus 364 364 providing true internationalization support. 365 365 </p><p> 366 <a class="indexterm" name="id 2599428"></a>366 <a class="indexterm" name="id367306"></a> 367 367 Non-English users whose national language character set has special characters and who upgrade naively will 368 368 find that many files that have the special characters in the file name will see them garbled and jumbled up. … … 370 370 that was in use with Samba-2.x using an 8-bit encoding scheme. 371 371 </p><p> 372 <a class="indexterm" name="id 2599445"></a>372 <a class="indexterm" name="id367320"></a> 373 373 Files that are created with Samba-3 will use UTF-8 encoding. Should the file system ever end up with a 374 374 mix of codepage (unix charset)-encoded file names and UTF-8-encoded file names, the mess will take some 375 375 effort to set straight. 376 376 </p><p> 377 <a class="indexterm" name="id 2599459"></a>377 <a class="indexterm" name="id367332"></a> 378 378 A very helpful tool is available from Bjorn Jacke's <a class="ulink" href="http://j3e.de/linux/convmv/" target="_top">convmv</a> 379 379 work. Convmv is a tool that can be used to convert file and directory names from one encoding method to 380 380 another. The most common use for this tool is to convert locale-encoded files to UTF-8 Unicode encoding. 381 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2599479"></a>Updates and Changes in Idealx smbldap-tools</h4></div></div></div><p>381 </p></div><div class="sect3" title="Updates and Changes in Idealx smbldap-tools"><div class="titlepage"><div><div><h4 class="title"><a name="id367349"></a>Updates and Changes in Idealx smbldap-tools</h4></div></div></div><p> 382 382 The smbldap-tools have been maturing rapidly over the past year. With maturation comes change. 383 383 The location of the <code class="filename">smbldap.conf</code> and the <code class="filename">smbldap_bind.conf</code> … … 393 393 current release should note that the information stored under <code class="constant">NextFreeUnixId</code> 394 394 must now be relocated to the DIT object <code class="constant">sambaDomainName</code>. 395 </p></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2599550"></a>Upgrading from Samba 1.x and 2.x to Samba-3</h2></div></div></div><p>395 </p></div></div></div><div class="sect1" title="Upgrading from Samba 1.x and 2.x to Samba-3"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id367413"></a>Upgrading from Samba 1.x and 2.x to Samba-3</h2></div></div></div><p> 396 396 Sites that are being upgraded from Samba-2 (or earlier versions) to Samba-3 397 397 may experience little difficulty or may require a lot of effort, depending … … 403 403 does not use LDAP, the other does. Samba-1.9.x did not provide LDAP support. 404 404 Samba-2.x could be compiled with LDAP support. 405 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="sbeug2"></a>Samba 1.9.x and 2.x Versions Without LDAP</h3></div></div></div><p>405 </p><div class="sect2" title="Samba 1.9.x and 2.x Versions Without LDAP"><div class="titlepage"><div><div><h3 class="title"><a name="sbeug2"></a>Samba 1.9.x and 2.x Versions Without LDAP</h3></div></div></div><p> 406 406 Where it is necessary to upgrade an old Samba installation to Samba-3, 407 407 the following procedure can be followed: 408 </p><div class="procedure" ><a name="id2599588"></a><p class="title"><b>Procedure 8.1. Upgrading from a Pre-Samba-3 Version</b></p><ol type="1"><li><p>409 <a class="indexterm" name="id 2599599"></a>410 <a class="indexterm" name="id 2599606"></a>411 <a class="indexterm" name="id 2599613"></a>408 </p><div class="procedure" title="Procedure 8.1. Upgrading from a Pre-Samba-3 Version"><a name="id367444"></a><p class="title"><b>Procedure 8.1. Upgrading from a Pre-Samba-3 Version</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 409 <a class="indexterm" name="id367455"></a> 410 <a class="indexterm" name="id367462"></a> 411 <a class="indexterm" name="id367468"></a> 412 412 Stop Samba. This can be done using the appropriate system tool 413 413 that is particular for each operating system or by executing the 414 414 <code class="literal">kill</code> command on <code class="literal">smbd</code>, 415 415 <code class="literal">nmbd</code>, and <code class="literal">winbindd</code>. 416 </p></li><li ><p>416 </p></li><li class="step" title="Step 2"><p> 417 417 Find the location of the Samba <code class="filename">smb.conf</code> file and back it up to a 418 418 safe location. 419 </p></li><li ><p>419 </p></li><li class="step" title="Step 3"><p> 420 420 Find the location of the <code class="filename">smbpasswd</code> file and 421 421 back it up to a safe location. 422 </p></li><li ><p>422 </p></li><li class="step" title="Step 4"><p> 423 423 Find the location of the <code class="filename">secrets.tdb</code> file and 424 424 back it up to a safe location. 425 </p></li><li ><p>426 <a class="indexterm" name="id 2599694"></a>427 <a class="indexterm" name="id 2599701"></a>428 <a class="indexterm" name="id 2599708"></a>429 <a class="indexterm" name="id 2599715"></a>425 </p></li><li class="step" title="Step 5"><p> 426 <a class="indexterm" name="id367546"></a> 427 <a class="indexterm" name="id367553"></a> 428 <a class="indexterm" name="id367560"></a> 429 <a class="indexterm" name="id367567"></a> 430 430 Find the location of the lock directory. This is the directory 431 431 in which Samba stores all its tdb control files. The default … … 437 437 <code class="filename">/var/lib/samba</code> directory. Copy all the 438 438 tdb files to a safe location. 439 </p></li><li ><p>440 <a class="indexterm" name="id 2599754"></a>439 </p></li><li class="step" title="Step 6"><p> 440 <a class="indexterm" name="id367601"></a> 441 441 It is now safe to upgrade the Samba installation. On Linux systems 442 442 it is not necessary to remove the Samba RPMs because a simple … … 447 447 move it out of the way by renaming the directories that contain the 448 448 Samba binary files. 449 </p></li><li ><p>449 </p></li><li class="step" title="Step 7"><p> 450 450 When the Samba upgrade has been installed, the first step that should 451 451 be completed is to identify the new target locations for the control 452 452 files. Follow the steps shown in <a class="link" href="upgrades.html#sbeug1" title="Location of config files">“Location of config files”</a> to locate 453 453 the correct directories to which each control file must be moved. 454 </p></li><li ><p>454 </p></li><li class="step" title="Step 8"><p> 455 455 Do not change the hostname. 456 </p></li><li ><p>456 </p></li><li class="step" title="Step 9"><p> 457 457 Do not change the workgroup name. 458 </p></li><li ><p>459 <a class="indexterm" name="id 2599809"></a>458 </p></li><li class="step" title="Step 10"><p> 459 <a class="indexterm" name="id367650"></a> 460 460 Execute the <code class="literal">testparm</code> to validate the <code class="filename">smb.conf</code> file. 461 461 This process will flag any parameters that are no longer supported. … … 469 469 <code class="prompt">root# </code> testparm -s smb.conf.master > smb.conf 470 470 </pre><p> 471 <a class="indexterm" name="id 2599866"></a>471 <a class="indexterm" name="id367704"></a> 472 472 The resulting <code class="filename">smb.conf</code> file will be stripped of all comments 473 473 and of all nonconforming configuration settings. 474 </p></li><li ><p>475 <a class="indexterm" name="id 2599888"></a>474 </p></li><li class="step" title="Step 11"><p> 475 <a class="indexterm" name="id367725"></a> 476 476 It is now safe to start Samba using the appropriate system tool. 477 477 Alternately, it is possible to just execute <code class="literal">nmbd</code>, 478 478 <code class="literal">smbd</code>, and <code class="literal">winbindd</code> for the command 479 479 line while logged in as the root user. 480 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2599919"></a>Applicable to All Samba 2.x to Samba-3 Upgrades</h3></div></div></div><p>481 <a class="indexterm" name="id 2599927"></a>482 <a class="indexterm" name="id 2599934"></a>483 <a class="indexterm" name="id 2599940"></a>480 </p></li></ol></div></div><div class="sect2" title="Applicable to All Samba 2.x to Samba-3 Upgrades"><div class="titlepage"><div><div><h3 class="title"><a name="id367754"></a>Applicable to All Samba 2.x to Samba-3 Upgrades</h3></div></div></div><p> 481 <a class="indexterm" name="id367762"></a> 482 <a class="indexterm" name="id367769"></a> 483 <a class="indexterm" name="id367776"></a> 484 484 Samba 2.x servers that were running as a domain controller (PDC) 485 485 require changes to the configuration of the scripting interface … … 487 487 users, groups, and trust accounts (machines and interdomain). 488 488 </p><p> 489 <a class="indexterm" name="id 2599955"></a>489 <a class="indexterm" name="id367788"></a> 490 490 The following parameters are new to Samba-3 and should be correctly configured. 491 491 Please refer to <a class="link" href="secure.html" title="Chapter 3. Secure Office Networking">“Secure Office Networking”</a> through <a class="link" href="net2000users.html" title="Chapter 6. A Distributed 2000-User Network">“A Distributed 2000-User Network”</a> 492 492 in this book for examples of use of the new parameters shown here: 493 <a class="indexterm" name="id 2599976"></a>494 <a class="indexterm" name="id 2599983"></a>495 <a class="indexterm" name="id 2599990"></a>496 <a class="indexterm" name="id 2599997"></a>497 <a class="indexterm" name="id 2600004"></a>498 <a class="indexterm" name="id 2600011"></a>499 <a class="indexterm" name="id 2600018"></a>500 </p><p> 501 </p><table class="simplelist" border="0" summary="Simplelist"><tr><td>add group script</td></tr><tr><td>add machine script</td></tr><tr><td>add user to group script</td></tr><tr><td>delete group script</td></tr><tr><td>delete user from group script</td></tr><tr><td>passdb backend</td></tr><tr><td>set primary group script</td></tr></table><p>502 </p><p> 503 <a class="indexterm" name="id 2600063"></a>504 <a class="indexterm" name="id 2600070"></a>493 <a class="indexterm" name="id367807"></a> 494 <a class="indexterm" name="id367814"></a> 495 <a class="indexterm" name="id367821"></a> 496 <a class="indexterm" name="id367828"></a> 497 <a class="indexterm" name="id367834"></a> 498 <a class="indexterm" name="id367841"></a> 499 <a class="indexterm" name="id367848"></a> 500 </p><p> 501 </p><table border="0" summary="Simple list" class="simplelist"><tr><td>add group script</td></tr><tr><td>add machine script</td></tr><tr><td>add user to group script</td></tr><tr><td>delete group script</td></tr><tr><td>delete user from group script</td></tr><tr><td>passdb backend</td></tr><tr><td>set primary group script</td></tr></table><p> 502 </p><p> 503 <a class="indexterm" name="id367892"></a> 504 <a class="indexterm" name="id367898"></a> 505 505 The <em class="parameter"><code>add machine script</code></em> functionality was previously 506 506 handled by the <em class="parameter"><code>add user script</code></em>, which in Samba-3 is 507 507 used exclusively to add user accounts. 508 508 </p><p> 509 <a class="indexterm" name="id 2600094"></a>510 <a class="indexterm" name="id 2600101"></a>511 <a class="indexterm" name="id 2600108"></a>512 <a class="indexterm" name="id 2600114"></a>513 <a class="indexterm" name="id 2600121"></a>514 <a class="indexterm" name="id 2600128"></a>515 <a class="indexterm" name="id 2600135"></a>516 <a class="indexterm" name="id 2600142"></a>517 <a class="indexterm" name="id 2600148"></a>509 <a class="indexterm" name="id367921"></a> 510 <a class="indexterm" name="id367928"></a> 511 <a class="indexterm" name="id367935"></a> 512 <a class="indexterm" name="id367942"></a> 513 <a class="indexterm" name="id367948"></a> 514 <a class="indexterm" name="id367955"></a> 515 <a class="indexterm" name="id367962"></a> 516 <a class="indexterm" name="id367969"></a> 517 <a class="indexterm" name="id367976"></a> 518 518 Where the <em class="parameter"><code>passdb backend</code></em> used is either <code class="constant">smbpasswd</code> 519 519 (the default) or the new <code class="constant">tdbsam</code>, the system interface scripts … … 522 522 <code class="literal">groupmod</code>, <code class="literal">groupdel</code>, and so on. 523 523 </p><p> 524 <a class="indexterm" name="id 2600209"></a>525 <a class="indexterm" name="id 2600216"></a>526 <a class="indexterm" name="id 2600223"></a>524 <a class="indexterm" name="id368035"></a> 525 <a class="indexterm" name="id368042"></a> 526 <a class="indexterm" name="id368048"></a> 527 527 Where the <em class="parameter"><code>passdb backend</code></em> makes use of an LDAP directory, 528 528 it is necessary either to use the <code class="constant">smbldap-tools</code> provided 529 529 by Idealx or to use an alternate toolset provided by a third 530 530 party or else home-crafted to manage the LDAP directory accounts. 531 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2600245"></a>Samba-2.x with LDAP Support</h3></div></div></div><p>531 </p></div><div class="sect2" title="Samba-2.x with LDAP Support"><div class="titlepage"><div><div><h3 class="title"><a name="id368069"></a>Samba-2.x with LDAP Support</h3></div></div></div><p> 532 532 Samba version 2.x could be compiled for use either with or without LDAP. 533 533 The LDAP control settings in the <code class="filename">smb.conf</code> file in this old version are … … 539 539 of all files to the correct locations. 540 540 </p><p> 541 <a class="indexterm" name="id 2600280"></a>542 <a class="indexterm" name="id 2600286"></a>541 <a class="indexterm" name="id368099"></a> 542 <a class="indexterm" name="id368106"></a> 543 543 The Samba SAM schema required for Samba-3 is significantly different from that 544 544 used with Samba 2.x. This means that the LDAP directory must be updated … … 695 695 the DN's with quotation marks. 696 696 </pre><p> 697 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2600427"></a>Updating a Samba-3 Installation</h2></div></div></div><p>697 </p></div></div><div class="sect1" title="Updating a Samba-3 Installation"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id368184"></a>Updating a Samba-3 Installation</h2></div></div></div><p> 698 698 The key concern in this section is to deal with the changes that have been 699 699 affected in Samba-3 between the Samba-3.0.0 release and the current update. … … 701 701 taken to update Samba-3 versions. 702 702 </p><p> 703 <a class="indexterm" name="id 2600443"></a>703 <a class="indexterm" name="id368197"></a> 704 704 The information in <a class="link" href="upgrades.html#sbeug1" title="Location of config files">“Location of config files”</a> would not be necessary if every 705 705 person who has ever produced Samba executable (binary) files could agree on … … 707 707 Clearly, such agreement is further away than a pipedream. 708 708 </p><p> 709 <a class="indexterm" name="id 2600468"></a>709 <a class="indexterm" name="id368220"></a> 710 710 Vendors and packagers who produce Samba binary installable packages do not, 711 711 as a rule, use the default paths used by the Samba-Team for the location of … … 720 720 effect. 721 721 </p><p> 722 <a class="indexterm" name="id 2600502"></a>722 <a class="indexterm" name="id368248"></a> 723 723 The best advice for those lacking in code compilation experience is to use 724 724 only vendor (or Samba-Team) provided binary packages. The Samba packages … … 726 726 that are compatible with the original OS vendor's practices. 727 727 </p><p> 728 <a class="indexterm" name="id 2600517"></a>729 <a class="indexterm" name="id 2600524"></a>728 <a class="indexterm" name="id368261"></a> 729 <a class="indexterm" name="id368268"></a> 730 730 If you are not sure whether a binary package complies with the OS 731 731 vendor's practices, it is better to ask the package maintainer via … … 733 733 Alternately, just diagnose the paths specified by the binary files following 734 734 the procedure outlined above. 735 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2600542"></a>Samba-3 to Samba-3 Updates on the Same Server</h3></div></div></div><p>735 </p><div class="sect2" title="Samba-3 to Samba-3 Updates on the Same Server"><div class="titlepage"><div><div><h3 class="title"><a name="id368281"></a>Samba-3 to Samba-3 Updates on the Same Server</h3></div></div></div><p> 736 736 The guidance in this section deals with updates to an existing 737 737 Samba-3 server installation. 738 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2600553"></a>Updating from Samba Versions Earlier than 3.0.5</h4></div></div></div><p>738 </p><div class="sect3" title="Updating from Samba Versions Earlier than 3.0.5"><div class="titlepage"><div><div><h4 class="title"><a name="id368291"></a>Updating from Samba Versions Earlier than 3.0.5</h4></div></div></div><p> 739 739 With the provision that the binary Samba-3 package has been built 740 740 with the same path and feature settings as the existing Samba-3 … … 743 743 and without need to change either the <code class="filename">smb.conf</code> file or, where 744 744 used, the LDAP schema. 745 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2600576"></a>Updating from Samba Versions between 3.0.6 and 3.0.10</h4></div></div></div><p>746 <a class="indexterm" name="id 2600584"></a>747 <a class="indexterm" name="id 2600591"></a>745 </p></div><div class="sect3" title="Updating from Samba Versions between 3.0.6 and 3.0.10"><div class="titlepage"><div><div><h4 class="title"><a name="id368310"></a>Updating from Samba Versions between 3.0.6 and 3.0.10</h4></div></div></div><p> 746 <a class="indexterm" name="id368318"></a> 747 <a class="indexterm" name="id368324"></a> 748 748 When updating versions of Samba-3 prior to 3.0.6 to 3.0.6 through 3.0.10, 749 749 it is necessary only to update the LDAP schema (where LDAP is used). … … 751 751 update. 752 752 </p><p> 753 <a class="indexterm" name="id 2600607"></a>754 <a class="indexterm" name="id 2600614"></a>755 <a class="indexterm" name="id 2600621"></a>753 <a class="indexterm" name="id368339"></a> 754 <a class="indexterm" name="id368346"></a> 755 <a class="indexterm" name="id368352"></a> 756 756 Samba-3.0.6 introduced the ability to remember the last <span class="emphasis"><em>n</em></span> number 757 757 of passwords a user has used. This information will work only with … … 760 760 </p><p> 761 761 After updating the LDAP schema, do not forget to re-index the LDAP database. 762 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2600654"></a>Updating from Samba Versions after 3.0.6 to a Current Release</h4></div></div></div><p>763 <a class="indexterm" name="id 2600663"></a>762 </p></div><div class="sect3" title="Updating from Samba Versions after 3.0.6 to a Current Release"><div class="titlepage"><div><div><h4 class="title"><a name="id368384"></a>Updating from Samba Versions after 3.0.6 to a Current Release</h4></div></div></div><p> 763 <a class="indexterm" name="id368392"></a> 764 764 Samba-3.0.8 introduced changes in how the <em class="parameter"><code>username map</code></em> 765 765 behaves. It also included a change in behavior of <code class="literal">winbindd</code>. … … 767 767 from versions prior to 3.0.8 to a current version. 768 768 </p><p> 769 <a class="indexterm" name="id 2600695"></a>769 <a class="indexterm" name="id368421"></a> 770 770 In Samba-3.0.11 a new privileges interface was implemented. Please 771 771 refer to <a class="link" href="happy.html#sbehap-ppc" title="Addition of Machines to the Domain">“Addition of Machines to the Domain”</a> for information regarding this new … … 789 789 back to searching the 'ldap suffix' in some cases. 790 790 </pre><p> 791 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2600746"></a>Migrating Samba-3 to a New Server</h3></div></div></div><p>791 </p></div></div><div class="sect2" title="Migrating Samba-3 to a New Server"><div class="titlepage"><div><div><h3 class="title"><a name="id368465"></a>Migrating Samba-3 to a New Server</h3></div></div></div><p> 792 792 The two most likely candidates for replacement of a server are 793 793 domain member servers and domain controllers. Each needs to be 794 794 handled slightly differently. 795 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2600758"></a>Replacing a Domain Member Server</h4></div></div></div><p>796 <a class="indexterm" name="id 2600766"></a>795 </p><div class="sect3" title="Replacing a Domain Member Server"><div class="titlepage"><div><div><h4 class="title"><a name="id368475"></a>Replacing a Domain Member Server</h4></div></div></div><p> 796 <a class="indexterm" name="id368483"></a> 797 797 Replacement of a domain member server should be done 798 798 using the same procedure as outlined in <a class="link" href="unixclients.html" title="Chapter 7. Adding Domain Member Servers and Clients">“Adding Domain Member Servers and Clients”</a>. … … 803 803 change its SID and will necessitate rejoining to the domain. 804 804 </p><p> 805 <a class="indexterm" name="id 2600791"></a>806 <a class="indexterm" name="id 2600798"></a>807 <a class="indexterm" name="id 2600805"></a>808 <a class="indexterm" name="id 2600811"></a>809 <a class="indexterm" name="id 2600818"></a>810 <a class="indexterm" name="id 2600825"></a>805 <a class="indexterm" name="id368506"></a> 806 <a class="indexterm" name="id368512"></a> 807 <a class="indexterm" name="id368519"></a> 808 <a class="indexterm" name="id368526"></a> 809 <a class="indexterm" name="id368532"></a> 810 <a class="indexterm" name="id368539"></a> 811 811 Following a change of hostname (NetBIOS name) it is a good idea on all servers 812 812 to shut down the Samba <code class="literal">smbd</code>, <code class="literal">nmbd</code>, and … … 818 818 change, but can persist for a longer period of time. 819 819 </p><p> 820 <a class="indexterm" name="id 2600872"></a>821 <a class="indexterm" name="id 2600879"></a>822 <a class="indexterm" name="id 2600886"></a>823 <a class="indexterm" name="id 2600893"></a>820 <a class="indexterm" name="id368583"></a> 821 <a class="indexterm" name="id368589"></a> 822 <a class="indexterm" name="id368596"></a> 823 <a class="indexterm" name="id368603"></a> 824 824 If the old domain member server had local accounts, it is necessary to create 825 825 on the new domain member server the same accounts with the same UID and GID … … 832 832 account entries to the new target server. 833 833 </p><p> 834 <a class="indexterm" name="id 2600941"></a>834 <a class="indexterm" name="id368648"></a> 835 835 Where the user accounts for both UNIX and Samba are stored in LDAP, the new 836 836 target server must be configured to use the <code class="literal">nss_ldap</code> tool set. 837 837 This will automatically ensure that the appropriate user entities are 838 838 available on the new server. 839 </p></div><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2600960"></a>Replacing a Domain Controller</h4></div></div></div><p>840 <a class="indexterm" name="id 2600968"></a>839 </p></div><div class="sect3" title="Replacing a Domain Controller"><div class="titlepage"><div><div><h4 class="title"><a name="id368664"></a>Replacing a Domain Controller</h4></div></div></div><p> 840 <a class="indexterm" name="id368672"></a> 841 841 In the past, people who replaced a Windows NT4 domain controller typically 842 842 installed a new server, created printers and file shares on it, then migrate across … … 848 848 the same name as the old one. In this case, simply follow the same process 849 849 as for upgrading a Samba 2.x system and do the following: 850 </p><div class="itemizedlist"><ul type="disc"><li><p>850 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 851 851 Where UNIX (POSIX) user and group accounts are stored in the system 852 852 <code class="filename">/etc/passwd</code>, <code class="filename">/etc/shadow</code>, and … … 863 863 the <code class="literal">nss_ldap</code> tool and the <code class="filename">/etc/nsswitch.conf</code> 864 864 (as shown in <a class="link" href="happy.html" title="Chapter 5. Making Happy Users">“Making Happy Users”</a>). 865 </p></li><li ><p>865 </p></li><li class="listitem"><p> 866 866 Copy the <code class="filename">smb.conf</code> file from the old server to the new server into the correct 867 867 location as indicated previously in this chapter. 868 </p></li><li ><p>868 </p></li><li class="listitem"><p> 869 869 Copy the <code class="filename">secrets.tdb</code> file, the <code class="filename">smbpasswd</code> 870 870 file (if it is used), the <code class="filename">/etc/samba/passdb.tdb</code> file (only 871 871 used by the <code class="constant">tdbsam</code> backend), and all the tdb control files 872 872 from the old system to the correct location on the new system. 873 </p></li><li ><p>873 </p></li><li class="listitem"><p> 874 874 Before starting the Samba daemons, verify that the hostname of the new server 875 875 is identical to that of the old one. Note: The IP address can be different 876 876 from that of the old server. 877 </p></li><li ><p>877 </p></li><li class="listitem"><p> 878 878 Copy all files from the old server to the new server, taking precaution to 879 879 preserve all file ownership and permissions as well as any POSIX ACLs that … … 891 891 should correctly pick up the original SID and preserve all other settings. It is 892 892 sound advice to validate this before turning the system over to users. 893 </p></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2601160"></a>Migration of Samba Accounts to Active Directory</h3></div></div></div><p>893 </p></div></div><div class="sect2" title="Migration of Samba Accounts to Active Directory"><div class="titlepage"><div><div><h3 class="title"><a name="id368842"></a>Migration of Samba Accounts to Active Directory</h3></div></div></div><p> 894 894 Yes, it works. The Windows ADMT tool can be used to migrate Samba accounts 895 895 to MS Active Directory. There are a few pitfalls to be aware of: 896 </p><div class="procedure" ><a name="id2601172"></a><p class="title"><b>Procedure 8.2. Migration to Active Directory</b></p><ol type="1"><li><p>896 </p><div class="procedure" title="Procedure 8.2. Migration to Active Directory"><a name="id368853"></a><p class="title"><b>Procedure 8.2. Migration to Active Directory</b></p><ol class="procedure" type="1"><li class="step" title="Step 1"><p> 897 897 Administrator password must be THE SAME on the Samba server, 898 898 the 2003 ADS, and the local Administrator account on the workstations. … … 900 900 called <code class="constant">Administrator</code> in your Samba domain, with 901 901 full administrative (root) rights to that domain. 902 </p></li><li ><p>902 </p></li><li class="step" title="Step 2"><p> 903 903 In the Advanced/DNS section of the TCP/IP settings on your Windows 904 904 workstations, make sure the <em class="parameter"><code>DNS suffix for this 905 905 connection</code></em> field is blank. 906 </p></li><li ><p>906 </p></li><li class="step" title="Step 3"><p> 907 907 Because you are migrating from Samba, user passwords cannot be 908 908 migrated. You'll have to reset everyone's passwords. (If you were … … 911 911 To date this has not been attempted with roaming profile support; 912 912 it has been documented as working with local profiles. 913 </p></li><li ><p>913 </p></li><li class="step" title="Step 4"><p> 914 914 Disable the Windows Firewall on all workstations. Otherwise, 915 915 workstations won't be migrated to the new domain. 916 </p></li><li ><p>917 <a class="indexterm" name="id 2601238"></a>916 </p></li><li class="step" title="Step 5"><p> 917 <a class="indexterm" name="id368911"></a> 918 918 When migrating machines, always test first (using ADMT's test mode) 919 919 and satisfy all errors before committing the migration. Note that the … … 923 923 a test. 924 924 </p></li></ol></div><p> 925 <a class="indexterm" name="id 2601256"></a>925 <a class="indexterm" name="id368925"></a> 926 926 There are some significant benefits of using the ADMT, besides just 927 927 migrating user accounts. ADMT can be found on the Windows 2003 CD. 928 </p><div class="itemizedlist"><ul type="disc"><li><p>928 </p><div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem"><p> 929 929 You can migrate workstations remotely. You can specify that SIDs 930 930 be simply added instead of replaced, giving you the option of joining a 931 931 workstation back to the old domain if something goes awry. The 932 932 workstations will be joined to the new domain. 933 </p></li><li ><p>933 </p></li><li class="listitem"><p> 934 934 Not only are user accounts migrated from the old domain to the new 935 935 domain, but ACLs on the workstations are migrated as well. Like SIDs, 936 936 ACLs can be added instead of replaced. 937 </p></li><li ><p>937 </p></li><li class="listitem"><p> 938 938 Locally stored user profiles on workstations are migrated as well, 939 939 presenting almost no disruption to the user. Saved passwords will be 940 940 lost, just as when you administratively reset the password in Windows ADS. 941 </p></li><li ><p>941 </p></li><li class="listitem"><p> 942 942 The ADMT lets you test all operations before actually performing the 943 943 migration. Accounts and workstations can be migrated individually or in
Note:
See TracChangeset
for help on using the changeset viewer.
